Write a Lucene query

Elasticsearch uses Lucene query syntax for searching log data. Lucene queries let you search for specific terms, filter by fields, and combine conditions using boolean operators. Understanding basic Lucene syntax enables you to quickly find the logs you need for troubleshooting.

In this milestone, you’ll write Lucene queries to search and filter your Elasticsearch logs.

You’ll enter a Lucene query, run it, and check the results.

Note: Boolean operators must be uppercase: AND, OR, NOT. Lowercase versions are not supported by Lucene query syntax.

1. In the Lucene Query field, enter a search term such as error.

2. Click Run query (or press Shift + Enter) to execute the query.

3. In the results panel under the query editor, confirm log lines appear.

4. Optional: in the Lucene Query field, replace the query with level:info to filter by log level.

5. Click Run query again. You should see fewer lines (only info-level logs).

You searched Elasticsearch logs with Lucene and reviewed matching results (timestamps, color-coded levels, and message content).

In the next milestone, you’ll configure the log display options to enhance how your logs are visualized.

More to explore (optional)

At this point in your journey, you can explore the following paths:

• Lucene query syntax
• Query string syntax