---
title: "Write a Lucene query | Grafana Labs"
description: "Learn how to write Lucene queries to search and filter Elasticsearch logs."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Write a Lucene query

Elasticsearch uses Lucene query syntax for searching log data. Lucene queries let you search for specific terms, filter by fields, and combine conditions using boolean operators. Understanding basic Lucene syntax enables you to quickly find the logs you need for troubleshooting.

In this milestone, you’ll write Lucene queries to search and filter your Elasticsearch logs.

To write a Lucene query to search your logs, complete the following steps:

1. In the query editor, locate the **Lucene Query** field (the text input area).
2. Enter a search term or field-based query.
   
   For example, enter `error` to find all logs containing the word “error”.
3. Click **Run query** or press `Shift + Enter` to execute the query.
4. Review the log results displayed below the query editor.
5. (Optional) Refine your query using field-specific syntax.
   
   For example, enter `level:error` to filter logs where the level field equals “error”.
6. (Optional) Combine conditions using boolean operators (AND, OR, NOT).
   
   For example, enter `level:error AND service:api` to find error logs from the api service.

> Note
> 
> Boolean operators must be uppercase: `AND`, `OR`, `NOT`. Lowercase versions are not supported by Lucene query syntax.

Log entries matching your query appear in the results panel, showing timestamps, log levels (color-coded), and message content.

In the next milestone, you’ll configure the log display options to enhance how your logs are visualized.