Skip to content

Query filters

You will learn the filter operators available on Query, views, and MCP.

Filters are combined with AND. Each filter has a field path, an operator, and (usually) a value.

Operators

UI label API / MCP op Value Notes
= eq Required Typed equality
≠ ne Required Not equal
> gt Required
≥ gte Required
< lt Required
≤ lte Required
contains contains Required Case-insensitive substring
not contains not_contains Required
in in Required Comma-separated list (1–50 values); match any
not in not_in Required
exists exists None Field present
is null is_null None JSON null
starts with starts_with Required Case-sensitive
ends with ends_with Required Case-sensitive
regex regex Required RE2 pattern; case-sensitive unless the pattern opts in
not regex not_regex Required

Examples

Common names such as level, severity, message, service, and environment bind to compatible catalog paths on the stream (for example level also matches log.level). Query chips show extra paths as also ….

Match errors:

level eq error

Match any of several services:

service in api,worker,ingest

Field must be present:

http.status exists