Support Center Home


LM Logs Query Language

The Logs query language expands the standard search capabilities beyond keyword searches and filtering by resource, group, pipeline, and time range. With the additional flexibility of combining filters with logical operators, filtering events based on fields and values parsed from your logs, and matching patterns with glob expressions and regular expressions, you can:

  • Narrow down information to quickly find relevant logs when troubleshooting. 
  • Summarize activity from log messages over a time range for reporting or alerting.
Logs page with query bar

Using the query bar

Searching and filtering is done from the query bar which is located at the top of the Logs page. 

Use autocomplete

When you type into the query bar, the autocomplete menu will open and provide a list of options based on what you’ve entered and the information that you have in your logs.

If you select a field from the list or type in the field name, autocomplete will then suggest possible values for that field.

After you enter a complete keyword or field=value pair, autocomplete will continue to provide suggestions to help you build the query. For example, you may see options for logical operators: AND, OR, and NOT.

Searches do not execute automatically. When you’re done building your query, click the Search icon to run it.

View search history

You can view and manage your Recent Searches by clicking the Clock icon on the left of the query bar. Your Recent searches menu shows the last 10 searches in your history. You can remove individual or clear all searches from this list. 

Save a search by clicking the Star icon to the right of the query bar.

Writing a query

Autocomplete for reserved fields

If you don’t know where to start, type an underscore and autocomplete will show list of the LogicMonitor reserved fields, such as resource names, resource groups, log alert severity, anomaly type, and so on. 

Pattern matching

The query language is flexible and supports a few different ways to help you filter and narrow down your search for logs: keywords, exact match, fuzzy match, and regex match.

Expression Description
Keywords A keyword search will search the log message field and return the logs that contain the specified word or phrase.
Exact match Searches for a field=value pair will return logs where the field has the exact value that is specified.
Fuzzy match If you don’t want an exact match, you can define a fuzzy match pattern using glob expressions to describe the value. Fuzzy matching is not case sensitive.
Regex match You can use regular expressions to define a pattern to match. Regular expressions need to be put inside of front slashes.

Logical Operators

You can use the logical operators AND, OR, and NOT to combine multiple filters to narrow your search for logs. Autocomplete will suggest logical operators after you enter a complete keyword or field=value pair.

Operator Description
NOT Search for logs except any of the keywords or filters specified.
AND Search for logs that contain all the keywords and filters specified.
OR Search for logs that contain one or more of the keywords and filters specified.

Examples

The following examples illustrate the syntax for searching and filtering logs with the query language. For more usage examples, see Logs Search Cheatsheet.

Example 1: Exact match

Return logs from resources named “winserver01” or “win-server01” if their message field contains the keyword “error”.

error AND _resource.name=winserver01,"win-server01"

An alternate way to write this search is:

error AND ( _resource.name=winserver01 OR _resource.name="win-server01" )

Example 2: Fuzzy match

Return logs from any resource that contains the word “linux” in its name if the message field contains the keyword “Invalid login”.

"Invalid login" AND _resource.name~linux

Example 3: Groups and subgroups

The following examples show searching groups and subgroups. These examples assume that you have access to groups with the full path “Pods/p02.prod” and “Kubernetes Cluster: services/p01-us-west”.

To search logs for all its subgroups and direct devices:

_resource.group~/Pods\/p02.prod($|\/)/

To search logs only for its direct devices:

_resource.group="Pods/p02.prod"

To search logs by the group name, regardless of the parent group:

_resource.group.name~"p01-us-west"

Example 4: Non-reserved fields

To query a non-reserved field, you need to know the nested field name and its datatype. For example, to search for GET requests, you would use the query:

method.string=GET

Note: The datatype will not be needed in a future implementation.

In This Article