Docs

Torch Log Service

Query and analysis FAQ

What are the usage scenarios for quotes in retrieval analysis statements?

This paper introduces the use of quotation marks in search analysis statements.

Instructions for use

In a search analysis statement, if there are special characters (spaces, etc.), search operators (and, or, etc.), index participles, etc. in the field name or field value, you need to use double quotation marks " wrap. For more instructions and examples of search syntax, see Query syntax.

In parsing statements (SQL statements), you need to use single quotes ' to represent the character of the string, and unsigned or double-quoted " to represent the character of the field or column name. For example, ' time ' represents the string, time or " time " represents the field or column name.

The difference between single and double quotes

In a search statement, the characters wrapped in single quotes ' and double quotes " both represent strings. Single quotes ' and double quotes " have the same semantics except for the following two points.

Phrase queries should use the form #"" and cannot use single quotes ' instead of double quotes " .

Use double quotes " to wrap the asterisk * and question mark ? Does not represent wild-card, only normal characters; use single quotes ' to wrap the asterisk * and question mark ? Represents a wild-card. For example:

"Abc *" means the normal query, the query string abc * .

'Abc * ' represents a wild-card query for strings starting with abc .

Use quotes in search statements

Example 1: Retrieving logs with a value greater than 100 for the Req Size field.

There is a space in the field name Req Size , which needs to be wrapped in double quotes " in the search statement.

"Req Size" > 100

Example 2: Query logs containing the keyword open failed .

"open failed"

Example 3: The query message field contains logs for the keywords error and failed .

Here, and is a normal search string, not a search operator.

message:"error and failed"

Using quotes in SQL parsing statements

Example 1: Counting the number of requests corresponding to each request method.

* | SELECT Method, COUNT(*) AS "request total" GROUP BY Method

Example 2: Counting the number of logs corresponding to each log level.

The logging field is in JSON format and the level field is its sub-node. When retrieving analysis, the field format is logging.level .

* | SELECT "logging.level", COUNT(*) AS PV GROUP BY "logging.level"

Last updated: 2026.06.25 17:01:03