search

Searches the input data according to the conditional expression.

Syntax

search [limit=INT] EXPR
EXPR
Filter conditions in the form of an expression. For example, you can enter a comparison expression in the form "KEY == VALUE" or "KEY != VALUE" or a boolean expression. You can concatenate conditional expressions using logical operators such as and and or.
limit=INT
Maximum number of records to return (default: unlimited).

Description

The search command is responsible for receiving data, filtering only the data that matches the specified expression, and passing it to the following query commands. Only if the expression is true, the record can be passed to the next query command.

Usage

  1. Filter a log containing the game string literal in the line field (supports wildcards).

    search line == "*game*"
    
  2. Filter a log where the status code is not 200.

    search status != 200
    
  3. Search for the case where src_ip is 1.2.3.4 and dst_port is 22.

    search src_ip == ip("1.2.3.4") and dst_port == 22