Log Search


IMPORTANT NOTICE

We are currently in the process of rolling out updates to our query language. During the staggered roll out some customers will have access to the new query builder and LEQL updates pictured below. For a detailed explanation of how to use the new query builder please visit the LEQL blog post.

Others will have access to the old query bar and functions. If you still have the old query bar (pictured below) and want early access to the new query builder and LEQL functions please email support@logentries.com


LEQL Query Bar

The LEQL Query Bar has two modes. The first mode is simple mode that will allow you to build queries by selecting the desired functions and keys with your mouse.

The second is the advanced mode which will allow you to enter the full query using the keyboard. Experienced users will likely find this mode faster, but the syntax is strict and you must remember the different analytic functions available.

Switch Query Mode

You can quickly switch between the simple and the advanced mode by clicking the blue link to the top right of the query bar. If you find yourself in the advanced mode with an invalid query, the system will prevent you from returning to the simple mode. To return to the simple mode delete the query or fix the syntax errors.


The following section will provide the details required to search your logs in a wide variety of ways. This will cover keyword search, KVP search, regex search, and analytic functions. The capabilities available and the way you should search your logs will vary based on the format of your logs.


Operators

Logical Operators

Logentries supports the following logical operators to create comprehensive search criteria

Logical Operator

Usage

Description

“AND”

expr1 AND expr2

Returns log events that match both criteria

“OR”

expr1 OR expr2

Returns log events that match one or both criteria

“NOT” or “-”

expr1 NOT expr2

Returns log events that match expr1 but not expr2

Note: to be recognizing by the Logentries query language logical operators must be in UPPERCASE.

Comparison Operators

Comparison operators can be used for KVP search and Regular Expression search

Operator

Example

Description

=

field=value

Returns log events that match the search value – matches numeric and text values

!=

field!=value

Returns log events that do not match the search value – matches numeric and text values

>

field>num

Returns log events with field values higher than the search value

>=

field>=num

Returns log events with field values higher than or equal to the search value

<

field<num

Returns log events with field values lower than the search value

<=

field<=num

Returns log events with field values lower than or equal the search value

Numerical values must be formatted as an integer, floating-point value, or in  scientific notation to be properly recognized by Logentries. Units are not calculated as part of the comparison. E.g. searching for a value<100bytes would not return a result with value=200bits


Keyword search will work on all logs regardless of their format. Keyword searches are case sensitive by default and will match a full string until it is delimited by a non-letter character. For example, given the log events below:

Apr 13 20:01:01 hostname run-parts(/etc/cron.hourly)[26263]: starting 0anacron
Apr 13 20:01:01 hostname run-parts(/etc/cron.hourly)[26272]: finished 0anacron

Logentries will match the events by searching for “etc” or “run” because the text is delimited by whitespace and non-letter characters. Logentries would not match “hour” but will match “hourly”.

Keyword search can be combined with logical operators, e.g. “starting AND finishing” would return both log events.

Note: When you list a series of keywords Logentries automatically assumes an AND between each keyword. If you want to match an exact string place “Double Quotes” around the search.


Regular Expression Keyword Search

Regular Expressions can greatly enhance the power of your keyword searching. Regular expressions must be wrapped with two forward slashes (“/”). The two most common cases for regex search in Logentries are below.

Partial Matching

By default, regex search will return partial matches. The search below will match “complete,” “completely,” and “completed”

Case Insensitive Search

Using a case-insensitive keyword search means that the search below will match Error, ERROR, error, and any other form of capitalization.

Regular Expression Operators

Regular expressions use special characters to enable searching for more advanced patterns. These characters are *, +, ., \, [, ], (, ), {, }.If you need to use special characters as ordinary characters, you will need to escape them with a backward slash (\).

Advanced Capabilities

To learn more about our advanced regular expression search capabilities please read the Regular Expression Search Documentation


Logentries will automatically parse log events that are in a Key Value Pair (KVP) or JSON format for easy use of advanced analytics. The KVP and JSON parsing doc details the specific formats the system will parse. If your logs are not in a standard KVP or JSON format you can utilize the regular expression field extraction to gain access to the same advanced analytics. To understand which KVP and JSON formats

Given the log events below

Searches can be easily written to return important log events

Search for all log events with a response time over 25 to return the first two log events

Add the logical operator OR to include events from containerID 14 to return all three log events


Regular Expression Field Extraction

If your logs do not contain any Key Value Pairs (KVP), you can designate a Key Value Pair relationship for a given string using Regular Expression Field Extraction. This will give you access to all of the advanced search, analytic, and visualization capabilities available for KVP and JSON log formats.


Analytic Functions and Visualizations

Syntax

Logentries syntax is designed to be intuitive, easy to use, and follows a SQL-style syntax for analyzing log data.

Where: Filter to the subset of log events you want to analyze
GroupBy: Optional function that arranges data into identical groups based on a specified KVP
Calculate: Selects the method of calculation to run

Count

Log search also supports returning a count of matched search results. Append calculate(COUNT) to your search query or press the f{x} drop down followed by the count function (as seen below) to get the number of search results.

Sum

You can use the sum function to total the values of your name value pairs. If you had a KVP for sale_value and wanted to know the total sales for a specified time period it would be returned with the following query: where(sale_total>0) calculate(SUM:sale_total).

Average

The average modifier works the same as sum, but it computes the mean of the values matching the search criteria. For instance, to get the average value of your sales, you might invoke a search like where(sale_total>0) calculate(AVERAGE:sale_total).

Unique

The UNIQUE keyword returns the number of unique values for a given key. It takes one parameter: the name of the key. For example, if you have the KVP userID in your log file and want to find the number of unique users where(userID) calculate(UNIQUE:userID)

Min (New LEQL Only)

The Min function will return the minimum value of the key for each time period. For example the query below will return the shortest response time for each time period. where(status=200) calculate(MIN:responseTime)

Max (New LEQL Only)

The Max function will return the maximum value of the key for each time period. For example the query below will return the longest response time for each time period. where(status=200) calculate(Max:responseTime)

Grouping

You can perform search functions based on grouping identical datasets. In the example below the logs contain the KVP “status” which represents the HTTP status code for a request from a web server.

where(status) groupby(status) calculate(count)

The query below will further refine this search to match only status codes 300 and above.

where(status>=300) groupby(status) calculate(count)

NOTE: Currently there is a maximum limit of 40 groups that will be displayed in a result set.  


Saved Searches

Logentries allows searches to be saved. The star icon allows you to save your searches, and the drop-down icon allows you to access saved searches.

In order to save your current log search all you have to do is click on the star. Now if you or any other user in the same account clicks on the drop-down symbol then all the previously saved searches will be displayed.

It is also possible to edit a saved log search in order to give it a nickname or change the query. Click on the ‘edit query’ link that displays when you mouse over a saved search and you’ll be shown the modal below.


Next Steps

Back to Top