Skip to content

textSearch - Find one or more tokens in complex nested structures

Searches for the provided text phrase in the target value.

Syntax

textSearch(target: T, phrase: string): bool

Arguments

Name Type Required Description
target T true T must be either string, bool, number, interval, timestamp, regexp or enum
phrase string true The string that we're looking for. Must be a string literal and not the result of a calculation

Target type and search behavior

Depending on the concrete type of target, the textSearch function will behave differently:

  • For primitive target types (like string, number, bool etc), the value is converted into a string before searching.
  • For object types, the search succeeds if one of the values (not keys) matches the search phrase.
  • For array types, the search succees if one of the elements in the array matches the phrase.

A successful search and tokenization

The phrase argument must appear in the target for a search to be successful. This means that it can not be separated by other characters. For the phrase to appear in the target, it must be a token. Tokens are defined when logs & trace values are parsed:

When content is parsed by Coralogix, it is tokenized. This means that the values are separated based on one of the following characters:

  • \s (whitespace)
  • =
  • /
  • :
  • @
  • #
  • $
  • *
  • |
  • ,
  • ;
  • '
  • "
  • (
  • [
  • {
  • }
  • )
  • ]
  • <
  • >
  • .
  • _
  • -

This means that in order to search for a given token using textSearch, your search phrase must be equal to one or more tokens.

For example, searching for online when the string inside your object looks like onlineboutique will not work, because onlineboutique is one token, whereas it would match online_boutique, because _ is a token boundary.

Likewise, given the following string, Version 17.4 (Build 21E213), the search phrase Version 17 would work, but Vers wouldn't, because the former matches the first two tokens, whereas Vers does not exactly match any token.

Example - Finding a username in a complex object

Consider the following document:

{
    "path": "/home",
    "latency": 500,
    "metadata": {
        "headers": [
            "Authorization=User Chris Bearer ...",
            "Team=Super Team",
            "User=Dave"
        ],
        "body": {
            "text": "User Chris has entered page /home and it took 500 ms",
            "body_headers": {
                "user": "Dave",
                "team": "Dragon Team"
            }
        }
    }
}

We can see that there are many different fields. Manually searching through all of these would be painful and inefficient. Instead, we can use textSearch to check the values throughout the headers array, to find a username that we're looking for.

filter textSearch(metadata, 'Dave')

This will confirm the presence of the name Dave in the document.