Skip to content

Query events

You will learn how to filter, search, and chart events.

Before you start

  1. Select a stream in the sidebar.
  2. Ingest some JSON so Fields has learned paths (see Ingest your logs).
  3. Open Query.

Query reads the analytics projection. If you just ingested, wait a few seconds or check Events for an immediate raw tail.

Search events

  1. Choose Search.
  2. Pick a Period (relative lookback) or Fixed absolute range.
  3. To search the complete event without choosing a field, enter Event text. Keep Contains for a case-insensitive phrase, or choose Regex for RE2.
  4. Add learned-field filters with Add filter — pick a field, operator, and value.
  5. Click Run search.

Event text and multiple field filters combine with AND. Event text includes nested keys, values, and JSON scalars such as numbers and booleans. When the filter picker shows Top values for a field, click a chip to fill a common value quickly.

Operators include =, ≠, comparisons, contains / not contains, in / not in, exists, is null, starts with / ends with, and regex / not regex. See Query filters.

If you filter on level (or another common name), the chip may show also paths such as severity — those events match too.

Aggregate and chart

  1. Choose Aggregate.
  2. Select a function: Count, Sum, Average, Max, P50, P95, or P99 (numeric functions need a Field).
  3. Optionally Group by a field.
  4. Optionally enable Normalize URI paths when grouping URL-like fields so UUID/numeric segments collapse to {id}.
  5. Optionally set an Interval (1 minute through 1 day) for a time chart.
  6. Optionally set Compare to Prior period to overlay the previous equal-length window (table delta/percent and chart overlay).
  7. Click Run query.

You can use Event text with an aggregate too. Cordo first restricts the events by complete JSON text and any field filters, then computes the count or numeric aggregate. Raw event text can be saved as a view, but not as a recorded metric.

Lookup: Aggregates and Relative lookbacks.

Investigate an aggregate bucket

Each numeric aggregate row shows Samples, the number of field values that participated in that result.

  1. Find the bucket or group with the unexpected value.
  2. Click Inspect contributing events.
  3. Review the ordered event results and open Surrounding when you need nearby log context.
  4. Click Back to aggregate to return to the unchanged aggregate result.

For P50/P95/P99 and Max, the investigation filters to events at or above the displayed value and orders the highest values first. A percentile is approximate, so treat these as the relevant tail events rather than one definitive cause.

Download search results

After a Search run, use Download CSV or Download NDJSON for the matching events (bounded; identity columns included). A notice appears when the export was truncated. This is for event rows, not aggregate charts.

Result status

Query says when the window is empty versus still catching up:

  • Analytics is behind this period — events were accepted but are not in Query yet (wait, or check Events).
  • Size or page limits — some rows were dropped, or more pages remain.
  • A healthy Count of 0 means no matches, not lag.

Save as a view

When the result is useful:

  1. Click Save as view.
  2. Name it and confirm.

You can also build views from Insights or the Views page — see Create and manage views.

Tips

  • Prefer Fields / Insights first when you do not know which paths exist.
  • Use in for several discrete values instead of many = filters.
  • Live tails live on views and Events — Query is request/response for a window.

Next