> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiaxoniq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Searching logs

> The Logs Explorer query syntax — free text, field filters, booleans, wildcards and numeric comparisons — with the full field list.

The Logs Explorer search box takes a query language rather than a plain keyword.
It is the same syntax used for searching traces, so learning it once covers both
surfaces.

<Info>
  **Before you start.** You need logs arriving from at least one service — see
  [Send data with OpenTelemetry](/send-data/otel/collector).
</Info>

## Free text

The simplest query is a bare word, which matches anywhere in the log body:

```text theme={null}
error
```

Two words are an implicit **AND** — both must be present:

```text theme={null}
error timeout
```

Quote a phrase to match it exactly, rather than as separate words:

```text theme={null}
"connection refused"
```

## Field filters

Prefix a term with a field name and a colon to constrain it to that field:

```text theme={null}
level:error
service:checkout
trace_id:4bf92f3577b34da6a3ce929d0e0e4736
```

Numeric fields support comparisons:

```text theme={null}
duration:>1000
```

A trailing `*` matches a prefix, and `field:*` tests only that the field is
present at all:

```text theme={null}
service:api*
trace_id:*
```

## Booleans and grouping

`AND`, `OR` and `NOT` combine terms, and parentheses group them. `-` is a
shorthand for `NOT`:

```text theme={null}
error OR exception
level:error NOT service:healthcheck
level:error -service:healthcheck
(level:error OR level:fatal) AND service:checkout
```

Putting it together — errors from the checkout service, excluding the noisy
timeouts you have already triaged:

```text theme={null}
service:checkout level:error -"upstream timeout"
```

## Fields you can filter on

Several fields have aliases; any of the listed names works.

| Field             | Aliases                     |
| :---------------- | :-------------------------- |
| `level`           | `severity`, `severity_text` |
| `severity_number` | —                           |
| `service`         | `service_name`              |
| `body`            | `message`, `msg`            |
| `trace_id`        | —                           |
| `span_id`         | —                           |
| `host`            | `host_name`                 |
| `scope`           | `scope_name`                |
| `version`         | `service_version`           |

Any name not in that list is looked up in the log record's **attributes**, which
is how dotted OpenTelemetry attribute keys work:

```text theme={null}
http.method:GET
http.status_code:>=500
```

<Note>
  **An unrecognised field name is not an error.** Because unknown names fall
  through to an attribute lookup, a typo like `levle:error` is a valid query —
  it searches for an attribute called `levle` and matches nothing. A query that
  unexpectedly returns zero results is worth re-reading for a misspelled field
  before concluding the data is missing.
</Note>

Attribute keys are case-sensitive: `service.name` and `Service.Name` are
different fields.

## Time range and retention

The search box controls *what* matches; the time-range picker controls *when*.
They are independent, and the most common reason a query that should match
returns nothing is a time range that predates the data.

Queries are also bounded by your plan's retention period. Selecting a range that
starts before it returns an explicit retention error rather than an empty
result, so you can tell "we do not have this any more" apart from "nothing
matched".

## Fuzzy full-text search

Alongside the Logs Explorer, the API exposes a separate log search endpoint
backed by OpenSearch, which does fuzzy full-text matching over the log body.

The two are genuinely different tools, and it is worth not confusing them:

<CardGroup cols={2}>
  <Card title="Logs Explorer" icon="filter">
    Everything on this page. **Exact.** Supports fields, booleans and
    comparisons. Use it when you know what you are looking for.
  </Card>

  <Card title="Fuzzy search API" icon="wand-magic-sparkles">
    Tolerates typos and near-misses in the body text, but takes **no** field
    filters, booleans or comparisons. Use it when you are not sure of the exact
    wording.
  </Card>
</CardGroup>

<Warning>
  The syntax on this page does **not** apply to the fuzzy endpoint — sending
  `level:error` there searches for the literal text `level:error` in the body.
</Warning>

## Next

<CardGroup cols={2}>
  <Card title="Turn a search into an alert" icon="bell" href="/guides/alerts/overview">
    Alert when this query starts matching.
  </Card>

  <Card title="Send logs from another service" icon="telescope" href="/send-data/otel/collector">
    Add a second source.
  </Card>
</CardGroup>