When TLS executes a fuzzy query statement, it identifies up to 100 words matching the fuzzy keyword and returns logs containing any of those 100 words. You can perform a fuzzy query in the following ways.

Query principle

Fuzzy query only queries the first 100 matched words. If the fuzzy condition prefix is short and more than 100 words exist in the log, the query result may be incomplete.

When you use NOT statements at the same time, some conditions may not be filtered as expected. For example, when you run not abc*, the query result may still contain words beginning with abc.

Common syntax is described below. For details, see Query syntax.

Asterisk (*): represents a word with multiple arbitrary characters. For example, ab* represents a query for words that start with ab.

Question mark (?): represents words with a single character. For example, ab?de represents a query for words that start with ab, end with de, and have a single character in between.

Basic fuzzy query

Example 1: Query logs with keywords that start with erro.

erro*

Example 2: Query logs where the Action field value starts with put.

Action:put*

Fuzzy query using SQL LIKE syntax

The SQL LIKE syntax is used to specify query conditions in the WHERE clause, which can be used for fuzzy queries for logs. In LIKE syntax, percent sign (%) matches any number of characters, including zero; underscore (_) matches a single character.

Description

When using the SQL LIKE syntax, the target field must have Key-value index enabled and statistics enabled. For details, see key-value index configuration.

Example 1: Query logs where the ReqID field value starts with 8f60.

* | SELECT * WHERE ReqID LIKE '8f60%'

Example 2: Query logs where the region field does not contain shanghai.

* | SELECT * WHERE region NOT LIKE '%shanghai%'

Last updated: 2026.06.25 17:01:03

Public security network record in Beijing: No. 11010802032137