Phrase search - syntax, limitations, and examples - Simple Log Service

Overview

By default, SLS uses tokenized queries. For example, abc def matches all logs containing both abc and def, regardless of order. To match an exact sequence of terms, use phrase search.

A phrase search runs in two steps:

SLS first runs a standard (non-phrase) search. For example, #"abc def" first executes a standard search for "abc def".

Note
This initial step is limited to 10,000 results.
SLS filters these results for the exact phrase and returns the final matches.

Syntax

Note

SLS Query Skill for intelligent log query and analysis: Query and analyze SLS log data in a local AI agent using natural language.

Field-specific search
```
key:#"abc def"
```
Full-text search
```
#"abc def"
```

Limitations

Phrase search results support only sequential page navigation. Random page jumps are not supported.
The log distribution histogram shows results from the initial non-phrase search, not the final phrase search results.
Phrase search cannot be combined with a fuzzy match.
Phrase search requires double quotation marks ("").
The NOT operator is not supported in phrase search statements. For example, not #"abc def" is an invalid query.
Analytic statements cannot be used with phrase search. For example, #"abc" | select *** is not supported. The quick analysis feature is also unavailable for phrase searches.

Pagination

Each page turn triggers a new phrase search to retrieve the next set of results.

Each phrase search processes up to 10,000 logs. A page may show fewer logs than the Items per page setting while still allowing navigation to the next page. This means fewer than Items per page logs matched in the current batch of 10,000.

For example, with 20,000 total logs and 100 per page: if a phrase search returns only 89 logs but the next page option is available, only 89 of the first 10,000 logs matched. Navigating to the next page triggers a second phrase search on the remaining 10,000 logs.

Examples

Query for logs that contain redo_index/1.
- A non-phrase search such as "redo_index/1" uses the full-text index to match keywords. SLS splits the query by the delimiter (/) and returns entries containing tokens like redo_index and 1. This produces imprecise matches such as /redo_index/318/.../1/... or /redo_index/14912/.../1/....
- The phrase search #"redo_index/1" matches the complete phrase redo_index/1. Only logs containing the exact string redo_index/1 are returned. The file path field shows the complete segment /redo_index/1/, confirming that phrase search preserves the term as-is.
Query for logs that contain 02/Mar (debug).
- The non-phrase search time_local: 02/Mar uses the full-text index to match keywords.
  
  The results include a log with time_local value 01/Mar/2025:15:02:56. Although the date is 01/Mar, not 02/Mar, this entry matches because 02 appears in the time component 15:02:56 and Mar in the date. The tokens are matched independently.
- The phrase search time_local: #"02/Mar" matches the complete phrase 02/Mar.
  
  A matched log has time_local value 02/Mar/2025:23:59:56, containing the exact phrase 02/Mar.