Support Center Home


Advanced Search Operators

Advanced searches include aggregation, processing, and formating operators that can help you to refine and modify your search results. 

You can add advanced search operations to your query after filtering. Search operations work sequentially on a set of events, and the result from one operation is piped into the next one. Some operations work on an event at search time (parsing fields), others require a partial set (limit) or the full set (sort) of events to produce a result. You can view the results of an advanced search in the Aggregate tab.

Note: Advanced search operations are available for LM Logs Enterprise and LM Logs Unlimited customers.

Operator Description Type
as Displays the column name as the alias value. Formatting
count Count the number of events returned by a search, optionally grouped by one or more fields. Aggregation
limit Limits the results of an aggregation operation to a fixed number of results. Formatting
parse Extracts the contents of a specified source field into a new field based on a string pattern match. The new field is added as a field:value pair to the log metadata. If the source field is not specified, it defaults to the message field. Processing
sort Sorts the results of an aggregation operation by a set of fields, ascending or descending. Formatting
sum Calculate the sum of the values of the specified field, optionally grouped by one or more fields. Aggregation

Note: The following examples begin with the filtering query for the wildcard * which searches for all logs. You can replace this wildcard with any filtering query. For more information, see Writing a filtering query.

Aggregation operators

count

Counts the number of events returned by a filtering query, and optionally group the events by one or more fields. You can also count events that contain specific fields.

Syntax

Count the number of events in the specified time range:

* | count

Count the number of events optionally grouped by one or more fields:

* | count (as <ALIAS>) by <FIELD> (, <FIELD>)

Count the number of events only if the event contains the field specified in the argument to count():

* | count(<FIELD>) (as <ALIAS>) by <FIELD> (, <FIELD>)

Examples

Example 1: Count the number of events for each unique resource and show the first 15 results.

* | count by _resource.name | sort by _count desc | limit 15

Example 2: You can count the number of unique values for a field by passing the results of one count operation into another count. The following example counts the number of unique resource names sending logs during the specified time range.

* | count by _resource.name | count

sum

Calculate the sum of the values of the specified field, and optionally grouped the calculations by one or more fields.

Syntax

Count the number of events in the specified time range:

* | sum(<FIELD>) (as <ALIAS>) by <FIELD> (, <FIELD>)

Examples

Example 1: Calculate the sum of the size field for each unique resource name, and sort the results.

* | sum(_size) by _resource.name | sort by _sum desc

Processing operators

parse

Extracts the contents of a specified source field into a new field based on a string pattern match. The new field is added as a field:value pair to the log metadata.

Syntax

* | parse <SRC-FIELD> <PATTERN> as <FIELD1> (, <FIELDN>)
  • If the source field, <SRC-FIELD>, the message field is used by default.
  • <PATTERN> is a string with wildcards.
  • If parsing multiple fields, the number of field names must match the pattern.

Examples

Example 1: The following example searches for the phrase “Failed to pull image” in the message field. If found, the image name will be parsed out and added as a field called “image” to the log event.

"Failed to pull image" | parse /Failed to pull image "(\S+)"/ as image

Aftwards, you can search for a specific image using the query image=<imagename>.

Formatting operators

as

Displays the column name as the alias value.

Syntax

... as <ALIAS>

Examples

Example 1: Calculate the sum of the size field for each unique resource name, and sort the results.

* | sum(_size) as log_volume by _resource.name | sort by log_volume desc

limit

Limits the result set to a fixed number of results. The limit operator can only be used after an aggregation operation.

Syntax

* | limit <number>

Examples

Example 1: Count the number of events for each unique resource and show the first 15 results.

* | count by _resource.name | sort by _count desc | limit 15

sort

Sorts the result by a set of fields, ascending or descending.  The sort operator can only be used after an aggregation operation. By default, results are sorted in descending order by timestamp and ID.

Syntax

* | sort by <FIELD> desc

Examples

Example 1: When sorting by an aggregation operator, include a leading underscore on the operator.

* | count by _resource.name | sort by _count desc

Example 2: When sorting by an alias, no underscore is needed.

* | sum(_size) as log_volume by _resource.name | sort by log_volume desc

More examples

These examples demonstrate how you can evaluate several operations at the same time in the same query.

Example 1:  Display the list of resource group names with count of logs and sum of log size, sorted by count of logs, limited to top 25 resource group names.

* | count(_size), sum(_size) by resource.group.name | sort by _count desc | limit 25

Example 2: Parses the image name from the message and stores name in image field (image=imagename).  Then display the unique image names and sorts by imagename with most occurrences in the specified time range.

“Failed to pull image” | parse /Failed to pull image "(\S+)"/ as image | count by image | sort by _count desc | limit 15

In This Article