Indications of a Blocked Query

The documentation explains how users can identify when their LogScale queries have been blocked by administrative controls, showing both visual indicators in the Search interface and detailed error messages. When queries match patterns in the global blocklist, users receive specific feedback about why their query was blocked, including the exact matching pattern that triggered the block.

Queries are the primary interface to data in LogScale and so it is important that you are not confused when a query you submit happens to be blocked.

Within the Search interface, a warning message is shown, as shown in Figure 12, “Query Administration Blocked Query”.

Screenshot showing the LogScale Search interface with an error message displayed when a user attempts to run a blocked query. The error notification includes detailed information stating 'Failed to execute the query' and explains that 'The query has been blocked in LogScale by an administrator.' The message also shows which specific blocklist entry pattern matched the user's query, helping users understand why their query was restricted and how they might need to modify their approach.

Figure 12. Query Administration Blocked Query


Say for instance that we added the pattern /admin-[0-9]?/ to the global blocklist and then you submit a query for admin-1. LogScale presents a very detailed message in place of event data:

default
Failed to execute the query
There was an error while trying to start the query:
The query has been blocked in LogScale by an administrator.
The matched blocklist entry is: /admin-[0-9]/

This helps you know what has happened and how future queries my be impacted. If you are concerned with this blocklist entry, you may pass along the pattern to an administrator, making it easy to locate in the blocklist.