The Timber search syntax follows familiar standards set by other popular services and websites. This documentation outlines the various syntax options when executing a search. The purpose is to enable you to utilize the full power of the Timber search feature.

Demo

Search / Query example

Syntax Rules

Condition Example Description
Contains paul bunyan Any line that contains the phrase paul bunyan. Case insensitive.
Intersection paul AND bunyan Any line that contains paul and bunyan, separately. Case insensitive.
Either / Or paul OR bunyan Any line that contains paul or bunyan. Case insensitive.
Literal phrases " "paul:bunyan" Allows you to treat special characters literally. Any line that contains paul:bunyan, (: included). Case insensitive.
Literal phrases ' 'paul bunyan' Allows you to treat special characters literally. Any line that contains paul bunyan, (space included). Case insensitive.
Negation (exclusion) -(paul bunyan) Any line that does not contain paul bunyan. Case insensitive.
Wildcards * pau*unyan Regex equivalent: /paul.*unyan/. Case insensitive.
Grouping (paul OR bunyan) AND ox Any line that contains (paul or bunyan) and ox.
Grouping w/ negation -(paul bunyan) Any line that does not contain paul and does not contain bunyan.
Has (exists) has:context.user.id Any line that has a value for context.user.id field.
Is is:sql_query Any line that is the specified event type. In this example, any line that has event.sql_query.
Missing (does not exist) missing:context.user.id Any line missing a value for context.user.id field.
Equals context.user.name:Paul Any line where the context.user.name field equals Paul. Case insensitive.
Contains context.user.name:*Paul* Any line where the context.user.name field contains Paul. Case insensitive.
Begins with context.user.name:Paul* Any line where the context.user.name field begins with Paul. Case insensitive.
Ends with context.user.name:*Bunyan Any line where the context.user.name field ends with Bunyan. Case insensitive.
Literal phrases w/ " context.user.name:"Paul Bunyan" Any line where the context.user.name field equals Paul Bunyan. Case insensitive.
Literal phrases w/ ' context.user.name:'Paul Bunyan' Any line where the context.user.name field equals Paul Bunyan. Case insensitive.
Greater than http_server_response.time_ms:>50 Any line where the http_server_response.time_ms field is greater than 50.
Greater than or equal to http_server_response.time_ms:>=50 Any line where the http_server_response.time_ms field is greater than or equal to 50.
Less than http_server_response.time_ms:<50 Any line where the http_server_response.time_ms field is less than 50.
Less than or equal to http_server_response.time_ms:<=50 Any line where thehttp_server_response.time_ms field is less than or equal to 50.

Aliases

To support other familiar syntaxes, Timber implements various aliases for the above conditions:

Condition Alias for
_exists_ has
_missing_ missing

Schema & Fields

See the log line JSON schema for a comprehensive list of fields.

Real-world examples

  1. is:exception - Find all exceptions
  2. level:error - View all logs on the error level.
  3. user.id:1234 level:error - View logs for a specific user
  4. Controller -(Sent 200) - View all lines that contain Controller and do not contain Sent 200.
  5. sent 200 OR 192.138* - View all lines that contain sent 200 or just simply contain a word that begins with 192.138.
  6. Started OR GET OR "/path" - View all lines that contain Started _or_ GET or /path.

Questions? Need help?

Chat with us, just click the talk button in the bottom right of this page.

Chat with us

Start a trial - 15 days free

Log better and solve problems faster, today. Less than 1 minutes to install.

Start a trial