Search language
Issues, Explore and Logs read one search language.
Terms
Terms are joined by AND. Apps, environment and time come from the filter bar.
| Write | Finds what |
|---|---|
timeout | holds the word, any case |
"connection reset" | holds the phrase |
/time(d)? ?out/, /timeout/i | matches the regular expression (RE2); i ignores case |
key:value | the field or attribute is the value |
key:"two words" | the value as written, spaces and stars included |
key:pay*, key:*-rc, key:*users* | starts with, ends with, or holds the value |
key:[a, b] | is either value |
key:>500, key:<=0.5 | reads as a number past it |
has:key | has the field or attribute |
level:error, level:>=warn, level:17 | at a level, from one up or down, or at a severity from 1 to 24 |
-term, !key:value | without it |
a OR b | with either |
A key no chosen app has as a field is searched as words in Issues and Explore. A value in slashes, such as route:/api/, is a path there, as in Sentry; in Logs it is a regular expression.
The same search reads the same way in the dashboard, saved views, widgets, alerts, the API and the MCP.
Where each term reads
| Term | Issues | Explore | Logs |
|---|---|---|---|
Words and phrases | The title and culprit | The title, culprit and message | The body |
/regex/ | The title or culprit of the issue's events; 3 at most | The title, culprit and message | The body; key:/regex/ an attribute |
key:value and its forms | A field of the apps' schemas, on one event | A field of the apps' schemas | An attribute, or service, env, release, source, trace or span |
level: | The app's level by key or label; >= and numbers by severity | The app's level by key or label; >= and numbers by severity | OpenTelemetry's ranges by word, or an app's own level by name |
category: | By key or label | By key or label | An attribute |
is:, assigned:, priority:, age:, firstSeen:, lastSeen:, times_seen: | The issue | Refused | Attributes |
pattern: | Refused | Refused | A pattern by its number |
Issues
is:takesunresolved,resolved,archived,ignored,for_review,new,regressed,unassigned,assignedorunread. It narrows the tab, sois:resolvedfinds nothing on Unresolved.assigned:me,assigned:noneor a person's id;priority:high,mediumorlow.age:-24hfirst seen in the last 24 hours,age:+7dlonger ago;firstSeen:andlastSeen:the same, or>2026-10-01. Units are m, h, d and w.times_seen:>100counts events since the issue was made.- Fields hold on one event together. An OR between a field and an issue's own term is refused.
Refused terms
A term an area cannot honour is refused with one line saying why, and nothing is searched; no term is left out quietly. The API answers 400 with that line.
Limits
- A search is at most 2,000 characters in Logs, 500 in Issues and 200 in Explore.
- 30 terms, each value of a list counting as one; 10 fields in Issues and Explore.
- A value is at most 500 characters, a regular expression 200.
- Regular expressions are RE2: no looking ahead or behind, no references back to a group, no atomic groups or possessive repeats.