Skip to content

Commit

Permalink
Simplify to clarify.
Browse files Browse the repository at this point in the history
  • Loading branch information
kirkrodrigues committed Dec 2, 2024
1 parent 58a7251 commit 0967dc8
Showing 1 changed file with 33 additions and 12 deletions.
45 changes: 33 additions & 12 deletions docs/src/user-guide/reference-json-search-syntax.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,24 +33,18 @@ To search for a key or value with multiple words, you must quote the key/value w
"multi-word key": "multi-word value"
```

Keys or values with the following literal characters must escape the characters using a `\`
(backslash): `\`, `"`.

Unquoted keys or values must also escape the following characters: `(`, `)`, `:`, `<`, `>`, `{`,
`}`.

Values containing `?` and `*` can escape these characters with a `\` to differentiate them from the
`?` and `*` characters used to specify arbitrary single character match and wildcard match.

Keys containing `.` can escape the `.` with `\` to differentiate from the special `.` character that
indicates nested keys.

:::{caution}
Currently, a query that contains spaces is interpreted as a substring search, i.e., it will match
log events that contain the value as a *substring*. In a future version of CLP, these queries will
be interpreted as _exact_ searches unless they include [wildcards](#wildcards-in-values).
:::

:::{note}
Certain characters have special meanings when used in keys or values, so to search for the
characters literally, you must escape them. For a list of such characters, see
[Escaping special characters](#escaping-special-characters).
:::

### Querying nested kv-pairs

If the kv-pair is nested in one or more objects, you can specify the key in one of two ways:
Expand Down Expand Up @@ -170,6 +164,33 @@ There are three supported boolean operators:

You can use parentheses (`()`) to apply an operator to a group of expressions.

### Escaping special characters

Keys containing the following literal characters must escape the characters using a `\` (backslash):

* `\`
* `"`
* `.`

Values containing the following literal characters must escape the characters using a `\`
(backslash):

* `\`
* `"`
* `?`
* `*`

_Unquoted_ keys or values containing the following literal characters must also escape the
characters using a `\` (backslash):

* `(`
* `)`
* `:`
* `<`
* `>`
* `{`
* `}`

## Examples

**Search for log events that contain a specific key-value pair:**
Expand Down

0 comments on commit 0967dc8

Please sign in to comment.