Sample Elasticsearch Queries for Searching Logs
This page provides sample Elasticsearch Query String (QS) examples to help you construct search queries for filtering and exploring logs.
Steps
- In Pulse, go to Logs from the left navigation bar.
- On the Logs page, select the search type as Elastic QS.
- Use the following sample Elastic QS queries to search logs.
Use Boolean operators (AND, OR) to combine multiple search parameters.
Examples
- To search logs by a message string, Receiving BP-18:
message:Receiving BP-18
- To search logs by a message string on a particular host:
message:Receiving BP-18 AND host.name.keyword:host4.acceldata.dev
- To search application logs of a specific service:
fields.component:hdfs_datanode
Search Keywords Allowed
The following keywords can be used in search queries:
Keyword | Description | Example |
fields.component | Search within services. | fields.component:hive_server |
host.name.keyword | Filter by host name. | host.name.keyword:host2.acceldata.dev |
source.keyword | Filter by source location. | source.keyword:/var/log/hive/hiveserver2.log |
loglevel | Search within log levels: Info, Debug, Warn, or Error. | loglevel:INFO |
Boolean operators AND, OR | Combine search conditions. | loglevel:INFO AND fields.component:hive_server |