Search and filters

Use filters to reduce a stream to the events relevant to one investigation.

Available filters

• one or more stream IDs;
• time range;
• case-insensitive message terms;
• exact host, service name, or service namespace;
• severity;
• repeatable key:value labels;
• Kubernetes namespace, deployment, pod, container, node, or cluster.

Start broad, then narrow

1. Select the stream and time window.
2. Search a stable message fragment or error name.
3. Add service and severity filters.
4. Add labels or Kubernetes fields only when needed.

An empty result means no retained row matches all active filters. It does not prove the receiver has no traffic.

API equivalent

The customer Stream API exposes the same main filters on GET /api/v1/logs, histograms, and facets. Use the public logId parameter for an exact event.