Logs

Log search with facets and a Datadog-style query language over what the agent shipped.

The search syntax

The bar takes free text, field predicates, and boolean operators together:

service:checkout status:error @http.status_code:>=500 timeout

Free text

Bare words and "quoted phrases" match the log body, case-insensitively, as a substring.

Fields

field:value is case-sensitive. Six reserved fields:

service · env · status · trace_id · span_id · scope

Every other key is a span attribute — with or without a leading @, and dots are allowed:

@http.route:/api/orders
k8s.namespace.name:payments

Levels

status: uses level-band semantics — it matches the OTLP severity number band, not just a string. status:error therefore catches the whole error band rather than only records whose text happens to read ERROR. An unrecognised status value falls back to case-insensitive equality on the severity text.

Wildcards

* and ? work in values and in free text:

service:payment-* @http.route:/api/*/orders

Boolean operators

AND (explicit, or implicit by adjacency), OR, NOT or -, and parentheses.

Precedence is NOT > AND > OR.

Operators must be UPPERCASE

and and or in lowercase are ordinary search terms, matching those words in the body — same as Datadog. status:error or status:warn searches for the literal word “or”.

Grouped values

service:(checkout OR payments OR cart)

Numeric comparisons and ranges

On attributes, parsed as floats:

@duration:>1000
@http.status_code:>=500
@retry.count:[2 TO 5]

[a TO b] is inclusive. Exclusive ranges {a TO b} are not supported and fail to parse — unsupported syntax is an error rather than a silently different match. A stored value that is not numeric never matches a numeric comparison.

Existence

_exists_:@user.id
_missing_:@trace_id

Escaping

Backslash escaping and double quotes for special characters.

Facets

Facet fields are discovered from the data itself, then each shows its values with counts — so you can narrow before you know the exact field name. Use the field finder to search the facet list when a cluster has many attributes.

When a search returns nothing

Check the reduction rules shown on the panel before concluding the event never happened. Logs are where volume becomes cost fastest, so rules that drop or aggregate lines are normal — and a line that was dropped at ingest is not there to find.

This is why the rules are surfaced here rather than buried in settings. Manage them from Cardinality & cost rules.

A worked search

5xx responses on the orders route, excluding a known noisy client, in the last 6 hours:

1. Set the range to Last 6h.
2. Query: @http.route:/api/orders @http.status_code:>=500 NOT service:synthetic-probe
3. Click a promising field in the facets to narrow further — the query bar updates.
4. Pivot to the trace: take the trace_id from a line and open it in Traces.

From the CLI

rtz logs --since 15m --level ERROR
rtz logs -s checkout -q 'status:5* AND @http.method:POST'
rtz logs --follow                    # polls; the API has no log stream

The same grammar applies to -q. The server rejects an unparseable query rather than silently matching everything.

See Logs, traces & metrics.