Orbtrace
ENTR
Talk to sales
Self-host

Search syntax

The complete query language used in the Logs search bar, the Traces search bar, the Metrics filters, and the alert-rule editor. Same syntax everywhere.

Orbtrace uses one search language across logs, traces, and metric filters. It was modelled on the Kibana / Datadog / Loki / HyperDX shape — intuitive, whole-word by default, with explicit booleans.

The basics

On screen
  • Whole worderror matches any record whose body / message contains the word error. Case-insensitive by default.
  • Wildcardserror* matches errors, error-handler, etc. *timeout matches read-timeout. The * matches zero or more characters within one word.
  • Quoted exact"connection refused" matches the exact phrase, including spaces.
  • Negation-error matches records that do not contain the word error. Alternative: NOT error.
  • Booleanerror AND payment — both. error OR warning — either. error AND NOT timeout — exclude. Operators are case-sensitive uppercase; precedence is the obvious left-to-right with parentheses for grouping.
  • Grouping(error OR warning) AND service:checkout-api

Field queries

The shape is field:value. Field names come from your data — anything your apps set as an OTel attribute.

On screen
  • String equalityservice:checkout-api. Whole word, case-insensitive.
  • String wildcardservice:checkout* — anything starting with checkout.
  • Existenceuser_id:* — record has a non-null user_id.
  • Numeric equalityhttp.status_code:500
  • Numeric rangesduration:>500, duration:>=500, duration:<1000, duration:>=500 AND duration:<1000.
  • Multiple valueslevel:(ERROR OR WARN) — value is one of the listed values.
  • Negation per field-level:DEBUG or NOT level:DEBUG excludes DEBUG records.

Time

You can put a time clause anywhere in the query, but most of the time you'll use the page-level time picker instead. Time clauses in the query body use natural language:

in "last 24 hours"
in "yesterday"
in "last week"
in "between 2026-05-12 14:00 and 2026-05-12 15:00"

If the page's time picker is set and a query contains a time clause, the query wins for that one query.

Special fields per pillar

Some fields are special — Orbtrace recognises them across signals.

Logs

On screen
  • levelSeverity. level:ERROR, level:(ERROR OR FATAL), level:>=WARN (comparison on the ordered severity scale).
  • serviceservice.name resource attribute. service:checkout-api.
  • trace_idThe trace this log line belongs to. trace_id:7a8b9c…
  • bodyThe free-text message. body:"out of memory" is the same as "out of memory" typed bare.

Traces

On screen
  • serviceRoot span's service. service:checkout-api.
  • service.inAny span in the trace belongs to the service. service.in:inventory-service finds traces that touched inventory anywhere.
  • operationRoot operation name. operation:"POST /checkout".
  • durationTrace duration in milliseconds. duration:>1000.
  • statusTrace-level status. status:error matches traces with at least one ERROR span; status:ok excludes them.
  • span.XAny field on any span. span.http.status_code:500 matches a trace where some span returned 500.

Metrics filters

In the metric explorer's filter strip, the same syntax applies to attribute filters. You can also enter a freeform query into the filter box:

service.name=checkout-api AND http.route =~ "^/api/.*" AND env=prod

=~ is regex equality.

Operators reference

OperatorExampleMeans
= (implicit with :)service:apiequals
=~route =~ ^/api/.*regex matches
!=level != DEBUGnot equal
> >= < <=duration:>500numeric comparison
AND OR NOT -error AND -timeoutboolean
(...)(a OR b) AND cgrouping
"...""exact phrase"quoted exact match
*service:checkout*wildcard inside a word

Worked examples

# All ERROR logs from checkout-api in the last 24 hours
level:ERROR AND service:checkout-api in "last 24 hours"
 
# Slow checkout traces with a 5xx anywhere
service:checkout-api AND duration:>1000 AND span.http.status_code:>=500
 
# Anything mentioning "OutOfMemoryError" excluding DEBUG noise
"OutOfMemoryError" AND -level:DEBUG
 
# Records with a trace_id (i.e., correlated to a trace)
trace_id:*
 
# Users 42 or 99 only, recently
user_id:(42 OR 99) in "last 1 hour"
 
# Latency under 100ms AND no errors AND not from the demo emitter
duration:<100 AND -status:error AND -service:demo-*

Saving queries

Right of the search bar: Save query. Saved queries:

  • Appear in the ⌘K command palette.
  • Have a sharable URL.
  • Can be wrapped into an alert rule via "Create alert from this query".
  • Show up in the per-screen quick-access dropdown.

What the syntax does not support

  • Free-text relational joins. "Find log lines whose trace_id also appears in a trace where service:db-X" — use the trace detail page's cross-pillar pivots instead.
  • Aggregations. count by service is not a search; it's a metric query. Go to the Metrics explorer.
  • Free-floating wildcards. * works inside a word; it does not work as a standalone "match anything". Use service:* for "any service" — service: alone is invalid.

Next: Troubleshooting.

PreviousRun a replayNextTroubleshooting