Skip to content
Original file line number Diff line number Diff line change
Expand Up @@ -73,9 +73,10 @@ The following options are available:
| `"quoted phrase"` | Single fragment containing spaces |
| `field:value` | Field qualifier — value must match the named field |
| `-field:value` | Negated qualifier — excludes matches |
| `field:>value` / `field:>=value` / `field:<value` / `field:<=value` | Comparison for supported timestamp fields |
| `@attr:value` | Attribute qualifier — matches custom log attributes |

Supported fields for structured logs: `severity`, `resource`, `scope`, `message`, `trace-id`, `span-id`, `event`.
Supported fields for structured logs: `severity`, `resource`, `scope`, `message`, `trace-id`, `span-id`, `event`, `timestamp`.

- <Include relativePath="reference/cli/includes/option-help.md" />

Expand Down Expand Up @@ -133,6 +134,12 @@ The following options are available:
aspire otel logs --search "scope:Microsoft.EntityFrameworkCore severity:Warning"
```

- Filter logs by timestamp:

```bash title="Aspire CLI"
aspire otel logs --search "timestamp:>=2024-06-01T12:00:00 severity:error"
```

- View logs from a standalone dashboard using the login URL (token is automatically exchanged for an API key):

```bash title="Aspire CLI"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -73,10 +73,10 @@ The following options are available:
| `"quoted phrase"` | Single fragment containing spaces |
| `field:value` | Field qualifier — value must match the named field |
| `-field:value` | Negated qualifier — excludes matches |
| `field:>N` / `field:>=N` / `field:<N` / `field:<=N` | Comparison for numeric fields |
| `field:>value` / `field:>=value` / `field:<value` / `field:<=value` | Comparison for supported `duration` and `timestamp` fields |
| `@attr:value` | Attribute qualifier — matches custom span attributes |

Supported fields for spans: `resource`, `name`, `span-id`, `trace-id`, `status`, `kind`, `duration`.
Supported fields for spans: `resource`, `name`, `span-id`, `trace-id`, `status`, `kind`, `duration`, `timestamp`.

- <Include relativePath="reference/cli/includes/option-help.md" />

Expand Down Expand Up @@ -134,6 +134,12 @@ The following options are available:
aspire otel spans --search "@db.system:postgresql"
```

- Filter spans by timestamp:

```bash title="Aspire CLI"
aspire otel spans --search "timestamp:>=2024-03-01T08:30:00 kind:server"
```

- View spans from a standalone dashboard using the login URL (token is automatically exchanged for an API key):

```bash title="Aspire CLI"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -71,10 +71,10 @@ The following options are available:
| `"quoted phrase"` | Single fragment containing spaces |
| `field:value` | Field qualifier — value must match the named field |
| `-field:value` | Negated qualifier — excludes matches |
| `field:>N` / `field:>=N` / `field:<N` / `field:<=N` | Comparison for numeric fields |
| `field:>value` / `field:>=value` / `field:<value` / `field:<=value` | Comparison for supported `duration` and `timestamp` fields |
| `@attr:value` | Attribute qualifier — matches custom span attributes |

Supported fields for traces: `resource`, `name`, `trace-id`, `status`, `duration`.
Supported fields for traces: `resource`, `name`, `trace-id`, `status`, `duration`, `timestamp`.

- <Include relativePath="reference/cli/includes/option-help.md" />

Expand Down Expand Up @@ -132,6 +132,12 @@ The following options are available:
aspire otel traces --search "@http.status_code:500"
```

- Filter traces by timestamp:

```bash title="Aspire CLI"
aspire otel traces --search "timestamp:>2024-01-15T09:30:00 status:error"
```

- View traces from a standalone dashboard using the login URL (token is automatically exchanged for an API key):

```bash title="Aspire CLI"
Expand Down
27 changes: 23 additions & 4 deletions src/frontend/src/content/docs/reference/cli/search-filter.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,26 @@ Search queries support free-text fragments, field qualifiers, attribute qualifie
| `field:"value with spaces"` | Quoted field qualifier value | `message:"connection failed"` |
| `@attr:value` | Attribute qualifier — matches custom span/log attributes | `@http.method:GET` |
| `-field:value` / `-@attr:value` | Negated qualifier — excludes matches | `-severity:debug` |
| `field:>N` / `field:>=N` / `field:<N` / `field:<=N` | Numeric comparison | `duration:>100` |
| `field:>value` / `field:>=value` / `field:<value` / `field:<=value` | Comparison for supported numeric and timestamp fields | `duration:>100` |

All terms are AND'd: every fragment and qualifier must independently match.

## Timestamp qualifier

Use the `timestamp` field qualifier to narrow structured logs, traces, and spans to a specific date/time range. The qualifier accepts ISO 8601 date or date/time strings together with a comparison operator:

```bash title="Aspire CLI"
aspire otel logs --search "timestamp:>2024-01-15T09:30:00"
aspire otel traces --search "timestamp:<=2024-06-01T12:00:00Z"
aspire otel spans --search "timestamp:>=2024-01-01 timestamp:<2025-01-01"
```

The supported comparison operators are `>`, `>=`, `<`, and `<=`. Timestamp values follow these timezone rules:

- A value with no timezone suffix (for example `2024-01-15` or `2024-01-15T09:30:00`) is treated as local time on the dashboard server.
- A value with a UTC offset (for example `+05:00`) is adjusted to UTC before comparison.
Comment thread
JamesNK marked this conversation as resolved.
Resolved
- A value with the `Z` suffix is treated as UTC directly.
Comment thread
JamesNK marked this conversation as resolved.
Resolved

## Console logs

Matches against log line text content and resource name. Only free-text is supported (no structured qualifiers).
Expand All @@ -45,36 +61,39 @@ aspire logs --follow --search "\"connection error\""

Supports free-text and structured qualifiers. Free-text matches against message, resource name, scope, trace/span IDs, severity, and all attribute keys/values.

Available field qualifiers: `severity`, `resource`, `scope`, `message`, `trace-id`, `span-id`, `event`.
Available field qualifiers: `severity`, `resource`, `scope`, `message`, `trace-id`, `span-id`, `event`, `timestamp`.

```bash title="Aspire CLI"
aspire otel logs --search "severity:error \"connection failed\""
aspire otel logs --search "resource:api -severity:debug"
aspire otel logs --search "scope:Microsoft.EntityFrameworkCore"
aspire otel logs --search "timestamp:>=2024-06-01T12:00:00 severity:error"
```

## Traces

Supports free-text and structured qualifiers. Free-text matches against trace name, resource name, and all span fields within the trace.

Available field qualifiers: `name`, `resource`, `trace-id`, `status`, `duration`.
Available field qualifiers: `name`, `resource`, `trace-id`, `status`, `duration`, `timestamp`.

```bash title="Aspire CLI"
aspire otel traces --search "checkout"
aspire otel traces --search "status:error duration:>500"
aspire otel traces --search "@http.status_code:500"
aspire otel traces --search "timestamp:>2024-01-15T09:30:00 status:error"
```

## Spans

Supports free-text and structured qualifiers. Free-text matches against span name, resource name, scope, trace/span IDs, status, kind, and all attribute keys/values.

Available field qualifiers: `name`, `resource`, `scope`, `status`, `kind`, `trace-id`, `span-id`, `duration`.
Available field qualifiers: `name`, `resource`, `scope`, `status`, `kind`, `trace-id`, `span-id`, `duration`, `timestamp`.

```bash title="Aspire CLI"
aspire otel spans --search "@http.method:GET duration:>100 status:error"
aspire otel spans --search "@db.system:postgresql"
aspire otel spans --search "-kind:internal"
aspire otel spans --search "timestamp:>=2024-03-01T08:30:00 kind:server"
```

## See also
Expand Down
Loading