Skip to content
Sections
Versionv2.1 · latestv1.8 · archive
LanguageRUEN

v2.1Guide

Query language

Syntax of the short filter queries: comparisons, substrings, AND, OR and NOT.

A query is a string compiled into a function (rec) => boolean. The query parser is hand-written, evaluates nothing through eval and never runs code from the string.

js
const isProblem = parser.query('level>=warn AND NOT msg~"health"');

Operators#

OperatorMeaningExample
:equalsstatus:404, method:GET
> >= < <=compare numbers, levels and datesbytes>1000000, level>=warn
~contains a substring, case-insensitivemsg~"timeout"
:5xxstatus class maskstatus:5xx
AND OR NOTlogic, parentheses allowed(a OR b) AND NOT c

Two conditions in a row without a word between them mean AND: level>=warn status:5xx.

What can be compared#

  • The names ts, level and msg belong to the record; anything else is looked up in rec.fields.
  • Levels are ordered: trace < debug < info < warn < error < fatal.
  • Dates are written as 2026-10-01 or 2026-10-01T09:00:00Z. ts>2026-10-01 compares with midnight UTC.
  • If the record lacks the field, the condition is false, not an error. The exception is NOT: NOT status:200 is true for a record without status.

Examples#

text
level>=error
status:5xx AND path~"/api/"
ts>2026-10-01T09:00:00Z AND ts<2026-10-01T10:00:00Z
(service:db OR service:cache) AND level>=warn

Query errors#

A malformed query throws ParseError with code E_QUERY_SYNTAX and the character position. The query is validated once at compile time, not on every record.

Quoted strings

Put values containing spaces in double quotes: msg~"connection reset". Single quotes are not supported so that a query works unchanged inside a single-quoted shell argument.

Updated: