Searching

Searching

Loggregate supports a very basic query language. Searches use the form variable = "value" and can be combined using and and or. For example:

steamid = "[U:1:1234]" or name = "Person"

Will match log entries where the user's SteamID equals [U:1:1234] or their name matches Person. You can also group parameters with parenthesis as needed, for example:

steamid = "[U:1:1234]" or (name = "Person" and type = "connected")

This will match entries where the users's SteamID equals [U:1:1234], or their name matches Person and the log entry type equals connected Loggregate includes some helpers for searching, and more advanced searching can be done on any field that is saved in Elastic Search by using dot notation.

Operators

The following operators are supported

• = - Equals
• != - Not equals
• < - Less than
• <= - Less than or equal to
• > - Greater than
• >= - Greater than or equal to

Common options

Commonly used search options include

• message

  Performs full-text search on chat messages.

  Example

  message = "Hello"

• line

  Performs full-text search on the entire log line.

  Example

  line = "VAC"

• type

  Matches log entries by log type. Default types are below, however additional types can be defined dynamically by message parsers.
  • chat
  • connected
  • map
  • rcon
  • vpn_detected

  Example

  type = "chat"

• map

  Matches map name when searching for map loads

  Example

  map = "cs_office"

Helpers

The following helpers are applied automatically by loggregate.

server

Matches log entries to a specific server, by name.

Example

server = "office_dm"

steamid

Matches log by user's SteamID, where applicable. Equivalent to who.steamid

Example

steamid = "[U:1:1234]"

name

Matches log by user's name, where applicable. Equivalent to who.name

Example

name = "Person"