Docs
v2
Search

Search

HyperDX allows you to do full text search on your events (logs and spans). You can get started searching by just typing keywords that match your events. For example if your log contains "Error", you can find it by just typing in "Error" in the search bar.

This same search syntax is used for filtering events with Dashboards and Charts as well.

Search

Lucene Search Syntax

  • Searches are not case sensitive
  • Searches match by whole word by default (ex. Error will match Error here but not Errors here). You can surround a word by wildcards to match partial words (ex. *Error* will match AnyError and AnyErrors)
  • Search terms are searched in any order (ex. Hello World will match logs that contain Hello World and World Hello)
  • You can exclude keywords by using NOT or - (ex. Error NOT Exception or Error -Exception)
  • You can use AND and OR to combine multiple keywords (ex. Error OR Exception)
  • Exact matches can be done via double quotes (ex. "Error tests not found")

Column/Property Search

  • You can search columns and JSON/map properties by using column:value (ex. level:Error, service:app)
  • You can search for a range of values by using comparison operators (>, <, >=, <=) (ex. Duration:>1000)
  • You can search for the existence of a property by using property:* (ex. duration:*)

Time Input

  • Time input accepts natural language inputs (ex. 1 hour ago, yesterday, last week)
  • Specifying a single point in time will result in searching from that point in time up until now.
  • Time range will always be converted into the parsed time range upon search for easy debugging of time queries.
  • You can highlight a histogram bar to zoom into a specific time range as well.

SQL Search Syntax

You can optionally toggle search inputs to be in SQL mode. This will accept any valid SQL WHERE clause for searching. This is useful for complex queries that cannot be expressed in Lucene syntax.

SELECT Statement

To specify the columns to display in the search results, you can use the SELECT input. This is a SQL SELECT expression for the columns to select in the search page. Aliases are not supported at this time (ex. you can not use column as "alias").

Local Mode

Hi, how can I help you?