> ## Logs Explorer search

> Reference for all fields, operators, and preset values available in the Logs Explorer search filter

> Fetch the complete documentation index at: https://antithesis.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

---

The [Logs Explorer](/docs/product/logs_explorer/) comes with powerful search capabilities, including regular expressions, temporal search and logical conditions. As well as general search, it provides special search options for [assertion](/docs/concepts/properties_assertions/assertions/), [fault injector](/docs/concepts/fault_injection/) and [test command](/docs/product/test_templates/test_composer_reference/) logs.

This reference page summarizes the options available.

## Search fields

You can search the following fields.

### General fields

These fields are available for all events.

#### `output_text`

The normal text output of an executable or script. Often from stdout or stderr streams.

Example: `"An error occurred."`

Operators: `contains`, `excludes`, `regex`, `excludes regex`

#### `source`

The human-readable name of the system or process that emitted the event.

Example: `"kafka"`

Operators: `contains`, `excludes`, `regex`, `excludes regex`

#### `vtime`

The time in seconds that passed within the simulation up to the event.

Example: `5.345623644`

Operators: `=`, `>`, `≥`, `<`, `≤`

#### `moment`

A stringified JavaScript object representing an exact `Moment`. Contains an `input_hash`, `vtime`, and `session_id`.

Example: `Moment.from({ input_hash: "8145871537511053238", vtime: 14.287596361711621, session_id: "adcdef1234567890dba63952203b5b5c-12-3"})`

#### `custom`

A JSON field from a structured event, usually defined via the Antithesis SDK. Use dot notation to navigate nested fields (for example, `a.b.c` refers to `{"a": {"b": {"c": ...}}}`).

Example: `source.pid`

Operators: `contains`, `excludes`, `exact match`, `doesn't match`, `regex`, `excludes regex`, `is present`, `is not present`, `=`, `≠`, `>`, `≥`, `<`, `≤`

### Assertion fields

These fields provide special search capabilities for [assertion](/docs/concepts/properties_assertions/assertions/) log messages, including the type of assertion and whether it is passing or failing.

#### `message`

The name of the assertion. Often a human-readable description of the property being tested.

Example: `Client put requests can fail`

Operators: `contains`, `excludes`, `regex`, `excludes regex`

#### `type`

The type of assertion.

Preset options: `Always`, `Always Or Unreachable`, `Sometimes`, `Unreachable`, `Reachable`

#### `status`

Whether the assertion is currently passing or failing its test condition.

Preset options: `passing`, `failing`

#### `function`

The function in which the assertion is called.

Example: `example_function`

Operators: `contains`, `excludes`, `regex`, `excludes regex`

#### `file`

The file in which the assertion is called.

Example: `/opt/antithesis/test/v1/main/parallel_driver_example_file.py`

Operators: `contains`, `excludes`, `regex`, `excludes regex`

---

### Test command fields

These fields provide special search capabilities for [test command](/docs/product/test_templates/test_composer_reference/) logs.

#### `command`

The full name of the executable, including its file path.

Example: `/opt/antithesis/test/v1/main/parallel_driver_generate_traffic.py`

Operators: `contains`, `excludes`, `regex`, `excludes regex`

#### `type`

The command type, which dictates how and when a command runs.

Preset options: `singleton`, `anytime`, `parallel`, `serial`, `first`, `eventually`, `finally`

#### `status`

Whether a command has started or finished.

Preset options: `started`, `finished successfully`, `finished with error`

---

### Fault injector fields

These fields provide special search capabilities for [fault injector](/docs/concepts/fault_injection/) logs, including searching for the type of fault and the nodes affected.

#### `fault`

The fault type and name.

Preset options: `any network fault`, `network partition`, `network clog`, `network restore`, `any node fault`, `node kill`, `node stop`, `node pause`, `node throttle`, `clock skip`

#### `affected_nodes`

The containers or pods affected by a given fault. Use `[ALL]` to select all nodes.

Examples:

- `client1`

Operators: `contains`, `excludes`, `regex`, `excludes regex`

#### `quiet`

Whether the fault injector is currently paused (`true`) or active (`false`).

Preset options: `true`, `false`

#### `duration`

The maximum duration in seconds that a given fault could execute.

Example: `2.5`

Operators: `=`, `>`, `≥`, `<`, `≤`

## Operators

The Logs Explorer search uses the following operators. The specific operators available depend on the field type.

| Operator | Description |
|---|---|
| `contains` | Field contains the given substring. |
| `excludes` | Field does not contain the given substring. |
|`exact match` | Matches exactly. |
|`doesn't match` | Does not match. |
| `regex` | Case-sensitive regular expression match within the field. |
| `excludes regex` | Negated case-sensitive regular expression match. |
| `is present` | The field exists on the event. |
| `is not present` | The field does not exist on the event. |
| `=` | Equal to. |
| `≠` | Not equal to. |
| `>` | Greater than. |
| `≥` | Greater than or equal to. |
| `<` | Less than. |
| `≤` | Less than or equal to. |

## Temporal search

To find events within a time interval of a given event, use the optional **Preceded by** or **Followed by** groups.

| Option | Description |
|---|---|
| `Preceded by` | Find events where the given event is preceded by a matching event within the look-back window. |
| `Not preceded by` | Find events where the given event is *not* preceded by a matching event. |
| `Followed by` | Find events where the given event is followed by a matching event within the look-forward window. |
| `Not followed by` | Find events where the given event is *not* followed by a matching event. |

The time window is specified in seconds. Each group supports its own independent set of filter conditions.

## Logical search

To search for logical relationships between events, use the **AND** and **OR** conditions.

Conditions within a group are joined with **OR** — an event matches if it satisfies any one of them. Groups themselves are joined with **AND** — an event must satisfy at least one condition in every group.

Use the **+ AND** button to add a new group and the **+ OR** button to add an alternative condition within a group.

## Type coercions

Search performs some convenient type coercions to assist with event matching:

- `false` matches `0` and vice versa; same for `true` and `1`.
- Numbers are standardized: `17.0` matches `17`, `-.50` matches `-0.5`, etc.
- Events missing the field being searched will be ignored, even when using negative operators, like `not contains`.