Search query language

The search language allows you to:

Filter the list of event log entries by one or more parameters;
Apply logical and comparison operations in filter expressions.

Filtering is available by the following parameters:

Parameter	Description
`event_id`	The unique event identifier
`timestamp`	The event occurrence time, RFC3339. Example: 2006-01-02T15:04:05Z07:00
`action`	The event type
`request_id`	The request ID used to communicate with Cloud Logging
`severity`	The event severity. Available values: `DEFAULT`,`DEBUG`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `CRITICAL`, `ALERT`, `EMERGENCY`
`message`	The human-readable description of the event
`source.id`	The event source identifier
`source.address`	The IP address of the event source
`subject.user_id`	The identifier of the user whose actions are associated with the event
`subject.address`	The IP address of the user
`subject.project_id`	The project ID in OpenStack
`subject.metadata`	Additional metadata identifying the user. Example: the `subject.metadata.email` parameter is the user's email
`resource.id`	The OpenStack resource ID or similar
`resource.type`	The resource type
`resource.metadata`	Additional metadata that defines the resource. For example: `resource.metadata.service_id` — service name (`DBaaS`) `resource.metadata.group_id` — subservice name (`Redis`) `resource.metadata.stream_id` — name of the object where the resource is located (`DB_id`)
`status.code`	The status code of operation execution. For example, HTTP or gRPC
`status.message`	The status description of operation execution
`labels`	The tags to search for events

Parameter

Description

event_id

The unique event identifier

timestamp

The event occurrence time, RFC3339.

Example: 2006-01-02T15:04:05Z07:00

action

The event type

request_id

The request ID used to communicate with Cloud Logging

severity

The event severity. Available values: DEFAULT,DEBUG, INFO, NOTICE, WARNING, ERROR, CRITICAL, ALERT, EMERGENCY

message

The human-readable description of the event

source.id

The event source identifier

source.address

The IP address of the event source

subject.user_id

The identifier of the user whose actions are associated with the event

subject.address

The IP address of the user

subject.project_id

The project ID in OpenStack

subject.metadata

Additional metadata identifying the user.

Example: the subject.metadata.email parameter is the user's email

resource.id

The OpenStack resource ID or similar

resource.type

The resource type

resource.metadata

Additional metadata that defines the resource.

For example:

resource.metadata.service_id — service name (DBaaS)
resource.metadata.group_id — subservice name (Redis)
resource.metadata.stream_id — name of the object where the resource is located (DB_id)

status.code

The status code of operation execution.

For example, HTTP or gRPC

status.message

The status description of operation execution

labels

The tags to search for events

To filter the list of log entries, use the <PARAMETER_NAME>/<PARAMETER_VALUE> pairs in the search string. To filter entries by multiple values of one parameter, list the values one after another.

Search features

", ', and ＼ characters in the search string are escaped with ＼.
The value does not need to be quoted if it:
- Starts with a Latin letter and contains only Latin letters, numbers, and underscores.
- Is an unsigned integer.
Time value format: RFC3339.
All values in nested objects are treated as strings and compared in lexicographic order.
Search by array parameters is supported using the :, =, <> operators.

Comparison operators

Operator	Description	Example
`=`	Equal	`message="search string"`
`<>`	Not equal	`message<>"search string"`
`>`	More	`severity > DEBUG`
`<`	Less	`severity < DEBUG`
`>=`	More or less	`timestamp >= "2023-04-10T10:20:00Z"`
`<=`	Less or more	`timestamp <= "2023-04-10T10:20:00Z"`
`:`	Include	`message: "строка"`

Operator

Description

Example

=

Equal

message="search string"

<>

Not equal

message<>"search string"

>

severity > DEBUG

<

Less

severity < DEBUG

>=

More or less

timestamp >= "2023-04-10T10:20:00Z"

<=

Less or more

timestamp <= "2023-04-10T10:20:00Z"

:

Include

message: "строка"

Logical operators

You can combine multiple conditions in one filter expression using logical operators:

Operator	Description	Example
`AND`	Meets all conditions	`service_id=databases AND severity=ERROR`
`OR`	Meets at least one condition	`severity=ERROR OR status.code=500`
`NOT`	Does not meet this condition	`NOT message: hello`
`EXIST`	This parameter is exist	`subject.metadata.email EXIST`

Operator

Description

Example

AND

Meets all conditions

service_id=databases AND severity=ERROR

OR

Meets at least one condition

severity=ERROR OR status.code=500

NOT

Does not meet this condition

NOT message: hello

EXIST

This parameter is exist

subject.metadata.email EXIST

Calculation order

Use parentheses to specify a specific order of evaluation, for example:


parameter1: "value1" AND (parameter2 = "value2" OR parameter3 < "value3")

This example will find records where parameter1 contains the substring "value1" and at least one of the following conditions is met:

The value of parameter2 is equal to "value2".
The value of parameter3 is less than "value3" in the lexicographic order.

Examples of expressions

Expression	Search result
`source.id=iam AND (subject.address="127.0.0.1" OR status.code=500)`	All IAM service events that occurred to a user at the `127.0.0.1` IP address or that resulted in the 500 error code
`severity=CRITICAL AND subject.metadata.email: "@example.ru"`	All critical events that occurred for users with the `example.ru` mail domain
`timestamp > "2023-06-02T15:04:05Z03:00" AND source.address="127.0.0.1" AND resource.metadata.stream_id="2278584446"`	All events that occurred on the `2278584446` object at the `127.0.0.1` IP address after 15:04:05 on June 2, 2023. The time is specified for the UTC+3 time zone

Expression

Search result

source.id=iam AND (subject.address="127.0.0.1" OR status.code=500)

All IAM service events that occurred to a user at the 127.0.0.1 IP address or that resulted in the 500 error code

severity=CRITICAL AND subject.metadata.email: "@example.ru"

All critical events that occurred for users with the example.ru mail domain

timestamp > "2023-06-02T15:04:05Z03:00" AND source.address="127.0.0.1" AND resource.metadata.stream_id="2278584446"

All events that occurred on the 2278584446 object at the 127.0.0.1 IP address after 15:04:05 on June 2, 2023. The time is specified for the UTC+3 time zone

Search query language

Search features

Comparison operators

Logical operators

Calculation order

Examples of expressions

Was this article helpful?

Was this article helpful?