--- schema_version: "1" id: 687ff7b54291d72db73b8dd9af26f58094bf0fedab766ff1c0d4d2f6098be184 title: Log Search Query Syntax Reference (US and EU) collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/monitoring/log-search-query-syntax.md canonical_url: https://docs.mulesoft.com/monitoring/log-search-query-syntax source_site: docs.mulesoft.com content_type: documentation content_hash: 0a134491022a5d0c77860c4d3fadaf68e39bdb2fd17161b1e4b60a6b5515dfd5 description: Reference for log search query syntax in MuleSoft Anypoint Monitoring on US and EU clouds, including search terms, modifiers, wildcards, and fuzzy search options. latest: true --- --- product: Monitoring description: Reference for log search query syntax in MuleSoft Anypoint Monitoring on US and EU clouds, including search terms, modifiers, wildcards, and fuzzy search options. keywords: MuleSoft, Anypoint Monitoring, log search, query syntax, search operators, wildcards, fuzzy search, log search reference --- # Log Search Query Syntax Reference (US and EU) > For the full documentation index, see: https://docs.mulesoft.com/llms.txt

info Availability: Usage-based and Titanium tiers only

On [US](https://anypoint.mulesoft.com/monitoring) and [EU](https://eu1.anypoint.mulesoft.com/monitoring) Clouds, fine tune your Anypoint Monitoring log search by using log query syntax. ## Search Terms Search terms consist of terms and operators. Search terms can be either single terms, such as "hello" or phrases, such as "hello dolly". You can combine multiple terms with boolean operators to form complex queries. ## Term Modifiers You can modify query terms using the log search query language to provide a wide range of searching options. ## Wildcard Searches You can use single and multiple character wildcard searches within single terms. > [!NOTE] You can’t use wildcard searches within phrase queries. To perform a single character wildcard search use the `?` symbol. The single character wildcard search looks for terms that match the single character replaced by `?`. For example, to search for "text" or "test" you can use the search: `te?t` To perform a multiple-character wildcard search, use the \* symbol. Multiple-character wildcard searches look for zero or more characters. For example, to search for test, tests, or tester, use the search: `test*` You can also use the wildcard searches in the middle of a term, for example: `te*t`. > [!NOTE] You can’t use a \* or `?` symbol as the first character of a search. ## Fuzzy Searches You can perform fuzzy searches by using the tilde~ symbol at the end of a single word term. For example, to search for a term similar in spelling to "roam" you can use the fuzzy search: `roam˷` This search returns terms like foam and roams. ## Boolean Operators Boolean operators allow terms to be combined through logic operators. Log search query language supports `AND`, `+`, `OR`, `NOT` and `-` as Boolean operators. > [!NOTE] Boolean operators must be ALL CAPS.
Boolean OperatorDescriptionExample

AND

The AND operator matches documents where both terms exist anywhere in the text of a single document. This is equivalent to an intersection using sets.

To search for documents that contain "anypoint monitoring" use the query: "anypoint monitoring" AND "results"

OR

The OR operator is used by default if there is no Boolean operator inserted between two terms. The OR operator links two terms and returns a matching document if either of the terms exists in a document. This is equivalent to a union using sets. The symbol | | can be used in place of the word OR.

To search for documents that contain either "monitoring anypoint" or just "monitoring" use the query:

"monitoring anypoint" monitoring

or

"monitoring anypoint" OR monitoring

NOT

The NOT operator excludes documents that contain the term after NOT. This is equivalent to a difference using sets. The symbol ! can be used in place of the word NOT.

To search for documents that contain "anypoint monitoring" but not "functional", use the query: "anypoint monitoring" NOT "functional"

The NOT operator can’t be used with just one term. For example, the following search returns no results:
NOT "functional"

+

Requires that the term after the + symbol exists somewhere in the field of a single document.

To search for documents that must contain "anypoint" and may contain "monitoring" use the query:

+anypoint monitoring

-

Excludes documents that contain the term after the - symbol.

To search for documents that contain "anypoint monitoring" but not "results" use the query:

"anypoint monitoring" -"results"

## Special Characters You can escape special characters that are part of the query syntax. The current list of supported special characters includes: `+ - && || ! ( ) { } [ ] ^ " ~ * ? : \ < >` To escape these characters, use the `\` before the character. For example, to search for (1+1):2 use the query: `\(1\+1\)\:2` ## Search Fields Specify a field name or use the default when performing a search. The field name and default field are specific to the search implementation. Search any field by typing the field name, followed by a colon, and then the term you are looking for. For example, to find logs with a message that contains "called the function Value Selector" in the app "my-app", enter either of the following: - `appId: "my-app" AND message: "called the function Value Selector"` - `appId: "my-app" AND "called the function Value Selector"` The default field, `message`, does not require a field indicator in the query.