Full-Text Search Guide

Full-text search allows you to search through log body content without specifying field names. This guide covers all aspects of text searching in SigNoz.

Full-text search is only supported for logs currently and searches only in the log body field.

Quoted Text

Use quotes for exact phrase matching in the log body:

'failed to connect to database'

This finds logs where the body contains the exact phrase "failed to connect to database".

Quoted full-text search in SigNoz Logs Explorer — *Quoted full-text search in the Logs Explorer*

Unquoted Text

Without quotes, each word is searched separately in the log body:

error database connection

This searches for logs where the body contains 'error' AND 'database' AND 'connection' (not necessarily together).

Unquoted full-text search in SigNoz Logs Explorer — *Unquoted full-text search in the Logs Explorer*

How Search Text Is Evaluated

SigNoz first tries to compile your search text as an RE2 regular expression. If it compiles, the search runs as a regex. If it doesn't, SigNoz matches the text as a literal substring instead.

This means regex metacharacters stay active even in a search that looks like plain text:

Search	Evaluated as	Result
`'status != 200'`	Regex with no metacharacters	Matches the literal text
`'array[index] = value'`	Regex, where `[index]` is a character class	Matches `arrayi = value`, not the literal text
`'C:\\Users\\John'`	Not valid regex, so a literal substring	Matches the literal text

Escape any of . [ ] ( ) { } * + ? | ^ $ \ that you want to match literally.

Escaping Special Characters

When searching for text that contains special characters, enclose your search in single quotes and escape only these two characters:

Single quotes: Use \'
Backslashes: Use \\

Examples:

# Searching for text with single quotes
'user\'s email address'
'can\'t connect to database'
'it\'s working'
 
# Searching for text with backslashes
'C:\\Program Files\\App'
'escape sequence: \\n'
'path\\to\\file'
 
# Combining both
'user\'s path: C:\\Users\\John'

Those two escapes are for the query parser. Double quotes and other characters that mean nothing to a regex need no escaping:

'error: "connection failed"'
'status != 200'

Regex metacharacters are a separate matter. Escape them when you want to match them literally:

# Wrong - [index] reads as a character class, and $ anchors to end of text
'array[index] = value'
'price: $99.99'
 
# Correct
'array\[index\] = value'
'price: \$99\.99'

Tabs, Newlines, and Other Whitespace

Because search text is evaluated as a regex, the standard regex escapes match control characters:

Escape	Matches
`\t`	Tab
`\n`	Newline
`\r`	Carriage return
`\s`	Any whitespace character

To find a tab between two values in the log body:

'error\tconnection refused'

To match a literal backslash followed by t instead of a tab, use four backslashes. The parser collapses \\\\ to \\, which the regex engine then reads as an escaped backslash:

'\\\\t'

Regular Expressions

You can use any valid RE2 syntax as the full text search.

Examples

Match structured log entries:

'^\[SnapshotGenerator id=\d+\] Creating new KRaft snapshot file snapshot \d+-\d+ because .+ \d+ bytes\.$'

This matches log records with body like:

[SnapshotGenerator id=1] Creating new KRaft snapshot file snapshot 00000000000001109202-0000000001 because we have replayed at least 2800 bytes.
[SnapshotGenerator id=1] Creating new KRaft snapshot file snapshot 00000000000001109163-0000000001 because we have replayed at least 2800 bytes.
[SnapshotGenerator id=1] Creating new KRaft snapshot file snapshot 00000000000001109124-0000000001 because we have replayed at least 2800 bytes.
[SnapshotGenerator id=1] Creating new KRaft snapshot file snapshot 00000000000001108539-0000000001 because we have replayed at least 2800 bytes.
[SnapshotGenerator id=1] Creating new KRaft snapshot file snapshot 00000000000001108305-0000000001 because we have replayed at least 2800 bytes.

Match logs where the body contains email addresses:

'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'

Combining Full-Text with Field Searches

You can combine full-text search (on log body) with field-based filtering:

'payment failed' AND service.name = 'payment-service'

This finds logs where the body contains "payment failed" AND the service name is 'payment-service'.

Important: When to Use Quotes

Always use quotes when:

Searching for exact phrases
Your search term contains special characters or operators
You want to search for operator keywords as text

Examples where quotes are necessary:

# Wrong - AND will be treated as boolean operator
searching for AND operator
 
# Correct - searches for the phrase including 'AND'
'searching for AND operator'

Best Practices

Use quotes for phrases - Always quote multi-word searches unless you want each word searched separately
Be specific - More specific searches perform better than broad ones
Combine with fields - Add field filters to narrow down results
Test regex patterns - Complex regex can be slow; test and optimize
Escape properly - Escape single quotes and backslashes for the parser, plus any regex metacharacter you want matched literally

Get Help

If you need help with the steps in this topic, please reach out to us on SigNoz Community Slack. If you are a SigNoz Cloud user, please use in product chat support located at the bottom right corner of your SigNoz instance or contact us at cloud-support@signoz.io.