Query Language Reference

Syntax guide for the Advanced Search bar on the Records page.

Overview

The Advanced Search bar accepts the Lucene query string syntax. Queries are matched against all records in the selected data source and time range.

Multiple terms are combined with AND by default — a query of two words only matches records containing both.

Field names: labels vs raw fields

Fields can be written two ways — both are valid and equivalent:

• Label — the name shown in the result table headers, for example Dst Port: 443. It is automatically translated to the underlying field before the query runs.
• Raw field — the actual stored field name, for example dst.port: 443.

Labels are case-insensitive (dst port: 443 is the same as Dst Port: 443) and may contain spaces without quoting, as long as they are immediately followed by a colon.

Label (table header)	Raw field	Example
Src IP	src.ip	Src IP: 10.0.0.5
Dst Port	dst.port	Dst Port: 443
Network Protocol	network.protocol	Network Protocol: tcp
DNS Question Name	dns.question.name	DNS Question Name: *.example.com
HTTP Status	http.status	HTTP Status: [400 TO 499]
TLS SNI	tls.sni	TLS SNI: login.microsoft.com
Alert Severity	alert.severity	Alert Severity: 1
Event Type	event_type	Event Type: alert
Risk Score	risk_score	Risk Score: >=70

tip

Use the All Fields picker next to the search bar to browse every available field and its type. Click a field name to insert it into your query.

Label limitations

The raw field is required in these cases:

• After _exists_: — labels are not translated in that position. Write _exists_: tls.sni, not _exists_: TLS SNI.
• If two different fields share the same label, only one of them is recognized. If results look wrong, switch to the raw field.
• Labels only work in the Advanced Search bar of the UI. Queries copied into the API or other tools must use raw fields.

Basic queries

Query	Meaning
firefox	Records containing the term firefox in any field
firefox chrome	Records containing both terms (default operator is AND)
"connection reset"	Exact phrase — terms must appear together, in order
Src IP: 10.0.0.5	Field-scoped match: src.ip equals 10.0.0.5
HTTP Status: 404	Numeric field match

A field name (label or raw) followed by a colon restricts the match to that field. Without a field prefix, all searchable fields are queried.

Boolean operators

Operator	Example	Meaning
AND	dns AND udp	Both terms must match (same as a space)
OR	ssh OR rdp	Either term matches
NOT	NOT HTTP Status: 200	Excludes matching records
( )	(ssh OR rdp) AND Dst Port: 22	Grouping controls precedence

Operators must be UPPERCASE. AND binds tighter than OR — use parentheses whenever mixing them.

Alert Severity: 1 AND (Dst Port: 22 OR Dst Port: 3389)
NOT (Network Protocol: dns OR Network Protocol: ntp)

Wildcards

Symbol	Example	Meaning
*	HTTP Hostname: *.example.com	Zero or more characters
?	Conn State: S?	Exactly one character

Wildcards work inside, at the end, or at the start of a term. A leading * is allowed but slow on large data — prefer a trailing wildcard. Wildcards do not work inside quoted phrases.

DNS Question Name: *.ru
Src IP: 192.168.1.*

Ranges

Syntax	Example	Meaning
[a TO b]	HTTP Status: [400 TO 499]	Inclusive range
{a TO b}	Dst Port: {1024 TO 65535}	Exclusive range
[a TO *]	Risk Score: [70 TO *]	Open-ended (greater than or equal to a)
> >= < <=	Dst Port: >=1024	Shorthand comparison

TO must be uppercase. Inclusive [ ] and exclusive { } brackets can be mixed, for example [0 TO 100}.

@timestamp: [2026-07-01 TO 2026-07-24]
Alert Severity: <=2

Field existence

Query	Meaning
_exists_: tls.sni	Records where the field tls.sni is present
NOT _exists_: dns.response_code	Records where the field is missing

Important

After _exists_: use the raw field, not the label. _exists_: TLS SNI is not recognized.

This is useful because not every record type carries every field.

Fuzzy and proximity

Syntax	Example	Meaning
term~	mozila~	Fuzzy match (default edit distance 2)
term~1	firefx~1	Fuzzy with explicit edit distance
"a b"~N	"failed login"~3	Phrase terms within N positions of each other

Regular expressions

Wrap a pattern in forward slashes to use a regular expression against a single field:

src.ip: /10\.0\.[0-9]+\.1/

Regex queries can be expensive — prefer wildcards or ranges when they suffice.

Escaping special characters

The following characters are reserved and must be escaped with a backslash \ when searched literally:

+ - = && || > < ! ( ) { } [ ] ^ " ~ * ? : \ /

Example — searching for a literal URL path:

http.url: \/admin\/login

Alternatively, wrap the value in double quotes: http.url: "/admin/login". Inside quotes, only " and \ need escaping.

Putting it together

Event Type: alert AND Alert Severity: [1 TO 2] AND NOT Src IP: 10.*
(DNS Question Name: *.xyz OR DNS Question Name: *.top) AND _exists_: dns.response_code
HTTP Method: POST AND HTTP Status: [500 TO 599] AND HTTP Hostname: *.internal.corp

Notes and limits

• Case — operators (AND, OR, NOT, TO) must be uppercase. Field labels are case-insensitive. Value matching on analyzed text fields is case-insensitive; exact keyword fields are case-sensitive.
• Default operator is AND — a b means a AND b. Use OR explicitly when needed.
• A mistyped field name does not raise an error (lenient mode) — that clause simply returns no matches. Check spelling via the All Fields picker.
• Relevance boosting (term^2) is accepted but has no effect — results are sorted by time, not by score.
• Field labels only work in the UI's Advanced Search bar; for the API and other integrations use raw fields.