textSearch - Find one or more tokens in complex nested structures
Searches for the provided text phrase in the target value.
Syntax
Arguments
Name | Type | Required | Description |
---|---|---|---|
target | T | true | T must be either string , bool , number , interval , timestamp , regexp or enum |
phrase | string | true | The string that we're looking for. Must be a string literal and not the result of a calculation |
Target type and search behavior
Depending on the concrete type of target
, the textSearch
function will behave differently:
- For primitive target types (like
string
,number
,bool
etc), the value is converted into astring
before searching. - For object types, the search succeeds if one of the values (not keys) matches the search phrase.
- For array types, the search succees if one of the elements in the array matches the phrase.
A successful search and tokenization
The phrase
argument must appear in the target for a search to be successful. This means that it can not be separated by other characters. For the phrase
to appear in the target, it must be a token. Tokens are defined when logs & trace values are parsed:
When content is parsed by Coralogix, it is tokenized. This means that the values are separated based on one of the following characters:
\s
(whitespace)=
/
:
@
#
$
*
|
,
;
'
"
(
[
{
}
)
]
<
>
.
_
-
This means that in order to search for a given token
using textSearch
, your search phrase must be equal to one or more tokens.
For example, searching for online
when the string inside your object looks like onlineboutique
will not work, because onlineboutique
is one token, whereas it would match online_boutique
, because _
is a token boundary.
Likewise, given the following string, Version 17.4 (Build 21E213)
, the search phrase Version 17
would work, but Vers
wouldn't, because the former matches the first two tokens, whereas Vers
does not exactly match any token.
Example - Finding a username in a complex object
Consider the following document:
{
"path": "/home",
"latency": 500,
"metadata": {
"headers": [
"Authorization=User Chris Bearer ...",
"Team=Super Team",
"User=Dave"
],
"body": {
"text": "User Chris has entered page /home and it took 500 ms",
"body_headers": {
"user": "Dave",
"team": "Dragon Team"
}
}
}
}
We can see that there are many different fields. Manually searching through all of these would be painful and inefficient. Instead, we can use textSearch
to check the values throughout the headers array, to find a username that we're looking for.
This will confirm the presence of the name Dave
in the document.