All of the search parameters are contained within the URL, so you can share your view simply sharing the URL.
A query is composed of terms and operators.
There are two types of terms:
A Single Term is a single word such as “test” or “hello”.
A Sequence is a group of words surrounded by double quotes such as “hello dolly”.
To combine multiple terms into a complex query, you can use any of the following boolean operators:
|Operator||**Description **||**Example **|
||Intersection: both terms are in the selected events (if nothing is added, AND is taken by default)||authentication AND failure|
||Union: either term is contained in the selected events||authentication OR password|
||Exclusion: the following term is NOT in the event||authentication AND -password|
For instance, if your facet name is url and you want to filter on the url value www.datadoghq.com just enter:
To perform a multi-character wildcard search, use the
* symbol as follows:
service:web*matches every log message that has a service starting by “web”.
hello*matches all log messages starting with hello
*hellomatches all log messages that end with hello
>= to perform a search on numerical attributes. For instance, retrieve all logs that have a response time over 100ms with:
It is also possible to search for numerical attribute within a specific range. For instance, retrieve all your 4xx errors with:
@http.status_code:[400 TO 499]
testis searching for the string “test”.
("env:prod" OR test)matches all logs with the tag
#env:prodor the tag
(service:srvA OR service:srvB)or
(service:(srvA OR srvB))Matches all logs that contain tags
("env:prod" AND -"version:beta")matches all logs that contain
#env:prodand that do not contain
If your tags don’t follow tags best practices and don’t use the
key:value syntax, use this search query:
Typing a complex query can be cumbersome. Use the search bar’s autocomplete feature to complete your query using existing values:
The following attributes are considered as special:
\ require escaping.
For instance, to search logs that contain
user=12345 the following search must be entered:
The same logic must be applied to spaces within log attributes. Log attributes should not contain spaces, but in such a case, spaces must be escape.
If an attribute was called
user.first name, perform a search on this attribute by escaping the space:
Don’t lose time building the same views everyday. Saved Views contain your search query, columns, time horizon, and facet.
Additional helpful documentation, links, and articles: