> For the complete documentation index, see [llms.txt](https://docs.groundcover.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.groundcover.com/investigate/search-and-filter.md). # Search & Filter ### Search and filter To help you slice and dice your data, you can use our dynamic filters (left panel) and/or our powerful filter bar, which supports key:value pairs, as well as free text search. The Query Builder works in tandem with our filters. To further focus your results, you can also restrict the results to specific time windows using the time picker on the upper right of the screen. ## Query Builder The Query Builder is the default search option wherever search is available. Supporting advanced autocomplete of keys, values, and our discovery mode that across values in your data to teach users the data model. The following syntaxes are available for you to use in Query Builder:

Syntax	Description	Examples	Sections
`key:value`	Search attributes: Both groundcover built-ins custom attributes. Use `` for wildcard search. Note: Multiple filters for the same key act as 'OR' conditions, whereas multiple filters for different keys act as 'AND' conditions.*	`namespace:prod-us` `namespace:prod-*`	Logs Traces K8s Events API Catalog Issues
`request_body:value` `response_body:value`	Payload search: Search within request and response payloads. Use `` for wildcard/substring matching. Works across all protocols that capture payload data.*	`request_body:user_id` `response_body:error`	Traces
`term`	Free text: Search for single-word terms. Tip: Expand your search results by using wildcards.	`Exception` `DivisionBy*`	Logs
`"term"`	Phrase Search (case-insensitive): Enclose terms within double quotes to find results containing the exact phrase. Note: Using double quotes does not work with `` wildcards.*	`"search term"`	Logs
`-key:value`	Exclude: Specify terms or filters to omit from your search; applies to each distinct search.	`-key:value` `-term` `-"search term"`	Logs Traces K8s Events API Catalog Issues
`*:value`	Search all attributes: Search any attribute for a value, you can use double quotes for exact match and wildcards.	`:error` `:"POST /api/search"` `:erro`	Logs Traces Issues

### Search performance groundcover optimizes searches so they scan as little data as possible, using indexed scope keys, automatically promoted favorite attributes, inverted indexes, and index tiers. If a search feels slow, see [Search Performance](/investigate/querying-your-groundcover-data/search-performance.md) for how these work and how to make a slow query faster. ### How to use filters Filters are very easy to add and remove, using the filters menu on the left bar. You can combine filters with the Query Builder, and filters applied using the left menu will also be added to the Query Builder in text format.

* **Select / deselect a single filter** - click on the checkbox on the left of the filter. (You can also deselect a filter by clicking the 'x' next to the text format of the filter on the search bar). * **Deselect all but one filter** (within a filter category, such as 'Level' or 'Format') - hover over the filter you want to leave on, then click on "ONLY". * You can switch between filters you want to leave on by hovering on another filter and clicking "ONLY" again. * To turn all other filters in that filter category back on, hover over the filter again and click "ALL". * **Clear all filters within a filters category** - click on the funnel icon next to the category name. * **Clear all filters currently applied** - click on the funnel icon next to the number of results. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.groundcover.com/investigate/search-and-filter.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.