vpruthi/doc-exports
1
0
Fork 0
forked from docs/doc-exports
Code Pull Requests Activity
doc-exports/docs/lts/umn/lts_05_0005.html
Liu, Siying 35cd899fe1 LTS UMN 20230609 version. 
Reviewed-by: Mützel, Andrea <andrea.muetzel@t-systems.com>
Co-authored-by: Liu, Siying <liusiying@noreply.gitea.eco.tsi-dev.otc-service.com>
Co-committed-by: Liu, Siying <liusiying@noreply.gitea.eco.tsi-dev.otc-service.com>
2023-08-08 15:12:51 +00:00

265 lines
49 KiB
HTML
Raw Blame History

<a name="lts_05_0005"></a><a name="lts_05_0005"></a>
<h1 class="topictitle1">Log Search</h1>
<div id="body32001227"><p id="lts_05_0005__en-us_topic_0000001252577734_p1881115912114">Follow the directions below to search logs by keyword and time range:</p>
<ol id="lts_05_0005__en-us_topic_0000001252577734_ol1481195991118"><li id="lts_05_0005__en-us_topic_0000001252577734_li32721840182510">On the LTS console, choose <strong id="lts_05_0005__en-us_topic_0000001252577734_b1926733916287">Log Management</strong> in the navigation pane on the left.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li1277132885510">In the log group list, click <span><img id="lts_05_0005__en-us_topic_0000001252577734_image195326611314" src="en-us_image_0000001463823649.png"></span> on the left of a log group name.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li1667373725615">In the log stream list, click a log stream name.<p id="lts_05_0005__en-us_topic_0000001252577734_p5311141522820"><a name="lts_05_0005__en-us_topic_0000001252577734_li1667373725615"></a><a name="en-us_topic_0000001252577734_li1667373725615"></a></p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p57569208612"></p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p3205209155520"></p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p159991629115717"></p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p13405133014617"></p>
</li><li id="lts_05_0005__en-us_topic_0000001252577734_li1881220591111">In the upper right corner, select a time range. The default time range is 1 hour (from now).<div class="p" id="lts_05_0005__en-us_topic_0000001252577734_p5230165717577"><a name="lts_05_0005__en-us_topic_0000001252577734_li1881220591111"></a><a name="en-us_topic_0000001252577734_li1881220591111"></a>There are three types of time range: relative time from now, relative time from last, and specified time. Select a time range as required.<div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note83845121"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="lts_05_0005__en-us_topic_0000001252577734_ul11413464564"><li id="lts_05_0005__en-us_topic_0000001252577734_li614111467563">From now: queries log data generated in a time range that ends with the current time, such as the previous 1, 5, or 15 minutes. For example, if the current time is 19:20:31 and 1 hour is selected as the relative time from now, the charts on the dashboard display the log data that is generated from 18:20:31 to 19:20:31.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li5141204611562">From last: queries log data generated in a time range that ends with the current time, such as the previous 1 or 15 minutes. For example, if the current time is 19:20:31 and 1 hour is selected as the relative time from last, the charts on the dashboard display the log data that is generated from 18:00:00 to 19:00:00.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li161419461563">Specified time: queries log data that is generated in a specified time range.</li></ul>
</div></div>
</div>
</li><li id="lts_05_0005__en-us_topic_0000001252577734_li954091217311">On the log stream details page, you can search for logs using the following methods:<ol type="a" id="lts_05_0005__en-us_topic_0000001252577734_ol3231113093210"><li id="lts_05_0005__en-us_topic_0000001252577734_li119401727151513">In the search area, click in the search box. The drop-down list contains the following items:<ul id="lts_05_0005__en-us_topic_0000001252577734_ul4895545181512"><li id="lts_05_0005__en-us_topic_0000001252577734_li289594501520">Structured fields or index fields: Built-in fields are not displayed in the drop-down list. However, when you enter a built-in field, the drop-down list is automatically associated and matched with the field.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li366010771716"><strong id="lts_05_0005__en-us_topic_0000001252577734_b97681225113718">NOT</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b194594273378">AND</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b0451202918376">OR</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b773183293714">:</strong>, and <strong id="lts_05_0005__en-us_topic_0000001252577734_b136704023719">:*</strong> keywords can be displayed. Keywords other than <strong id="lts_05_0005__en-us_topic_0000001252577734_b99961188386">NOT</strong> are displayed in the drop-down list only after you enter the keyword in the search box.<div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note19316956593"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="lts_05_0005__en-us_topic_0000001252577734_ul050615441511"><li id="lts_05_0005__en-us_topic_0000001252577734_li95061244916">When entering a keyword, you can press <strong id="lts_05_0005__en-us_topic_0000001252577734_b122171538143913">Tab</strong> to automatically add the first keyword displayed in the drop-down list.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li85219468118">Keywords are case-insensitive.</li></ul>
</div></div>
</li><li id="lts_05_0005__en-us_topic_0000001252577734_li41662301201">Historical records: A maximum of 20 historical records can be retained, but only the latest three records are displayed in the drop-down list.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li2176411112414">Quick search: quick search fields that have been created.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li748863171916">Search syntax: common search syntax.</li></ul>
<p id="lts_05_0005__en-us_topic_0000001252577734_p676617156215">Enter a keyword, or select a field and keyword from the drop-down list, and click <strong id="lts_05_0005__en-us_topic_0000001252577734_b14369575814">Query</strong>.</p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p261015479140">Logs that contain the keyword are displayed.</p>
<div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note967414275375"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="lts_05_0005__en-us_topic_0000001252577734_ul73781314015"><li id="lts_05_0005__en-us_topic_0000001252577734_li16371713154010">Built-in fields include <strong id="lts_05_0005__en-us_topic_0000001252577734_b1560813693515">appName</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b114569816357">category</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b14334171063516">clusterId</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b856271223519">clusterName</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b173046147357">collectTime</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b1538631613517">containerName</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b1189816178356">hostIP</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b314502023512">hostIPv6</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b107341322193512">hostId</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b15263245353">hostName</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b1567322612357">nameSpace</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b13111429173515">pathFile</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b1304183220359">podName</strong> and <strong id="lts_05_0005__en-us_topic_0000001252577734_b7880193410354">serviceID</strong>. By default, the fields are displayed in simplified mode, and <strong id="lts_05_0005__en-us_topic_0000001252577734_b141368556357">hostIP</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b16633165712351">hostName</strong>, and <strong id="lts_05_0005__en-us_topic_0000001252577734_b1279235943510">pathFile</strong> are displayed at the beginning.<p id="lts_05_0005__en-us_topic_0000001252577734_p99561095247"></p>
</li><li id="lts_05_0005__en-us_topic_0000001252577734_li2037131334010">The structured fields are displayed in <strong id="lts_05_0005__en-us_topic_0000001252577734_b13568104003718">key:value</strong> format.</li></ul>
</div></div>
</li><li id="lts_05_0005__en-us_topic_0000001252577734_li186124131011">On the <strong id="lts_05_0005__en-us_topic_0000001252577734_b5308154518381">Raw Logs</strong> page, click a field in blue in the log content. You can select <strong id="lts_05_0005__en-us_topic_0000001252577734_b1330911458384">Copy</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b13309545203812">Add To Search</strong>, and <strong id="lts_05_0005__en-us_topic_0000001252577734_b1230974553814">Exclude from Search</strong> from the displayed drop-down list.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li8585112910124">Click a field for which quick analysis has been created to add it to the search box.<div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note364542074511"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="lts_05_0005__en-us_topic_0000001252577734_p3524712566">If the field you click already exists in the search box, it will be replaced by this newly added one. If the field is added for the first time, fields in the search box are searched using the AND operator.</p>
</div></div>
</li><li id="lts_05_0005__en-us_topic_0000001252577734_li209612574414">In the search area, press the up and down arrows on the keyboard to select a keyword or search syntax from the drop-down list, press <strong id="lts_05_0005__en-us_topic_0000001252577734_b16802438215">Tab</strong> or <strong id="lts_05_0005__en-us_topic_0000001252577734_b1980310381018">Enter</strong> to select a keyword or syntax, and click <strong id="lts_05_0005__en-us_topic_0000001252577734_b18031138917">Query</strong>.</li></ol>
</li></ol>
<div class="section" id="lts_05_0005__en-us_topic_0000001252577734_section36611942194013"><h4 class="sectiontitle">Common Log Search Operations</h4><p id="lts_05_0005__en-us_topic_0000001252577734_p94438216450">Log search operations include sharing logs and refreshing logs.</p>
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="lts_05_0005__en-us_topic_0000001252577734_table755214580176" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Common operations</caption><thead align="left"><tr id="lts_05_0005__en-us_topic_0000001252577734_row2553558151716"><th align="left" class="cellrowborder" valign="top" width="22.62%" id="mcps1.3.3.3.2.3.1.1"><p id="lts_05_0005__en-us_topic_0000001252577734_p151561310131814">Operation</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="77.38000000000001%" id="mcps1.3.3.3.2.3.1.2"><p id="lts_05_0005__en-us_topic_0000001252577734_p1455385821711">Description</p>
</th>
</tr>
</thead>
<tbody><tr id="lts_05_0005__en-us_topic_0000001252577734_row1030112345535"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p15302173415537">Creating quick search criteria</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1430263475316">Click <span><img id="lts_05_0005__en-us_topic_0000001252577734_image885473082112" src="en-us_image_0000001561940610.png"></span> to create a quick search.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row195539582170"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1455313584174">Sharing logs</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p175531358151716">Click <span><img id="lts_05_0005__en-us_topic_0000001252577734_image6372361315" src="en-us_image_0000001421609924.png"></span> to copy the link of the current log search page to share the logs that you have searched.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row3248133214436"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p111868493432">Refreshing logs</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p118634984312">You can click <span><img id="lts_05_0005__en-us_topic_0000001252577734_image1378515564433" src="en-us_image_0000001481236306.png"></span> to refresh logs in two modes: manual refresh and automatic refresh.</p>
<ul id="lts_05_0005__en-us_topic_0000001252577734_ul111865497438"><li id="lts_05_0005__en-us_topic_0000001252577734_li13186194964317">Manual refresh: Select <strong id="lts_05_0005__en-us_topic_0000001252577734_b19934455192110">Refresh Now</strong> from the drop-down list.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li118654916436">Automatic refresh: Select an interval from the drop-down list to automatically refresh logs. The interval can be 15 seconds, 30 seconds, 1 minute, or 5 minutes.</li></ul>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row98801030399"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p188016301991">Copying logs</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p588012309911">Click <span><img id="lts_05_0005__en-us_topic_0000001252577734_image133024013118" src="en-us_image_0000001262546024.png"></span> to copy the log content.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row3550182811918"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p175500281398">Viewing context of a log</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p17550122817912">Click <span><img id="lts_05_0005__en-us_topic_0000001252577734_image3519165121112" src="en-us_image_0000001262546228.png"></span> to view the log context.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row1351109918"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1536301097">Simplifying field details</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p6361901792">Click <span><img id="lts_05_0005__en-us_topic_0000001252577734_image1727923231518" src="en-us_image_0000001611750029.png"></span> to view the simplified field details.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row347118291386"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1147262912819">Unfold/Fold</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><div class="p" id="lts_05_0005__en-us_topic_0000001252577734_p11472829586">Click <span><img id="lts_05_0005__en-us_topic_0000001252577734_image2109161519421" src="en-us_image_0000001576175974.png"></span> to display the full log content. <div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note85892461154"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="lts_05_0005__en-us_topic_0000001252577734_p3589194618151"><strong id="lts_05_0005__en-us_topic_0000001252577734_b7941175513523">Unfold</strong> is enabled by default.</p>
</div></div>
</div>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row16307141611247"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1330718163249">Downloading logs</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p190176132613">Click <span><img id="lts_05_0005__en-us_topic_0000001252577734_image335716448560" src="en-us_image_0000001474530441.png"></span>. On the displayed <strong id="lts_05_0005__en-us_topic_0000001252577734_b4729182412220">Download Logs</strong> page, click <strong id="lts_05_0005__en-us_topic_0000001252577734_b107290241222">Direct Download</strong> or <strong id="lts_05_0005__en-us_topic_0000001252577734_b572917246210">Transfer and Download</strong>.</p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p6462101410499"><strong id="lts_05_0005__en-us_topic_0000001252577734_b331163910592">Direct Download</strong>: Download log files to the local PC. Up to 5000 logs can be downloaded at a time.</p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p23031132112810">Select <strong id="lts_05_0005__en-us_topic_0000001252577734_b11581901838">.csv</strong> or <strong id="lts_05_0005__en-us_topic_0000001252577734_b18586014313">.txt</strong> from the drop-down list and click <strong id="lts_05_0005__en-us_topic_0000001252577734_b205870333">Download</strong> to export logs to the local PC.</p>
<div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note3271192115313"><span class="notetitle"> NOTE: </span><div class="notebody"><ul id="lts_05_0005__en-us_topic_0000001252577734_ul727110212318"><li id="lts_05_0005__en-us_topic_0000001252577734_li0272152193114">If you select <strong id="lts_05_0005__en-us_topic_0000001252577734_b15265474302">Export .csv</strong>, logs are exported as a table.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li142721221103110">If you select <strong id="lts_05_0005__en-us_topic_0000001252577734_b142251010153016">Export .txt</strong>, logs are exported as a <strong id="lts_05_0005__en-us_topic_0000001252577734_b8225171011304">.txt</strong> file.</li></ul>
</div></div>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row16514120816"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p3514411582">Layout</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p17520411084">Move the cursor over <span><img id="lts_05_0005__en-us_topic_0000001252577734_image194511161792" src="en-us_image_0000001476964177.png"></span> and choose <strong id="lts_05_0005__en-us_topic_0000001252577734_b37411101523">Layout</strong> from the drop-down list. On the displayed <strong id="lts_05_0005__en-us_topic_0000001252577734_b10744103523">Layout</strong> page, specify whether to simplify field display and show fields.</p>
<ul id="lts_05_0005__en-us_topic_0000001252577734_ul1552141316374"><li id="lts_05_0005__en-us_topic_0000001252577734_li112463012370"><strong id="lts_05_0005__en-us_topic_0000001252577734_b987112121576">Simple View</strong>: If this is enabled, the fields are displayed in a simplified manner.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li195221913163712"><strong id="lts_05_0005__en-us_topic_0000001252577734_b9612114985015">Show/Hide</strong>: When the visibility of a field is disabled, the field is not displayed in the log content.</li></ul>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row7343123832113"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p123441138122116">JSON</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p13908806227">Move the cursor over <span><img id="lts_05_0005__en-us_topic_0000001252577734_image970019147461" src="en-us_image_0000001410398388.png"></span>, click <strong id="lts_05_0005__en-us_topic_0000001252577734_b116596402135">JSON</strong>, and set JSON formatting.</p>
<div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note36181239398"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="lts_05_0005__en-us_topic_0000001252577734_p06181139694">Formatting is enabled by default. The default number of expanded levels is 2.</p>
</div></div>
<ul id="lts_05_0005__en-us_topic_0000001252577734_ul20182113812245"><li id="lts_05_0005__en-us_topic_0000001252577734_li1318283892419">Formatting enabled: Set the default number of expanded levels. Maximum value: <strong id="lts_05_0005__en-us_topic_0000001252577734_b93392057153112">10</strong>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li018216384242">Formatting disabled: JSON logs will not be formatted for display.</li></ul>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row1736704962610"><td class="cellrowborder" valign="top" width="22.62%" headers="mcps1.3.3.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p12367124912616">Invisible fields (<span><img id="lts_05_0005__en-us_topic_0000001252577734_image122481729153216" src="en-us_image_0000001316788136.png"></span>)</p>
</td>
<td class="cellrowborder" valign="top" width="77.38000000000001%" headers="mcps1.3.3.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p18367124910265">This list displays the invisible fields configured in the layout settings.</p>
<ul id="lts_05_0005__en-us_topic_0000001252577734_ul184343131382"><li id="lts_05_0005__en-us_topic_0000001252577734_li20434131310813">The <span><img id="lts_05_0005__en-us_topic_0000001252577734_image52432416720" src="en-us_image_0000001320576858.png"></span> button is unavailable for log streams without layout settings configured.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li1443481316817">If the log content is <strong id="lts_05_0005__en-us_topic_0000001252577734_b1972223619140">CONFIG_FILE</strong> and layout settings are not configured, the default invisible fields include <strong id="lts_05_0005__en-us_topic_0000001252577734_b14299749141414">appName</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b18492352121417">clusterId</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b17354554171410">clusterName</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b083575514142">containerName</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b921817574141">hostIPv6</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b678865811414">NameSpace</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b184260161517">podName</strong>, and <strong id="lts_05_0005__en-us_topic_0000001252577734_b1739111316157">serviceID</strong>.</li></ul>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="section" id="lts_05_0005__en-us_topic_0000001252577734_section987953011291"><h4 class="sectiontitle">Search Syntax and Examples</h4><p id="lts_05_0005__en-us_topic_0000001252577734_p123316109449"><strong id="lts_05_0005__en-us_topic_0000001252577734_b293582917119">Search syntax:</strong></p>
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="lts_05_0005__en-us_topic_0000001252577734_table3879103092911" frame="border" border="1" rules="all"><caption><b>Table 2 </b>Search syntax</caption><thead align="left"><tr id="lts_05_0005__en-us_topic_0000001252577734_row1988013016293"><th align="left" class="cellrowborder" valign="top" width="22.64%" id="mcps1.3.4.3.2.3.1.1"><p id="lts_05_0005__en-us_topic_0000001252577734_p1880113018292">Filter</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="77.36%" id="mcps1.3.4.3.2.3.1.2"><p id="lts_05_0005__en-us_topic_0000001252577734_p288053022914">Description</p>
</th>
</tr>
</thead>
<tbody><tr id="lts_05_0005__en-us_topic_0000001252577734_row18102748173810"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1011135983816">Exact search by keyword</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p3250114016543">LTS searches for logs containing the exact keyword (case-sensitive) that you specify. A keyword is the word between two adjacent delimiters.</p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p13043611552">You can add an asterisk (*) after a keyword, for example, <strong id="lts_05_0005__en-us_topic_0000001252577734_b831255814309">error*</strong>, if you are not familiar with delimiters.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row274904583818"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p191121959103817">Exact search by phrase</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p911295953810">LTS searches for logs containing the exact phrase (case-sensitive) that you specify.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row856819218393"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1941532019394">&amp;&amp;</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p6415122017390">Intersection of search results</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row18116181720393"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p5415122011393">||</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1241552018398">Union of search results</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row11880193012915"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p773413355128">AND</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p208801630122918">Intersection of search results</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row2954194883818"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p79551648113818">and</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1564411717392">Intersection of search results</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row2085834515263"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1485810452262">OR</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p5858104514269">Union of search results</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row919354143811"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p21915549382">or</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p519155453816">Union of search results</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row117341135101217"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p47341635101214">NOT</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p17341435151215">Logs that contain the keyword after <strong id="lts_05_0005__en-us_topic_0000001252577734_b252665225111">NOT</strong> are excluded.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row1044772317407"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1344812234407">not</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p154481323134017">Logs that contain the keyword after <strong id="lts_05_0005__en-us_topic_0000001252577734_b132955587515">not</strong> are excluded.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row1288123052914"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p7881730192919">?</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1588123092913">Fuzzy search. The question mark (?) can be put in the middle or at the end of a keyword to replace a character.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row958620482289"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p185874485285">&gt;</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1158712485289">Search for structured long or float fields with values greater than a specified number. For example, <strong id="lts_05_0005__en-us_topic_0000001252577734_b239419194173">num &gt; 10</strong>.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row6297754112818"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1029865442818">&lt;</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p929865416282">Search for structured long or float fields with values less than a specified number. For example, <strong id="lts_05_0005__en-us_topic_0000001252577734_b289116342177">num &lt; 10</strong>.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row135671072919"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1283222614299">=</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p556780192915">Search for structured long or float fields with values equal to a specified number. For example, <strong id="lts_05_0005__en-us_topic_0000001252577734_b9291135612179">num = 10</strong>.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row1051018541917"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1151115544114">&gt;=</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p14511654912">Search for structured long or float fields with values greater than or equal to a specified number. For example, <strong id="lts_05_0005__en-us_topic_0000001252577734_b159148861816">num &gt;= 10</strong>.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row238115591317"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p7381155912119">&lt;=</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p4821184301712">Search for structured long or float fields with values less than or equal to a specified number. For example, <strong id="lts_05_0005__en-us_topic_0000001252577734_b6391821191816">num &lt;= 10</strong>.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row15429101774512"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p144721147114515">:</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p847284764514">Search for a specified field (key:value). For example, <strong id="lts_05_0005__en-us_topic_0000001252577734_b13249182114194">request_method:GET</strong>.</p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p5472174744511">Use double quotation marks ("") to enclose a field name or value that contains reserved characters, such as spaces and colons (:). For example, <strong id="lts_05_0005__en-us_topic_0000001252577734_b145714429206">"file info":apsara</strong>.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row36631210456"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1052014316463">""</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p11520731194620">Enclose a syntax keyword to convert it into common characters. For example, <strong id="lts_05_0005__en-us_topic_0000001252577734_b1197023142212">"and"</strong>.</p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p185201031154617">This "and" means searching for logs that contain this word. It is not an operator.</p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p1052033115461">All words enclosed in double quotation marks ("") are considered as a whole.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row1655982454518"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p2085414194719">\</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p168544464716">Escape double quotation marks (""). The escaped quotation marks indicate the symbol itself. For example, to search for <strong id="lts_05_0005__en-us_topic_0000001252577734_b1497841482714">instance_id:nginx"01"</strong>, use <strong id="lts_05_0005__en-us_topic_0000001252577734_b6785132162719">instance_id:nginx\"01\"</strong>.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row175488276451"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p28546420479">*</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p158543418476">An asterisk (*) can be placed only after the keyword and can match zero, one, or multiple characters. For example, <strong id="lts_05_0005__en-us_topic_0000001252577734_b5467125142915">host:abcd*c</strong>.</p>
<div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note123367710510"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="lts_05_0005__en-us_topic_0000001252577734_p53361574518">LTS will find 100 words that meet the search criteria in all logs and return these logs.</p>
</div></div>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row11153104514503"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1630218378511">in</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p9302937175119">Query logs whose field values are in a specified range. Brackets indicate a closed interval, and parentheses indicate an open interval. Numbers are separated with spaces. Example:</p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p113024377517"><strong id="lts_05_0005__en-us_topic_0000001252577734_b26901065323">request_time in [100 200]</strong> and <strong id="lts_05_0005__en-us_topic_0000001252577734_b129351511133213">request_time in (100 200]</strong></p>
<div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note18227818526"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="lts_05_0005__en-us_topic_0000001252577734_p522819155210">Enter <strong id="lts_05_0005__en-us_topic_0000001252577734_b13355132918324">in</strong> in lowercase and use only long or float fields.</p>
</div></div>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row4346229183817"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p16116202413445">()</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p1953414441448">Specify fields that should be matched with higher priority. Use <strong id="lts_05_0005__en-us_topic_0000001252577734_b3745102417341">and</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b162511263343">or</strong>, and <strong id="lts_05_0005__en-us_topic_0000001252577734_b273392723416">not</strong> to connect fields. Example: <strong id="lts_05_0005__en-us_topic_0000001252577734_b13283104403420">(request_method:GET or request_method:POST) and status:200</strong></p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row1854314520239"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p2544124510237">key:<span style="color:#776977;">#"abc def"</span></p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p95441445192319">Search for specified field names and values (key:value) after field indexing is configured.</p>
</td>
</tr>
<tr id="lts_05_0005__en-us_topic_0000001252577734_row8986296240"><td class="cellrowborder" valign="top" width="22.64%" headers="mcps1.3.4.3.2.3.1.1 "><p id="lts_05_0005__en-us_topic_0000001252577734_p15987497249">#"abc def"</p>
</td>
<td class="cellrowborder" valign="top" width="77.36%" headers="mcps1.3.4.3.2.3.1.2 "><p id="lts_05_0005__en-us_topic_0000001252577734_p798714932419">Full text search. LTS splits an entire log into multiple words based on the delimiter you set. Search for logs using specified keywords (field name and value) and rules.</p>
</td>
</tr>
</tbody>
</table>
</div>
<div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note7621179193917"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="lts_05_0005__en-us_topic_0000001252577734_p71352010396">Operators (such as <strong id="lts_05_0005__en-us_topic_0000001252577734_b1443151405217">&amp;&amp;</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b24419144521">||</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b84421485215">AND</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b944131418520">OR</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b645414185215">NOT</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b1345514175216">*</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b845614145213">?</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b94511141523">:</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b124671465211">&gt;</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b9463144529">&lt;</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b17461414175213">=</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b64618143520">&gt;=</strong>, and <strong id="lts_05_0005__en-us_topic_0000001252577734_b74751410526">&lt;=</strong>) contained in raw logs cannot be used to search for logs.</p>
</div></div>
<p id="lts_05_0005__en-us_topic_0000001252577734_p7120345194015"><strong id="lts_05_0005__en-us_topic_0000001252577734_b105517203387">Search rules:</strong></p>
<ul id="lts_05_0005__en-us_topic_0000001252577734_ul31158252309"><li id="lts_05_0005__en-us_topic_0000001252577734_li21153257304">Fuzzy search is supported.<p id="lts_05_0005__en-us_topic_0000001252577734_p71151025193010"><a name="lts_05_0005__en-us_topic_0000001252577734_li21153257304"></a><a name="en-us_topic_0000001252577734_li21153257304"></a>For example, if you enter <strong id="lts_05_0005__en-us_topic_0000001252577734_b296212855914">error*</strong>, all logs containing <strong id="lts_05_0005__en-us_topic_0000001252577734_b296232812591">error</strong> will be displayed and those start with <strong id="lts_05_0005__en-us_topic_0000001252577734_b996315288598">error</strong> will be highlighted.</p>
</li><li id="lts_05_0005__en-us_topic_0000001252577734_li1877313200188">You can use a combination of multiple search criteria in the key and value format: <em id="lts_05_0005__en-us_topic_0000001252577734_i767181102813">key1:value1</em> <strong id="lts_05_0005__en-us_topic_0000001252577734_b136167461330">AND</strong> <em id="lts_05_0005__en-us_topic_0000001252577734_i590391892819">key2:value2</em> or <em id="lts_05_0005__en-us_topic_0000001252577734_i64371532289">key1:value1</em> <strong id="lts_05_0005__en-us_topic_0000001252577734_b33991623746">OR</strong> <em id="lts_05_0005__en-us_topic_0000001252577734_i7613161517292">key2:value2</em>. After entering or selecting <em id="lts_05_0005__en-us_topic_0000001252577734_i1447818454294">key1:value1</em>, you need to add <strong id="lts_05_0005__en-us_topic_0000001252577734_b13377527152911">AND</strong> or <strong id="lts_05_0005__en-us_topic_0000001252577734_b1037712278293">OR</strong> before entering or selecting <em id="lts_05_0005__en-us_topic_0000001252577734_i554015892910">key2:value2</em> in the search box.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li17801941339">Click a keyword and select one of the three operations from the displayed drop-down list: <strong id="lts_05_0005__en-us_topic_0000001252577734_b099741317111">Copy</strong>, <strong id="lts_05_0005__en-us_topic_0000001252577734_b533141014">Add To Search</strong>, and <strong id="lts_05_0005__en-us_topic_0000001252577734_b16414149116">Exclude from Search</strong>.<p id="lts_05_0005__en-us_topic_0000001252577734_p54246371427"><strong id="lts_05_0005__en-us_topic_0000001252577734_b143086241113">Copy</strong>: Copy the field.</p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p171581523188"><strong id="lts_05_0005__en-us_topic_0000001252577734_b4693182616110">Add To Search</strong>: Add <strong id="lts_05_0005__en-us_topic_0000001252577734_b20693102614119">AND </strong><em id="lts_05_0005__en-us_topic_0000001252577734_i10677625193013">field: value</em> to the search statement.</p>
<p id="lts_05_0005__en-us_topic_0000001252577734_p1932045264314"><strong id="lts_05_0005__en-us_topic_0000001252577734_b13948124924">Exclude from Search</strong>: Add <strong id="lts_05_0005__en-us_topic_0000001252577734_b9948132410216">NOT </strong><em id="lts_05_0005__en-us_topic_0000001252577734_i112955583016">field: value</em> to the query statement.</p>
</li></ul>
<p id="lts_05_0005__en-us_topic_0000001252577734_p13881530172912"><strong id="lts_05_0005__en-us_topic_0000001252577734_b1019035494818">Searching sample</strong></p>
<ul id="lts_05_0005__en-us_topic_0000001252577734_ul0649143215394"><li id="lts_05_0005__en-us_topic_0000001252577734_li245884103919">Search for logs containing <strong id="lts_05_0005__en-us_topic_0000001252577734_b550016310161">start</strong>: Enter <strong id="lts_05_0005__en-us_topic_0000001252577734_b342145091616">start</strong>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li54585413399">Search for logs containing <strong id="lts_05_0005__en-us_topic_0000001252577734_b161461316464751">start to refresh</strong>: Enter <strong id="lts_05_0005__en-us_topic_0000001252577734_b48414255364751">start to refresh</strong>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li117115384012">Search for the logs containing both keyword <strong id="lts_05_0005__en-us_topic_0000001252577734_b175872616564751">start</strong> and <strong id="lts_05_0005__en-us_topic_0000001252577734_b122993312464751">unexpected</strong>: Enter <strong id="lts_05_0005__en-us_topic_0000001252577734_b165463155164751">start &amp;&amp; unexpected</strong>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li676275264811">Search for logs containing both <strong id="lts_05_0005__en-us_topic_0000001252577734_b538092513175">start</strong> and <strong id="lts_05_0005__en-us_topic_0000001252577734_b13850172721719">unexpected</strong>: Enter <strong id="lts_05_0005__en-us_topic_0000001252577734_b181876339173">start AND unexpected</strong>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li131711053114014">Search for the logs containing keyword <strong id="lts_05_0005__en-us_topic_0000001252577734_b188005347664751">start</strong> or <strong id="lts_05_0005__en-us_topic_0000001252577734_b204447687664751">unexpected</strong>: Enter <strong id="lts_05_0005__en-us_topic_0000001252577734_b6738650364751">start || unexpected</strong>.</li></ul>
<ul id="lts_05_0005__en-us_topic_0000001252577734_ul78821530142917"><li id="lts_05_0005__en-us_topic_0000001252577734_li1230517552349">Search for logs containing <strong id="lts_05_0005__en-us_topic_0000001252577734_b5519132161617">start</strong> or <strong id="lts_05_0005__en-us_topic_0000001252577734_b1052693251615">unexpected</strong>: Enter <strong id="lts_05_0005__en-us_topic_0000001252577734_b1252613261610">start OR unexpected</strong>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li16200002358">Logs that do not contain <em id="lts_05_0005__en-us_topic_0000001252577734_i627913561713">query1</em>: <strong id="lts_05_0005__en-us_topic_0000001252577734_b182851511712">NOT content: </strong><em id="lts_05_0005__en-us_topic_0000001252577734_i102869514176">query1</em>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li118823304290"><strong id="lts_05_0005__en-us_topic_0000001252577734_b392061220171">error*</strong>: logs that contain <strong id="lts_05_0005__en-us_topic_0000001252577734_b159281712191716">error</strong>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li13882133017290"><strong id="lts_05_0005__en-us_topic_0000001252577734_b170747855864751">er?or</strong>: logs that start with <strong id="lts_05_0005__en-us_topic_0000001252577734_b159714823464751">er</strong>, is followed by any single character, and end with <strong id="lts_05_0005__en-us_topic_0000001252577734_b141215407264751">or</strong>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li1454412413349">If your keyword contains a colon (:), use the <strong id="lts_05_0005__en-us_topic_0000001252577734_b244734121213">content:</strong> <em id="lts_05_0005__en-us_topic_0000001252577734_i74479471211">Keyword</em> format. Example: <strong id="lts_05_0005__en-us_topic_0000001252577734_b104473401218">content: "120.46.138.115:80"</strong> or <strong id="lts_05_0005__en-us_topic_0000001252577734_b94476419126">content: 120.46.138.115:80</strong>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li3802468914"><em id="lts_05_0005__en-us_topic_0000001252577734_i1772431918404">query1</em> <strong id="lts_05_0005__en-us_topic_0000001252577734_b572431924019">AND</strong> <em id="lts_05_0005__en-us_topic_0000001252577734_i2072420193408">query2</em> <strong id="lts_05_0005__en-us_topic_0000001252577734_b57241819154020">AND NOT content:</strong> <em id="lts_05_0005__en-us_topic_0000001252577734_i1972421913401">query3</em>: logs that contain both <em id="lts_05_0005__en-us_topic_0000001252577734_i97249195401">query1</em> and <em id="lts_05_0005__en-us_topic_0000001252577734_i97241719194016">query2</em> but not <em id="lts_05_0005__en-us_topic_0000001252577734_i177247194401">query3</em>.</li></ul>
<div class="note" id="lts_05_0005__en-us_topic_0000001252577734_note113033143310"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="lts_05_0005__en-us_topic_0000001252577734_ul1813013363310"><li id="lts_05_0005__en-us_topic_0000001252577734_li1130123113313">When you enter a keyword to query logs, the keyword is case-sensitive. Log contents you queried are case-sensitive but the highlighted log contents are case-sensitive.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li19381926181211">The asterisk (*) and question mark (?) do not match special characters such as hyphens (-) and spaces.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li13800171716">For fuzzy match, the question mark (?) or asterisk (*) can only go in the middle or at the end of a keyword. For example, you can enter <strong id="lts_05_0005__en-us_topic_0000001252577734_b99221612716">ER?OR</strong> or <strong id="lts_05_0005__en-us_topic_0000001252577734_b1793017662715">ER*R</strong>.</li><li id="lts_05_0005__en-us_topic_0000001252577734_li5677171212398">When you search logs by keyword, if a single log contains more than 255 characters, exact search may fail.</li></ul>
</div></div>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="lts_05_0004.html">Log Search and View</a></div>
</div>
</div>
View Git Blame Copy Permalink