The following provides tips for how to work with the query language in LM Logs. For more information, see LM Logs query language.
LogicMonitor reserved fields are indicated by a leading underscore. If you’re not sure what to search for, you can always start by typing a underscore into the query bar to see the list of reserved fields.
|The severity level of alerts, which can be warning, error, critical.
|The type of anomaly detected, such as never_before_seen.
|The message field of the log. If a field name is not specified, the _message field is the default search field.
|The full path of the resource group.
|The resource group ID. These values may not be provided by autocomplete.
|The name of the resource group, which is the part of the full path after the last front slash.
|The ID of the monitored resource. These values may not be provided by autocomplete.
|The name of the monitored resource.
Note: You should avoid using reserved field names when configuring the sending of log data for ingestion. Using reserved field names when naming custom log metadata fields may cause unexpected behavior when ingesting log data.
Searching with logical operators supports NOT, AND, and OR to combine filters.
|Search for logs that contain all of the fields and values specified.
_resource.name=winserver01 AND type=winevents
Displays all logs associated with winserver01 and also contains winevents in the type field.
|Search for logs that contain one or more of the fields and values specified.
_resource.group.name="Linux Servers" OR _resource.name~linux
Displays all logs for resources in the “Linux Servers” Resource Group or any resource that contains “linux” in the Resource Name.
|Search for logs except any of the fields or values specified.
Displays all logs from any resource except winserver01.
Run queries comparing number values included in log message or metadata.
|For example <, >, and >=
|Parse out specific number values in messages or metadata.
Displays all logs with volumes larger than or equal to 1500 bytes.
Advanced Search Operators
Advanced searches include aggregation, processing, and formating operators that can help you to refine and modify your search results. For more information, see Advanced Search Operators.
Any free text search will search only the raw log message for matches.
|Searches and displays only logs where the keyword is found in the message field. Use when you want to search all log messages for a string or value.
This works the same way as previous LogicMonitor Logs keyword search.
Only logs that contain “error” in the message field will be displayed in the logs table.
Returns events if the pattern exactly matches the field value.
|Searches and displays only logs where field has the value word.
Use when you know the exact value you want to match.
Only logs associated with resource “winserver01” will be displayed in the logs table.
|Searches and displays only logs where field has the value word1 OR word2 OR word3. The commas represent an OR operator.
Use when there are multiple exact values you want to match.
Only logs associated with resources “winserver01”, “winserver02”, or “winserver03” will be displayed in the logs table.
field="word with special characters"
|Uses double quotes to capture a special character in the field value. Finds all logs where field equals “word with special character”.
Use when you know the exact value and the value includes a special character. Double quotes are required when there are special characters, such as a hyphen or a whitespace, in the pattern. The non-special characters set is [a-zA-Z0-9*].
Only logs associated with resource “win-server01” will be displayed in the logs table.
Returns events using glob expressions to match similar field values. Fuzzy matching is not case sensitive.
|Searches and displays only logs where field contains word.
Use when you specifically want a fuzzy match instead of an exact match.
Only logs associated with resources that contain “winserver” will be displayed, this includes “winserver01”, “winserver02”, “winserver03”, “winserver03west”, and so on.
|Searches and displays only logs where field contains any of word1 OR word2 OR word3. The commas represent an OR operator.
Can use when you want fuzzy match on multiple values.
Only logs associated with resources that contain “winserver”, “linuxserver”, “firewall”, etc. will be displayed. This includes resources such as “winserver01east”, “winserver03west”, “nonprodserver”, and so on.
field~"word with special characters"
|Uses double quotes to capture a special character in the field value. Finds all logs where the field contains “word with special character”.
Double quotes are required when there are special characters, such as a hyphen or a whitespace, in the pattern. The non-special characters set is [a-zA-Z0-9*].
Only logs associated with resources that contain “win-server01” will be displayed, this includes “win-server01”, “win-server01-east”, “win-server01-west”, and so on.
Note: Regular expressions are used for queries with ~. Therefore the resulting output requires more computing resources and may take longer to complete.
Returns log events using regular expressions (Regex) to match field values. Regular expressions must be put inside of front slashes: /regular expression/.
Note: Note: The LM Logs query processing uses the Go RE2 regular expression library. For more information, see the Go RE2 documentation.
|Searches and displays logs where the message field contains the regular expression.
Use when you want to find logs that contain certain structures (such as an IP address, unique identifier, and so on.)
Only logs that contain an IP address in the message field will be displayed.
Only logs that contain a unique identifier structure will be displayed.
|Searches and displays logs where field contains any of regex1 OR regex2 expressions.
Use when you want a regex match on multiple values.
If there is a parsing error with your query, it may be caused by incorrect syntax.
- Check that all patterns that have special characters in the pattern are surrounded by double quotes.
- If there are double quotes, check that they are the correct double quote characters: “”
- Check that regular expression patterns include properly escaped characters within the “/ /”.
For raw logs, the timeout is 2 minutes. A timeout may occur when the time range for the search is too long, such as 30 days, and depends on the volume of ingested logs that you are searching. If the search has a timeout error, try decreasing the time range.