Skip to main content
This page describes our newest query syntax. For the syntax using attributes, see our legacy query syntax
AppSignal’s log filtering system allows you to search and filter through your application logs using an intuitive query syntax. Whether you need to find specific error messages, filter by severity levels, or search through custom attributes, our query language makes it easy to pinpoint exactly what you’re looking for. Screenshot of expanded log

​
Quick Start

Get started with these simple queries: 
timeout
Searches for “timeout” in the message field. 
severity=error
Finds all error-level logs. 
severity=error hostname=production-web-1
Finds errors from a specific server.

​
Available Fields

You can query the following fields in your logs:
FieldDescriptionExample
severityLog level (error, warning, info, debug, trace)severity=error
hostnameApplication hosthostname=production-1
groupNamespace defined for your applicationgroup="background jobs"
messageLog message contentmessage:timeout
Custom attributesAny custom attribute defined in your logsduration>10.1
If no field is provided, the query will search the message field.

​
Query Operators

​
Search Operators

OperatorSyntaxDescriptionExample
:field:valueContains valuemessage:error
!:field!:valueDoes not contain valuehostname!:test
=field=valueExact matchseverity=error
!=field!=valueNot equal tosource!=mongodb
Use quotes for values with spaces: group:"background jobs"

​
Comparison Operators

For numeric values:
OperatorSyntaxDescriptionExample
>attribute>valueGreater thanduration>100
<attribute<valueLess thanuser_id<1000
>=attribute>=valueGreater than or equal toduration>=100
<=attribute<=valueLess than or equal touser_id<=1000

​
Nested Attributes

We’ll use the following example JSON structure: 
{
  "message": "User logged in",
  "group": "admin",
  "hostname": "production-1",
  "user": {
    "id": 123,
    "name": "John Doe",
    "emails": ["john@example.com", "john@work.com"],
    "location.country": "US"
  }
}
Query nested JSON attributes using dot notation: 
user.id=123
Access nested object properties. 
user.emails.0=john@example.com
Query array elements by index (zero-based). 
user.location\.country=US
Escape dots that are part of the field name itself using a backslash.

​
Combining Queries

​
AND Logic (Default)

Space-separated queries are combined with AND: 
severity=error hostname=production-1
Finds errors from production-1.

​
OR Logic

Use OR to match any condition: 
severity=error OR severity=warning
Finds errors or warnings.

​
Grouping with Parentheses

Use parentheses for complex queries: 
severity=error AND (hostname=web-1 OR hostname=web-2)
Finds errors from either web-1 or web-2.