Log Query Syntax

This page describes our newest query syntax. For the syntax using attributes, see our legacy query syntax

AppSignal’s log filtering system allows you to search and filter through your application logs using an intuitive query syntax. Whether you need to find specific error messages, filter by severity levels, or search through custom attributes, our query language makes it easy to pinpoint exactly what you’re looking for.

You don’t have to type this syntax by hand. Select the logs search bar and autocomplete suggests fields, operators, and severity levels from your logs. Suggestions insert text into the query, and you press Enter to run it. For the full flow, see Logs query autocomplete.

Quick Start

Get started with these simple queries:

timeout

Finds logs whose message contains “timeout”.

severity=error

Finds all error-level logs.

severity=error hostname=production-web-1

Finds errors from a specific server.

Available Fields

You can query the following fields in your logs:

Field	Description	Example
`severity`	Log level (error, warning, info, debug, trace)	`severity=error`
`hostname`	Application host	`hostname=production-1`
`group`	Namespace defined for your application	`group="background jobs"`
`message`	Log message content	`message:timeout`
Custom attributes	Any custom attribute defined in your logs	`duration>10.1`

If no field is provided, the query will search the message field.

Query Operators

Search Operators

Operator	Syntax	Description	Example
`:`	`field:value`	Contains value	`message:error`
`!:`	`field!:value`	Does not contain value	`hostname!:test`
`=`	`field=value`	Exact match	`severity=error`
`!=`	`field!=value`	Not equal to	`severity!=info`

Use quotes for values with spaces: group:"background jobs" Compare a field with an empty string to filter empty and non-empty values:

code="" matches log lines where code is empty.
code!="" matches log lines where code has a non-empty value.

Partial Matches and Wildcards

The : operator matches when the value appears anywhere in the field. message:timeout finds “Request timeout” and “timeout after 30s”. The match is case-sensitive, so it does not find “Timeout”. There is no wildcard character. An asterisk is searched for literally, so message:error* only matches messages that contain the text error*. To find messages that contain “error”, use message:error. The % and _ characters are matched literally as well. Use = when the whole field has to match. Exact matches are case-sensitive too.

Comparison Operators

For numeric values:

Operator	Syntax	Description	Example
`>`	`attribute>value`	Greater than	`duration>100`
`<`	`attribute<value`	Less than	`user_id<1000`
`>=`	`attribute>=value`	Greater than or equal to	`duration>=100`
`<=`	`attribute<=value`	Less than or equal to	`user_id<=1000`

Nested Attributes

We’ll use the following example JSON structure:

{
  "message": "User logged in",
  "group": "admin",
  "hostname": "production-1",
  "user": {
    "id": 123,
    "name": "John Doe",
    "emails": ["john@example.com", "john@work.com"],
    "location.country": "US"
  }
}

Query nested JSON attributes using dot notation:

user.id=123

Access nested object properties.

user.emails.0=john@example.com

Query array elements by index (zero-based).

user.location\.country=US

Escape dots that are part of the field name itself using a backslash.

Combining Queries

AND Logic (Default)

Space-separated queries are combined with AND:

severity=error hostname=production-1

Finds errors from production-1.

OR Logic

Use OR to match any condition:

severity=error OR severity=warning

Finds errors or warnings.

Grouping with Parentheses

Use parentheses for complex queries:

severity=error AND (hostname=web-1 OR hostname=web-2)

Finds errors from either web-1 or web-2.

Features

Application health

Logs & metrics

Infrastructure

Tuning your apps

Quick Start

Available Fields

Query Operators

Search Operators

Partial Matches and Wildcards

Comparison Operators

Nested Attributes

Combining Queries

AND Logic (Default)

OR Logic

Grouping with Parentheses

​Quick Start

​Available Fields

​Query Operators

​Search Operators

​Partial Matches and Wildcards

​Comparison Operators

​Nested Attributes

​Combining Queries

​AND Logic (Default)

​OR Logic

​Grouping with Parentheses

Quick Start

Available Fields

Query Operators

Search Operators

Partial Matches and Wildcards

Comparison Operators

Nested Attributes

Combining Queries

AND Logic (Default)

OR Logic

Grouping with Parentheses