where

The where command filters the search results. It only returns results that match the specified conditions.

Syntax

The where command has the following syntax:

where <boolean-expression>

Parameters

The where command supports the following parameters.

Example 1: Filtering by severity level

The following query finds all log entries with a severity level above INFO (severityNumber > 9), filtering out routine logs to focus on warnings and errors:

source=otellogs
| where severityNumber > 9
| sort severityNumber, `resource.attributes.service.name`
| fields severityText, severityNumber, `resource.attributes.service.name`

The query returns the following results:

Example 2: Filtering using combined criteria

The following query narrows down errors to a specific service during an incident investigation, combining severity and service name conditions with AND:

source=otellogs
| where severityNumber >= 17 AND `resource.attributes.service.name` = 'payment'
| fields severityText, severityNumber, `resource.attributes.service.name`

The query returns the following results:

Example 3: Filtering with multiple possible values

The following query retrieves all warnings and errors using OR to match either condition:

source=otellogs
| where severityText = 'WARN' or severityText = 'ERROR'
| fields severityText, `resource.attributes.service.name`, body
| head 5

The query returns the following results:

Example 4: Filtering by text patterns

The LIKE operator enables pattern matching on string fields using wildcards.

Matching with a prefix pattern

The following query uses a percent sign (%) to find all services starting with frontend:

source=otellogs
| where LIKE(`resource.attributes.service.name`, 'frontend%')
| fields severityText, `resource.attributes.service.name`, body
| head 3

Matching with a wildcard pattern

The following query finds all logs from services containing product in their name:

source=otellogs
| where LIKE(`resource.attributes.service.name`, '%product%')
| fields severityText, `resource.attributes.service.name`, body
| head 3

The query returns the following results:

Example 5: Filtering by excluding specific values

The following query uses a NOT operator to exclude routine informational and debug logs, focusing on warnings and errors that need attention:

source=otellogs
| where NOT severityText IN ('INFO', 'DEBUG')
| sort severityNumber, `resource.attributes.service.name`
| fields severityText, `resource.attributes.service.name`, body
| head 4

The query returns the following results:

Example 6: Filtering using value lists

The following query uses an IN operator to match multiple severity levels at once, retrieving all errors and warnings for incident response:

source=otellogs
| where severityText IN ('ERROR', 'WARN')
| sort severityNumber, `resource.attributes.service.name`
| fields severityText, `resource.attributes.service.name`, body

The query returns the following results:

Example 7: Filtering records with missing data

The following query finds logs that have instrumentation scope metadata:

source=otellogs
| where NOT ISNULL(instrumentationScope.name)
| fields severityText, instrumentationScope.name

The query returns the following results:

Example 8: Filtering using grouped conditions

The following query investigates a specific service’s errors by combining severity conditions with a service filter, using parentheses to control evaluation order:

source=otellogs
| where (severityText = 'ERROR' OR severityText = 'WARN') AND `resource.attributes.service.name` = 'payment'
| sort severityNumber
| fields severityText, `resource.attributes.service.name`, body

The query returns the following results: