Search with ClickStack

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/use-cases/observability/clickstack/search.md)

ClickStack allows you to do a full-text search on your events (logs and traces). You can get started searching by just typing keywords that match your events. For example, if your log contains "Error", you can find it by just typing in "Error" in the search bar.

This same search syntax is used for filtering events with Dashboards and Charts
as well.

## Search features[​](#search-features "Direct link to Search features")

### Natural language search syntax[​](#natural-language-syntax "Direct link to Natural language search syntax")

- Searches aren't case sensitive
- Searches match by whole word by default (ex. `Error` will match `Error here`
  but not `Errors here`). You can surround a word by wildcards to match partial
  words (ex. `*Error*` will match `AnyError` and `AnyErrors`)
- Search terms are searched in any order (ex. `Hello World` will match logs that
  contain `Hello World` and `World Hello`)
- You can exclude keywords by using `NOT` or `-` (ex. `Error NOT Exception` or
  `Error -Exception`)
- You can use `AND` and `OR` to combine multiple keywords (ex.
  `Error OR Exception`)
- Exact matches can be done via double quotes (ex. `"Error tests not found"`)

#### Column/property search[​](#column-search "Direct link to Column/property search")

- You can search columns and JSON/map properties by using `column:value` (ex. `level:Error`,
  `service:app`)
- You can search for a range of values by using comparison operators (`>`, `<`,
  `>=`, `<=`) (ex. `Duration:>1000`)
- You can search for the existence of a property by using `property:*` (ex.
  `duration:*`)

### Time input[​](#time-input "Direct link to Time input")

- Time input accepts natural language inputs (ex. `1 hour ago`, `yesterday`,
  `last week`)
- Specifying a single point in time will result in searching from that point in
  time up until now.
- Time range will always be converted into the parsed time range upon search for
  easy debugging of time queries.
- You can highlight a histogram bar to zoom into a specific time range as well.

### SQL search syntax[​](#sql-syntax "Direct link to SQL search syntax")

You can optionally toggle search inputs to be in SQL mode. This will accept any valid
SQL WHERE clause for searching. This is useful for complex queries that can't be
expressed in Lucene syntax.

### Select statement[​](#select-statement "Direct link to Select statement")

To specify the columns to display in the search results, you can use the `SELECT`
input. This is a SQL SELECT expression for the columns to select in the search page.
Aliases aren't supported at this time (ex. you can not use `column as "alias"`).

## Saved searches[​](#saved-searches "Direct link to Saved searches")

You can save your searches for quick access later. Once saved, your searches will appear on the `Saved Searches` page, making it easy to revisit frequently used search queries without having to reconstruct them.

To save a search, simply configure your search query and click the save button. You can give your saved search a descriptive name to help identify it later.

### Adding alerts to saved searches[​](#alerts-on-saved-searches "Direct link to Adding alerts to saved searches")

Saved searches can be monitored with alerts to notify you when certain conditions are met. You can set up alerts to trigger when the number of events matching your saved search exceeds or falls below a specified threshold.

For more information on setting up and configuring alerts, see the [Alerts documentation](/docs/use-cases/observability/clickstack/alerts).

### Tagging[​](#tagging "Direct link to Tagging")

You can add tags to dashboards and saved searches to help organize them.
Tags provide a flexible way to categorize and filter based on your needs.

#### How tags work[​](#how-tags-work "Direct link to How tags work")

- **Organization**: Tags appear in the left sidebar, where dashboards and saved searches are grouped by their assigned tags
- **Multiple tags**: You can add one or more tags to a single item for better categorization
- **Auto-creation**: If you assign a tag that doesn't exist yet, it will be automatically created
- **Easy management**: You can add or remove tags at any time to adjust your organization structure

This makes it easy to find related items and maintain an organized workspace as your collection grows.

You can also select multiple tags to filter and view items across different categories:

- [Search features](#search-features)
  - [Natural language search syntax](#natural-language-syntax)- [Time input](#time-input)- [SQL search syntax](#sql-syntax)- [Select statement](#select-statement)- [Saved searches](#saved-searches)
    - [Adding alerts to saved searches](#alerts-on-saved-searches)- [Tagging](#tagging)

Was this page helpful?