---
title: "Advanced Search Syntax"
description: "Search traces and logs with Lucene query syntax. Combine conditions with AND, OR and NOT, filter numbers and durations, match words, prefixes and patterns."
section: "Using Middleware"
breadcrumb: "Using Middleware > Advanced Search Syntax"
canonical: "https://docs.middleware.io/features/advance-search"
---
# Advanced Search Syntax

Advanced Search is the query box on the Traces and Logs pages. It uses the Apache Lucene
query syntax: conditions written as `field:value`, joined with `AND`, `OR` and `NOT`.

```
ServiceName:checkout AND Duration:>500ms
```

Open it with the **`</>`** tile at the right of the search bar. As you type, the
suggestions offer the fields, the operators that fit each field, and its values.

#### Traces

Slow requests of one service, built from the suggestions.

[Video](/images/workflow/advanced-search/advanced-search-traces.webm)

#### Logs

Error logs that mention a timeout.

[Video](/images/workflow/advanced-search/advanced-search-logs.webm)

## Search syntax

A query is one or more conditions. A condition is a field, a colon and a value.

```
ServiceName:checkout
```

Conditions are combined with boolean operators:

| Operator | Description | Example |
| --- | --- | --- |
| `AND` | Both conditions must match. A space between conditions means the same. | `ServiceName:checkout AND Duration:>500ms` |
| `OR` | Either condition may match. | `SeverityText:ERROR OR SeverityText:WARN` |
| `NOT` or `-` | The condition must not match. | `-SpanName:health` |
| `( )` | Groups conditions. Without brackets, `AND` binds before `OR`. | `(ServiceName:checkout OR ServiceName:cart) AND Duration:>1s` |

A value that contains spaces or symbols goes in double quotes.

```
SpanName:"GET /api/orders"
```

## Fields

**Built-in fields** have plain names.

- Traces: `ServiceName`, `SpanName`, `Duration`, `StatusCode`, `StatusCodeString`,
  `SpanKind`, `TraceId`, `SpanId`, `ParentSpanId`
- Logs: `ServiceName`, `SeverityText`, `Body`, `TraceId`, `SpanId`

**Attributes** carry a prefix that says which part of the span or log they come from.

| Prefix | Reads | Example |
| --- | --- | --- |
| `span.` | Span attributes (traces) | `span.http.status_code:500` |
| `resource.` | Resource attributes (traces and logs) | `resource.k8s.namespace.name:prod` |
| `event.` | Span events, such as exceptions (traces) | `event.exception.type:TimeoutException` |
| `link.` | Span links (traces) | `link.trace_id:4bf92f35*` |
| `log.` | Log attributes (logs) | `log.request.id:8f3c2a` |
| `scope.` | Instrumentation scope (logs) | `scope.name:io.opentelemetry.http` |

Pick `http.status_code` from the suggestions and the bar writes `span.http.status_code`.
An attribute that is not listed still works when typed in full.

## Text search

Text fields hold free text: `SpanName`, `StatusMessage`, `span.db.query.text`, exception
messages and the log `Body`. On these fields, a value matches **words**.

- `Body:timeout` matches the word anywhere in the message.
- `Body:"connection refused"` matches the two words in that order.
- `Body:"connection refused"~3` matches them within three words of each other.
- `SpanName.keyword:"GET /api/orders"` matches the whole span name, character for
  character.

A word typed on its own searches the span name on Traces and the message on Logs.

```
timeout
```

## Wildcards

- `*` stands for any number of characters.
- `?` stands for one character.

```
ServiceName:check*
ServiceName:*out*
ServiceName:checkou?
```

Wildcard matches ignore case. Inside quotes, `*` and `?` are plain characters.

## Numerical values

Compare numbers and durations with `>`, `>=`, `<` and `<=`.

```
span.http.status_code:>=500
Duration:>500ms
```

Search a range with `[a TO b]`. Square brackets include the ends, curly brackets exclude
them, and `*` leaves an end open.

```
Duration:[100ms TO 2s]
span.http.status_code:[400 TO 499]
Duration:[1s TO *]
```

Durations take `ns`, `us`, `ms`, `s`, `m` or `h`. A bare number means milliseconds.

## Regular expressions

Write the pattern between slashes, in RE2 syntax. On an exact field the pattern must match
the whole value; on a text field it is searched for.

```
ServiceName:/check(out|in)/
Body:/user [0-9]+ locked/
```

Add `~` to a word to allow one typo, or `~2` to allow two.

```
ServiceName:chekout~
```

## Escaping special characters

Quote a value that contains a space or any of these characters: `: " ( ) [ ] { } ~ ^ * ?`

```
Body:"[ERROR] disk full"
SpanName:"AND"
```

Inside quotes, write a literal `"` or `\` with a backslash in front.

`[` and `{` only open a range, directly after a field. Typed anywhere else they are not
accepted.

## Autocomplete

The suggestions follow what you type.

1. **Fields**: type part of a name to narrow the list.
2. **Operators**: after `field:`, the ways to match that fit the field.
3. **Values**: the most frequent values in the selected time range.
4. **Combine**: after a finished condition, `AND`, `OR`, `NOT` or the next field.

Under the bar, **Searching for:** reads the query back in plain words. If an attribute or
value is not listed, keep typing it and choose **Find attributes containing "…"** or
**Fetch values starting with "…"** at the bottom of the list.

## Examples

#### Traces

| To find | Search |
| --- | --- |
| Errors from one service | `ServiceName:checkout AND StatusCodeString:Error` |
| Server errors | `span.http.status_code:>=500` |
| Spans that recorded an exception | `event.exception.type:*` |
| Slow spans of one route | `span.http.route:"/api/orders" AND Duration:>1s` |
| Slow database calls | `span.db.system:* AND Duration:>200ms` |
| Queries that touch a table | `span.db.query.text:orders` |
| Writes only | `span.http.method:(POST OR PUT OR DELETE)` |
| Several services | `ServiceName:(checkout OR payments OR cart)` |
| Root spans of one trace | `TraceId:4bf92f3577b34da6a3ce929d0e0e4736 AND NOT ParentSpanId:*` |
| Everything except health checks | `-SpanName:health` |

#### Logs

| To find | Search |
| --- | --- |
| Errors | `SeverityText:ERROR` |
| Warnings and errors from one service | `ServiceName:checkout AND SeverityText:(WARN OR ERROR)` |
| A word in the message | `Body:timeout` |
| An exact phrase | `Body:"connection refused"` |
| Both words, in any order | `Body:timeout AND Body:retry` |
| A pattern in the message | `Body:/user [0-9]+ locked/` |
| Errors from one namespace | `resource.k8s.namespace.name:prod AND SeverityText:ERROR` |
| One pod | `resource.k8s.pod.name:checkout-7d9f*` |
| Every line of one request | `log.request.id:8f3c2a` |
| Everything except debug | `-SeverityText:DEBUG` |