You're viewing version 3.6 of the OpenSearch documentation. This version is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.

where

The where command filters the search results. It only returns results that match the specified conditions.

Syntax

The where command has the following syntax:

where <boolean-expression>

Parameters

The where command supports the following parameters.

Example 1: Filtering by severity level

The following query finds all log entries with a severity level above INFO (severityNumber > 9), filtering out routine logs to focus on warnings and errors:

source=otellogs
| where severityNumber > 9
| sort severityNumber, `resource.attributes.service.name`
| fields severityText, severityNumber, `resource.attributes.service.name`

The query returns the following results:

Example 2: Filtering using combined criteria

The following query narrows down errors to a specific service during an incident investigation, combining severity and service name conditions with AND:

source=otellogs
| where severityNumber >= 17 AND `resource.attributes.service.name` = 'payment'
| fields severityText, severityNumber, `resource.attributes.service.name`

The query returns the following results:

Example 3: Filtering with multiple possible values

The following query retrieves all warnings and errors using OR to match either condition:

source=otellogs
| where severityText = 'WARN' or severityText = 'ERROR'
| fields severityText, `resource.attributes.service.name`, body
| head 5

The query returns the following results:

Example 4: Filtering by text patterns

The LIKE operator enables pattern matching on string fields using wildcards.

Matching with a prefix pattern

The following query uses a percent sign (%) to find all services starting with frontend:

source=otellogs
| where LIKE(`resource.attributes.service.name`, 'frontend%')
| fields severityText, `resource.attributes.service.name`, body
| head 3

Matching with a wildcard pattern

The following query finds all logs from services containing product in their name:

source=otellogs
| where LIKE(`resource.attributes.service.name`, '%product%')
| fields severityText, `resource.attributes.service.name`, body
| head 3

The query returns the following results:

Example 5: Filtering by excluding specific values

The following query uses a NOT operator to exclude routine informational and debug logs, focusing on warnings and errors that need attention:

source=otellogs
| where NOT severityText IN ('INFO', 'DEBUG')
| sort severityNumber, `resource.attributes.service.name`
| fields severityText, `resource.attributes.service.name`, body
| head 4

The query returns the following results:

Example 6: Filtering using value lists

The following query uses an IN operator to match multiple severity levels at once, retrieving all errors and warnings for incident response:

source=otellogs
| where severityText IN ('ERROR', 'WARN')
| sort severityNumber, `resource.attributes.service.name`
| fields severityText, `resource.attributes.service.name`, body

The query returns the following results:

Example 7: Filtering records with missing data

The following query finds logs that have instrumentation scope metadata:

source=otellogs
| where NOT ISNULL(instrumentationScope.name)
| fields severityText, instrumentationScope.name

The query returns the following results:

Example 8: Filtering using grouped conditions

The following query investigates a specific service’s errors by combining severity conditions with a service filter, using parentheses to control evaluation order:

source=otellogs
| where (severityText = 'ERROR' OR severityText = 'WARN') AND `resource.attributes.service.name` = 'payment'
| sort severityNumber
| fields severityText, `resource.attributes.service.name`, body

The query returns the following results: