Do a keyword search on loggly

Question

Anyone know how to search by keyword through loggly JSON logs?

I have JSON logs with a key messageText and if I search for cat i want a log with messageText: "someone took a photo of their cat" which should return about a bajillion results, but instead it returns 0.

I have tried:

search json.messageText:cat
search json.messageText:%cat%

but I'm just gessing at this point. Loggly's help is unhelpful. It's entirely possible that this is not possible.

Answer 1

Try this:

search json.messageText:"*cat*"

Answer 2

There is no need to type "search" at the beginning.

First, you can do a text-based search, on all fields, by just typing:

cat

Now, if you want to restrict your search to the field json.MessageText:

json.messageText:cat

Answer 3

I just spent an hour stuck on this one, too. Their "filter system" shows that they do a search on "json.key1.key2 : value8".

BUT, if you want to do the exact same search, you have to type in "key1.key2 : value8", which is essentially the same thing without the "json." at the beginning. The interface is very misleading and confusing about this.

So basically, don't put the "json." and the beginning of searches.