Skip to main content
The Rootprint search box accepts Lucene query syntax. Queries combine field-scoped clauses with boolean operators, and the same syntax works whether you type it in the UI or pass it to the search API.

​
Quick reference

Operator precedence: NOT / - > AND > OR. Use parentheses when you need a different order.

​
Field paths

Use dot notation to reach nested JSON fields:
A key that itself contains a dot, such as {"k8s.pod.name": "web-7f4"}, needs no escaping when the field has expand_dots: true, as attributes and resource_attributes do in the bundled OTel index. If expand_dots is false, escape the literal dots with a backslash:

​
Default search fields

A query without a field name searches the index’s default_search_fields. The bundled otel-logs-v0_9 index searches body.message:
To search a different field, name it explicitly: attributes.exception.type:ValueError.

​
Tokenizers and case sensitivity

A field’s index-time tokenizer decides how queries against it match. The two tokenizers used in the bundled OTel index: This means severity_text:error will not match a document with "severity_text": "ERROR". Match the case your shipper sends, or filter via the UI quick-filters which know each field’s casing. If exact-match terms are missing on a custom index, check the field’s tokenizer. See Create a custom index.

​
Time ranges

The UI’s time picker bounds every query, so you don’t write a timestamp clause. The picker, timestamps, and charts use your browser’s time zone. To show them in UTC, turn on Time in UTC in the user menu. When you call the log endpoint directly, pass startTs and endTs in seconds, whatever the field’s precision, and authenticate with a query API key:

​
Common log search recipes

Pasting a bare trace ID into the search box opens the trace. Wrap it in quotes to search it as text. See Read a trace.

​
Escaping special characters

These characters are reserved by the query parser and must be backslash-escaped to appear in a value:
Outside quotes, escape reserved characters: body.message:\(test\). Inside quotes, escape only the quote character that delimits the value: attributes.label:"say \"hi\"". Other reserved characters need no escaping inside quotes.

​
Limits

  • Phrase and phrase-prefix queries need a field indexed with record: position. No field in the bundled otel-logs-v0_9 index sets it, so combine terms instead: body.message:connection AND body.message:timeout.
  • IP fields don’t accept CIDR notation. Use a range instead: client_ip:[10.0.0.0 TO 10.0.0.255].