A query is composed of terms and operators.
There are two types of terms:
A single term is a single word such as test or hello.
A sequence is a group of words surrounded by double quotes, such as "hello dolly".
To combine multiple terms into a complex query, you can use any of the following Boolean operators:
| Operator | Description |
|---|---|
AND | Intersection: both terms are in the selected views (if nothing is added, AND is taken by default) |
OR | Union: either term is contained in the selected views |
- | Exclusion: the following term is NOT in the view |
Use the search bar’s autocomplete feature to complete your query using existing values:
To search on a specific attribute, first add it as a facet and then add @ to specify you are searching on a facet.
For instance, if your facet name is url and you want to filter on the url value www.datadoghq.com, enter:
@url:www.datadoghq.com
Searching on a facet value that contains special characters requires escaping or double quotes. The following characters are considered special: ?, >, <, :, =,", ~, /, and \ require escaping with the \ character.
The same logic is applied to spaces within views facet names. Views facets should not contain spaces, but if they do, spaces must be escaped. If a facet is named user.first name, perform a facet search by escaping the space: @user.first\ name:myvalue.
To perform a multi-character wildcard search, use the * symbol. For instance, @http.url:https:\/\/* matches every view that has a URL starting with https://.
Use <,>, <=, or >= to perform a search on numerical attributes. For instance, retrieve all views that have a duration over 100ns with:
@duration:>100
You can search for numerical attribute within a specific range. For instance, retrieve all your views with a duration between 100ns and 300ns:
@duration:[100 TO 300]
@http.url_details.path:"/api/v1/test"/api/v1/test in the attribute http.url_details.path.@http.url:\/api\/v1\/*http.url attribute that start with /api/v1/.@duration:[100 TO 300] @http.url_details.path:\/api\/v1\/*duration between 100 and 300 ns, and containing a value in http.url_details.path attribute that start with /api/v1/.Additional helpful documentation, links, and articles:
