From 9aacb5afb78649120eb68269fdf72a818bd54860 Mon Sep 17 00:00:00 2001 From: May Lee Date: Sun, 26 Oct 2025 13:44:39 -0400 Subject: [PATCH 01/13] add search syntax doc --- .../observability_pipelines/search_syntax.md | 245 ++++++++++++++++++ 1 file changed, 245 insertions(+) create mode 100644 content/en/observability_pipelines/search_syntax.md diff --git a/content/en/observability_pipelines/search_syntax.md b/content/en/observability_pipelines/search_syntax.md new file mode 100644 index 0000000000000..38368d0f47a2f --- /dev/null +++ b/content/en/observability_pipelines/search_syntax.md @@ -0,0 +1,245 @@ +--- +title: Search Syntax +description: Learn the search syntax to create filter queries for your Observability Pipelines processors. +disable_toc: false +private: true +--- +## Overview + +When you add a processor to a pipeline, you can filter your logs so only a subset of them go through a processor. This document goes over the following information: + +- [Free text search](#free-text-search): when you want to search the `message` field value. +- [Attribute search](#attribute-search)): when you want to search attribute keys and values. +- [Arrays]() when you want to search within an array of nested values. +- [Boolean operators](#boolean-operators) that you can use in your search query. +- [Special characters and spaces that need to be escaped](#escape-special-characters-and-spaces) in search queries. +- Using [wildcards](#wildcards) in your search queries. + +**Note**: Worker version 2.11 and newer uses an upgraded search syntax. After you upgrade from Worker version 2.10 or older to version 2.11, you might need to update your filter queries to match the new syntax. See the [Upgrade to the New Search Syntax](?tab=t.lxlscm3ib5qp#heading=h.cxcjarr1kri8) for more information. + +## Search syntax + +There are two types of filter queries you can use: + +- [Free text](#free-text-search) +- [Attribute](#attribute-search) + +### Free text search + +Free text search only searches the `message` field and is case insensitive. It is composed of terms and operators. There are two types of terms: + +- A single term is a single word such as `test` or `hello`. +- A sequence is a group of words surrounded by double quotes, such as `"hello dolly"`. + +The following are free text search examples: + +`hello` +: Searches for the exact string `hello`. For example, `{"message": "hello world"}` is a matching log. + +`Hello world` +: Searches for `hello` and `world`. For example, "hello beautiful world" is a match. +: This query can also be written as: `Hello AND world`. +: **Note**: The message must contain both `hello` and `world` to match. + +`"hello world"` +: Searches for a sequence of words. For example "hello world", "hello-world", and "Hello, world" are all matches. + +### Attribute search + +You can search attribute key and values. For example, if your attribute key is `url` and you want to filter on the `url` value `www.datadoghq.com`, enter: `url:www.datadoghq.com`. + +To filter for events that have a specific attribute key, use the `_exists_` syntax. For example if you use the query `_exists_:service`,`{"service": "postgres"}` matches the query, but `{"env": "prod"}` does not match. + +**Note**: Attribute searches are case sensitive. + +The following are attribute search syntax examples: + +`status:ok service:flask-web-app` +: Matches logs with the status `ok` from your `flask-web-app` service. +: This query can also be written as: `status:ok AND service:flask-web-app`. + +`user.status:inactive` +: Matches logs with the status `inactive` nested under the `user` attribute. + +`http.url:/api-v1/*` +: Matches logs containing a value in the `http.url` attribute that starts with `/api-v1/`. + +`http.status_code:[200 TO 299] http.url_details.path:/api-v1/*` +: Matches logs containing an `http.status_code` value that is greater than or equal to `200` and less than or equal to `299`, and containing a value in the `http.url_details.path` attribute that start with `/api-v1/`. + +`http.status:[200 TO 299]` +: Matches logs containing an `http.status` value that is greater than or equal to `200` and less than or equal to `299`. +: **Notes**: +: - `[..]` Square brackets mean the ranges are inclusive. +: - Ranges can be used across any attribute. + +`http.status:{200 TO 299}` +: Matches logs containing an `http.status` value that is greater than `200` or less than `299`. **Notes**: - `{..}` Curly brackets mean the ranges are exclusive. - Ranges can be used across any attribute. + +`"service.status":disabled` +: Matches logs with `"service.status": "disabled"`. This filter syntax searches for a literal `.` in the attribute key. +: See [Path notation](#path-notation) for more information. + +`_exists_:service` +: Matches logs with the attribute key `service`. For example, the query matches `{"service": "postgres"}`, but does not match {"env": "prod"}. + +#### Path notation + +For the following log structure: + +```json +{ + "outer_key": { + "inner_key": "inner_value", + "a": { + "double_inner_key": "double_inner_value", + "b": "b value" + }, + "c": "c value" + }, + "d": "d value" +} +``` + +- Use `outer_key.inner_key` to reference the key with the value `inner_value`. +- Use `outer_key.inner_key.double_inner_key` to reference the key with the value `double_inner_value`. + +For this example log:```{"http": {"url_details": {"path": "/api/v1/test" } } }``` + +The filter syntax `http.url_details.path:"/api/v1/test"`, matches logs with a value of `/api/v1/test` for the `url_details` attribute path nested under `http`. + +If you want to search for a literal `.` in the attribute key, wrap the key in escaped quotes in the search query. For example, the search query `"service.status":disabled` matches the event `{"service.status": "disabled"}`. + +### Boolean operators + +You can use the following case sensitive Boolean operators to combine multiple terms in a search query. + +| Operator | Description | +|--------------|--------------------------------------------------------| +| `AND` | Intersection: both terms are in the event. | +| `OR` | Union: either term is contained in the event. | +| `-` or `NOT` | Exclusion: the following term is **not** in the event. | + +The follow are example queries that use Boolean operators: + +`NOT (status:debug)` +: Matches logs that do not have the status `DEBUG`. + +`host:COMP-A9JNGYK OR host:COMP-J58KAS` +: Only matches logs from those specific hosts. + +`Hello AND World` +: Searches for `hello` and `world`. For example, "hello beautiful world" is a match. +: This query can also be written as: `Hello world`. +: **Note**: The message must contain both `hello` and `world` to match. + +`hello` AND `status:info` +: Matches logs with a message field that contains `hello` and with `status:info`. + +`-http.status_code:200` +: Matches logs where http.status_code is not equal to 200 + +`service:(postgres OR datadog_agent)` +: Matches logs with the values `postgres` or `datadog_agent` for the `service` attribute. This query can also be written as: `service:postgres OR service:datadog_agent` + +## Escape special characters and spaces + +The following characters are considered special and require escaping with the following characters: `-` `!` `&&` `||` `>` `>=` `<` `<=` `(` `)` `{` `}` `[` `]` `"` `*` `?` `:` `#`, and spaces. + +**Notes**: + +- `/` is not considered a special character and doesn't need to be escaped. +- You can search for special characters inside of an attribute. See [Search an attribute that contains special characters](#search-an-attribute-that-contains-special-characters). +- You cannot use free text search queries to filter for log messages with special characters. For example, if you want to match logs that contain the special character `!` in the `message` field, use the attribute search query: `message:*!*`. + +### Search an attribute that contains special characters + +Searching for an attribute value that contains special characters requires escaping or double quotes. For example, for an attribute `my_app` with the value `hello:world`, search using: `my_app:hello:world` or `my_app:"hello:world"`. + +### Match a single special character or space + +To match a single special character or space, use the `?` wildcard. For example, for an attribute `my_app` with the value `hello world again`, search using: `my_app:hello?world?again`. + +### Examples + +For the following example log: + +``` +{ + "service": "postgres", + "status": "INFO", + "tags": [ + "env:prod", + "namespace:something", + "reader:logs", + "my_app:hello world again" + ] +} +``` + +The following are search syntax examples that escape special characters and spaces: + +`tags:env` +: Matches logs with a `tag` attribute value of `env`. + +`tags:(env\:prod OR env\:test)` +: Matches logs `env:prod` or the tag `env:test` in the `tags` array. +: This query can also be written as `tags:("env:prod" OR "env:test")`. + +`tags:env\:prod AND -tags:version\:beta` +: Matches logs that have `env:prod` and does not have `version:beta` in the `tag` array. +: This query can also be written as `tags:"env:prod" AND -tags:"version:beta"`. + +`my_app:hello\:world` +: Matches logs that contain `my_app:hello:world`. +: This query can also be written as `my_app:"hello:world"`. + +`my_app:hello?world?again` +: Matches logs that contain `"my_app":"hello world again"`. + +### Arrays + +In the following example, CloudWatch logs for Windows contain an array of JSON objects under `Event.EventData.Data`. + +``` +Event +{ +EventData { + Data [ + {"Name":"SubjectUserID1", "value":"12345"}, + {"Name":"SubjectUserID2", "value":"Admin"}, + {"Name":"ObjectServer", "value":"Security"} + ] + } +} +``` + +If you use the filter query: `Event.EventData.Data.Name:ObjectServer`, the above log event is matched because it contains a nested object with the attribute key `Name` and the value `ObjectServer`. + +## Wildcards + +​​You can use `*` for wildcard searches. The following are wildcard search examples: + +`*network*` +: Matches logs with a `message` field value that contains `network`. + +`web*` +: Matches logs with a `message` field value that starts with `web`. + +`*web` +: Matches logs with a `message` field value that ends with `web`. + +`service:*mongo` +: Matches logs with `service` attribute values that ends with `mongo`. + +`service:web*` +: Matches logs that have a `service` attribute value that starts with `web`. + +**Notes**: +- You cannot use wildcards to search attribute keys, such as `*:app` or `service*:app`. +- Wildcards only work as wildcards outside of double quotes. +- For example, `"*test*"` matches a log which has the string `*test*` in its `message` field, while `*test*` matches a log which has the string `test` anywhere in the `message` field. + +#### Search for special characters or escaped characters + +When searching for an attribute that contains special characters or requires escaping or double quotes, use the `?` wildcard to match a single special character or space. For example, to search for an attribute `my_attribute` with the value `hello world`, use the syntax: `my_attribute:hello?world`. \ No newline at end of file From e68d4e4d74484afd9eab298c0c2fc3b885d16653 Mon Sep 17 00:00:00 2001 From: May Lee Date: Sun, 26 Oct 2025 14:24:37 -0400 Subject: [PATCH 02/13] add upgrade guide --- ...filter_queries_to_the_new_search_syntax.md | 129 ++++++++++++++++++ .../guide/legacy_search_checkbox.png | Bin 0 -> 32309 bytes 2 files changed, 129 insertions(+) create mode 100644 content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md create mode 100644 static/images/observability_pipelines/guide/legacy_search_checkbox.png diff --git a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md new file mode 100644 index 0000000000000..55c71c408131a --- /dev/null +++ b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md @@ -0,0 +1,129 @@ +--- +title: Upgrade Your Filter Queries to the New Search Syntax +description: Learn how to update your Observability Pipelines filter queries to use the new search syntax. +aliases: + - /observability_pipelines/guide/upgrade_to_the_new_search_syntax/ +disable_toc: false +further_reading: +- link: "/observability_pipelines/search_syntax/" + tag: "Documentation" + text: "Learn more about Observability Pipelines search syntax" +--- + +## Overview + +Worker versions 2.11 and newer use an updated search syntax. To upgrade to the new search syntax, install Worker version 2.11 or later and update your filter queries to the new syntax. This document goes over: + +- [How to upgrade to the new syntax](#how-to-upgrade-to-new-search-syntax) +- [What's new in the updated search syntax](#whats-new-in-the-updated-search-syntax--whats-new-in-the-updated-search-syntax) + +## How to upgrade to new search syntax + +See the steps based on whether you: + +- [Created the pipeline in the Pipeline UI](#created-the-pipeline-in-pipeline-ui) +- [Created the pipeline using the API or Terraform](#created-the-pipeline-using-the-api-or-terraform) + +### Created the pipeline in Pipeline UI + +If you created your pipeline using the Pipeline UI: + +1. [Upgrade to Observability Pipelines Worker][1] version 2.11. +1. Navigate to the [Pipeline UI][2] for that pipeline and update your filter queries to the new syntax. See the [What's new in the updated search syntax](#whats-new-in-the-updated-search-syntax--whats-new-in-the-updated-search-syntax) section for more information. +1. By default the `Use legacy search syntax` box is checked because your pipeline is still running with the old search syntax +{{< img src="observability_pipelines/guide/legacy_search_checkbox.png" alt="The pipelines editor showing the legacy search checkbox selected" style="width:100%;" >}} +1. After you've updated all your queries in that pipeline, uncheck the `Use legacy search syntax` box and deploy your pipeline + +### Created the pipeline using the API or Terraform + +If your pipeline was created using the public API or Terraform: +- Within the same request that you make to update your pipeline queries to the new search syntax, set `use_legacy_search_syntax` to false. +- **Note**: You **must** set `use_legacy_search_syntax` to `false` while updating your queries because if `use_legacy_search_syntax` is left unpopulated, it defaults to `true` in the Worker. + + +## What's new in the updated search syntax + +The following table lists the what has been updated with the search syntax: + +| Legacy syntax | New syntax | +| ------------- | ------------------------------- | +| Must use the `@` for attribute search, except for [reserved fields](#). | Do not need to use `@` for attribute search. **Note**: The `@` symbol in queries gets stripped to preserve backwards compatibility. | +| Since `@` indicates an attribute search, tag searches do not include an `@` so are matched under the attributes `tags` and `ddtags`.

Attribute search queries without an `@` symbol are matched against the `tags` or `ddtags` array.

Example attribute search syntax: `env:prod` | Tags syntax must be explicitly entered.

Inspect your data with Live Capture to determine which fields to match against.

Example attribute search syntax: `tags:"env:prod" OR ddtags:"env:prod"` | +| [Reserved fields](#legacy-syntax-reserved-fields) do not need the `@` symbol. | Reserved fields do not need the `@` symbol. | + +**Note**: The upgraded search syntax does not need the `@` symbol for attribute searches. While you do not need to remove the `@` symbol from filter queries that were previously using them, Datadog recommends that you remove the `@` symbol. + +The following examples show a matched log along with the legacy syntax and new syntax that matches the log, a description of the differences. + +`{"user": "user.one"}` +: **Legacy syntax**: `@user:user.once` +: **New syntax**: `user:user.one` +: **Difference**: The `@` symbol is no longer required for attribute search. + +`{"status": "INFO"}` +: **Legacy syntax**: `status:INFO` +: **New syntax**: `status:INFO` +: **Difference**: No changes because `status` was previously a reserved field that could be filtered without using the `@` symbol. + +`{"tags": ["env:prod"] }` `{"ddtags": ["env:prod"] }` +: **Legacy syntax**: `env:prod` +: **New syntax**: `tags:"env:prod" OR ddtags:"env:prod"` +: **Difference**: With the old syntax, when the syntax does not contain the `@` symbol and is not searching for a reserved field, all terms were matched with the `tags` or `ddtags` field. With the new search syntax, there are no reserved fields so all searches must be entered explicitly. + +`{"tags": ["message.log_level:INFO"] }` `{"ddtags": ["message.log_level:INFO"]}` +: **Legacy syntax**: `message.log_level:INFO` +: **New syntax**: `tags:"message.log_level:INFO" OR ddtags:"message.log_level:INFO"` +: **Difference**: Same reason as the previous query for `env:prod` query. + +`{"source": "postgres" }` `{"ddsource":"postgres" }` +: **Legacy syntax**: `source:postgres` +: **New syntax**: `source:postgres OR ddsource:postgres` +: **Difference**: With the old syntax, attribute search with `source` field would match both `source` and `ddsource` fields. The new syntax no longer does this so you must enter `source` or `ddsource` explicitly. + +`{"message": "Hello, world" }` `{"message: "hello world"}` `{"message": "Hello-world"}` +: **Legacy syntax**: `message:"hello world"` +: **New syntax**: `message:"hello world"` +: **Difference**: There are no changes between the legacy and new syntax because `message` was a reserved field in the old search syntax and didn't require the `@` symbol. + +`{"message": {"log_level": "ERROR"}}` +: **Legacy syntax**: `@message.log_level:ERROR` +: **New syntax**: `message.log_level:ERROR` +: **Difference**: With the new syntax, the `@` symbol is not required for attribute search. + +`{"something": ["values", "stuff"]}` +: **Legacy syntax**: @something:value* +: **New syntax**: something:value* +: **Difference**: With the new syntax, the `@` symbol not required for attribute search + +`{"message": "hEllo world"}` +: **Legacy syntax**: `HELLO OR hello OR Hello` +: **New syntax**: `hello` +: **Difference**: With the new syntax, [free text search][/observability_pipelines/search_syntax/#free-text-search] is case insensitive. + +`{"user": "james"}` +: **Legacy syntax**: `@user:(james OR James OR jAmes)` +: **New syntax**: `user:(james OR James or jAmes)` +: **Difference**: With the new syntax, [attribute search][/observability_pipelines/search_syntax/#attribute-search] is case sensitive and the `@` symbol is not required for attribute search. + +**Note**: Using wildcards for field names in attribute search is not supported for either the legacy or new syntax. For example, the following usage of wildcard does not work: +- Legacy syntax: `*:something` +- New syntax: `*:something` + +### Legacy syntax reserved fields + +For the legacy syntax, these are the reserved fields: + +* host +* source +* status +* service +* trace_id +* message +* timestamp +* tags + +See [Reserved attributes][3] for more information. + +[1]: /observability_pipelines/install_the_worker/?tab=docker#upgrade-the-worker +[2]: https://app.datadoghq.com/observability-pipelines +[3]: /logs/log_configuration/attributes_naming_convention/#reserved-attributes diff --git a/static/images/observability_pipelines/guide/legacy_search_checkbox.png b/static/images/observability_pipelines/guide/legacy_search_checkbox.png new file mode 100644 index 0000000000000000000000000000000000000000..88ff75804497323623d0a14f4ef3bedb11b6c526 GIT binary patch literal 32309 zcmdSBRa6{Z^e+em4Hh6sAfyQi?t$R$5Zv9}-5UuBBxnfk?rx2{1q<%dxHpY9(Af0% zzxU3Xr_94V4Xdh8QN3%`sa<>jwx0f}q9lX+lKdqS5)!VQtfU$e5*i3`+>VKk_$&~- zr9uqI?rJjPNL7E|9wPqnvDA^XQdC4@L>yxxp(2wbq5VgK*oBcP{_kUHWO}3*|8pJ% z2`Stb3H5)|C?UrG{(d3$|E~F8?Z|R!AJ34GM3Lkq#WZ}7Pcku5<|IkO!Wnf4R9e+EUJ(!z)FMq6-Y_b@ zBL0Op?GIIyR4u@kC6FxmphKWa@IagpqoLY^j?yavUd=pNb#VG}%69^8&&En*;Iv*VYA;zSik zN*{k!V5-z+RydJjfBDzcKOz`){0~kdzWV<)qrPc4I4{>|ZA_H2XKtVlhX;Hm!VFBh z{{K1-Wh=`LfP!3}sF4Y&{;`Gh)BM`HO1;!3Y{DGN{HJUOqxRB?MncYXIX?bV9z_YM z5OPb{jK%!_BHy>DC5w33#1j9Oq>sobr9|yG3~E1^N(+Pyo#u?ck_Nx|_ci?jAxv(* zGIz;aU88ms;}3)ywLltA#`kK|vVv(mzii|FAyA^fKfW?w4M5}H98H#r`0^}OnSxbh zsin27VJ8C_!jNLQ|rtY-ISi$}P}_&@(m>N!BXfd|0p& z+SQEz$J~Me$UfJ>k%X~?&f9!8I1ZH z37HWT->qmu@NYVV91eKhR*?Pv*YsqmuwG%7F0MD2R(1ov|C2HpHBYX)@`9mG-Ag3ukm@BY|X9qbP<+U+Wx=iTg8FGz-n;iG0?CG`xYA~_fH!_n1;Y= zEX9nwe+elPmJh->fan6E6#faGza|knrew1<7W+>IbQ2*MFSKcH@$VP;jTXUoaU$!$ ze{(1c0qhVgz=wZHGQyH@A?`_(#(VkUp8|X)864rLd`p)4&j+B&#X=a9$^KNpKcOj@ z4q?6gdx!q~`vI^NgCii{X#YO^`?U%Z*Tn77sCbDr0oEgL6pkSz?%OZuML_QB=u!qWBW!IzlNu+@XwQa&cS<-@Q} z8qx}y;@6cO*$r^eGx77|O}1+$bxnwl|IEQ3}LIfG`G5HJ_(9nG%I?O#6M zqXf9tcnU|pUuS4yGBDD_!-v%XMQ#`9CIyREeukIxvfYopaq7@q_1KQyG(zd~rRw&M z!0?HZNBQV7PSm{Dpq5ysMN~MFMD#&A*3C%d5%+rZSX=Z-1r_g|;7(ikg>aQ&QbB%PJN-c;D?P$Yqnj_cPJBK8TP; zKAFIig6nl+`NFG#Z07gEPdn=8qlYtQyZ7baW;$TYO_-XjS+RH_kd-b%3LZy7QWJ}K zRLhNDre%tyhFxNL33xB~t2@q%=wY`+d2WqID7*CPonLLP#nUAjCK{7$%{tWspC7#o z!Mr{PlZ|1S3ltJmrA@J$tMoW{w4W*0vV$IJp6>RuT_Psf-(h{@()|xxM)DL|BHqQpMpjz`G zytofCc;}~E-a9*euU&gv5B2-yzF};A?>=4gmrRF2G?#(?*My(Tv?G%P^5SgF8tM9E zVhPH%t7F`;ymv+j_Q~-3*+RZmy^sitO?cr0h}19q{&bWG{hm=s*rh!&OOz(+W(R;c zT0_hVO6XVUdWsTz%@HP87M z4@d%1l0OePpne~3sZnC=KC$y@5QizwN-;eG?s-JN`*$69FR4^IHdsM~iGDQcio1~c z9*&!`sddnK-@oP!w%qN>{6=$@oWWPHyTjIXVCZCynUiH-=#?etD|ruc9O%O*Ree0A zaB2?8_{|aGvYaFG3|BXN&)meJ67+aIHI>=V19GWi=^S-l;5Q-U9T~%RC%tmb;UMyG@F8Rb z+xGI|aykg+X=nUAnkAIJe%!QE z()=pP=ZNw#<@hJE1DEX+tF3RGrt8k$U$==qJo^LLO30*D|aWjmdKXPOKW&m1#XseSg+HinQJo^aeaRL zE;-Mv+p7pqd%3Um{8p_tGl70DKGXbRX*b~n)n>rUywqhd&+D85cZ??~;@a{}NoD-34Q$BV znfNG<^n!qb+ewzXumu!RtH~(Nfb|85(sa$2<=6AOp)ml1p2h~7+S0`^U7WP(tq)Z& zTHrWxq|YB}T{_z;;LhxV(mbhmG^ua~cgfk~4fX>K57z$j@0HIq(!TNL_ltGDoafuI zB0n*9b1eJ(JRev0Unf`LmCFIw>L-MXUBpY@{xtI+7`Yjk+^ltqD%Yr@)&kZr?o_@J zwx~H+D$e!+>8jhlx@acuRLQ-U{C=_9zk*E?ffY|zzHJ;(%Ocm-U-vRQ%IkNcnSgM! z8UN1V**MVY<(1;8eWv=j9i0c&Uvgl6xP z{699Kpj}`v$G=(V1eCSYf9dguYEC^pTq@Vfa9f01bS@ZrXZ}g$EEd!j)jKL~q@&p9 zDbj*2UFK(~!NdO~G8H!)b8|TrEmGdyS%(}lsH|_i;~N%n`+WWa1FuA#tWrW3f`a|C zPX@0X{`E4ICMbbPCG7_^NuYw}97S{=*HcKnD2n<^QpJ{$@5GsSWKp*>d;xr-@*%-? z*OU17_48kWQeJ-aZ|B3ixuatQZBran+gX^DUw6`_CFH%VUBNzD;(>RdldD} zibD3i60hnb_FuW3ZJ2ghqd2`eb2NQ#Xr5&8r*yk~n0<77)9n+eVSl7Zm-hZQc)@{(S zo2$XLo1jLUa`t0nx6@UT5$gh_xAg?jBy?cQLfrMV9-4(AqnZz%mlmkpMQc&!S?r!7BO zs*lv?v|z7qgnbwX5S(W~m#;H})8+ezDwx`1r?PRbtLi^-dtJ4mK_;fmhx%{8qt5hq zh9TTc%2}&1k60gCm!o(1yZ3T7kBB@~npWsVmQ~eP8*XeUx-ll2pU@?RH^Qu0GatOl zj2g>QqmQ3rjHx+9+UKWs;7V9cxYG;!vqMu8De2AzmqrISxhuk1sU)zz4sK4P0w_Ia z)p|H~RD7{gS+@5Vph8Wf*%@xkv6r9o#$AkL?AG3!mpA_Gt1tq{aoh)yQRvc(t^QKu z1lIT2C-=O-bQ`0oG7)~E4k-#tV+rN#KF}l(&C)+r=FqHWUAY-0bAD{8Uel!kNHi23 z4{QaRGJvLx{`vs*x+@rk45!o_p2_l=Fv(KrsA*ls89~);td&>E^_q91 z$;{=(lj45t3tpq{IYb=rcz<;vAOalJ--_k|UkO+}m8iFYy05BSB=8cw;d*s&>;~PjcEf6hp#uf7xMxV_$OqW zD0WfsLM=N`-PJdea(wHpwo=1z$NJ`lh4}?MA$vA0{0?U(g|flb%n9C+EqflAWDfm3N@UW+cykZ!c<$7xv8mPQefXB`TAFWo5GhYeX2bE>E7o_K#yP%9m`8jp^3Z zvz}XbCsW0-1Cuzh-b(PR9$>8a8=k|&Qsk8)B{z+7P$gTMW!oML4Rc_TB* zkuipCgSMAvIQb5i@*=xBTsV37Nl+yr&siLedTCtMogR#FiNJfOWxaczkEbC{$-j8l z&A*VcT#Z^EH7pEN@O9#)_@bEldqP0?9 zwlfL4iEz{Vg>vVhxl>{$SV;=M?N?9kY43Pq4l9huU{@kKIMAEfxK?~ad9)bdNMO6W z0d2;L@1JJ_mBm~LI8Q7Tzi=|PSulc^Jdg0>i{uosskDKWc^tDBj+PRPlYKj;&NihlQ50+Y z?rb(gJ}DUc=u-Ux%;f{xxS31Pn&>il3@~CXS#I5}pLcG8JX*EnTwxym#sKTrgVP9# zqncUOYavBl=ET#cL-v%4G0+6rWhx->puDnPx9G^4c^ZL@+&+ifsfP!TvQ@aQtDX5C zfqNvUR}FJ4SL}N?zuw?M=ZjbZCX`z0cKb0)?I*X20%b06q~JniO83o>QHWadCn}}% zZ}z?JLU#QwG7IEWB_e6*E0t@Ct~DO)Djd>BV54~cjzG6uQ!*OJ-Ea$-n3;0OeY!^K z%SX#;*JfNLD$BDOZRiprEYg*CY*)Z0ZUxuL_73eLauYikC!iW+W}tUVwi?9;NtJ$+ zYY&zXX4Na-VhGcPgfUa&dEJ!OC}!k$E{ZQft|1BeN{6XKMhQO01;1HB-OHGtgo%pxN`{E=h<~)%nqS!i zDfiV^@o`o%21w=WctE-O1|}c^zTO?JC{S7(f~>Tcgt3?+DkfftClNtN7!Za{`|LT7PK zMm@F_0hjH1Z?(JaMQ|Qj=7cE9v9Ee*bZZncHp|9Rhcz3rRI%Y%p3{0=VzwH(rvw=L z+fa!!B<*uWN%?NCQOM4V!(p>Kjv=ff3gy&OAw?g- zBa*&-F$~A0cuZJMi-!@RkAer?kor#ObE^*FVIJ6Dy3CZO3-3ph)F>eGPY-AnCMxt- zl)StrUNpa3@tNoaNq;3mt34cUT<|6;v~ErH(rjzPE@z6m-ec4U$UC}lfSGt>`EjHo zk~r(uttPViVsWb|u1SM@&`pr5EH9H{Sqec;Lkd+oHRo%)wJ+c3#OJ@LD16T8u~Vgb zq*#%wZnyLNle>fM9Tt)rwysQ5Nq6Os3OOPPM}A2;Z+l!=>2l!bT#fEcX&%^D*Blxtq9e9luYQXcIuTLVGXo9V1G98i>2+djR^&X74 z(K^})T#>DM0hX&tlLksY&YA^=TeJwxXX#$&lI=Rn zLLV8AoyCcQJ|7bYd7XY0XF;J#&!TXZ@L(km%0k5e=t+l+O@J1k)b~%G4Sd%3ar})M zpWzrksSO4I{X=2lJ5{K+*F<5}nWDB!vD@3|wlU?*QHL z#hr|gSIjCs#R{1ulXi<)S$7n+5Y2%NzX7;rt*3ZR&QxqQIYy$$+3w3N zvh?_1bqy+2`o&4Rc`t5Y6s2zm6Exk^3iMBJ4~*CZV81SQMxs3eOH*L;f#7*2UtP?>g4DAUmsiT~pBfowWk|3XohEkj>+T*Sv)v2VX|z9Q4o z15}J(U>UsVh9Bl)ykr9CEwhY6rxgbq7K+Q^A^i8lblHpmZGK7|E0Zf-Y-aT|E;|bb zB95=orA{v2k-r17qzYaXN;BOV6f}7Ha40G)d=`X;7;qdstj?mbWo(}A6>>W!T6z>l z5Lc3NA1xexwx2`Mre7iCQ&~8+%>JsCtm)i1Q9EBZqgiT(Hh?w*y3%OxkqFlZa4RSJ z$zL7J&(-lt-=o~n3`FoXl{XKioKH!3EjLV)L9BWBBv3ptMy4UgK*vVDRt2RM+2g=R z{>H)!$7J~smmmCZlFUwwAngLu8Fz2wEG-Wyi&!K4;~AWm!Yi5O|Ew zeW2X!715{d>xGAP06(rnI+qi@z*tM6raG}Eohy#|SMQP1_DbUb0+B?iPQDe)nHN*1 zrYcwfpPH9*fzsy=hdtw;3cm;#)ys2z4LV~gwr1`otgj8oA|K%J)9{(0RLnycMjn`?JFf+MDYNg%e)FI^9pH(_;?s)e!CQ`;sx|_WP-j>ukU00Y^ zk=|}84X78xDmgx6nlU0))@Fv@tg^&~ z;=+ZZd%9}#rFEP>oduq*c7!*I{+juYz%}F3Wkf=(%G~cDhy}Lj2e?YfJK3Degp+~R9LsWovZm#Ss^W^{K(f z4`5{X3TGEj(Wgi)|5$F_36!t9f^fhAbVGn}3)GcQP1oJEbEWjN0QV&Zr4_dHMRfVh z)$-8HVG06BS(c&n&FR5y9kC*JI&Zdfs%>FQs!9RY?R3@#;yI|SusW(qVkjbLRLomC%5OXE`5F*FhYp0Mdg z89d>kB!CE;Z;jo~pI$5ca;j5zR$^0%r;R?kJ+1)&AAYV!FMD0w)*{@5pLv&yx-nEo z7pGw8rEMi=f5~p1_qwVGlV(}Ls>y*84_;nAHVrc>8~vkcAzuGXmxx7bLjsfbAlzht zV^yENe#6XIs5d_BkQM8ZIy0YV1dE#=-Lx|;P)cKKo%Y8&WPC<*@ z#&~4JkL-^h)?NOG;>6`2KVbF#W5HN~eHi|{gtlvJj~Wc+l)ei+gfBB&iKl@?s9NdE z+2tL~KGiAmjv3yUMzzI}V5xV0vJ8bBlX+;@7h-%lFVH@rj_~>mg!Ks0Gf^Ehi`!xi z*aqopVG3*b-}vZ4{2#;j3spnIv_6pqSF#fGyP%I&2R|#vT+tYB62O0gv zm=|GHAv#5<8H@|>t)LAqd9cv!7O)U4BCxr38d`;Ly|#EL-v0(+*|yq#@z7m$(gxNn ztA#bjJBmji%{`Fib}A)gQev*-x)-#S^uNN9w<+Yl2+zX~#e@{v^I?uy{q^YPnTXP@ zpXFNxG!w8}ubOrff~j*qk~=!)2wII@FtnRKf}6CJ%ip~hT&AU0eecutcx!&Z(BQNp zQhjYe{3+rYr6WBrMQS$wVj8xDy}bvY3QrX_50ig+4a|7kKLsJgvl^xbM#WH?PcW8s zZhSp!+wiO2YRV}!!k0M^ zJ(LV{xpJ4|>DKdY(?aex#)@=XM>Z|k*99Y=_$yps+A)YuXDJ_eY8O!aZIpi6dDZ6n zyq6_g$RMC2-^3(u;N4)mZ%E*dJGHv1y{b{E=uFSATb3aFe5am!K*?_w%&V)iuejlPxs+ zt`n)q$@<#ARsGwxj;J&?$=r;Zs-FEany}YrZ2DD>-=r)dL5y_ZYI>-UTgYe32i;UN zw^IG`BHxkapfU|P`=Fq)-n97;pG994){_D>rv2V!_Jro$7^yFfQJL&w4&ZmkP*p(e zJW1q=XimRt-AL$f32f$(h5$NJ{kiEJBg2m4CKlZ-IeT~)_$PZ{j?$4*+L|V=fq+d< z#7J&I1jk0rr@dW^LERR+MEK7KdBMAHz9X(+MMQYAREq=(^%DaGyh0_US2IaG{+JyA zYw>KBnxPG({B$h&E3>uHe1(g1QOFGzo|Nx4)$j6gx;56TUD`9d?Tt>Dgq-tB=JD%p zMany|t&dXy)x3p(lSRrFH{Ifieg)!LjI&L?8fWKYJ~FDcc$~NVW8||v;j~%tHkkaI zhWwttLdiccH{r^Xc3N)QznU-cbD15R_@Yk~_ajK<$R=6*HYawzDbASoeV~SW z3NVDehIOHCr5T)3nxE}?JI#$D;OP?(X(An=k5ycWo4}1;HR<~;xGgK!A}pxghvT@I z?|P2kX2o^o$+vPJWaa~ZbF#L>u;~+XQV8LU+=Ic#;W02w&mLB?9GDsya+uncubX`@ zYj4FINcz)fxJzd$kC92IE%qIcnC_FzZ||C##Av7@r$J${`Mr_I$xleUZwnshqv-vV z1GIK8VGT)i{}^G~w(0s|cK!&N9~3qA>6v@{|RIlGC zSssYtAC~thgoyba%WiLzW|EfSepjHR^UQX+s>a=qPDioo{JAl?EGHs1KdvcxRQ_st z!Q=}(Pa>M1bQH9c!eVn(Pyj=BSNQwS?|w+6oW@f?8U z^24@vQ?;q_G|LzJU=avH^+9_}hXQF10s%=f$!@ZEWN71Doo z@4mHz_4$#~w3fOxN!5Jt(69><_o4RXdwNI3WAUzFf~P;}Jj&fvGos(zg(U)T3 zue5e^QBB#qQA85T7b*zW+B`s3HlhS nhdBd43~k{>Fujd;@+!jRjZheI$G*h2Hj z0{?W|?pI}6u@61UnDM(Q(J9OC>AhU8NWMBZ(XTwI4G*EgKl*gK{T;jWunfiy13MiB zM%!tkK4?e?|Ekih(Md|0JDxu_w1w!dFY|ckJsNS$%-`RdNXQ_E`p5(dGd|sJD|DTa36yr>C#|R?!VB%NajFJ@Z}rAtvVfTtm!md3ieYZO>o-+f;w?e$jLFFl zo4q!rS0XW~1d+RWTep2th5U{7ey8_4e^UEOo9*6vt~sSXval^|ro=%^xK{kt&#gvj zRqs<_b*OM)V~0A5Vew;gI>Nxf&QEr+_Pr4XW|A$00|$bgu6-dHQtb;b^%7jZV;6dlFf(3BEA^7sPx(Y5hVa+D;=qHCxdbWH z#k!mLok99sK<3S2##HCgx9kyGuRnB`s@Kk^gULzspp^k^ zCIP@LacwP5Wq>3^Wg6v~Pblu=;F9U33p!YYfZXYvL70!PwCX!6Tw5L5q4B zR@w*dA)q&$gCN_GUP(8>>DFvEXCwPbtjM_DwU_9cD#qH?FkOr8>a0Vf0cPa}Fq75t z*#eLKsUU|v%;8v;BN-*tE_y7<4YFiOYf=oN}el3gj1T_Mbj zO@=%@-fLW`O!#S;pVuOqR5&*-w+op=w#vN2fX^Z{QHMrZ#4dFXb=|)LyHWGUl^o0S^JO=lR#B!tcvkEx`*YmeG-1Iql!nJV*Mm+{C1;BWFc@ zA6bYQLnL|9c%gfKf6?Ub*=&1CX&R>(W}o`c&4M@vvw!1RgNuG)xKWgMu1v_lSD0m* zU7tT!2&{Bn{gx#%i!eJ!id_Dlp8e)DJIIWsXl#3N=nIB$ZnopPMhgOPU2^@f%uK(p zPiJ58fKL;!qdjY^h<$eP08pJ^bZpeWNr6gJ-DN$br6=puz}#4X(DcmM*GP10oo^y6 zq_jA+B_eubw)raSXulh5GZTqa&^=G4=kyA2vGbDrF0c+sKSkE{DkY!t@1nd{Y2^(( z>^ifuqB`l5ilE1KW)JWlcv-k8-J(5$rvCnHx3H3RF67lSbt%HE0%7^s7UO0!&cTi1Ygvn`~za8UYs%0@JO= z%EC-3iXr>vE6K(YLlLB;03f_n6Hn(eIw23lC8yzJh_s`AQO|^M0-ssxbR=2E)5SS~ zm8AyW`qT{?n(Nw(*k|JVB8go^&{;5!mT=u-wKOD%njIfi9@@M>$Wa&{6SL=X^R>ut5W{bfWHQTp(DR5cx}HK6JY~hP z#=Amk=0RzCXpH57LZVwK()dkidprtIS+cxxZnxH%jr_RP1oF#YV(imsyg-xC&)}{P zj?a0T6E8^U_xfAhL%P0ut|Dv&B`t%~8VCrpclCd?0(J%5iTKwc0)p$cm#@s|CNIe= z;Tfl`9`EHh0+#Kc&cuX0r%^+evat&V#HxDE`!X#Pej!yB13Mq={&2oOnLgj~{nP9<#^SwBmFq zxIb`@Arq3Wh&YT~s8p9}pWPdfjsI!qb3nK3b?_1IEpN^=CGDDM(l0oc`~yL=74gdX z_gU*)SaXAlzX5Q^WZ)!L7%s~om!r|k*ctcdkgC&(!%_FkU$SzZM}Z7Tb=M;a`{Kl4 z!|KUWo!(}h^+YbY3zuFr`D{}R-5e#eU~yqoK+8_TNW0C*E>-5bNnnKM8UR02bLIJR{^ZSzC6-&8X_ zs+fJZ(dp_#8*Xvmub5hFb&Gq&L#SkU*82wg84=zZ-MZv|wddF!q;O&nl5Tg_tIkSN zul_yKOBOc^yj>07BFjvkvtM8sfccejg>BrL#|n{fkX94a+>Y}ew!T0Cc+VIEr4k1e zZtO9<$@YA+Y5FinBP6qrX-JO^sEgIiOebzhW}9fEDfA*7ZwIRwNn^h@JC=6{67^Iq zI3%+py|Rh$&+!^=2=KHZ{pZ7$2%aPsj+CK!Yo$MOh}^D zzz7ugUtyv}cYahmW5J>aI6bdqbz5!;cKn|PkmEKWB_SuiJFLieb=CW_eb5@nJxXFD zqIV}T{C%K$rSmpV!-Y)?`|}57=IMuTS3?ws0wiFnB7z^fPegPv<=Iwk#FfYFmmD`l zc^xu=QwPwLT@bXbG#|!Q1@ewSRDu7qU|>$h|b8*<2b!`Fp(q4G5J;Y zG`3wLPzH2!cx^-*Ek;Q?nb0V$?-#%aYrHGY-auyReb2lE_S*>o)EAW>W0c1h11t1(E3~YWaVWz=Z#C(!`*uUA~XVNsOa< zFLRY~jQ~#eFQelG<6c!bfznzy;aluMu?-o@5hffZaTmeGD-+^B+akr*Lk17%RS_Bd zZTC0#%qS?9T^>trd^x-RT6$d0tVP3OT$sxjoB4yN5hT~!MPH{H0^I&L@)~eUwA_uy zI8%o968d`wTkmDH1wiE`S6dy^%>&*(9KnV1ck>i(-uhDkBFa~3_FTy33h@0(nq?l^*c4kV?l+GUECo>x| zuvo*1XtcNrE-B@Tf_bL+nu!Rn_;XguTsv<;?g0*CUfdBj_~ggNsC%N=xy(N7Sij-bHYL*u-M_RoN>0&1z)~+ zk7Jo@JFc4Rpv&~&a|ohJ`CLKFPT(z{NN>6;Y@@YupvA4sf?YgPYW3u+IR(#M zg&<`A>*HT4()#I(8*r_<^LD5|{OV8&ekGht6(rYHY=nCK7MoW5%q*Sf8B!A;YLCxy zxl5g_%+swSy3CytsSUt~THn~c>)u3suYQaERxz1%FE5PW7w6N_ zp*K9GWdMVYS)M9|dr1$D$EJ5>I+fGuJdeA~C$ z8lJDqAMXRF9pgxv92=9Z#rGi%z#NwofzK*!4Px+f&csVA{*=Z-%NUR6tJuCaKq!G9 z1cRA9L6=pje86#~U^`vE7}PHaZ3t@HB)yMBdXY^$G7yMwGLO$s<`r^Xr=_Fiw``s1 zjK6&)kOo~G7)=^rpjd`aZPV)Lioj)6?Exdym8*k(s7hKDDy(RJL;jBT*UWqs3tLy~ zp~l8ztHBk9OHiW(d{Ikb*^Zv?ka~N;!~t9kcBM} zq`r6?#)D(-@kSM#X~kfYYYSC<5ar-bghJF@d~42i3`k0P8VT$RRuW@!rSp&M3d7cNfAGt3vLC`(_8b5_>Ot4!~I&mg` z=cCo==ir7Ea5Y>fzyT-^`Dymkpc>=rXNaH2F*%~(;Oc$4Ofz2zel;09tC-4>o)6rw zLY(Ft&aTpVUr{g_1lJ*NGtmO(Ab+bNYz=#%T1)voJvKr|U0A`n{j+)tU<$x~z}sWz zx*h=T!=tI?(_~()7#d|bxZGn?89}2zRXH?1om)9l*%tFMuZ?~{wEieL{B%up+Z)rZ zy?E3#3l6|+YyfVeb)j#a4@Kyc9O!o~GU|Z>jk*cRqbaK>%27UabiP3U`NnyCdidiq zEJ@#q0MSsVahD%}OD>X6&OvY2O&IAU9>*0p{d%g+4#AVJU3=!gmwNU#zz z@cMCix)B34KYh&~Mxs&@f_=2(5A9-$y*tf)X>p(Yob_;oc?yk6t=BBZVPnQ&?S7mX zxiKfU1(oDk{G?+k_te>ko$`oQIX#Lr{-Ne~Bl86aI(*CjOkI>M#x9DAhWat(*^;;$ zHt}D^m(O{uLyVwkBIP{{dZT;0wLX@{sg1*x<*(1t_k?8}ugQ2Hpkh8*Jm6kA*D)9| zdBB`6tdt3B^=PYSJ>gnIzf!xo+!(2#Wt$>_x~ z&V1$4S8oUZ1N5Jw4oSteadvUqE>ax%Br4@{8-7EyY|esM08~@)cQXhN0RAN=5ni^h z6yEohuJL$|G}NNQX0gCl2cT>0aIYr#9>W`s|1R(04*DzUuTRY6dfu4NJC5#>LW8Ag zKkd6)?-i{!AZ^7MrB}|!5^{6LP_I(^*mu*8Q(^;@S`S~6JDA|tfQ?r(-k5|G%Q9BZDm z?7Ix+4qW^*HP27)NzZ?$@u%S=DW{7frV@kBxrlK=0w09;5In+(N&!|!SWl&EYl zl9&yP&|A);Y_z%0uQSP6QD<+Gmm6xoHX)X1ku!@Kim!k zs#YG(JNV76bOuJbGJ4ujus!V=blAOKX#=nu2fCLwO#5a}bOiC)WmDkG$MbsR2kJ>Y z=%jI3E613cBpI<2u=O#pW6+R7pDoy)^7D*>6Es1^@t3dT)cVcx5VmHP%EI0?B{5@A zMzzsr5I8@Y7?IIGEf$$N?ALyrKQyO+KzoX!DX=QC(cbU}G|L0PAADkS+4w|(m({BK z|25LSV<5Mu&%qm<>H4W|q;67%JvabSfmY zx57HbUFTtN3HE@J{1-MOvZcK2EYLCc5ZHN6uNlTuz_~T4#~-~$8!M5w^UeXU#ojL{ zGU{d)7%aK*~JD?E@D9{fiImcE-*nQ2-UX`K@*VGSQUfug`4y zGf)M4i7VWq&;YLBo*cPL64yL4)P>}wQ&)a{H}HJgcZ>zvEzLPR52~vXz={UUBP08mGS3ne{zd2+hYLZRZu(cd+Y2_c@~Wi%pO2V(ikDajIJw zv5Q91#aZ~{tq=R?H-DXnsXyqL|5LK%FvDT8!x0C<53P?T+TYP<$%|+%r~S3einQp` z-;bGg923@rZgjN+i9_4Gt8%iHyTgPr-muRXe=lX8R_*jO97!`a$=dJ}yl_G!?tqW+c! z$)(QHC(8sHoN4at?bD0=w!n^7d4gxR1=b_-sZ?wa@Dw**vi#HWE_1HSz^K4{7Di|O z*F@YGj6OqYYNg`7wMJes8=V+8;KS6uip=Zdh4iV}&IJ$&cAS04ge-)IaHuoNmF}C; z-mF}Fg|+ulgRR@7OIplclMtJLeu~oDpZ~cTrTZza-{IdvKL3&QRlMaygDz1xw-1y5 z;F+Ka2Qph#u1ExgZ{ee$bvLVah5(uzjT@=}H!hH{>#|IV>=$53FR{$No2qyppwV`l zut4IH;2w8S1axr8MK{N`rFN(fFz`;aUmW|ntO>?)HyT$Pxxy2i zs{0fKCWWnJ2DJU1_YOf_=0%$g(8icFTiPaXd0vEi0}<*yjZp6-m#Xnm0Y;4{-e-hy zoV}^Y$_z74WYp@XjX~%)H)jOwhH5$e=l0OgeIp;$>zQKNSmfJ!Y@FbY75-dQbX&c% z^&`4_&K}gN5Nt5CJ`Zf&oHuiigfV`&Yxh33;nDE<#b2a;}5 zF+c0b*Y+AcV5%C;^(L?WZLe{iO|H#sjcSH9a)>IAiKZ24K*lULNksqGsG9$)y|<34 zs@vlJN$HLwN~2N-6cCU`LQ3g|LkdWDH;AMljWkL~cXvx8-5?=xfI~Njck?{=-tpf1 zpuc~9f4*Zd7;x6v=j=V_Tx+jA*Zh8#M~K+m1S)qj8)R3-)q2|!qc`;8h1P|0v06@? z;r_rS#)C46R7s1ycV&i(fswUPLXdtRL zmJ}A++1v+V(^8vA>lyDR57)vY`Nf0Y#S9eNJ#y-X=yVSkwIZEbMSks7njC8OruwRx z0gj*Q2rJYcLxa&fQH?m__}I_WA$e5G?d3Z2GiEQ@a(tEgF@@_-U$@_TRa9CZS@Fhd zHfm~adDjs-C&h{~_iPZu-pGAy{w4B7F7Ml7?=wiLi1@9-I0l;Z0t1z2X^q1C3D$1; z8a4?-#?Bh^6B8zuWNtP7rDu@)uvrX42^rm5%at(`e*2Ox*eu7c`vX^ZQ*#2U6msl$ zFI^2n8n0ZOO!}-_=&`H0ja@1#S<*aJ=Np)c%q3Aulkan`ow#LZ< z?nUCY-j2cD7F(9ch9n2_9LqfAQrNCA%y!;dGU=r5h17<#aGtVly~=&+Htr0_NX{YE zhVAHyIP5|xc>k-BXMFjKm5K7p&hPr7;_de*RZgHSuy_2$R?u?eVpxRIxeb_@nfu(Z z<&rhG-cPoYEBz%L@Mb?p^}|f zcSFT#qzANi6Lv;2_EX~d7DLo+4ZO_^HRN=ANT`Ts&IDUOr9*~lh*98B{l(;mJ)H#w zV=vjuZ^fM0pbuw)9oQ4X%T->1m)N!El-T2fd9Vl5lf%%i&yycuuyxI-vQsa#!}cgBa_pC9zb&v`BsVl36ho zQvpbXm~CE-?s*#t2fmw@o5gZZ%Vg4A&RT+$pBZJgatwWYcQ#yfQ~_(Eefs)R%pc{Z z^(ST#S<^>A(99hv!gasexJG4;>AJV`6v_N&+z=yqHr6twenv2M^;`M1j~!9{slQNp z#POBvO4Jdui$zO8;d;`%%f14F4DxDAmrTi*4;Y;}IkoE`zQ@#EUhF2lU^FrIR|P>h z>vazIZCcT{J}(XhIoR30ZXmYxbjd&?(w+sxUBn;`kEVHQ&b#{7v8C9oE9%!H=pTj`8^!85wg2F z!?11t$c=s$jgvFDS@x<#!tWR0taZwUS|6s|`|_E;LC0`w zYgzCNPt7i3@t9o;G4$b7tl~Fji3p0=B8>Mw2ZG8b3o@-sPKdqxZKoj2dWfi(O_I;a zURZ&NByvc4!2zAnRQam1ERY9CGHGM)$Y>c1$=!54KNGd%YRw9b7ke`OWErydNY7rns@Wz#K$e2H{0BZaOg-lm zb+>hBa_1;+yx_^tP!%%X93JQvzi`Ci9ng_H@!H-oi0X=YB(HfZ96)^ zoqNhcs_Mx6R|OUM&=uP`yjeptL6nUu4fdqkVy;W{p_>J%{withM%vd zPmIFPJVD=H=gmhgX0G2f;_vebjX=?r@8zuQk1xy~w%HTycx5N?x^Xrr(VF^ipVDYH zA6FAMnb2;o1oR5cnIB$+W2%Hp4s}ahPZ$M7z+PtJaI3t7+2FC^Q*Bl^vg#UG|Ckh_ zaimLl40g<%rAl{VW65-x ztMXL}pA_b~f6n3Gfh|(yPf;?kVAM$G(UU`r1O6q0FH_)qmnvV}UQ;O1vd%v^S&>=uygMBc4$MtLt-4g1F z$wF_z2~lW>Ro*=-f~7IHq?AwO=#RPub?laU*#Yj-8BvfU)4F$Z^Iu=liXKKL^s?^e zMV|J`oU=7zq=M$OzS(H8o%Chb$0Tr{2Jtu9!ZWRor&FlyA`iXVo?T<+vkracQ$r10 zE^j!>kdkUbc}B9=7Jy~OG!s8t9m;JoSapv@voCQ+DL}Rf9%**AR!A3ycQ7Fxew09BN#q0-rdp<^V?nxB)}EOX);z%wD-&Mj z#9(Lpo*v}C#U`Zo?Re7CNk?>vi}Kz3bXQWD9y zQ-(B>$37b&gH{OJ8PolAM~&ccZGd?sM-Jpl8}<@uUlPG9KY~)=39C*W1G`awrfR$# zW)U@<$5}QO+AI?+Yl1OEUO58s}S?!cVJ=<#ul zY#A3@`W{KQyiMgT9k0s$WConJ+7`W|YgeljtThNwX&~eRPTC~PMINr=bq?D?k9H~a zcQK@VU@;rRvU#2j8`=~~G>C+IA}!G6NT3g84AuN?;NSfwAll2Dk|nbZ5BoDnP8ccp zHY+XmeyHHjWF^{LY}9K1{XbHzB&i8*y&Sanne&e*A>mbktQ4M1X88ZX%cH%e91#eX z{}~b#lng|1B!?m3WA=!i{M@lm5{z0GaAvM7f41gkX4Vg{fc4FP=Ytx_Ovz2o^{H z!p8FdAXNYH*#F-UDgfK~-1e8mA46g(7zo4EJvR0~x>#6*NHS%Z>=j>g;pN~fJ}KtL z<#VgjlUmU~e)gy5=#R`hPu?F(bnH0>uEf5DVLAs5uGx2*Q@&3AGu+Dqsb_*jN`#@( zmmtJ`Rs7GvD)|5@XzOe}&AUTreem(5j9zW@eP8dJ zYqfDki{AtK^a%eAkkeHpWcnOEGQSsVw3de_mRq(amdkF`xxdmKt%IoX<*kI?EoMq~ zyl9bnIyMFMcby$Q!bj`c9$@XbOmiqdLUDpE&}}_`_YGcUeZ%y2>{d<`uvlxZ_I)py zV(DOwIT(WS%bSFt#R38Iw+=}_5n-j&$krC;;6ME;ymZRZ9NHd;mmf2D<1Y9%WPK>D zx^0w2R8kvT7)g!f7OoYXWZk5}4_DvM->P$A`%k$2*B=N-R>wmXQ(Rke0redBn`{1J z$^^?S#gFEQH~S)Y#;D~ywtAVsclTL6Vgo2^-E*HZVqwJQd<#!YvTnynVMXc^M<_@t z<31SqH^=cH(Lf>})e?4#`lk2qDxKrTmMxrIFUj+-5_?OfzHn8%0!l!a$8wdH0R=Nax~t%DG6!9+Gup)8*?Dwm|-hR;?&`87^`f43L#*^jwPRZ^>SWLO*l7uiw0_ zSu<9svC+5H`qfVp9l#d{l=6jMqn-3YrC2amn&mk0SgPUqR8Z1?&;;JN4v? zwTc>9yIwFbN&iIeY(;Wfz38R1y^lIVAk^dj<*T4#Er zIbueoUXxYa^MX~-q^@@(nex^3>Ed!a7#U?qm-+)5E_uvQpAeJwH>jHL*>4z!gh9gE zZ&Z+sl9kKYVrS}J%UjWdI=P4=0onupLoTb~&eK_ujPXi)dWA+amFAV3tHX#5KD|$8 zXVDSY;VTk9+wg)SMbScMGY_~D*&Sz~1{2BCwowhDO!5CB0K6FFAwSzbEc~Lj*o0)n zh1y#aywVj60Im8Q)`LPwm_joA?*kdjAKjG zYgQ$HGN{^kpv)urG9^Zcv_FZN*J1Zd%pk*1uXB8GjAF*dqvAK-O5o^q8jeL5x=aIi zK+@ciu)i{{7og;ZCwP{AU&y$kX0z+zwXF5rQO13K3w3fG`Alx>iP!w2CBC{YS3Yf2 z$qSGse&Bpt1b}6IpRDw8-&+ohW`&#V^<0_h*Qu%v^RXZIfS0tgHjs;$X<`k87=x{)lIb_#QB9884T~&tkIgzSq*9p(V}-bRzHy#+tWLOAwQ${b-Q)hvu=5vW zo;LEp9;j_*Afexp&Lk9%V*#rNhTq@J8Dmx6@KVV9-X1qX+`AN3eZg$0KRvC*gbxV( zG37dZ{cw=74C}*FPzq$eKDPfgP#rTPU-8lv*N6-S%e2aLQAe{3exJU6+wEADi zbkMGY_o;BsTu zSNe8I(PJi@F;EVPGAw@!;qD z!GJ^9P&1q`Wlb0}W*dK1w_xfk69huKiW<6yxz?v4#p*p|B4A1J%!$il?%g$j%PFfY zcAjzGGGMICknFP0J8V0ygbu&d`{hfj-UwY6rE0gn4xC2PRLp)&^Gl|aYxgP2>rg@R z{6`WGecZ624lD_|2u8dpjuy)?YDbKfjW+vVj&=mT^Kw}X3rBLjc>v{hzI{IZ=MQx$ zhPET=tU7|-yqt-M9ZvQbF1^=xVB(DslLpPIWX}ZPT?X>aO|%~~JT7kK%`fZUFo}g; z#u~S+GRBovD|Lr|QMh)Ci`~D>7sU7ffJ*|5Liot{@M1|@zg{iZo$vqr#bVGqmdj+8 zm6Jv)Q14tG<7QJlT;++D6=b=XTdv;Z5L}~E*X+|0+y1^MdR!2W6Hi*T))%YN{L{*) zwM|@+hPzV{u8H_Dg^9h{b0k1&yjLzXFf*Xssnd4#JArAbpgbctx3tVkH2tj1BugnP z%Mz=&R=)@$Pl>LOLRm+2?=i-~huQe%Og~~PojjEyuyMn2T<`HUo~lfi0l`<4rum_) z;CSfO^%opkIG{uGCzO1RHahjV>@Wna!W1 zSsH7ebzWC>lJD)5&6=txa{~e5=48H>9RHE9z5)RH>*KsPm-E`)vrf@X6!8L3a9=RG zJAN*q02VGUrY~yO#Q-%n%3Pc9OUwXfRIO!fg=YD%F z`Vax}YlEvHn)297_}#c$U$G}PDjF7|xfFv)pVa&nA0GcI7P=|RlRIZOx{8^3fk@Rb z^xWz#Ba$ulL|*8ED_Z>*#VqMwmViy(uV%5maajz+I`XgGV#&%qFnQFYPIdq_o*5nF z%%}*GU)765nj?STT;p+U#|&nr=WG>Fv$C#WtgYpLaqMW*%@X4Qz?}#I?dNwz9a_C2 z?OL%uQkH@jLfs6!$A}Dwm0?ksvmr`Zz z&r~Os0Cew0zjNUfQcNnFdWpCeS^X3UFt)fT0@Mxnn3#DN+^ zO+bnpFW}DAd}%(k^116{)^cN&F67m`DGN(Wr7#a=_!UhWBFkED?0!Dz{|0gc-N{MQ~Sb@&GoM~RP8=%o^WcGY;*|yxGHX@=bb8J@HEAEL6lyb~7&jTew z`j1gVjaf=&AdPO77Z`o(5}^WLaRk?M_Q0d==g{wz7$5U|UT3i7lOrwD5k0+(U>lGH(#mW|&hXCSsxk09_c z8~8YAA+-v?ChOzVmUUB>gznBGNFt#WJy3h(X&GX{P)+lT_LEw);={>%ol1tAgFkmr zv10ge&vHMw2fxC35X5dI&3DnkdA-f5UZGx~UW+Mp9=r*4i>OFv{Up@9crNKh&g=3W z6TZ2gCiD2q5bAqJ`Q2nb@4<`n#*8UJrg=eOy~=`lW_3hErwXHz>zeb2P2W$q&lSk| z?bOKy?3Aw#pr)JmmK%JMaOi!TO%ho;Bgtv7^M$+-5fZT}$4-~8dPcr5Fgryu#E}%Id@pKJA zabLpIpKYm0q>j;7_}sG2nQaBlel3#mYeaVd)=i=U?LuJX@y+VeJyIkAx2pt4nA7eI z*>jc}CclRd#yEB&C<#7blQXcJgkR~P4usL)ot&eV27K4))FZVR62U7-Ej>q(zrh|m ztCpmwwRkf~F%!y{`E;dcB#<*ELLI+2Ouo>BJ%zAlJ-ZW&0>$$snlwdzbJa9CgB%wd3dDS+ow5!} z<30(h;N0RytJ;u~H0O)!OIRtUHTVb=o++E6$&_LaWTX4>7d@+G$X~b&mnG^{&a5{f zArq8L;Yy@8q%vQ>!lM)vIahy`j0#Lln+fIO@PWK;(Ok_&ML30!RV|J0&AS~@&9rLk zosg}63C65g7|igf24Q}v2G>5b?P>h3iWI%1t2#3)8;eWXki-o`ohlo|gRRwIgAwLp zCL`97nWLY9TX>`wEI?)N3Mp!+q(~`_FO_5A)WZHwwd#ESW6vD4s96pZT!-F6TkMY4 zv8Ps_$Z z5>RYOL0MhIDpf7q(RGu`jKrMQQ*1~WV&_y(&|7EiMLno!$vJJLDQJEJdQhXPeVHW_ z??4!?W#9Um10m*W-tDLYSEWE+fuEt!vHWcht?OI?SnCq+!P}HcJ~v;ftE&2xVg2MP zbuq#a%kOB4pXZAPu$JE|Z?rMpSN!VsF^ITAz29yt69b9#2rEn10lbaj3$wq%i3?>j z(;WtVyu{4^nX^Xg*NW0>z+w|SQYxcnPA~}YgGsYeJw$B%93AT%CWEtCQpa17twwpr z-ni?5ZSLp37(bUBEeVuJ++&1W9A=NOd(~mU?@)_8 zer9sAy<9bG6KnpJWIfw{= zvKodpEfyL&F;%h@ZH&rEhO44=FZ3vftBc=VE{7_%HmdgnOF{uYij=JK>3RbR`>M>O zb2@r7tv0A3asxIAN5$CCw@S1MyGi@~p4d;)1u6NQ`uUSLE?p>fEUuH^Eo26(mpc_E zyf6w;+-qa$Ug@MFk$XUT0x+|k8LDWgtj;Bsr#nWZ zJ^wGnwUch4&bo>clUVh*nL6_7c~WSc9x%jUF_<7@3|fA&BBZv7*3+Ef?UVv^+lpNS zZihH)Ne}d^JjtMPJZZ{qW*8==QWO(ACxd*RO@jp9(21wC(ocZ778C!RSV#^c;^T0|ho+`#^d}D1ks$^H=Ny|L{+P}hvSz1`iCgsGU(NHiN(J*J3fEnY z{(du|!Wgsv)*6th&xoYYeUKqV-#rb$0*!gSxVe4kB*AX#-vMACK1oEyQQUGmu_(Jz z)Vn%|dxTV>FD9a}d<+o8`X;%mc>;EszoouRzR?@d+#jD@R97A3%u7~*g5bUrK8-%+!6%)`J<$X}vT`(F-`n2+7AVoYh zK0&DPdTivhD(-9dGOM~Pu=fI+{UA9-hjr-Xp@Vpu5f5?c3~G>WI)YFMewymD=2Q4( z?;@Aq1n#mokFX*lo(X$Fd1car8o6B3uiE0D*9W`-YW*d~PVX9UVo2KC?DkbdB6D8+ zQHu!_>1%}=<^H(8Hf(}R2R_kEXx_k@SL!hGbaSehNay-Is973l?xVQA)^zR;d^;4U z^4R@sPv1PftDpW&;*=D(tiMpcYH?}IgfV|(1aBToQ>o7*kHG48GaYWm64IeN00(+& zY3}aLafG92Y{r?YUQQLw$zn=ddaln_TbgU2%Ee#_IBhP7*5dO#B2kwJCs()>xI7|~ z7c_Ux)<(*z=PMqAN7`*ZQ4DIlIEh&Ce;6t`kq-?u zXX@ySWj4$L4ax$DtInVwhU3C5Fq1)bh4i-_BEFiKqz!5SUeB&{nBUcd^n5g14ul+t zO;qm;BLEf(s$aOD6iiinH>(4pj32+Ua1EfK*#ehySWodut4UY?^j2z%^Wo5lA|*UY zt*Lng6Y7)$RH+xb*SZZn*z9)msl!u0+uQhI2$UYFvbjv5tGudqegDupT=~K|wrR4o zgkdW(l?^d%1c=+xDA%(Lv_j8DrG>q(jc&(gjx|n&Ga`7n8#X^?7IZfRnRB@p5*fYD z*Fe7R{_7-B+`qgGz3Yx(P2M+%+j*BC*DcZ=ScoLUudaZ3qeTrb&f;7G4nk`s_ST}> z&WbJ!j!c_~s3*RPdv`*tgU(moz8T@O#mrK9v` zcRVneuRe?wC_ri_?{hj8l>OQsZEl9W-x1PQ5)&;+_^F)R;LX+5**a!AiULnwZP2zj z$WF3S%u$rehXOGcG&oU+<=T=2%ZY9{@H+fNkDv zZ_$&Y6tF}_pY?!WXzavJ@@##h8wGL1KZRjp7r8F^5^GtWkAQaXtLr@za`vkFv<@)n z4(6YGFI+jukH22>CBkVsGDf^gkgDG`fu5+FcOISC0o`c}75CS6ga| zS0w}sLxtW&W#e3S3p^%SUrh$`1m-5LH*U_s-zcG1VkhhbbM;z zfBo?;sYP;Sh-ik(k8MsKr8@0gW-;NRerBPI$GjnJQFAq;{C0P90oPl{(m(>_Fa?v4p&sR=nBbT-4JM!$mCmLxtr;?^mbx}P2*?a10 zzn+aYSx|%m3rz0E)%NUMn+A`~bF3Wl5@74P^|5T87*!iFK61+8>ls>4D;-|**YM#D zGxVr@j5NUp%%nW@y22bTOmpza!-buH*xAOxcn<6)nc0~6{B}V`j%G3q5{o*=0}icz zSY~o6Co3r-E!*3WP5tF1VB3!P-6m)e&FOth@p*UH`Kv_duH?F%HwA9H(Oc@uy2LzP z-iZSx5zciB?jYD)SU>C2=sJ3prmlop4Ozamn3qHJGlMr)Uy2_VH47GA&F#2vANYYy z+;x@(1+Ox`9?ri^6SuerQLiMz8tA$d^1L|8`^x9t5`w(%-{U!bD0rTkaUMNs`S>sGc^!RW4Y+r?`K;@e%N1;@W%=V4cG00~A^rhJ(b(PhCBJ3@rfB`vyScJ&~!E^V@ z9533BeQ#vqRb{&i&O?D-nUiNJKsoe;R3?Sr$nIh(Bhc6zZQg$-!a3{W%I1`9!+`Jq z?oqeq_r=9>uw4AC>Y6!^n_|T~5~n>`CXAwOsA~R$u>1qvFyCRx7q#62D#W2Lx$Lhd zMhEkk1tan}LOp7@=uWM7wgK%<%1{-KzuV)}T<4-5uHz@iVR4pcmkX@!5{i61DFb4+8Hu;0--9kTJo}WyH&XHZ zPza}M{>_7D|2^hV3+s`ihxL)o61;_9O$X-irAK#&H^KF!66`?5;?x(F~xgij4TExu>9htIIpXzIxuLTifKjN2JT0L z zmG(}%@6f90zNMUwPfL8Q#-D2Pba&gz&0*4_i;QJf#qQym`{uO~-4t?76-1`HiUF_ZISh_sRbZyxVk0D_kWML-a_4 zrJV**UsW=x$yla;&0O~{cW!1aUJK6Z$rT3EmT#UO zsJqLZbQcM)qUttTXk47Ru7}URd_eXOGgIMjZ0*cW2qm6QFAA7GPntXtd^9{;&vR_G z`vwAmm;!2E3dmj=!C{i8XKecAdki9GEY4S&ghnv@sZv9U3yHWBwa!bPEuPQrg|E(j@p(tg*W5|Jx1!wuij3uwMPQgp1#_=J~WZ{~i2amK!$p{efq3dg^?UdL;3`^QXUEW~h>m!)EBaQ+i?ZG4xKm zx_@nPLAP*jyj)n2gr)wo6WzX|hk~>dMCNSVb>i+fOXt$WO7p+B^xK$hS$K?Jx-8p2 zrE{}A%2=f;JsIvi`tW9MOq!_Z@m&WX`0j&0p;pqVYC~Q<@TR;bo2`F!o)fPt`|#$% z?Kr{nH?i&cGF?`_K6ZBZb_7|JMh+<6*^<5{DtB=^(U`{MUP8LNr{6zBinMz)%fwST z`^hWw!s|4DVe|WGO=RNcFN#ey`v0=*f6lf<4c!4u(xa2H_T+BUq&omXJ3{4)_*bv| zNAwF50L`?TTfnBbcQ{CR^LA_zLPEZ?6~UMGwvShg{l<7Bw|(3j<=$PN47gex1*IzV zU9QX>-wU*6VWC^Z!_l$tZbb<}2ZpsDit%@b42m=e7}l-{?%&;tPD}taf5~F~hc*6s ze+(;i3FLzA8N%IeVxR?@#bhAAX@vko=8=RR!rktY7t@<+Ik_-NlP#^(tQb}QgqPNZ z^l`||`|LUCJCBLW_MB4TmGT8D!H=j9(vIPKrr_bTg3~}bL*FiwMj?*}SkDEa*FQ(q z)Au!C|338ICHBK9O6_^dyDtZyK`lMM+FHxIR&zX_sWK$s*|D@Nb#tS%p)mXrG~=pXJp qHAJKVAWpcgv!2|2WnqZEH^@R6;F0Z(o!iaY5v0Ur#fn7q{QeKSx=J_z literal 0 HcmV?d00001 From 155c4058dbb7fd3c0ee3d1595182045158be7ec8 Mon Sep 17 00:00:00 2001 From: May Lee Date: Sun, 26 Oct 2025 14:26:15 -0400 Subject: [PATCH 03/13] make doc private --- .../upgrade_your_filter_queries_to_the_new_search_syntax.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md index 55c71c408131a..7758577dba522 100644 --- a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md +++ b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md @@ -3,6 +3,7 @@ title: Upgrade Your Filter Queries to the New Search Syntax description: Learn how to update your Observability Pipelines filter queries to use the new search syntax. aliases: - /observability_pipelines/guide/upgrade_to_the_new_search_syntax/ +private: true disable_toc: false further_reading: - link: "/observability_pipelines/search_syntax/" From 6db482a8ab163dab0a343743793193b13f9f91f5 Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 27 Oct 2025 12:19:11 -0400 Subject: [PATCH 04/13] updates to guide --- ...filter_queries_to_the_new_search_syntax.md | 89 +++++++++---------- 1 file changed, 43 insertions(+), 46 deletions(-) diff --git a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md index 7758577dba522..1edec28681c62 100644 --- a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md +++ b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md @@ -13,12 +13,12 @@ further_reading: ## Overview -Worker versions 2.11 and newer use an updated search syntax. To upgrade to the new search syntax, install Worker version 2.11 or later and update your filter queries to the new syntax. This document goes over: +Worker versions 2.11 and newer use an updated search syntax. This document goes over: -- [How to upgrade to the new syntax](#how-to-upgrade-to-new-search-syntax) -- [What's new in the updated search syntax](#whats-new-in-the-updated-search-syntax--whats-new-in-the-updated-search-syntax) +- [How to upgrade to the new syntax](#how-to-upgrade-to-the-new-search-syntax) +- [What's new in the updated search syntax](#whats-new-in-the-updated-search-syntax) -## How to upgrade to new search syntax +## How to upgrade to the new search syntax See the steps based on whether you: @@ -30,83 +30,79 @@ See the steps based on whether you: If you created your pipeline using the Pipeline UI: 1. [Upgrade to Observability Pipelines Worker][1] version 2.11. -1. Navigate to the [Pipeline UI][2] for that pipeline and update your filter queries to the new syntax. See the [What's new in the updated search syntax](#whats-new-in-the-updated-search-syntax--whats-new-in-the-updated-search-syntax) section for more information. -1. By default the `Use legacy search syntax` box is checked because your pipeline is still running with the old search syntax +1. Navigate to the [Pipeline UI][2] for that pipeline and update your filter queries to the new syntax. See the [What's new in the updated search syntax](#whats-new-in-the-updated-search-syntax) section for more information. +1. On the pipeline editor page, by default the `Use legacy search syntax` box is checked because your pipeline is running Worker 2.10 or older, which uses the old search syntax. {{< img src="observability_pipelines/guide/legacy_search_checkbox.png" alt="The pipelines editor showing the legacy search checkbox selected" style="width:100%;" >}} 1. After you've updated all your queries in that pipeline, uncheck the `Use legacy search syntax` box and deploy your pipeline ### Created the pipeline using the API or Terraform If your pipeline was created using the public API or Terraform: -- Within the same request that you make to update your pipeline queries to the new search syntax, set `use_legacy_search_syntax` to false. -- **Note**: You **must** set `use_legacy_search_syntax` to `false` while updating your queries because if `use_legacy_search_syntax` is left unpopulated, it defaults to `true` in the Worker. +- Within the same request that you make to update your pipeline queries to the new search syntax, set `use_legacy_search_syntax` to `false`. +- **Note**: You **must** set `use_legacy_search_syntax` to `false` when you update your queries because if `use_legacy_search_syntax` is left unpopulated, it defaults to `true` in the Worker. ## What's new in the updated search syntax -The following table lists the what has been updated with the search syntax: +The following table lists the differences between the legacy and new search syntax: | Legacy syntax | New syntax | | ------------- | ------------------------------- | -| Must use the `@` for attribute search, except for [reserved fields](#). | Do not need to use `@` for attribute search. **Note**: The `@` symbol in queries gets stripped to preserve backwards compatibility. | +| Must use the `@` symbol for attribute search, except when referencing [reserved fields](#legacy-syntax-reserved-fields). | Do not need to use the `@` symbol for attribute search. **Note**: The `@` symbol in queries gets stripped to preserve backwards compatibility. | | Since `@` indicates an attribute search, tag searches do not include an `@` so are matched under the attributes `tags` and `ddtags`.

Attribute search queries without an `@` symbol are matched against the `tags` or `ddtags` array.

Example attribute search syntax: `env:prod` | Tags syntax must be explicitly entered.

Inspect your data with Live Capture to determine which fields to match against.

Example attribute search syntax: `tags:"env:prod" OR ddtags:"env:prod"` | | [Reserved fields](#legacy-syntax-reserved-fields) do not need the `@` symbol. | Reserved fields do not need the `@` symbol. | **Note**: The upgraded search syntax does not need the `@` symbol for attribute searches. While you do not need to remove the `@` symbol from filter queries that were previously using them, Datadog recommends that you remove the `@` symbol. -The following examples show a matched log along with the legacy syntax and new syntax that matches the log, a description of the differences. +The following examples show matched logs, along with the legacy syntax and new syntax that matche the logs. -`{"user": "user.one"}` -: **Legacy syntax**: `@user:user.once` -: **New syntax**: `user:user.one` -: **Difference**: The `@` symbol is no longer required for attribute search. +`{"user": "firstname.lastname"}` +: **Legacy syntax**: `@user:firstname.lastname` +: **New syntax**: `user:firstname.lastname` +: **Difference**: The new syntax does not require the `@` symbol for attribute search. + +`{"message": {"log_level": "ERROR"}}` +: **Legacy syntax**: `@message.log_level:ERROR` +: **New syntax**: `message.log_level:ERROR` +: **Difference**: The new syntax does not require the `@` symbol for attribute search. `{"status": "INFO"}` : **Legacy syntax**: `status:INFO` : **New syntax**: `status:INFO` -: **Difference**: No changes because `status` was previously a reserved field that could be filtered without using the `@` symbol. +: **Difference**: No changes because `status` was previously a [reserved field](#legacy-syntax-reserved-fields) that could be filtered without using the `@` symbol. The new syntax does not use the `@` symbol for attribute searches. + +`{"message": "Hello, world" }`
`{"message: "hello world"}`
`{"message": "Hello-world"}` +: **Legacy syntax**: `message:"hello world"` +: **New syntax**: `message:"hello world"` +: **Difference**: There are no changes between the legacy and new syntax because `message` was a reserved field in the legacy search syntax and didn't require the `@` symbol. The new syntax does not use the `@` symbol for attribute searches. -`{"tags": ["env:prod"] }` `{"ddtags": ["env:prod"] }` +`{"message": "hEllo world"}` +: **Legacy syntax**: `HELLO OR hello OR Hello` +: **New syntax**: `hello` +: **Difference**: With the new syntax, [free text search][4] is case insensitive. + +`{"user": "name"}` +: **Legacy syntax**: `@user:(name OR Name OR nAme)` +: **New syntax**: `user:(name OR Name or nAme)` +: **Difference**: With the new syntax, [attribute search][4] is case sensitive and the `@` symbol is not required for attribute search. + +`{"tags": ["env:prod"] }`
`{"ddtags": ["env:prod"] }` : **Legacy syntax**: `env:prod` : **New syntax**: `tags:"env:prod" OR ddtags:"env:prod"` -: **Difference**: With the old syntax, when the syntax does not contain the `@` symbol and is not searching for a reserved field, all terms were matched with the `tags` or `ddtags` field. With the new search syntax, there are no reserved fields so all searches must be entered explicitly. +: **Difference**: With the legacy syntax, when the syntax does not contain the `@` symbol and is not searching for a reserved field, all terms are matched with the `tags` or `ddtags` field. With the new search syntax, there are no reserved fields so all searches must be entered explicitly. -`{"tags": ["message.log_level:INFO"] }` `{"ddtags": ["message.log_level:INFO"]}` +`{"tags": ["message.log_level:INFO"] }`
`{"ddtags": ["message.log_level:INFO"]}}` : **Legacy syntax**: `message.log_level:INFO` : **New syntax**: `tags:"message.log_level:INFO" OR ddtags:"message.log_level:INFO"` : **Difference**: Same reason as the previous query for `env:prod` query. -`{"source": "postgres" }` `{"ddsource":"postgres" }` +`{"source": "postgres" }`
`{"ddsource":"postgres" }` : **Legacy syntax**: `source:postgres` : **New syntax**: `source:postgres OR ddsource:postgres` -: **Difference**: With the old syntax, attribute search with `source` field would match both `source` and `ddsource` fields. The new syntax no longer does this so you must enter `source` or `ddsource` explicitly. - -`{"message": "Hello, world" }` `{"message: "hello world"}` `{"message": "Hello-world"}` -: **Legacy syntax**: `message:"hello world"` -: **New syntax**: `message:"hello world"` -: **Difference**: There are no changes between the legacy and new syntax because `message` was a reserved field in the old search syntax and didn't require the `@` symbol. - -`{"message": {"log_level": "ERROR"}}` -: **Legacy syntax**: `@message.log_level:ERROR` -: **New syntax**: `message.log_level:ERROR` -: **Difference**: With the new syntax, the `@` symbol is not required for attribute search. - -`{"something": ["values", "stuff"]}` -: **Legacy syntax**: @something:value* -: **New syntax**: something:value* -: **Difference**: With the new syntax, the `@` symbol not required for attribute search - -`{"message": "hEllo world"}` -: **Legacy syntax**: `HELLO OR hello OR Hello` -: **New syntax**: `hello` -: **Difference**: With the new syntax, [free text search][/observability_pipelines/search_syntax/#free-text-search] is case insensitive. - -`{"user": "james"}` -: **Legacy syntax**: `@user:(james OR James OR jAmes)` -: **New syntax**: `user:(james OR James or jAmes)` -: **Difference**: With the new syntax, [attribute search][/observability_pipelines/search_syntax/#attribute-search] is case sensitive and the `@` symbol is not required for attribute search. +: **Difference**: With the legacy syntax, attribute search with `source` field matches both `source` and `ddsource` fields. The new syntax no longer does this so you must enter `source` or `ddsource` explicitly. **Note**: Using wildcards for field names in attribute search is not supported for either the legacy or new syntax. For example, the following usage of wildcard does not work: + - Legacy syntax: `*:something` - New syntax: `*:something` @@ -128,3 +124,4 @@ See [Reserved attributes][3] for more information. [1]: /observability_pipelines/install_the_worker/?tab=docker#upgrade-the-worker [2]: https://app.datadoghq.com/observability-pipelines [3]: /logs/log_configuration/attributes_naming_convention/#reserved-attributes +[4]: /observability_pipelines/search_syntax/#attribute-search From 3737efbea211f7f809ed62c5f1291a078415a0e1 Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 27 Oct 2025 13:42:45 -0400 Subject: [PATCH 05/13] update search syntax --- ...filter_queries_to_the_new_search_syntax.md | 4 + .../observability_pipelines/search_syntax.md | 92 +++++++++---------- 2 files changed, 48 insertions(+), 48 deletions(-) diff --git a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md index 1edec28681c62..6df303e9584d5 100644 --- a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md +++ b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md @@ -121,6 +121,10 @@ For the legacy syntax, these are the reserved fields: See [Reserved attributes][3] for more information. +## Further reading + +{{< partial name="whats-next/whats-next.html" >}} + [1]: /observability_pipelines/install_the_worker/?tab=docker#upgrade-the-worker [2]: https://app.datadoghq.com/observability-pipelines [3]: /logs/log_configuration/attributes_naming_convention/#reserved-attributes diff --git a/content/en/observability_pipelines/search_syntax.md b/content/en/observability_pipelines/search_syntax.md index 38368d0f47a2f..2bfde905b39b1 100644 --- a/content/en/observability_pipelines/search_syntax.md +++ b/content/en/observability_pipelines/search_syntax.md @@ -8,14 +8,14 @@ private: true When you add a processor to a pipeline, you can filter your logs so only a subset of them go through a processor. This document goes over the following information: -- [Free text search](#free-text-search): when you want to search the `message` field value. -- [Attribute search](#attribute-search)): when you want to search attribute keys and values. -- [Arrays]() when you want to search within an array of nested values. +- [Free text search](#free-text-search): when you want to search the `message` field. +- [Attribute search](#attribute-search): when you want to search attribute keys and values. +- [Arrays](#arrays) when you want to search within an array of nested values. - [Boolean operators](#boolean-operators) that you can use in your search query. - [Special characters and spaces that need to be escaped](#escape-special-characters-and-spaces) in search queries. - Using [wildcards](#wildcards) in your search queries. -**Note**: Worker version 2.11 and newer uses an upgraded search syntax. After you upgrade from Worker version 2.10 or older to version 2.11, you might need to update your filter queries to match the new syntax. See the [Upgrade to the New Search Syntax](?tab=t.lxlscm3ib5qp#heading=h.cxcjarr1kri8) for more information. +**Note**: Worker version 2.11 and newer uses an upgraded search syntax. After you upgrade the Worker to version 2.11, you might need to update your filter queries to match the new syntax. See the [Upgrade to the New Search Syntax](/observability_pipelines/guide/upgrade_to_the_next_search_syntax/) for more information. ## Search syntax @@ -33,55 +33,55 @@ Free text search only searches the `message` field and is case insensitive. It i The following are free text search examples: -`hello` +Search syntax: `hello` : Searches for the exact string `hello`. For example, `{"message": "hello world"}` is a matching log. -`Hello world` -: Searches for `hello` and `world`. For example, "hello beautiful world" is a match. +Search syntax: `Hello world` +: Searches for `hello` and `world`. For example, `"hello beautiful world"` is a match. : This query can also be written as: `Hello AND world`. : **Note**: The message must contain both `hello` and `world` to match. -`"hello world"` -: Searches for a sequence of words. For example "hello world", "hello-world", and "Hello, world" are all matches. +Search syntax: `"hello world"` +: Searches for a sequence of words. For example `"hello world"`, `"hello-world"`, and `"Hello, world"` are all matches. ### Attribute search -You can search attribute key and values. For example, if your attribute key is `url` and you want to filter on the `url` value `www.datadoghq.com`, enter: `url:www.datadoghq.com`. +You can search attribute keys and values. For example, if your attribute key is `url` and you want to filter on the `url` value `www.datadoghq.com`, enter: `url:www.datadoghq.com`. -To filter for events that have a specific attribute key, use the `_exists_` syntax. For example if you use the query `_exists_:service`,`{"service": "postgres"}` matches the query, but `{"env": "prod"}` does not match. +To filter for events that have a specific attribute key, use the `_exists_` syntax. For example if you use the query `_exists_:service`, the event `{"service": "postgres"}` matches the query, but the event `{"env": "prod"}` does not match. **Note**: Attribute searches are case sensitive. -The following are attribute search syntax examples: +The following are attribute search syntax examples and logs that match the syntax: -`status:ok service:flask-web-app` -: Matches logs with the status `ok` from your `flask-web-app` service. +Search syntax: `status:ok service:flask-web-app` +: Matches logs with the status `ok` from your `flask-web-app` service. : This query can also be written as: `status:ok AND service:flask-web-app`. -`user.status:inactive` +Search syntax: `user.status:inactive` : Matches logs with the status `inactive` nested under the `user` attribute. -`http.url:/api-v1/*` +Search syntax: `http.url:/api-v1/*` : Matches logs containing a value in the `http.url` attribute that starts with `/api-v1/`. -`http.status_code:[200 TO 299] http.url_details.path:/api-v1/*` +Search syntax: `http.status_code:[200 TO 299] http.url_details.path:/api-v1/*` : Matches logs containing an `http.status_code` value that is greater than or equal to `200` and less than or equal to `299`, and containing a value in the `http.url_details.path` attribute that start with `/api-v1/`. -`http.status:[200 TO 299]` +Search syntax: `http.status:[200 TO 299]` : Matches logs containing an `http.status` value that is greater than or equal to `200` and less than or equal to `299`. : **Notes**: : - `[..]` Square brackets mean the ranges are inclusive. : - Ranges can be used across any attribute. -`http.status:{200 TO 299}` +Search syntax: `http.status:{200 TO 299}` : Matches logs containing an `http.status` value that is greater than `200` or less than `299`. **Notes**: - `{..}` Curly brackets mean the ranges are exclusive. - Ranges can be used across any attribute. -`"service.status":disabled` -: Matches logs with `"service.status": "disabled"`. This filter syntax searches for a literal `.` in the attribute key. +Search syntax: `"service.status":disabled` +: Matches logs with `"service.status": "disabled"`. This filter syntax searches for a literal `.` in the attribute key. : See [Path notation](#path-notation) for more information. -`_exists_:service` -: Matches logs with the attribute key `service`. For example, the query matches `{"service": "postgres"}`, but does not match {"env": "prod"}. +Search syntax: `_exists_:service` +: Matches logs with the attribute key `service`. For example, the query matches `{"service": "postgres"}`, but does not match `{"env": "prod"}`. #### Path notation @@ -104,10 +104,6 @@ For the following log structure: - Use `outer_key.inner_key` to reference the key with the value `inner_value`. - Use `outer_key.inner_key.double_inner_key` to reference the key with the value `double_inner_value`. -For this example log:```{"http": {"url_details": {"path": "/api/v1/test" } } }``` - -The filter syntax `http.url_details.path:"/api/v1/test"`, matches logs with a value of `/api/v1/test` for the `url_details` attribute path nested under `http`. - If you want to search for a literal `.` in the attribute key, wrap the key in escaped quotes in the search query. For example, the search query `"service.status":disabled` matches the event `{"service.status": "disabled"}`. ### Boolean operators @@ -122,24 +118,24 @@ You can use the following case sensitive Boolean operators to combine multiple t The follow are example queries that use Boolean operators: -`NOT (status:debug)` +Search syntax: `NOT (status:debug)` : Matches logs that do not have the status `DEBUG`. -`host:COMP-A9JNGYK OR host:COMP-J58KAS` +Search syntax: `host:COMP-A9JNGYK OR host:COMP-J58KAS` : Only matches logs from those specific hosts. -`Hello AND World` +Search syntax: `Hello AND World` : Searches for `hello` and `world`. For example, "hello beautiful world" is a match. : This query can also be written as: `Hello world`. : **Note**: The message must contain both `hello` and `world` to match. -`hello` AND `status:info` +Search syntax: `hello` AND `status:info` : Matches logs with a message field that contains `hello` and with `status:info`. -`-http.status_code:200` +Search syntax: `-http.status_code:200` : Matches logs where http.status_code is not equal to 200 -`service:(postgres OR datadog_agent)` +Search syntax: `service:(postgres OR datadog_agent)` : Matches logs with the values `postgres` or `datadog_agent` for the `service` attribute. This query can also be written as: `service:postgres OR service:datadog_agent` ## Escape special characters and spaces @@ -150,15 +146,15 @@ The following characters are considered special and require escaping with the fo - `/` is not considered a special character and doesn't need to be escaped. - You can search for special characters inside of an attribute. See [Search an attribute that contains special characters](#search-an-attribute-that-contains-special-characters). -- You cannot use free text search queries to filter for log messages with special characters. For example, if you want to match logs that contain the special character `!` in the `message` field, use the attribute search query: `message:*!*`. +- If you want to match logs that contain the special character `!` in the `message` field, use the attribute search syntax: `message:*!*`. **Note**: You cannot use free text search queries to filter for log messages with special characters. ### Search an attribute that contains special characters -Searching for an attribute value that contains special characters requires escaping or double quotes. For example, for an attribute `my_app` with the value `hello:world`, search using: `my_app:hello:world` or `my_app:"hello:world"`. +Searching for an attribute value that contains special characters requires escaping or double quotes. For example, to search for an attribute `my_app` with the value `hello:world`, use the syntax: `my_app:hello:world` or `my_app:"hello:world"`. ### Match a single special character or space -To match a single special character or space, use the `?` wildcard. For example, for an attribute `my_app` with the value `hello world again`, search using: `my_app:hello?world?again`. +To match a single special character or space, use the `?` wildcard. For example, to search for an attribute `my_app` with the value `hello world again`, use the syntax: `my_app:hello?world?again`. ### Examples @@ -179,22 +175,22 @@ For the following example log: The following are search syntax examples that escape special characters and spaces: -`tags:env` +Search syntax: `tags:env*` : Matches logs with a `tag` attribute value of `env`. -`tags:(env\:prod OR env\:test)` -: Matches logs `env:prod` or the tag `env:test` in the `tags` array. +Search syntax: `tags:(env\:prod OR env\:test)` +: Matches logs with the tag `env:prod` or `env:test` in the `tags` array. : This query can also be written as `tags:("env:prod" OR "env:test")`. -`tags:env\:prod AND -tags:version\:beta` +Search syntax: `tags:env\:prod AND -tags:version\:beta` : Matches logs that have `env:prod` and does not have `version:beta` in the `tag` array. : This query can also be written as `tags:"env:prod" AND -tags:"version:beta"`. -`my_app:hello\:world` +Search syntax: `my_app:hello\:world` : Matches logs that contain `my_app:hello:world`. : This query can also be written as `my_app:"hello:world"`. -`my_app:hello?world?again` +Search syntax: `my_app:hello?world?again` : Matches logs that contain `"my_app":"hello world again"`. ### Arrays @@ -220,25 +216,25 @@ If you use the filter query: `Event.EventData.Data.Name:ObjectServer`, the above ​​You can use `*` for wildcard searches. The following are wildcard search examples: -`*network*` +Search syntax: `*network*` : Matches logs with a `message` field value that contains `network`. -`web*` +Search syntax: `web*` : Matches logs with a `message` field value that starts with `web`. -`*web` +Search syntax: `*web` : Matches logs with a `message` field value that ends with `web`. -`service:*mongo` +Search syntax: `service:*mongo` : Matches logs with `service` attribute values that ends with `mongo`. -`service:web*` +Search syntax: `service:web*` : Matches logs that have a `service` attribute value that starts with `web`. **Notes**: - You cannot use wildcards to search attribute keys, such as `*:app` or `service*:app`. - Wildcards only work as wildcards outside of double quotes. -- For example, `"*test*"` matches a log which has the string `*test*` in its `message` field, while `*test*` matches a log which has the string `test` anywhere in the `message` field. + - For example, `"*test*"` matches a log which has the string `*test*` in its `message` field, while `*test*` matches a log which has the string `test` anywhere in the `message` field. #### Search for special characters or escaped characters From 0ade5775d2c6bcd683f5beeb1931b67baaaa5ce8 Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 27 Oct 2025 13:53:33 -0400 Subject: [PATCH 06/13] update filter query syntax shortcode --- .../processors/filter_syntax.en.md | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md b/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md index 69c65856eb0bb..89d497c927bae 100644 --- a/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md +++ b/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md @@ -2,19 +2,15 @@ Each processor has a corresponding filter query in their fields. Processors only process logs that match their filter query. And for all processors except the filter processor, logs that do not match the query are sent to the next step of the pipeline. For the filter processor, logs that do not match the query are dropped. -For any attribute, tag, or `key:value` pair that is not a [reserved attribute][4001], your query must start with `@`. Conversely, to filter reserved attributes, you do not need to append `@` in front of your filter query. +The following are filter query examples: -For example, to filter out and drop `status:info` logs, your filter can be set as `NOT (status:info)`. To filter out and drop `system-status:info`, your filter must be set as `NOT (@system-status:info)`. - -Filter query examples: -- `NOT (status:debug)`: This filters for only logs that do not have the status `DEBUG`. +- `NOT (status:debug)`: This filters for logs that do not have the status `DEBUG`. - `status:ok service:flask-web-app`: This filters for all logs with the status `OK` from your `flask-web-app` service. - This query can also be written as: `status:ok AND service:flask-web-app`. - `host:COMP-A9JNGYK OR host:COMP-J58KAS`: This filter query only matches logs from the labeled hosts. -- `@user.status:inactive`: This filters for logs with the status `inactive` nested under the `user` attribute. -- `@http.status:[200 TO 299]` or `@http.status:{300 TO 399}`: These two filters represent the syntax to query a range for `http.status`. Ranges can be used across any attribute. +- `user.status:inactive`: This filters for logs with the status `inactive` nested under the `user` attribute. +- `http.status:[200 TO 299]` or `http.status:{300 TO 399}`: These two filters represent the syntax to query a range for `http.status`. Ranges can be used across any attribute. -Queries run in the Observability Pipelines Worker are case sensitive. Learn more about writing filter queries in [Datadog's Log Search Syntax][4002]. +Learn more about writing filter queries in [Observability Pipelines Search Syntax][4001]. -[4001]: /logs/log_configuration/attributes_naming_convention/#reserved-attributes -[4002]: /logs/explorer/search_syntax/ +[4001]: /observability_pipelines/search_syntax/ From 32afc4e73cb3276d2086f17dfb71be2c3da3d065 Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 27 Oct 2025 13:54:32 -0400 Subject: [PATCH 07/13] revert shortcode update --- .../processors/filter_syntax.en.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md b/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md index 89d497c927bae..69c65856eb0bb 100644 --- a/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md +++ b/layouts/shortcodes/observability_pipelines/processors/filter_syntax.en.md @@ -2,15 +2,19 @@ Each processor has a corresponding filter query in their fields. Processors only process logs that match their filter query. And for all processors except the filter processor, logs that do not match the query are sent to the next step of the pipeline. For the filter processor, logs that do not match the query are dropped. -The following are filter query examples: +For any attribute, tag, or `key:value` pair that is not a [reserved attribute][4001], your query must start with `@`. Conversely, to filter reserved attributes, you do not need to append `@` in front of your filter query. -- `NOT (status:debug)`: This filters for logs that do not have the status `DEBUG`. +For example, to filter out and drop `status:info` logs, your filter can be set as `NOT (status:info)`. To filter out and drop `system-status:info`, your filter must be set as `NOT (@system-status:info)`. + +Filter query examples: +- `NOT (status:debug)`: This filters for only logs that do not have the status `DEBUG`. - `status:ok service:flask-web-app`: This filters for all logs with the status `OK` from your `flask-web-app` service. - This query can also be written as: `status:ok AND service:flask-web-app`. - `host:COMP-A9JNGYK OR host:COMP-J58KAS`: This filter query only matches logs from the labeled hosts. -- `user.status:inactive`: This filters for logs with the status `inactive` nested under the `user` attribute. -- `http.status:[200 TO 299]` or `http.status:{300 TO 399}`: These two filters represent the syntax to query a range for `http.status`. Ranges can be used across any attribute. +- `@user.status:inactive`: This filters for logs with the status `inactive` nested under the `user` attribute. +- `@http.status:[200 TO 299]` or `@http.status:{300 TO 399}`: These two filters represent the syntax to query a range for `http.status`. Ranges can be used across any attribute. -Learn more about writing filter queries in [Observability Pipelines Search Syntax][4001]. +Queries run in the Observability Pipelines Worker are case sensitive. Learn more about writing filter queries in [Datadog's Log Search Syntax][4002]. -[4001]: /observability_pipelines/search_syntax/ +[4001]: /logs/log_configuration/attributes_naming_convention/#reserved-attributes +[4002]: /logs/explorer/search_syntax/ From 4e133344861f0b09093ae3ab11edb737029e5c15 Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 27 Oct 2025 17:01:33 -0400 Subject: [PATCH 08/13] Apply suggestions from code review Co-authored-by: Michael Cretzman <58786311+michaelcretzman@users.noreply.github.com> --- ...filter_queries_to_the_new_search_syntax.md | 26 ++++++++------ .../observability_pipelines/search_syntax.md | 34 +++++++++---------- 2 files changed, 32 insertions(+), 28 deletions(-) diff --git a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md index 6df303e9584d5..6b3bdd33a6447 100644 --- a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md +++ b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md @@ -13,12 +13,12 @@ further_reading: ## Overview -Worker versions 2.11 and newer use an updated search syntax. This document goes over: +Worker versions 2.11 and newer use an updated search syntax. This document covers the following: -- [How to upgrade to the new syntax](#how-to-upgrade-to-the-new-search-syntax) +- [How to upgrade existing queries to the new syntax](#how-to-upgrade-to-the-new-search-syntax) - [What's new in the updated search syntax](#whats-new-in-the-updated-search-syntax) -## How to upgrade to the new search syntax +## How to upgrade queries to the new search syntax See the steps based on whether you: @@ -31,15 +31,18 @@ If you created your pipeline using the Pipeline UI: 1. [Upgrade to Observability Pipelines Worker][1] version 2.11. 1. Navigate to the [Pipeline UI][2] for that pipeline and update your filter queries to the new syntax. See the [What's new in the updated search syntax](#whats-new-in-the-updated-search-syntax) section for more information. -1. On the pipeline editor page, by default the `Use legacy search syntax` box is checked because your pipeline is running Worker 2.10 or older, which uses the old search syntax. +1. On the pipeline editor page, by default the `Use legacy search syntax` box is checked because your pipeline is running the old search syntax of Worker 2.10 or older. {{< img src="observability_pipelines/guide/legacy_search_checkbox.png" alt="The pipelines editor showing the legacy search checkbox selected" style="width:100%;" >}} -1. After you've updated all your queries in that pipeline, uncheck the `Use legacy search syntax` box and deploy your pipeline +1. After you've updated all queries in that pipeline, uncheck the `Use legacy search syntax` box and deploy your pipeline. ### Created the pipeline using the API or Terraform If your pipeline was created using the public API or Terraform: - Within the same request that you make to update your pipeline queries to the new search syntax, set `use_legacy_search_syntax` to `false`. -- **Note**: You **must** set `use_legacy_search_syntax` to `false` when you update your queries because if `use_legacy_search_syntax` is left unpopulated, it defaults to `true` in the Worker. + +
You must set use_legacy_search_syntax to false when you update your queries. If use_legacy_search_syntax is unpopulated, it defaults to true in the Worker.
+ +**Note**: ## What's new in the updated search syntax @@ -48,13 +51,13 @@ The following table lists the differences between the legacy and new search synt | Legacy syntax | New syntax | | ------------- | ------------------------------- | -| Must use the `@` symbol for attribute search, except when referencing [reserved fields](#legacy-syntax-reserved-fields). | Do not need to use the `@` symbol for attribute search. **Note**: The `@` symbol in queries gets stripped to preserve backwards compatibility. | -| Since `@` indicates an attribute search, tag searches do not include an `@` so are matched under the attributes `tags` and `ddtags`.

Attribute search queries without an `@` symbol are matched against the `tags` or `ddtags` array.

Example attribute search syntax: `env:prod` | Tags syntax must be explicitly entered.

Inspect your data with Live Capture to determine which fields to match against.

Example attribute search syntax: `tags:"env:prod" OR ddtags:"env:prod"` | -| [Reserved fields](#legacy-syntax-reserved-fields) do not need the `@` symbol. | Reserved fields do not need the `@` symbol. | +| Requires the `@` symbol for attribute search, except when referencing [reserved fields](#legacy-syntax-reserved-fields). | Does not require the `@` symbol for attribute search. **Note**: The `@` symbol in queries is removed to preserve backwards compatibility. | +| Since `@` indicates an attribute search, tag searches do not include an `@`, and are matched under the attributes `tags` and `ddtags`.

Attribute search queries without an `@` symbol are matched against the `tags` or `ddtags` array.

Example attribute search syntax: `env:prod` | Tags syntax must be explicitly entered.

Inspect your data with [Live capture][5] to determine which fields to match.

Example attribute search syntax: `tags:"env:prod" OR ddtags:"env:prod"` | +| [Reserved fields](#legacy-syntax-reserved-fields) do not require the `@` symbol. | Reserved fields do not require the `@` symbol. | **Note**: The upgraded search syntax does not need the `@` symbol for attribute searches. While you do not need to remove the `@` symbol from filter queries that were previously using them, Datadog recommends that you remove the `@` symbol. -The following examples show matched logs, along with the legacy syntax and new syntax that matche the logs. +The following examples show matched logs, along with the legacy syntax and new syntax that matches the logs. `{"user": "firstname.lastname"}` : **Legacy syntax**: `@user:firstname.lastname` @@ -101,7 +104,7 @@ The following examples show matched logs, along with the legacy syntax and new s : **New syntax**: `source:postgres OR ddsource:postgres` : **Difference**: With the legacy syntax, attribute search with `source` field matches both `source` and `ddsource` fields. The new syntax no longer does this so you must enter `source` or `ddsource` explicitly. -**Note**: Using wildcards for field names in attribute search is not supported for either the legacy or new syntax. For example, the following usage of wildcard does not work: +**Note**: Using wildcards for field names in attribute search is not supported for either the legacy or new syntax. For example, the following wildcard usage does not work: - Legacy syntax: `*:something` - New syntax: `*:something` @@ -129,3 +132,4 @@ See [Reserved attributes][3] for more information. [2]: https://app.datadoghq.com/observability-pipelines [3]: /logs/log_configuration/attributes_naming_convention/#reserved-attributes [4]: /observability_pipelines/search_syntax/#attribute-search +[5]: /observability_pipelines/live_capture/ diff --git a/content/en/observability_pipelines/search_syntax.md b/content/en/observability_pipelines/search_syntax.md index 2bfde905b39b1..72c830699ba89 100644 --- a/content/en/observability_pipelines/search_syntax.md +++ b/content/en/observability_pipelines/search_syntax.md @@ -1,21 +1,21 @@ --- title: Search Syntax -description: Learn the search syntax to create filter queries for your Observability Pipelines processors. +description: Learn the new filter query search syntax for your Observability Pipelines processors. disable_toc: false private: true --- ## Overview -When you add a processor to a pipeline, you can filter your logs so only a subset of them go through a processor. This document goes over the following information: +When you add a processor to a pipeline, you can filter logs to process only a defined subset. This document goes over the following information: -- [Free text search](#free-text-search): when you want to search the `message` field. -- [Attribute search](#attribute-search): when you want to search attribute keys and values. -- [Arrays](#arrays) when you want to search within an array of nested values. -- [Boolean operators](#boolean-operators) that you can use in your search query. -- [Special characters and spaces that need to be escaped](#escape-special-characters-and-spaces) in search queries. -- Using [wildcards](#wildcards) in your search queries. +- [Free text search](#free-text-search): to search the `message` field. +- [Attribute search](#attribute-search): to search attribute keys and values. +- [Arrays](#arrays): to search within an array of nested values. +- [Boolean operators](#boolean-operators). +- [Special characters and spaces that must be escaped](#escape-special-characters-and-spaces). +- [Wildcards](#wildcards). -**Note**: Worker version 2.11 and newer uses an upgraded search syntax. After you upgrade the Worker to version 2.11, you might need to update your filter queries to match the new syntax. See the [Upgrade to the New Search Syntax](/observability_pipelines/guide/upgrade_to_the_next_search_syntax/) for more information. +**Note**: Worker version 2.11 and newer uses an upgraded search syntax. After you upgrade the Worker to version 2.11, you might need to update your filter queries to match the new syntax. See [Upgrade to the New Search Syntax](/observability_pipelines/guide/upgrade_to_the_next_search_syntax/) for more information. ## Search syntax @@ -38,7 +38,7 @@ Search syntax: `hello` Search syntax: `Hello world` : Searches for `hello` and `world`. For example, `"hello beautiful world"` is a match. -: This query can also be written as: `Hello AND world`. +: This query can also be written as `Hello AND world`. : **Note**: The message must contain both `hello` and `world` to match. Search syntax: `"hello world"` @@ -48,11 +48,11 @@ Search syntax: `"hello world"` You can search attribute keys and values. For example, if your attribute key is `url` and you want to filter on the `url` value `www.datadoghq.com`, enter: `url:www.datadoghq.com`. -To filter for events that have a specific attribute key, use the `_exists_` syntax. For example if you use the query `_exists_:service`, the event `{"service": "postgres"}` matches the query, but the event `{"env": "prod"}` does not match. +To filter for events that have a specific attribute key, use the `_exists_` syntax. For example, if you use the query `_exists_:service`, the event `{"service": "postgres"}` matches the query, but the event `{"env": "prod"}` does not match. **Note**: Attribute searches are case sensitive. -The following are attribute search syntax examples and logs that match the syntax: +Here are some attribute search syntax examples and logs that match the syntax: Search syntax: `status:ok service:flask-web-app` : Matches logs with the status `ok` from your `flask-web-app` service. @@ -85,7 +85,7 @@ Search syntax: `_exists_:service` #### Path notation -For the following log structure: +To understand path notation, let's look at the following log structure: ```json { @@ -100,7 +100,7 @@ For the following log structure: "d": "d value" } ``` - +In this example, use the following reference rules: - Use `outer_key.inner_key` to reference the key with the value `inner_value`. - Use `outer_key.inner_key.double_inner_key` to reference the key with the value `double_inner_value`. @@ -158,7 +158,7 @@ To match a single special character or space, use the `?` wildcard. For example, ### Examples -For the following example log: +To learn how to escape special characters and spaces in a search, let's look at a log example: ``` { @@ -173,7 +173,7 @@ For the following example log: } ``` -The following are search syntax examples that escape special characters and spaces: +The following are search syntax examples that escape special characters and spaces in the log example: Search syntax: `tags:env*` : Matches logs with a `tag` attribute value of `env`. @@ -210,7 +210,7 @@ EventData { } ``` -If you use the filter query: `Event.EventData.Data.Name:ObjectServer`, the above log event is matched because it contains a nested object with the attribute key `Name` and the value `ObjectServer`. +If you use the filter query `Event.EventData.Data.Name:ObjectServer`, the above log event is matched because it contains a nested object with the attribute key `Name` and the value `ObjectServer`. ## Wildcards From 25c1e512c64d733c5175b1de0f7257bc5398642a Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 27 Oct 2025 17:47:13 -0400 Subject: [PATCH 09/13] remove search syntax from desc lists --- .../observability_pipelines/search_syntax.md | 54 +++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/content/en/observability_pipelines/search_syntax.md b/content/en/observability_pipelines/search_syntax.md index 72c830699ba89..514fb37affb14 100644 --- a/content/en/observability_pipelines/search_syntax.md +++ b/content/en/observability_pipelines/search_syntax.md @@ -33,15 +33,15 @@ Free text search only searches the `message` field and is case insensitive. It i The following are free text search examples: -Search syntax: `hello` +`hello` : Searches for the exact string `hello`. For example, `{"message": "hello world"}` is a matching log. -Search syntax: `Hello world` +`Hello world` : Searches for `hello` and `world`. For example, `"hello beautiful world"` is a match. : This query can also be written as `Hello AND world`. : **Note**: The message must contain both `hello` and `world` to match. -Search syntax: `"hello world"` +`"hello world"` : Searches for a sequence of words. For example `"hello world"`, `"hello-world"`, and `"Hello, world"` are all matches. ### Attribute search @@ -54,33 +54,33 @@ To filter for events that have a specific attribute key, use the `_exists_` synt Here are some attribute search syntax examples and logs that match the syntax: -Search syntax: `status:ok service:flask-web-app` +`status:ok service:flask-web-app` : Matches logs with the status `ok` from your `flask-web-app` service. : This query can also be written as: `status:ok AND service:flask-web-app`. -Search syntax: `user.status:inactive` +`user.status:inactive` : Matches logs with the status `inactive` nested under the `user` attribute. -Search syntax: `http.url:/api-v1/*` +`http.url:/api-v1/*` : Matches logs containing a value in the `http.url` attribute that starts with `/api-v1/`. -Search syntax: `http.status_code:[200 TO 299] http.url_details.path:/api-v1/*` +`http.status_code:[200 TO 299] http.url_details.path:/api-v1/*` : Matches logs containing an `http.status_code` value that is greater than or equal to `200` and less than or equal to `299`, and containing a value in the `http.url_details.path` attribute that start with `/api-v1/`. -Search syntax: `http.status:[200 TO 299]` +`http.status:[200 TO 299]` : Matches logs containing an `http.status` value that is greater than or equal to `200` and less than or equal to `299`. : **Notes**: : - `[..]` Square brackets mean the ranges are inclusive. : - Ranges can be used across any attribute. -Search syntax: `http.status:{200 TO 299}` +`http.status:{200 TO 299}` : Matches logs containing an `http.status` value that is greater than `200` or less than `299`. **Notes**: - `{..}` Curly brackets mean the ranges are exclusive. - Ranges can be used across any attribute. -Search syntax: `"service.status":disabled` +`"service.status":disabled` : Matches logs with `"service.status": "disabled"`. This filter syntax searches for a literal `.` in the attribute key. : See [Path notation](#path-notation) for more information. -Search syntax: `_exists_:service` +`_exists_:service` : Matches logs with the attribute key `service`. For example, the query matches `{"service": "postgres"}`, but does not match `{"env": "prod"}`. #### Path notation @@ -118,24 +118,24 @@ You can use the following case sensitive Boolean operators to combine multiple t The follow are example queries that use Boolean operators: -Search syntax: `NOT (status:debug)` +`NOT (status:debug)` : Matches logs that do not have the status `DEBUG`. -Search syntax: `host:COMP-A9JNGYK OR host:COMP-J58KAS` +`host:COMP-A9JNGYK OR host:COMP-J58KAS` : Only matches logs from those specific hosts. -Search syntax: `Hello AND World` +`Hello AND World` : Searches for `hello` and `world`. For example, "hello beautiful world" is a match. : This query can also be written as: `Hello world`. : **Note**: The message must contain both `hello` and `world` to match. -Search syntax: `hello` AND `status:info` +`hello` AND `status:info` : Matches logs with a message field that contains `hello` and with `status:info`. -Search syntax: `-http.status_code:200` +`-http.status_code:200` : Matches logs where http.status_code is not equal to 200 -Search syntax: `service:(postgres OR datadog_agent)` +`service:(postgres OR datadog_agent)` : Matches logs with the values `postgres` or `datadog_agent` for the `service` attribute. This query can also be written as: `service:postgres OR service:datadog_agent` ## Escape special characters and spaces @@ -175,22 +175,22 @@ To learn how to escape special characters and spaces in a search, let's look at The following are search syntax examples that escape special characters and spaces in the log example: -Search syntax: `tags:env*` +`tags:env*` : Matches logs with a `tag` attribute value of `env`. -Search syntax: `tags:(env\:prod OR env\:test)` +`tags:(env\:prod OR env\:test)` : Matches logs with the tag `env:prod` or `env:test` in the `tags` array. : This query can also be written as `tags:("env:prod" OR "env:test")`. -Search syntax: `tags:env\:prod AND -tags:version\:beta` +`tags:env\:prod AND -tags:version\:beta` : Matches logs that have `env:prod` and does not have `version:beta` in the `tag` array. : This query can also be written as `tags:"env:prod" AND -tags:"version:beta"`. -Search syntax: `my_app:hello\:world` +`my_app:hello\:world` : Matches logs that contain `my_app:hello:world`. : This query can also be written as `my_app:"hello:world"`. -Search syntax: `my_app:hello?world?again` +`my_app:hello?world?again` : Matches logs that contain `"my_app":"hello world again"`. ### Arrays @@ -216,19 +216,19 @@ If you use the filter query `Event.EventData.Data.Name:ObjectServer`, the above ​​You can use `*` for wildcard searches. The following are wildcard search examples: -Search syntax: `*network*` +`*network*` : Matches logs with a `message` field value that contains `network`. -Search syntax: `web*` +`web*` : Matches logs with a `message` field value that starts with `web`. -Search syntax: `*web` +`*web` : Matches logs with a `message` field value that ends with `web`. -Search syntax: `service:*mongo` +`service:*mongo` : Matches logs with `service` attribute values that ends with `mongo`. -Search syntax: `service:web*` +`service:web*` : Matches logs that have a `service` attribute value that starts with `web`. **Notes**: From fdb80508d5390f19ae8a30c7b38123996b55a90b Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 27 Oct 2025 17:50:29 -0400 Subject: [PATCH 10/13] Update content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md Co-authored-by: Michael Cretzman <58786311+michaelcretzman@users.noreply.github.com> --- .../upgrade_your_filter_queries_to_the_new_search_syntax.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md index 6b3bdd33a6447..886d368e8a711 100644 --- a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md +++ b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md @@ -55,7 +55,7 @@ The following table lists the differences between the legacy and new search synt | Since `@` indicates an attribute search, tag searches do not include an `@`, and are matched under the attributes `tags` and `ddtags`.

Attribute search queries without an `@` symbol are matched against the `tags` or `ddtags` array.

Example attribute search syntax: `env:prod` | Tags syntax must be explicitly entered.

Inspect your data with [Live capture][5] to determine which fields to match.

Example attribute search syntax: `tags:"env:prod" OR ddtags:"env:prod"` | | [Reserved fields](#legacy-syntax-reserved-fields) do not require the `@` symbol. | Reserved fields do not require the `@` symbol. | -**Note**: The upgraded search syntax does not need the `@` symbol for attribute searches. While you do not need to remove the `@` symbol from filter queries that were previously using them, Datadog recommends that you remove the `@` symbol. +**Note**: The upgraded search syntax does not require the `@` symbol for attribute searches. You do not need to remove the `@` symbol from existing filter queries, but Datadog recommends that you remove the `@` symbol from your queries. The following examples show matched logs, along with the legacy syntax and new syntax that matches the logs. From 9def9b6791e3fd9b54fc1370b23a61aa3d87cdc2 Mon Sep 17 00:00:00 2001 From: May Lee Date: Mon, 27 Oct 2025 17:51:06 -0400 Subject: [PATCH 11/13] Update content/en/observability_pipelines/search_syntax.md Co-authored-by: Michael Cretzman <58786311+michaelcretzman@users.noreply.github.com> --- content/en/observability_pipelines/search_syntax.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/observability_pipelines/search_syntax.md b/content/en/observability_pipelines/search_syntax.md index 514fb37affb14..d99ddac62c918 100644 --- a/content/en/observability_pipelines/search_syntax.md +++ b/content/en/observability_pipelines/search_syntax.md @@ -140,7 +140,7 @@ The follow are example queries that use Boolean operators: ## Escape special characters and spaces -The following characters are considered special and require escaping with the following characters: `-` `!` `&&` `||` `>` `>=` `<` `<=` `(` `)` `{` `}` `[` `]` `"` `*` `?` `:` `#`, and spaces. +The following characters are considered special and must be escaped with `\`: `-` `!` `&&` `||` `>` `>=` `<` `<=` `(` `)` `{` `}` `[` `]` `"` `*` `?` `:` `#`, and spaces. **Notes**: From 7c09bc0cb5208ba39a70e3d8f5a5e3b4de65bd42 Mon Sep 17 00:00:00 2001 From: May Lee Date: Tue, 28 Oct 2025 11:04:19 -0400 Subject: [PATCH 12/13] update pipeline --- ...pgrade_your_filter_queries_to_the_new_search_syntax.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md index 886d368e8a711..8bfbc270d0372 100644 --- a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md +++ b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md @@ -22,15 +22,15 @@ Worker versions 2.11 and newer use an updated search syntax. This document cover See the steps based on whether you: -- [Created the pipeline in the Pipeline UI](#created-the-pipeline-in-pipeline-ui) +- [Created the pipeline in the UI](#created-the-pipeline-in-the-ui) - [Created the pipeline using the API or Terraform](#created-the-pipeline-using-the-api-or-terraform) -### Created the pipeline in Pipeline UI +### Created the pipeline in the UI -If you created your pipeline using the Pipeline UI: +If you created your pipeline in the UI: 1. [Upgrade to Observability Pipelines Worker][1] version 2.11. -1. Navigate to the [Pipeline UI][2] for that pipeline and update your filter queries to the new syntax. See the [What's new in the updated search syntax](#whats-new-in-the-updated-search-syntax) section for more information. +1. Navigate to the [Pipeline page][2] for that pipeline and update your filter queries to the new syntax. See the [What's new in the updated search syntax](#whats-new-in-the-updated-search-syntax) section for more information. 1. On the pipeline editor page, by default the `Use legacy search syntax` box is checked because your pipeline is running the old search syntax of Worker 2.10 or older. {{< img src="observability_pipelines/guide/legacy_search_checkbox.png" alt="The pipelines editor showing the legacy search checkbox selected" style="width:100%;" >}} 1. After you've updated all queries in that pipeline, uncheck the `Use legacy search syntax` box and deploy your pipeline. From 4ae99e055f2e10fa7f258b35ec490f9b8cafc21b Mon Sep 17 00:00:00 2001 From: May Lee Date: Tue, 28 Oct 2025 11:07:26 -0400 Subject: [PATCH 13/13] fix typo --- .../upgrade_your_filter_queries_to_the_new_search_syntax.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md index 8bfbc270d0372..5993ae6167024 100644 --- a/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md +++ b/content/en/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax.md @@ -42,9 +42,6 @@ If your pipeline was created using the public API or Terraform:
You must set use_legacy_search_syntax to false when you update your queries. If use_legacy_search_syntax is unpopulated, it defaults to true in the Worker.
-**Note**: - - ## What's new in the updated search syntax The following table lists the differences between the legacy and new search syntax: