Query syntax for Logs

New Relic Logs enables you to quickly search through your log data in seconds. This document will explain the query syntax and how to use it, including:

Using the New Relic Logs UI, you can search through your log data by entering either simple keywords, such as new and relic, or phrases, such as new relic agent directly into the search field. You can also combine keywords or phrases with operators to form more complex queries.

General query rules:

  • The query syntax is case insensitive, including queries using wildcards or operators.
  • Escape special characters, such as *, %, \, /, ", and ', by wrapping them in double quotation marks ("). For example: "http://www.newrelic.com".
  • Wildcard searches can be run using an asterisk (*) to replace zero or more characters. For example: new*relic.

Text searches can be used to join together keywords or phrases to return more specific query results.

The Logs query syntax accepts the following text operators:

Condition Example Description
Matching (keyword) "new" "relic" Searches for log results containing the keywords entered, separately.
Exact matching (phrase) "new relic agent" Searches for log results containing the specific phrase entered.
Either / Or new OR relic Searches for log results containing either or both of the keywords entered.
* Wildcard (zero or more) new*relic Searches for log results containing both of the keywords entered, with zero or more characters in between.
Negation (keyword) -new Searches for log results that do not contain the specific keyword entered.
Negation (phrase) -"new relic" Searches for log results that do not contain the specific phrase entered.

Searching with attributes

Attribute searches can be used to narrow the query results to the attribute or field specified.

The following operators can be used by all types of attributes:

Condition Example Description
Equal (:) hostname:chi Searches for log results where the attribute equals the keyword specified.
Example: The field hostname equals chi.
Does not equal (-:) -hostname:chi Searches for log results where the attribute does not equal the keyword specified.
Example: The field hostname does not equal chi.
Contains (*) hostname:*chi* Searches for log results where the attribute contains the keyword specified.
Example: The field hostname contains chi.
Does not contain (-*) -hostname:*chi* Searches for log results where the attribute does not contain the keyword specified.
Example: The field hostname does not contain chi.
Starts with (*) hostname:chi* Searches for log results where the attribute starts with the keyword specified.
Example: The field hostname starts with chi.
Ends with (*) hostname:*chi Searches for log results where the attribute ends with the keyword specified.
Example: The field hostname ends with chi.
Has has:user_name Searches for log results that have the specified field.
Example: Has the field user_name.
Missing missing:user_name Searches for log results that are missing the specified field.
Example: Missing the field user_name.

The following operators can only be used by numeric attributes:

Condition Example Description
Greater than http_response_time_ms:>500 Searches for log results attribute matches that are greater than the given parameter.
Example: The field http_response_time_ms is greater than 500.
Greater than or equal to http_response_time_ms:>=500 Searches for log results attribute matches that are greater than or equal to the given parameter.
Example: The field http_response_time_ms is greater than or equal to 500.
Less than http_response_time_ms:<500 Searches for log results attribute matches that are less than the given parameter.
Example: The field http_response_time_ms is less than 500.
Less than or equal to http_response_time_ms:<=500 Searches for log results attribute matches that are less than or equal to the given parameter.
Example: The field http_response_time_ms is less than or equal to 500.

For more help

Recommendations for learning more: