From a90fd63ead1c9f101dd10f6a05a95656eca6b783 Mon Sep 17 00:00:00 2001 From: bean1352 Date: Wed, 10 Jun 2026 13:16:53 +0200 Subject: [PATCH] document negative search filters for instance logs --- maintenance-ops/monitoring-and-alerting.mdx | 23 ++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/maintenance-ops/monitoring-and-alerting.mdx b/maintenance-ops/monitoring-and-alerting.mdx index 515481f4..b40681c4 100644 --- a/maintenance-ops/monitoring-and-alerting.mdx +++ b/maintenance-ops/monitoring-and-alerting.mdx @@ -174,6 +174,23 @@ lag:>=5 Only one numeric comparison is allowed per property. Combining `lag:>5 lag:<10` is rejected. +#### Excluding Results + +Prefix a term or filter with `-` to exclude matching entries. This is useful for hiding known-noisy errors while triaging: + +``` +-error:PSYNC_S2106 +``` + +Exclusion works with both syntaxes: + +* `-alias:value` hides entries where the property matches the value. Repeating a negated alias hides every listed value: `-user_id:123 -user_id:456` hides both users. +* `-word` hides entries containing the text anywhere in the entry. Quote phrases: `-"token expired"`. + +Only an unquoted `-` at the start of a term excludes. A hyphen inside a term matches literally (`powersync-js`), and quoting keeps a leading hyphen literal: `"-foo"` finds entries containing `-foo` rather than excluding `foo`. + +Numeric comparisons **cannot** be negated. You should use the inverse comparison instead: `lag:<5` rather than `-lag:>=5`. + #### Filtering on Other Properties The **Property filters** button in the toolbar lists the aliases for the active log type. Log entries can contain many additional properties, and you can filter on any of them using `alias:value` syntax directly in the search bar. For example: @@ -191,13 +208,13 @@ This is the quickest way to filter on properties you spot in the logs without re #### Combined Example -You can mix free-text terms, known aliases, and unknown properties in a single query: +You can mix free-text terms, known aliases, unknown properties, and exclusions in a single query: ``` -checkpoint sync user_id:123 checkpoint:>=1224 +checkpoint sync user_id:123 checkpoint:>=1224 -error:PSYNC_S2106 ``` -This matches entries containing both `checkpoint` and `sync` in the message, with `user_id` equal to `123` and a `checkpoint` property greater than or equal to `1224`. +This matches entries containing both `checkpoint` and `sync` in the message, with `user_id` equal to `123` and a `checkpoint` property greater than or equal to `1224`, excluding entries with error code `PSYNC_S2106`. ### Export Logs