LogZilla provides standard boolean-type search syntax much like you would expect when using Google. The only difference is the ability to append a wildcard (
- All searches are case insensitive
- All searches must contain at least 4 characters at a minimum unless otherwise configured by your administrator.
Correct search syntax:
Incorrect search syntax (too few characters)
The 4 character minimum is set in a config at the OS level which administrators can opt to change at the cost of using more memory for indexing. Customers are welcome to contact us for guidance if this is desired.
AND is automatically implied when separating search words with a space and should not be included in your search criteria.
For example, searching on the text
hello world would return results for both
- operators may be used to find events
NOT containing the specified text. For example:
| (pipe) operator may be used to find events matching either of the given terms. For example:
Boolean Mode Wildcard
Many Network and Systems logs will include names such as
GigabitEthernet1/0/0, etc. The wildcard feature allows users to specify a search term when they may not know the trailing characters.
GigabitEthernet1/0/2, or even
A prefix/infix wildcard may also be used:
Invalid Search Syntax
The following examples show some of the mixed-mode searches which are not supported at this time:
- Searches containing both
- Mixed "Phrase"
- Negative searching without a preceding positive search
This would be analogous to searching Google for every word on the internet that does
NOTcontain the word hello. Which, of course, would not be very useful.