app / console / searching

The Timber App - Searching

Searching your logs is arguably the most important feature a logging platform can provide, and Timber has taken great care to expose a simple, intuitive, yet powerful search syntax. It follows the Lucene style syntax with slight differences conducive to searching logs.

App - Searching

Global Rules

  1. All text searching is case insensitive.
  2. Multiple successive terms combine to perform a phrase search and narrow your results.
  3. Special characters (* and ?) can be escaped with a \ or by wrapping the term in quotes "paul*bunyan" or 'paul*bunyan'.

Text Searching

ConditionExampleDescription
Keywords (intersection)paul bunyanContains paul and bunyan, separately.
Exact matching (phrases)"paul bunyan"Contains the phrase paul bunyan.
Either / Orpaul OR bunyanContains paul or bunyan.
* Wildcard (zero or more)paul*bunyanContains paul and bunyan with zero or more characters inbetween.
? Wildcard (zero or one)paul?bunyanContains paul and bunyan with zero or one characters inbetween.
Negation (single)-paulDoes not contain paul.
Negation (multiple)-(paul bunyan)Does not contain the phrase paul bunyan.

Attribute Searching

ConditionExampleDescription
Equals (:)user.name:PaulThe field user.name equals Paul.
Does not equal (:-)user.name:-PaulThe field user.name does not equal Paul.
Contains (*)user.name:*Paul*The field user.name contains Paul.
Greater than (:>)http_response.time_ms:>500The field http_response.time_ms is greater than 500.
Greater than or eq to (:>=)http_response.time_ms:>=500The field http_response.time_ms is greater than or equal to 500.
Less than (:<)http_response.time_ms:<500The field http_response.time_ms is less than 500.
Less than (:<=)http_response.time_ms:<=500The field http_response.time_ms is less than or equal to 500.
Hashas:user.nameHas the field user.name.
Missingmissing:user.nameMissing the field user.name.

Grouping & Negation

Any condition(s) can be grouped together with parenthesis and prefixed with a - negation operator. To demonstrate, here are a few examples with explanations:

  • user.name:*Paul* (500 OR error) - The user.name field contains Paul and the log line contains 500 or error.
  • -(user.name:*Paul* (500 OR error)) - The inverse of the search above. This is similar to !(..) in programming.
Questions?

Chat with us, just click the talk button in the bottom right of this page.

Chat with us
Sign Up

Log better and solve problems faster, today. Install in under a minute.

Sign Up