Search Syntax


Events search uses the logs search syntax. Like logs search, events search permits:

  • AND, OR, and - operators
  • Wildcards
  • Escape characters
  • Searching tags and facets with key:value
  • Searching within attributes with the @ prefix

Example queries

source:(github OR chef)
Show events from GitHub OR Chef.
host:(i-0ade23e6 AND
Show events from i-0ade23e6 AND
Show events from the kafka service.
Show events with an error status (supports: error, warning, info, ok).
Show events in the us-east-1a AWS availability zone (AZ).
Show events from all containers with an ID beginning with foo.
Show the events with attribute equal to foo.

See Logs Search Syntax for more details.

Further reading

Additional helpful documentation, links, and articles: