# Searching Spans and Logs

> Search spans and logs using natural syntax with word filters, AND/OR logic, quoted phrases, negative filters, and scoped attribute queries.

In addition to the SQL-like [query language](/features/traces/querying-spans), Uptrace lets you search spans and logs using a concise natural syntax. The search bar accepts plain words, phrases, logical operators, and attribute-scoped filters — making it faster to find specific records without writing full UQL expressions.

<video autoPlay="true" loop="true" muted="true" playsInline="true">
<source src="/video/product/logs/log-search.mp4" type="video/mp4" />
</video>

## Word filters

The simplest query is a single word that must be found within the [search scope](#search-scope).

**Example:** The query `error` matches:

```text
err
error
ERROR
ERRor
an error just occurred
```

### Multiple words (AND logic)

When your query contains multiple words separated by spaces, **all words** must be present in the search scope.

**Example:** `error select` matches:

```text
error select
select error
an error has occurred when executing a select query
```

### Multiple words (OR logic)

Separate words with a pipe (`|`) to match records containing **any** of the terms.

**Example:** `select|update` matches:

```text
select
update
select update
```

## Phrase filters

Enclose a phrase in double quotes to require an **exact match**, including spaces and punctuation.

**Example:** `"select query"` matches:

```text
an error has occurred when executing a select query
select query
```

But does **not** match:

```text
query select
selecting a query
```

## Negative filters

Prefix any term or phrase with `-` to **exclude** matching records.

**Example:** `error -ssh` finds error logs that do not contain the word `ssh`.

### Combining filters

```text
error "database connection" -timeout
```

Finds records that: contain `error`, contain the exact phrase `database connection`, and do not contain `timeout`.

## Search scope

The search scope defines which attributes Uptrace searches when filtering spans and logs. By default, it corresponds to your current grouping expression.

### Default scopes

<table>
<thead>
  <tr>
    <th>
      Grouping expression
    </th>
    
    <th>
      Search scope
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        group by _group_id
      </code>
    </td>
    
    <td>
      <code>
        _display_name
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        group by service_name, host_name
      </code>
    </td>
    
    <td>
      <code>
        service_name
      </code>
      
      , <code>
        host_name
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        group by _group_id, service_name
      </code>
    </td>
    
    <td>
      <code>
        _display_name
      </code>
      
      , <code>
        service_name
      </code>
    </td>
  </tr>
</tbody>
</table>

### Custom scopes

Use `attribute:value` to search a specific attribute regardless of grouping:

```text
host_name:host1
service_name:"hello world"
```

### Full-text index

If you configured a [text index transformation](/features/transformations/reference#text-index), search across all indexed attributes using `*:value`:

```text
*:hello
*:error|warning
-*:debug
```

The `*` scope searches the full-text index built from your selected attributes. Prefix with `-` to exclude.

## Syntax reference

<table>
<thead>
  <tr>
    <th>
      Filter type
    </th>
    
    <th>
      Syntax
    </th>
    
    <th>
      Example
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Word
    </td>
    
    <td>
      <code>
        word
      </code>
    </td>
    
    <td>
      <code>
        error
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Multiple words AND
    </td>
    
    <td>
      <code>
        word1 word2
      </code>
    </td>
    
    <td>
      <code>
        error database
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Multiple words OR
    </td>
    
    <td>
      <code>
        word1|word2
      </code>
    </td>
    
    <td>
      <code>
        error|warning
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Phrase
    </td>
    
    <td>
      <code>
        "phrase"
      </code>
    </td>
    
    <td>
      <code>
        "connection timeout"
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Negative
    </td>
    
    <td>
      <code>
        -term
      </code>
    </td>
    
    <td>
      <code>
        -debug
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Scoped
    </td>
    
    <td>
      <code>
        attribute:value
      </code>
    </td>
    
    <td>
      <code>
        host_name:prod-server
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Text index
    </td>
    
    <td>
      <code>
        *:value
      </code>
    </td>
    
    <td>
      <code>
        *:hello
      </code>
    </td>
  </tr>
</tbody>
</table>

**Tips:**

- All text searches are case-insensitive
- Word filters match partial words (`err` matches `error`)
- Always quote values containing spaces or special characters

## Related

- [Querying spans and logs](/features/traces/querying-spans) — full UQL reference for filters, grouping, and aggregations
- [Transformations](/features/transformations/reference#text-index) — configure a full-text index for `*:value` search