Sample Elasticsearch Queries for Searching Logs

This page provides sample Elasticsearch Query String (QS) examples to help you construct search queries for filtering and exploring logs.


Steps

  1. In Pulse, go to Logs from the left navigation bar.

  2. On the Logs page, select the search type as Elastic QS.

  3. Use the following sample Elastic QS queries to search logs.

Note Use Boolean operators (AND, OR) to combine multiple search parameters.

Examples

  • To search logs by a message string, Receiving BP-18:

message:Receiving BP-18
  • To search logs by a message string on a particular host:

message:Receiving BP-18 AND host.name.keyword:host4.acceldata.dev
  • To search application logs of a specific service:

fields.component:hdfs_datanode

Search Keywords Allowed

The following keywords can be used in search queries:

Keyword

Description

Example

fields.component

Search within services.

fields.component:hive_server

host.name.keyword

Filter by host name.

host.name.keyword:host2.acceldata.dev

source.keyword

Filter by source location.

source.keyword:/var/log/hive/hiveserver2.log

loglevel

Search within log levels: Info, Debug, Warn, or Error.

loglevel:INFO

Boolean operators AND, OR

Combine search conditions.

loglevel:INFO AND fields.component:hive_server