Search¶

The Explorer search bar supports text search, field filter, JSON search, and function query. You can also switch to DQL mode to write complete query statements.

Select Search Method¶

Text Search¶

The Explorer text search uses the search() query syntax. The system tokenizes the input and retrieves data that contains all tokens simultaneously.

• Chinese characters are tokenized by character;
• English is tokenized by word boundaries such as spaces and punctuation;
• English search is case-insensitive;
• Tokens do not need to appear consecutively.

Token Search¶

After entering text, the system automatically tokenizes it. As long as the data contains all tokens simultaneously, even if there are other contents between tokens, it can be retrieved.

Chinese Example:

Input: 我喜欢苹果

Possible matches:
- 我喜欢苹果
- 我很喜欢吃苹果
- 苹果是我喜欢的水果

All results above contain all valid tokens of the search content, and these tokens do not need to appear consecutively.

English Example:

Input: connection timeout

Possible matches:
- connection timeout
- Connection retry timeout
- connection request failed due to timeout

All results above contain both "connection" and "timeout", tokens do not need to appear consecutively and are case-insensitive.

Phrase Search¶

If you need to search for complete and consecutive phrases, use English double quotation marks " to enclose the search content:

• "我喜欢苹果": matches "我喜欢苹果，也喜欢香蕉", but does not match "我很喜欢吃苹果";
• "connection timeout": matches "connection timeout occurred", but does not match "connection retry timeout".

JSON Search¶

JSON search is used to query embedded fields in the message of logs, and message must be a valid JSON format. The query format is @field_name:field_value; when querying nested fields, use . to connect field names at each level.

For example, the message content is as follows:

{
  "__namespace": "tracing",
  "cluster_name_k8s": "k8s-demo",
  "meta": {
    "service": "ruoyi-mysql-k8s",
    "name": "mysql.query"
  }
}

The following conditions can be used for querying:

@cluster_name_k8s:k8s-demo       # Exact match
@cluster_name_k8s:k?s*           # Wildcard match
@meta.service:ruoyi-mysql-k8s    # Query nested fields
@meta.service:ruoyi?mysql*       # Wildcard match for nested fields

Here, * matches zero or more characters, and ? matches one character. The wildcards here are only used for field filtering and are not applicable to normal text search.

Field Name Contains .¶

In JSON search, . defaults to representing nested field levels. If the field name itself contains ., use a backslash \ to escape it.

It is not supported to use double quotation marks to enclose field names, for example, @"user.id":1001.

MD5 Function Query¶

If the sensitive data scanning rule uses MD5 encryption, the original value will be replaced with an irreversible 32-character hexadecimal string. When you need to locate masked data using the original value, you can use the MD5 function query in the Explorer.

Query format:

field_name:md5|original_value

For example, the original value red in the color field has been MD5 encrypted, you can enter:

color:md5|red

The system will calculate the MD5 value of red and match it with the hash value saved in the color field. MD5 is case-sensitive and space-sensitive, so ensure the input content is exactly the same as the original value before encryption.

MD5 encryption is irreversible, and the original content cannot be restored from the hash value. For more information, refer to Sensitive Data Scanning.

DQL Query¶

When you need to use functions, expressions, aggregations, or complex filter conditions, you can click the DQL button on the right side of the search bar to enter DQL Query mode:

The system will automatically bring in the corresponding data type and data source based on the current Explorer. For example, the following DQL query is used to retrieve logs from the last hour where message contains connection timeout:

L("default")::logs:(message) {search(message, "connection timeout")} [1h]

• L represents log data;
• "default" represents the log index;
• logs represents the data source;
• [1h] represents querying data from the last hour.

After entering DQL mode, you need to use a complete DQL statement. Different Explorers correspond to different data types, and you cannot switch to other data types within the current Explorer.

CIDR Function Query¶

The CIDR function is used to query data in a specified IP field that belongs to a certain CIDR range, performing range matching rather than string matching.

CIDR consists of a network address and a prefix length, for example, 13.0.0.0/8. The larger the prefix length, the smaller the address range matched; /32 in IPv4 matches only one IP address.

Query format:

CIDR(@field_name, IP_CIDR)

For example, to query data in the network.client.ip field that belongs to the 13.0.0.0/8 CIDR range:

CIDR(@network.client.ip, 13.0.0.0/8)

Matches:
- 13.0.0.1
- 13.100.20.5
- 13.255.255.255

Does not match:
- 12.255.255.255
- 14.0.0.1

If you need to exactly match a single IPv4 address, use /32:

CIDR(@network.client.ip, 13.10.20.30/32)

If the field value is empty, malformed, or not a valid IP address, it will not be matched.

In DQL mode, you can use the lowercase cidr() function and enclose the CIDR range in double quotes:

L::nginx:(*) {cidr(client_ip, "13.0.0.0/8")} [1h]

Search History¶

The current user can view recently used search and filter conditions in the local browser, up to 100 records. Click a historical condition to reuse it in the current Explorer.

More Reading¶

• Explorer Filter
• DQL Functions
• Full-Text Index Stop Words List