find / text

Description

The find command performs a free-text search within a specified keypath, returning documents whose values contain the given substring. It acts as a shorthand for combining filter with a text match (~).

This command is ideal for quick searches across log messages or string fields where full parsing is unnecessary. The alias text can be used interchangeably with find.

Syntax

(find|text) <free-text-string> in <keypath>

Example

Use case: Find logs mentioning a specific AWS availability zone

When investigating deployment behavior across regions, you might want to return only logs referencing a particular availability zone—without parsing or restructuring the message field.

Example data

{ "msg": "eu-west-1a instance deployed" },
{ "msg": "eu-west-1b instance deployed" },
{ "msg": "eu-west-1c instance deployed" }

Example query

find 'eu-west-1a' in msg

Example output

{ "msg": "eu-west-1a instance deployed" }

The find command returns only documents containing the specified substring. It’s particularly useful for quickly searching raw log fields.