---
schema_version: "1"
id: c03afc5e7bbd8ea3e536ae2392f6bf52fab13bb69624478ff532888c6496289f
title: Log Search Query Syntax
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub/cloudhub-log-search-syntax.md
canonical_url: https://docs.mulesoft.com/cloudhub/cloudhub-log-search-syntax
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 1a1afd83455df138a7958ea143d37998132c721660c7c943c36d56a9ab80cd67
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub
---

# Log Search Query Syntax

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

In addition to using the query builder and facet search user interface in Runtime Manager log
search, you can use the log search query language.

## Search Terms

Search terms consist of terms and operators. Search terms can be either single terms, such as
"hello" or phrases, such as "hello dolly".

You can combine multiple terms with boolean operators to form complex queries.

## Term Modifiers

You can modify query terms using the log search query language to provide a wide range of searching
options.

## Wildcard Searches

You can use single and multiple character wildcard searches within single terms.

To perform a single character wildcard search use the `?` symbol. The single character wildcard
search looks for terms that match the single character replaced by `?`. For example, to search for
"text" or "test" you can use the search:

`te?t`

To perform a multiple-character wildcard search, use the \* symbol. Multiple-character wildcard
searches look for zero or more characters. For example, to search for test, tests, or tester, use
the search:

`test*`

You can also use the wildcard searches in the middle of a term, for example: `te*t`.

## Boolean Operators

Boolean operators allow terms to be combined through logic operators. Log search query language
supports `AND`, `+`, `OR`, `NOT` and `-` as Boolean operators.

> [!NOTE] Boolean operators must be ALL CAPS.

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Boolean Operator</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td><div><div><p><code>AND</code></p></div></div></td><td><div><div><p>The <code>AND</code> operator matches documents where both terms exist anywhere in the text of a single document. This is equivalent to an intersection using sets.</p></div></div></td><td><div><div><p>To search for documents that contain "anypoint monitoring" use the query: <code>"anypoint monitoring" AND "results"</code></p></div></div></td></tr><tr><td><div><div><p><code>OR</code></p></div></div></td><td><div><div><p>The <code>OR</code> operator is used by default if there is no Boolean operator inserted between two terms. The <code>OR</code> operator links two terms and returns a matching document if either of the terms exists in a document. This is equivalent to a union using sets. The symbol <code>| |</code> can be used in place of the word <code>OR</code>.</p></div></div></td><td><div><div><p>To search for documents that contain either "monitoring anypoint" or just "monitoring" use the query:</p></div><div><p><code>"monitoring anypoint" monitoring</code></p></div><div><p>or</p></div><div><p><code>"monitoring anypoint" OR monitoring</code></p></div></div></td></tr><tr><td><div><div><p><code>NOT</code></p></div></div></td><td><div><div><p>The <code>NOT</code> operator excludes documents that contain the term after <code>NOT</code>. This is equivalent to a difference using sets. The symbol <code>!</code> can be used in place of the word <code>NOT</code>.</p></div></div></td><td><div><div><p>To search for documents that contain "anypoint monitoring" but not "functional", use the query: <code>"anypoint monitoring" NOT "functional"</code><br></p></div><div><div data-type="NOTE">The <code>NOT</code> operator can’t be used with just one term. For example, the following search returns no results:<br><code>NOT "functional"</code></div></div></div></td></tr><tr><td><div><div><p><code>+</code></p></div></div></td><td><div><div><p>Requires that the term after the <code>+</code> symbol exists somewhere in the field of a single document.</p></div></div></td><td><div><div><p>To search for documents that must contain "anypoint" and may contain "monitoring" use the query:</p></div><div><p><code>+anypoint monitoring</code></p></div></div></td></tr><tr><td><div><div><p><code>-</code></p></div></div></td><td><div><div><p>Excludes documents that contain the term after the <code>-</code> symbol.</p></div></div></td><td><div><div><p>To search for documents that contain "anypoint monitoring" but not "results" use the query:<br></p></div><div><p><code>"anypoint monitoring" -"results"</code></p></div></div></td></tr></tbody></table>

## Special Characters

You can escape special characters that are part of the query syntax. The current list of supported
special characters includes:

`+ - && || ! ( ) { } [ ] ^ " ~ * ? : \ < >`

To escape these characters, use the `\` before the character. For example, to search for (1+1):2 use
the query:

`\(1\+1\)\:2`

## Search Fields

Specify a field name or use the default when performing a search. The field name and default field
are specific to the search implementation.

Search any field by typing the field name, followed by a colon, and then the term you are looking
for. For example, to find logs with a message that contains "called the function Value Selector" in
the app "my-app", enter either of the following:

- `appId: "my-app" AND message: "called the function Value Selector"`

- `appId: "my-app" AND "called the function Value Selector"`

The default field, `message`, does not require a field indicator in the query.