Write a Lucene query

Elasticsearch uses Lucene query syntax for searching log data. Lucene queries let you search for specific terms, filter by fields, and combine conditions using boolean operators. Understanding basic Lucene syntax enables you to quickly find the logs you need for troubleshooting.

In this milestone, you’ll write Lucene queries to search and filter your Elasticsearch logs.

To write a Lucene query to search your logs, complete the following steps:

1. In the query editor, locate the Lucene Query field (the text input area).

2. Enter a search term or field-based query.

   For example, enter error to find all logs containing the word “error”.

3. Click Run query or press Shift + Enter to execute the query.

4. Review the log results displayed below the query editor.

5. (Optional) Refine your query using field-specific syntax.

   For example, enter level:error to filter logs where the level field equals “error”.

6. (Optional) Combine conditions using boolean operators (AND, OR, NOT).

   For example, enter level:error AND service:api to find error logs from the api service.

Log entries matching your query appear in the results panel, showing timestamps, log levels (color-coded), and message content.

In the next milestone, you’ll configure the log display options to enhance how your logs are visualized.