Skip to content
Original file line number Diff line number Diff line change
Expand Up @@ -65,17 +65,18 @@ The following options are available:

- **`--search <search>`**

Full-text search across log text fields, such as log messages, attribute values, scope, and IDs. Supports plain free-text fragments and structured `field:value` qualifiers. For more information, see [Search and filter](/reference/cli/search-filter/).
Full-text search across log text fields, such as log messages, attribute values, scope, IDs, and timestamps. Supports plain free-text fragments and structured `field:value` qualifiers. For more information, see [Search and filter](/reference/cli/search-filter/).
Comment thread
JamesNK marked this conversation as resolved.
Outdated

| Syntax | Meaning |
|--------|---------|
| `word` | Free-text fragment — matches any searchable field |
| `"quoted phrase"` | Single fragment containing spaces |
| `field:value` | Field qualifier — value must match the named field |
| `-field:value` | Negated qualifier — excludes matches |
| `field:>value` / `field:>=value` / `field:<value` / `field:<=value` | Comparison for supported timestamp fields |
| `@attr:value` | Attribute qualifier — matches custom log attributes |

Supported fields for structured logs: `severity`, `resource`, `scope`, `message`, `trace-id`, `span-id`, `event`.
Supported fields for structured logs: `severity`, `resource`, `scope`, `message`, `trace-id`, `span-id`, `event`, `timestamp`.

- <Include relativePath="reference/cli/includes/option-help.md" />

Expand Down Expand Up @@ -133,6 +134,12 @@ The following options are available:
aspire otel logs --search "scope:Microsoft.EntityFrameworkCore severity:Warning"
```

- Filter logs by timestamp:

```bash title="Aspire CLI"
aspire otel logs --search "timestamp:>=2024-06-01T12:00:00Z severity:error"
Comment thread
JamesNK marked this conversation as resolved.
Outdated
```

- View logs from a standalone dashboard using the login URL (token is automatically exchanged for an API key):

```bash title="Aspire CLI"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -65,18 +65,18 @@ The following options are available:

- **`--search <search>`**

Full-text search across span text fields, such as names, attribute values, source, and IDs. Supports plain free-text fragments and structured `field:value` qualifiers. For more information, see [Search and filter](/reference/cli/search-filter/).
Full-text search across span text fields, such as names, attribute values, source, IDs, and timestamps. Supports plain free-text fragments and structured `field:value` qualifiers. For more information, see [Search and filter](/reference/cli/search-filter/).
Comment thread
JamesNK marked this conversation as resolved.
Outdated

| Syntax | Meaning |
|--------|---------|
| `word` | Free-text fragment — matches any searchable field |
| `"quoted phrase"` | Single fragment containing spaces |
| `field:value` | Field qualifier — value must match the named field |
| `-field:value` | Negated qualifier — excludes matches |
| `field:>N` / `field:>=N` / `field:<N` / `field:<=N` | Comparison for numeric fields |
| `field:>value` / `field:>=value` / `field:<value` / `field:<=value` | Comparison for supported `duration` and `timestamp` fields |
| `@attr:value` | Attribute qualifier — matches custom span attributes |

Supported fields for spans: `resource`, `name`, `span-id`, `trace-id`, `status`, `kind`, `duration`.
Supported fields for spans: `resource`, `name`, `span-id`, `trace-id`, `status`, `kind`, `duration`, `timestamp`.

- <Include relativePath="reference/cli/includes/option-help.md" />

Expand Down Expand Up @@ -134,6 +134,12 @@ The following options are available:
aspire otel spans --search "@db.system:postgresql"
```

- Filter spans by timestamp:

```bash title="Aspire CLI"
aspire otel spans --search "timestamp:>=2024-03-01T08:30:00+05:00 kind:server"
Comment thread
JamesNK marked this conversation as resolved.
Outdated
```

- View spans from a standalone dashboard using the login URL (token is automatically exchanged for an API key):

```bash title="Aspire CLI"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -63,18 +63,18 @@ The following options are available:

- **`--search <search>`**

Full-text search across trace and span text fields, such as names, attribute values, source, and IDs. Supports plain free-text fragments and structured `field:value` qualifiers. For more information, see [Search and filter](/reference/cli/search-filter/).
Full-text search across trace and span text fields, such as names, attribute values, source, IDs, and timestamps. Supports plain free-text fragments and structured `field:value` qualifiers. For more information, see [Search and filter](/reference/cli/search-filter/).
Comment thread
JamesNK marked this conversation as resolved.
Outdated

| Syntax | Meaning |
|--------|---------|
| `word` | Free-text fragment — matches any searchable field |
| `"quoted phrase"` | Single fragment containing spaces |
| `field:value` | Field qualifier — value must match the named field |
| `-field:value` | Negated qualifier — excludes matches |
| `field:>N` / `field:>=N` / `field:<N` / `field:<=N` | Comparison for numeric fields |
| `field:>value` / `field:>=value` / `field:<value` / `field:<=value` | Comparison for supported `duration` and `timestamp` fields |
| `@attr:value` | Attribute qualifier — matches custom span attributes |

Supported fields for traces: `resource`, `name`, `trace-id`, `status`, `duration`.
Supported fields for traces: `resource`, `name`, `trace-id`, `status`, `duration`, `timestamp`.

- <Include relativePath="reference/cli/includes/option-help.md" />

Expand Down Expand Up @@ -132,6 +132,12 @@ The following options are available:
aspire otel traces --search "@http.status_code:500"
```

- Filter traces by timestamp:

```bash title="Aspire CLI"
aspire otel traces --search "timestamp:>2024-01-15T09:30:00 status:error"
```

- View traces from a standalone dashboard using the login URL (token is automatically exchanged for an API key):

```bash title="Aspire CLI"
Expand Down
27 changes: 23 additions & 4 deletions src/frontend/src/content/docs/reference/cli/search-filter.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,26 @@ Search queries support free-text fragments, field qualifiers, attribute qualifie
| `field:"value with spaces"` | Quoted field qualifier value | `message:"connection failed"` |
| `@attr:value` | Attribute qualifier — matches custom span/log attributes | `@http.method:GET` |
| `-field:value` / `-@attr:value` | Negated qualifier — excludes matches | `-severity:debug` |
| `field:>N` / `field:>=N` / `field:<N` / `field:<=N` | Numeric comparison | `duration:>100` |
| `field:>value` / `field:>=value` / `field:<value` / `field:<=value` | Comparison for supported numeric and timestamp fields | `duration:>100` |

All terms are AND'd: every fragment and qualifier must independently match.

## Timestamp qualifier

Use the `timestamp` field qualifier to narrow structured logs, traces, and spans to a specific date/time range. The qualifier accepts ISO 8601 date/time strings together with a comparison operator:

```bash title="Aspire CLI"
aspire otel logs --search "timestamp:>2024-01-15T09:30:00"
aspire otel traces --search "timestamp:<=2024-06-01T12:00:00Z"
aspire otel spans --search "timestamp:>=2024-03-01T08:30:00+05:00"
Comment thread
JamesNK marked this conversation as resolved.
Outdated
```

The supported comparison operators are `>`, `>=`, `<`, and `<=`. Timestamp values follow these timezone rules:

- A value with no timezone suffix (for example `2024-01-15T09:30:00`) is treated as local time on the dashboard server.
- A value with a UTC offset (for example `+05:00`) is adjusted to UTC before comparison.
Comment thread
JamesNK marked this conversation as resolved.
Outdated
- A value with the `Z` suffix is treated as UTC directly.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot Mention that time is optional. An ISO date by itself can be used as a value

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 38fb43f.


## Console logs

Matches against log line text content and resource name. Only free-text is supported (no structured qualifiers).
Expand All @@ -45,36 +61,39 @@ aspire logs --follow --search "\"connection error\""

Supports free-text and structured qualifiers. Free-text matches against message, resource name, scope, trace/span IDs, severity, and all attribute keys/values.

Available field qualifiers: `severity`, `resource`, `scope`, `message`, `trace-id`, `span-id`, `event`.
Available field qualifiers: `severity`, `resource`, `scope`, `message`, `trace-id`, `span-id`, `event`, `timestamp`.

```bash title="Aspire CLI"
aspire otel logs --search "severity:error \"connection failed\""
aspire otel logs --search "resource:api -severity:debug"
aspire otel logs --search "scope:Microsoft.EntityFrameworkCore"
aspire otel logs --search "timestamp:>=2024-06-01T12:00:00Z severity:error"
Comment thread
JamesNK marked this conversation as resolved.
Outdated
```

## Traces

Supports free-text and structured qualifiers. Free-text matches against trace name, resource name, and all span fields within the trace.

Available field qualifiers: `name`, `resource`, `trace-id`, `status`, `duration`.
Available field qualifiers: `name`, `resource`, `trace-id`, `status`, `duration`, `timestamp`.

```bash title="Aspire CLI"
aspire otel traces --search "checkout"
aspire otel traces --search "status:error duration:>500"
aspire otel traces --search "@http.status_code:500"
aspire otel traces --search "timestamp:>2024-01-15T09:30:00 status:error"
```

## Spans

Supports free-text and structured qualifiers. Free-text matches against span name, resource name, scope, trace/span IDs, status, kind, and all attribute keys/values.

Available field qualifiers: `name`, `resource`, `scope`, `status`, `kind`, `trace-id`, `span-id`, `duration`.
Available field qualifiers: `name`, `resource`, `scope`, `status`, `kind`, `trace-id`, `span-id`, `duration`, `timestamp`.

```bash title="Aspire CLI"
aspire otel spans --search "@http.method:GET duration:>100 status:error"
aspire otel spans --search "@db.system:postgresql"
aspire otel spans --search "-kind:internal"
aspire otel spans --search "timestamp:>=2024-03-01T08:30:00+05:00 kind:server"
Comment thread
JamesNK marked this conversation as resolved.
Outdated
```

## See also
Expand Down