After writing the log stream selector, the resulting set of logs can be further filtered with a search expression:

{host=~"^td1-plg-vmweb.*",log_type="nginx_access_log"} |= `"status_code":500`
{host=~"^td1-plg-vmweb.*",log_type="nginx_access_log"} |~ `"status_code":[45][0-9]{2}`

The following filter operators are supported:

  • |=: Log line contains string.
  • !=: Log line does not contain string.
  • |~: Log line matches regular expression.
  • !~: Log line does not match regular expression.

Regexes use Go RE2 syntax. The matching is case-sensitive by default and can be switched to case-insensitive prefixing the regex with (?i).