Functions Reference Guide

This guide covers functions available in SigNoz query expressions.

Available Functions

search() Function

Runs a case-insensitive text search for a term across every field of a log record: the body, attribute keys and values, resource keys and values, and log fields such as severity. Use it when you know what you are looking for but not which field holds it.

Syntax:

search(term)
search(term, context, ...)

Examples:

# Every field
search('timeout')
 
# Only the log body
search('timeout', body)
 
# Body and resource attributes
search('checkout', body, resource)
 
# Combined with a field filter
search('timeout') AND service.name = 'checkout'

Field Contexts

Each optional context narrows where SigNoz looks, and several contexts search the union of them. A context can be written bare or quoted, so search('checkout', body) and search('checkout', 'body') are equivalent.

Keys are searched as well as values, so search('tenant') also matches a log that carries a tenant attribute whatever its value.

# Invalid: not a field context
search('checkout', bogus)
 
# Invalid: a qualified field is not a context
search('checkout', body.message)
 
# Correct: filter the field directly
body.message CONTAINS 'checkout'

Matching Rules

• Case-insensitive - search('CHECKOUT') and search('checkout') return the same logs.
• Literal, never regex - regex metacharacters match as written, so search('price: $99.99') looks for that exact text rather than treating $ as an end anchor.
• Substring, not whole word - search('uuid') matches abcuuid123xyz. For whole-token matching, use hasToken().

Quote the term. An unquoted term is accepted only when it is a single bare word, number, or boolean, so anything containing a space or punctuation must be quoted:

# Correct
search('connection refused')
 
# Wrong: unquoted multi-word text is a syntax error
search(connection refused)

Query Cost

search() reads every searchable column instead of a single indexed one, so it is far more expensive than a field filter. SigNoz applies two guardrails.

Every call returns an advisory warning alongside its results. The results are still correct; the warning is a nudge to switch to a field filter once you know where the term lives:

search() runs across all fields and can be slow and expensive. Prefer a specific field, e.g. `<context>.<field_key>:<type>`

SigNoz also estimates how many rows the query would read before running it, and rejects it with an HTTP 400 error when the estimate is over the per-shard budget:

This query would scan about 84000000 rows per shard in this range, over the per-shard limit of 60000000

To get under the budget, shorten the time range, add a selective filter such as service.name = 'checkout' AND search('timeout'), or narrow it to one context with search('timeout', body). A query that cannot be planned within 5 seconds is rejected the same way, with This query is too broad to plan within 5s.

hasToken() Function

Check if a whole token is present in a string.

The needle must be a single token: one uninterrupted run of ASCII letters and digits (A-Z, a-z, 0-9) with no separator characters. hasToken matches the needle only as a complete word, never as a substring inside another word (for example, it matches uuid123 but not abcuuid123xyz).

Syntax:

hasToken(field, value)

Examples:

# Valid: the needle is a single alphanumeric token
hasToken(body, 'uuid123')
hasToken(body, 'timeout')

# Invalid: the needle contains separators (@ and .), returns HTTP 400
hasToken(body, 'john@test.com')
 
# Correct: CONTAINS matches across separators
body CONTAINS 'john@test.com'

has() Function

Checks if an array contains a specific value.

Syntax:

has(field, value)

Examples:

has(body.user_ids, 123)
has(body.tags, 'production')
has(body.regions, 'us-east')

hasAny() and hasAll() Functions

Check an array against a set of values. hasAny() matches when at least one of the values is present, hasAll() only when every one of them is.

Syntax:

hasAny(field, [value, ...])
hasAll(field, [value, ...])

Pass the values either as one array literal or as separate arguments. Mixing the two forms in a single call fails with an HTTP 400 error.

Examples:

# Logs tagged production or staging
hasAny(body.tags, ['production', 'staging'])
 
# The same query, with the values as separate arguments
hasAny(body.tags, 'production', 'staging')
 
# Only logs that carry both regions
hasAll(body.regions, ['us-east', 'us-west'])

Important Notes

1. Body fields only - has(), hasAny(), and hasAll() work only with JSON body fields (fields prefixed with body.). search() and hasToken() are not restricted this way.
2. Array data - The field must contain an array for has(), hasAny(), and hasAll() to work properly
3. Logs only - These functions apply to logs. Traces and metrics reject them and require field-based filters.

Combining with Other Conditions

Functions can be combined with other query conditions:

# Find production logs with error status codes
has(body.tags, 'production') AND status_code IN [500, 502, 503]

Common Use Cases

Filtering by Tags

# Find all logs with production tag
has(body.tags, 'production')

Finding a Value When You Do Not Know the Field

# The order ID could be in the body, an attribute, or a resource attribute
search('ord_8123fa')

Error Messages

Common errors you might encounter:

• "unknown function" - Check function name spelling and case
• "function expects key and value parameters" - Ensure you're providing both field and value
• "function supports only body JSON search" - Use only with body. prefixed fields
• "expects either a single array literal or scalar values, not a mix of the two" - Give hasAny() or hasAll() one form or the other, not both
• "invalid search scope" - the search() context must be body, attribute, resource, or log

Related

• Search Syntax - complete reference for filter bar expressions
• Operators Reference - all supported comparison and logical operators
• Search Troubleshooting - common query errors and how to fix them
• Slow Queries & Missing Results - diagnose query performance problems