log

Searches logs by specifying a schema, model, or source. The target table to search is determined automatically from the storage table of the collector that matches the specified condition, so you can query logs without knowing the table name directly.

Command properties

Property	Description
Command type	Processing query
Required permission	Table read permission
License usage	N/A
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

log schema=STR [duration=INT{s|m|h|d|mon}] [from=DATE] [to=DATE] [model=STR] [source=STR] [alias=BOOL] [SEARCH_EXPR]

SEARCH_EXPR: An optional search condition expression. Combine field value conditions using field comparison operators (==, !=, <, <=, >, >=) and logical operators (and, or, not). Example: src_ip == "203.0.113.10" and dst_port == 443. You can also use index search functions such as range() and iprange(). If omitted, all logs in the target table are returned without any condition.

Options

schema=STR (required): The log schema code to search. Specifying a code that is not registered causes an error (300149).
duration=INT{s|m|h|d|mon}: Limits results to logs within a given time range from the current time. Use units s (second), m (minute), h (hour), d (day), or mon (month). For example, 10s means the range up to 10 seconds before the current time. If the from option is also specified, the from value takes precedence.
from=DATE: The start time of the query range. Enter it in yyyyMMddHHmmss format; trailing digits that are omitted are padded with zeros.
to=DATE: The end time of the query range. Enter it in yyyyMMddHHmmss format; trailing digits that are omitted are padded with zeros.
model=STR: The GUID or name of the logger model to narrow the search to. Specify multiple values separated by commas. Cannot be used together with the source option.
source=STR: The GUID or name of the collector to narrow the search to. Specify multiple values separated by commas. Cannot be used together with the model option.
alias=BOOL: Whether to convert field names defined in the schema to their display names (default: f). Specify t or true to enable this (case-sensitive).

Input fields

None (the query planner always rewrites this into the table or fulltext command before execution, so the log command itself never runs).

Output fields

None. The rewritten table or fulltext command outputs whatever fields are stored in the target table as is. If alias=t and the schema has fields defined, field names are replaced with their display names and only the fields defined in the schema remain; if alias is not specified, field names are left unchanged, with the _table field placed first followed by the fields in the order defined in the schema (other fields remain after that).

Error codes

Parsing errors

Error code	Message	Description
300148	Schema option is required.	The `schema` option was not specified.
300149	Log schema not found.	No log schema exists for the `schema` option value.
300150	Cannot specify both model and source options.	Both `model` and `source` options were specified together.
300151	Unexpected term in search expression.	The search condition expression contains an unexpected token.
300152	Unparsed tokens remain in search expression.	Tokens remained unprocessed after parsing the search condition expression.
300153	Parentheses do not match in search expression.	The parentheses in the search condition expression do not match.
300154	Quotes do not match in search expression.	The quotation marks in the search condition expression do not match.
300155	Square brackets do not match in search expression.	The square brackets in the search condition expression do not match.
300156	Invalid escape sequence in search expression.	The search condition expression contains an invalid escape sequence.
300157	Unsupported expression type in search condition.	The search condition expression uses an unsupported expression, such as a single identifier with no operator.
300158	Unsupported operator in search expression.	The search condition expression uses an unsupported operator.
300159	Malformed search expression.	The search condition expression is malformed for some other reason.

Runtime errors

N/A

Description

The log command determines the target table to search using one of three methods: log schema, logger model, or collector.

If the model option is specified, the command determines at the model level whether the logger model has at least one extractor that matches the schema option. If a matching extractor exists, the tables of all collectors that use that model become the target (extractors are not compared again per collector); if not, that model is excluded from the target.
If the source option is specified, the table of that collector becomes the target.
If neither option is specified, the tables of all collectors that use a log schema matching the schema option become the target.

If there are no target tables at all (for example, no collectors match the condition), the command returns an empty result without an error. The schema option is checked for existence at parse time (300149), but the query planner queries the schema again just before execution, when it rewrites the command. If the schema cannot be found at that point (for example, if it was deleted after parsing), the command returns an empty result instead of raising an error.

The log command itself never runs. The query planner (LogCommandRewritingPlanner) always rewrites it into one of the following two forms before that command actually runs.

If schema=session and no search condition expression is specified: rewritten into a table command targeting the resolved tables, with a search _schema == "session" condition appended.
Otherwise (a search condition expression is specified, or the schema is not session): rewritten into a fulltext command that combines the search condition expression with the _schema condition.

Because the rewritten table or fulltext command is what actually runs, table read permission is enforced at the execution layer of the rewritten command, not by the log command itself. In both the case rewritten to fulltext and the case rewritten to table, tables the account cannot read are silently excluded from the search without an error. Logs in tables you do not have permission for do not appear in the result, and no error message is shown, so if the result is empty or smaller than expected, check the read permission on the target tables first. You can check which tables are granted to each account through the granted_tables output field of sonar-users.

Examples

Search by specifying only the schema
```
log schema="session"
```
Searches the most recent logs from all collectors that use the session schema.
Search with a time range and a search condition expression
```
log schema="session" duration=1h src_ip == "203.0.113.10"
```
Searches only session schema logs collected within the last hour where the source IP is 203.0.113.10.
Search narrowed to a specific collector
```
log schema="session" source="fw-edge-01" from=20260801 to=20260802
```
Searches only session schema logs collected by the fw-edge-01 collector on August 1, 2026.
Search with fields converted to display names
```
log schema="session" alias=t duration=1d
```
Searches session schema logs from the last day, converting field names to the display names defined in the schema and returning only the fields defined in the schema.

Change history

The log command is available in the Sonar 4.0 series starting with 4.0.2609.0, where the command previously provided by the Experimental app was built into Sonar core. On versions without the built-in command, install the Experimental app to use it.