Managing Queries

Queries in LogScale are written and can be reused from the Search tab of the User Interface.

Writing a New Query

To write a new query in LogScale:

  1. Go to Repositories and Views page and click on the Repository or View in which you want to search.

  2. Type one or more search terms in the Search box and click Run or enter.

  3. If needed, adjust the size of the box by dragging manually or clicking the arrows on the right to make it fit the query.

Here is an example of very simple search with just one value:

One-Value Search

Figure 91. One-Value Search


The Search box contains a query, and the search results appear in the Event list below.

In the example, we are filtering by selecting only events that contain the text example.com anywhere in their log message.

This is essentially the same as using grep on the Unix command-line, except with LogScale User Interface you can do it across all the logs, and from all servers and services at once.

Taking this example a little further, when we add a second search term to display only results for proxyRequest, the results are further filtered:

Two-Value Search

Figure 92. Two-Value Search


For much more details on the possible operations you can perform with queries, see Common Queries.

Saving Queries

You can save a query for future use — you save the query, not the resulting data.

  1. Click on the Save pull-down menu at the top right above the main panel.

  2. Select the Saved Query option.

  3. Specify in the Save Query window popping up whether this query is overwriting an existing one.

  4. Give the query a name and click Save.

You can find again and reload saved queries anytime later from the Queries pull-down menu at the top of the User Interface, just above the query editor. You can make a saved search load automatically when opening the repository.

Note

You'll be able to see all saved searches in the repository or view you are granted access for (via the Data read access permission).

Saved Queries

Figure 93. Saved Queries


Clicking Details on any saved query allows you to mark that query as favorite, export it as YAML, edit or delete it.

You can also save a query you use often by creating your own syntax function — see User Functions (Saved Searches) for more information.

Recalling Queries

You can recall recently run queries or saved queries from the Queries pull-down menu of the User Interface:

Recent Queries

Figure 94. Recent Queries


Using Saved Queries in Interactions

You can use saved queries to save interactions on the Search page, thus avoiding recreation of the same interaction at every search. For more information on the interactions we support, see Event List Interactions and Managing Dashboard Interactions.

You can either:

  • Load a saved query with interaction from QueriesSaved (or pick a saved query from a package):

    Loading a Saved Query

    Figure 95. Loading a Saved Query


  • Make an interaction from a query you've created and save it in a new saved query — or save your interaction in an existing saved query. From the Results tab click SaveSaved query and get the Save query dialog, where you save your query along with the interaction you have created.

    Interaction with a Saved Query

    Figure 96. Interaction with a Saved Query