LPQL Syntax Reference

Field expressions compare a field name to a value using comparison operators. Field names can contain letters, digits, underscores, and dots.

level=error
status!=200
duration>1000
host>=prod-01
field="quoted value"

Values support wildcards with * for pattern matching:

source=api-*       # starts with "api-"
host=*prod*        # contains "prod"
field=*            # field exists and is non-empty
field!=*           # field does not exist or is empty

Free-text search matches against the event message field. Unquoted terms are matched individually, quoted strings match exact phrases, and wildcards allow pattern matching.

error                     # free text search
"connection refused"      # exact phrase (double quotes)
'timeout error'           # exact phrase (single quotes)
*exception*               # wildcard text search

Combine expressions with AND, OR, and NOT operators. Spaces between expressions act as implicit AND. Use parentheses to control evaluation order. Operator precedence (lowest to highest): OR, AND, NOT.

# Implicit AND (space-separated)
level=error source=api

# Explicit operators
level=error AND source=api
level=error OR level=warn
NOT debug

# Grouping with parentheses
(level=error OR level=fatal) AND source=api

# Operator precedence: NOT > AND > OR
level=error OR level=warn NOT debug

The IN operator matches a field against a list of values. Values can include wildcards.

level IN (error, fatal, critical)
source IN ("api-gateway", "web-server")
host IN (prod-*, dev-*)

Every event has two times. _time is the time of the event itself, taken from the event when a parser reads it. _indextime is when LogPulse indexed the event. _indextime is hidden from results and the field list until you name it in a search, as in Splunk.

Use _index_earliest and _index_latest to filter on when events arrived, on top of the normal time range. They take the same values as earliest and latest. In eval and where, time fields count as epoch seconds, so _indextime-_time is the indexing delay in seconds.

# Everything indexed in the last 15 minutes, whatever its event time
earliest=-7d _index_earliest=-15m

# Late arrivals: indexed in the last hour, but more than an hour old
earliest=-24h _index_earliest=-1h | where _indextime-_time > 3600

# Indexing delay per source
earliest=-1h | eval lag=_indextime-_time | stats avg(lag) max(lag) by source

# Show the index time as a column
earliest=-15m | eval indexed=_indextime | table _time, indexed, source

Events indexed before index time was introduced have _indextime equal to _time.

Aggregates results by one or more fields, computing statistical functions.

| stats count by level
| stats avg(duration) as avg_dur by source
| stats count, sum(amount), avg(price) by level, host
| stats dc(host) as unique_hosts by level
| stats latest(io_data[io="66"].value) as voltage by device_id

Available aggregation functions:

Creates time-bucketed aggregations for charting. Similar to stats but automatically groups by time intervals.

| timechart count
| timechart span=5m count
| timechart span=1h count by level
| timechart span=1h cont=true avg(duration) by source

Available options:

Aggregates over an arbitrary field on the x-axis (over), with an optional split field for the columns. Like stats, but shaped for charting.

| chart count over source
| chart count over source by level
| chart avg(duration) over host limit=10

Aggregates metrics from the dedicated metrics store (OTLP ingest). Filter with where on index and metric_name. rate() and increase() are counter-reset aware; percentiles (p95, perc99) use histogram quantiles.

| mstats avg(value) where metric_name=cpu_usage by host
| mstats span=5m max(value) where index=otlp metric_name=memory_bytes
| mstats rate(value) where metric_name=http_requests_total by route span=1m
| mstats p95(value) where metric_name=http_duration by route

Returns raw metric data points from the metrics store without aggregation. Useful to inspect what a metric looks like before writing an mstats query.

| mpreview index=otlp metric_name=cpu_usage

Computes new fields from expressions. Supports arithmetic, string concatenation, comparisons, and a rich set of built-in functions.

| eval ratio = count / total
| eval msg = "Status: " . status
| eval is_error = (status >= 500)
| eval x=1, y=2, z=x+y
| eval voltage = io_data[io="66"].value

Filters results using eval expressions. Only events where the expression evaluates to true are kept.

| where status > 400
| where level == "error" OR level == "fatal"
| where duration/1000 > 5
| where like(source, "api%")
| where io_data[io="66"].value < 12

Selects specific fields to display in the output. Supports wildcard patterns for field names.

| table level, event, host
| table timestamp, source_*, host
| table *
| table timestamp, device_id, io_data[io="66"].value

top shows the most common values of a field, rare shows the least common. Both support a limit, percentage display toggle, and split-by fields.

| top level
| top 5 host
| top limit=10 showperc=false source
| top level by host

| rare level
| rare 5 host by source

Removes duplicate events based on one or more fields. Optionally keep a set number of duplicates or sort by a specific field.

| dedup host
| dedup 3 level
| dedup host, source
| dedup keepevents=true sortby=timestamp host

Sorts results by one or more fields. Use - prefix for descending order, + or no prefix for ascending.

| sort timestamp        # ascending (default)
| sort -level           # descending
| sort limit=100 -duration timestamp

head returns the first N results, tail returns the last N. Default is 10.

| head          # first 10 results (default)
| head 20       # first 20 results
| tail 50       # last 50 results

Include (+) or exclude (-) specific fields from the output. Supports wildcard patterns.

| fields level, event, host      # include only these
| fields +source                 # include
| fields -attributes             # exclude
| fields source_*, host          # wildcard include

Renames fields in the output using field as new_name syntax.

| rename old_field as new_field
| rename level as log_level, host as hostname

Extracts new fields using regular expressions with named capture groups. Defaults to extracting from the event field.

| rex field=event "(?<app>\w+)-(?<env>\w+)"
| rex "(?<status_code>\d{3})"

Applies an additional search expression mid-pipeline, using the same syntax as the root search. Useful after commands that create new fields.

| search level="error" OR status>500
| stats count by host | search count > 100

fillnull replaces null values with a constant (value=...); filldown carries the previous non-null value forward into nulls, which works well after sort.

| fillnull value="0" count
| fillnull value="unknown" host, source

| sort timestamp | filldown host

Buckets numeric or time values into discrete groups using span or bins; bucket is an alias. Use as to name the output field, and combine with stats to aggregate per bucket.

| bin response_time_ms span=100 as latency_bucket
| bin timestamp span=1h as hour
| bin duration bins=10 | stats count by duration

Joins results with a subsearch on shared fields. Defaults are type=inner and max=1 match per key; use type=left to keep events without a match.

| join host [search source=metadata | table host, region]
| join type=left user_id [search index=_audit | stats count by user_id]

Generates synthetic events. Useful for testing eval expressions or producing fixed rows without searching any data.

| makeresults | eval msg="hello"
| makeresults count=3 | eval host="test", level="info"

Pivots rows into columns. Run it after stats or timechart to flip the result orientation, e.g. one column per group instead of one row.

| stats count by level | transpose
| timechart count by source | transpose header_field=_time

Enriches events by joining a lookup dataset (LEFT JOIN on a single key field). OUTPUT selects which dataset columns to add, optionally with an alias. Two lookups are built in and read-only: identities (users, with roles and privileged) and assets (hosts, IPs and other entities), both keyed on key and matched case-insensitively.

| lookup users user_id OUTPUT name, email AS user_email
| lookup ip_allocations src_ip
| lookup assets key AS hostname OUTPUT owner, criticality
| lookup identities key AS actor_email OUTPUT roles, privileged
| lookup identities key AS actor_email OUTPUT roles | where NOT match(roles, "cloudflare_admin")

inputlookup emits the rows of a lookup dataset as events and must be the first pipe in the query. outputlookup writes the pipeline result to a lookup dataset and must be the last.

| inputlookup users
| inputlookup ip_allocations where region="EU" | stats count by region

index=apps level=error | stats count by service | outputlookup error_baseline
index=apps | stats count by host | outputlookup append=true host_counts

Enriches events with reputation columns from the system threat-intel store, matched on the given IP, domain, or hash field. By default it adds threat_verdict, threat_sources, threat_categories, and threat_confidence; iplookup is an alias.

| threatintel src_ip
| threatintel dest_ip OUTPUT threat_verdict AS verdict, threat_confidence
| threatintel src_ip | where threat_verdict = "malicious"

Geo-enriches events by resolving an IP field (default src_ip) against the GeoIP database, adding country, city, lat, lon, and asn. The lat/lon columns feed the map visualization directly. Unknown IPs yield empty values.

| iplocation
| iplocation client_ip | stats count by country
| iplocation src_ip | stats count by lat, lon
| iplocation src_ip | table src_ip, country, city, asn