Search
Sign in to the UI and search from the Dashboard or the Database. Searching is for signed-in users only; access tokens
are refused. Standard users limited to some sources only ever see events from those sources.
The search API uses the same browser session (an HttpOnly cookie), so it is meant for the UI rather than scripts.
q uses FTS5 query syntax: failed AND ssh,
"invalid user", admin*.
Beside the words, q takes field terms, written field=value. A comma means "any of these", a space between terms
means all of them apply, and quotes hold a value with spaces:
| Term | Matches events where |
|---|---|
src_ip=10.0.0.1,10.0.0.2 |
the source address is one of those |
dst_ip=... |
the destination address is one of those |
ip=192.168.48.21 |
either address is |
user="Jonathan Martinez",bob |
the user is one of those |
host=web1 · program=sshd |
the reporting host, or the program that wrote it |
source=Firewall,Syslog |
the log source (its name, or id) is one of those |
severity=high,critical |
the severity is (1-6, or info, low, medium, high, critical, fatal) |
category=3 · country=NL,DE · asn=AS15169 |
the category, a country on either address, or an autonomous system on either address |
threat=true |
it matched a threat intel list |
action=login |
a field the parser picked out, named action, has that value (or, for a list, has it among its items) |
So failed src_ip=192.168.48.20,192.168.48.21 severity=high finds the failed events from either address that are rated
High. They work in the API's q too, and add to the filter boxes (both apply). OR and NOT can't be used with a term; the
words beside them can use AND, OR and NOT as usual. Searching by a parser's field scans events, so add a date range when
the database is large.
Full-text search covers the parsed event: its message, program, host, user, source and destination addresses and the
values of the extra fields a parser picked out, not their names (so failed doesn't find an event that merely has a
field called failed; use failed=... to ask about that field). The original line is kept for 24 hours after it arrives (shown in an event's details),
then removed; the parsed event stays for the whole retention period and is what the Database page shows. Searching works
the same before and after the original goes, so search for what the parser understood rather than for a stray piece of
the raw text.
Filters
Beyond the text query, the Database page and the search API filter by time range (start, end), severity, category, class, src_ip, dst_ip, user, source (program), source_id, host, country, asn, threat=true, limit (max 1000) and offset. Results are newest first. See the API reference.