--- title: Search Logs description: >- Filter logs to narrow down, broaden, or shift your focus on the subset of logs of current interest. breadcrumbs: Docs > Log Management > Log Explorer > Search Logs --- # Search Logs ## Overview{% #overview %} The [Log Explorer](https://docs.datadoghq.com/logs/explorer/) lets you search and view individual logs as a list. However, the most valuable insights often come from aggregating logs at scale. Using the search feature, you can filter logs and visualize them as timeseries charts, top lists, tree maps, pie charts, or tables to better understand trends, patterns, and outliers across your log data. ## Natural language queries{% #natural-language-queries %} {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com {% alert level="danger" %} Natural Language Queries is not available in the [Datadog site](https://docs.datadoghq.com/getting_started/site) (). {% /alert %} {% /callout %} {% alert level="info" %} Natural Language Queries (NLQ) for Logs is **built with Llama**. {% /alert %} Use Natural Language Queries (NLQ) to describe what you're looking for in plain English. Datadog automatically translates your request into a structured log query, making it easier to explore logs without needing to write complex syntax. To access this feature, click **Ask** in the search field. {% video url="https://datadog-docs.imgix.net/images//logs/explorer/search/log_explorer_nlq.mp4" /%} The system translates natural language input into Datadog queries and understands context such as services, attributes, tags, and time ranges. It also detects relevant fields automatically and enables users to create visualizations using simple descriptions—for example, "Top 20 services by errors" or "Show errors from service X in the past 24 hours." To disable NLQ, you must have [`org_management` permissions](https://docs.datadoghq.com/account_management/rbac/permissions/#access-management). Navigate to [Organization Settings > Preferences](https://app.datadoghq.com/organization-settings/preferences) and toggle off the Natural Language Queries feature. ## Search query{% #search-query %} A Log Explorer search consists of a time range and a search query, combining `key:value` and [full-text search](https://docs.datadoghq.com/logs/explorer/search_syntax/#full-text-search). You can choose a time window for your search using the time range selector at the top right of the Log Explorer. For details on setting a custom time range, see the [Custom Time Frames documentation](https://docs.datadoghq.com/dashboards/guide/custom_time_frames). To filter on logs produced by a web store service, with an error status, over the past fifteen minutes, create a custom query like `service:payment status:error rejected` and set the time range to the `Past 15 minutes`: {% image source="https://datadog-docs.imgix.net/images/logs/explorer/search_filter.215732e4bae6090c27dade0af5a663fd.png?auto=format" alt="Create a search query in the Log Explorer that filters for error logs of rejected payments for a web store service" /%} [Indexed Logs](https://docs.datadoghq.com/logs/indexes) support both [full-text search](https://docs.datadoghq.com/logs/explorer/search_syntax/#full-text-search) and `key:value` search queries. **Note**: `key:value` queries **do not** require that you [declare a facet](https://docs.datadoghq.com/logs/explorer/facets/) beforehand. For complete query syntax reference, see the [Search Syntax documentation](https://docs.datadoghq.com/logs/search-syntax). ## Search bar features{% #search-bar-features %} The Log Explorer search bar includes several features to help you write queries more efficiently and accurately. ### Syntax highlighting and error validation{% #syntax-highlighting-and-error-validation %} Syntax highlighting clearly differentiates input types: keys, values, free text, and control characters. For example, `service` and `status` are keys, `auth-dotnet` and `error` are values, `500` and `check-token` are free text, and parentheses are control characters. Status attributes are color-coded by status (red for `error`, blue for `info`). {% image source="https://datadog-docs.imgix.net/images/logs/explorer/search/log_syntax_highlighting.872052ae718a056f56575f57614ab3ee.png?auto=format" alt="The Log Explorer search bar showing `service:auth-dotnet status:error 500 (check-token OR create-user)` as the query with differentiable syntax highlighting" /%} Error validation identifies syntax errors and suggests fixes, such as missing values in `key:value` pairs, incomplete range queries, or unclosed parentheses. {% image source="https://datadog-docs.imgix.net/images/logs/explorer/search/log_error_states.b9167523bb5c768e7c95d5b4f83d5973.png?auto=format" alt="The Log Explorer search bar showing `service:(web-store OR auth-dotnet` as the query with the message `Missing closing parenthesis character`" /%} ### Autocomplete{% #autocomplete %} The search bar's autocomplete feature helps you complete queries using existing keys and values in your logs, recent searches, and saved views. {% image source="https://datadog-docs.imgix.net/images/logs/explorer/search/log_search_bar_autocomplete.94bdeb82357ff11c2301d8f4f591ea14.png?auto=format" alt="The Log Explorer search bar showing service: as the query and emailer, balancer-checker, ad-server, and vpc as autocomplete options" /%} Autocomplete suggests facets and values based on your input, displayed in the order they appear in the [facet panel](https://docs.datadoghq.com/logs/explorer/facets/). After selecting a facet and entering `:`, values appear in descending order by log count from the past 15 minutes. {% image source="https://datadog-docs.imgix.net/images/logs/explorer/search/log_facet_autocomplete.050c1d3a4ea3652a276cf9e5d39c2ef1.png?auto=format" alt="The Log Explorer search bar showing `network` as the query and the facets @network.bytes_written, @network.client.ip, and @network.interface as autocomplete options" /%} Your 100 most recent searches are retained and suggested as you type. Saved Views that match your query are also suggested, displayed in the same order as the Saved Views panel. {% image source="https://datadog-docs.imgix.net/images/logs/explorer/search/log_recent_searches.c0080d71d1d2d2d949c30c266c13c062.png?auto=format" alt="The logs search bar showing `service:web-store status:error` as the query and recent searches for different web-store service errors as autocomplete options" /%} ## Disable styling and autocomplete for search bar{% #disable-styling-and-autocomplete-for-search-bar %} Toggle the button to the right of the search bar to search in raw mode, where syntax highlighting, search pills styling, and autocomplete are removed: {% image source="https://datadog-docs.imgix.net/images/logs/explorer/search/log_raw_search_mode.2e3405eb0c1e983471c33da6e0e94535.png?auto=format" alt="The logs search bar showing `service:auth-dotnet status:error 500 (check-token OR create-user)` as the query in raw search mode" /%} You can interact with the search bar with your mouse, as well as by using keyboard commands. For example, use `CMD-A` for selecting text, `CMD-C` for copying text, `CMD-X` for cutting text, and `CMD-V` for pasting text. ## Further Reading{% #further-reading %} - [Learn how to group logs](https://docs.datadoghq.com/logs/explorer/analytics) - [Create visualizations from logs](https://docs.datadoghq.com/logs/explorer/visualize) - [Export views from the Log Explorer](https://docs.datadoghq.com/logs/explorer/export)