Skip to main content
Sumo Logic

Keyword Search Expressions

A Keyword Search Expression defines the scope of data for the query.

Boolean logic and wildcards enable you to search for multiple terms, express logic about term distribution within messages, and specify partial terms with wildcards. The keyword expression can include built-in metadata fields such as _collector, _sourceCategory, _sourceName, and _sourceHost as well as custom log metadata fields.

Click any term from the messages listed in the Message tab to add it to the keyword search expression (AND term). Alt-click any term to remove the term from results (NOT term or !term). Run the query again to match the new keyword expression.


  • keyword keyword OR keyword NOT keyword
  • *keyword*
  • _sourceCategory="keywords with spaces or special characters"
  • _sourceHost=*keyword*


  • AND is implicit.
  • Supports boolean operators NOTANDOR. The precedence of boolean operators is NOTANDOR. Parentheses will override the precedence.
  • A wildcard * can represent zero or more of any character.
  • Supports built-in metadata fields created during configuration of Collectors and Sources, like _sourceHost, _sourceCategory, and  _sourceName.
  • Supports custom log metadata fields.
  • Punctuation characters are allowed (- _ : / . + @ # $ % ^).
  • Expressions containing spaces or special characters must be enclosed in quotes (" ").
  • Keyword expressions are case-insensitive.
  • Parentheses group search expressions and provide the structure necessary to perform complex queries. Parentheses are necessary only if both of the following conditions apply:
    • The query includes three or more search expressions.
    • The query uses both AND and OR operators to link search expressions.
  • Characters quoted with double quotes (not single quotes) are string literals. Use a backslash to escape double quotes in the string. Examples:
    • "Don’t forget"
    • "They said, \"No later than 10\""


  • *
  • error OR fail error AND fail*
  • (error OR fail) and debug error* OR (fail and debug) error NOT fail
  • (error OR fail) NOT debug
  • 15:39 NOT 15:39:26
  • _sourceCategory="Sumo Logic Collector logs" AND critical
  • _sourceHost=ldapserver AND _sourceCategory="hr-dept" AND "failed login"
  • _sourceHost=Atlanta AND (_sourceCategory="win-app-logs" OR _sourceName="win-firewall-logs")
  • _sourceHost="" AND_sourceCategory="my category" NOT _sourceCategory="some-other" AND _sourceName="/var/log/some.log"

Case sensitive keyword search

By default, keyword expressions are case-insensitive. Technically there isn't a way to define case sensitivity in the keyword search expression, you'll have to define this with an operator. 

After the keyword search expression, to search for case sensitive keywords, you can use the parse regex operator. You should still specify the keyword in the scope of the query, before the first pipe "|", to keep the search efficient. 

For example, if you want to search for the keyword "info" in lowercase, you could use this query:

| parse regex "(?<sample>info)"

If you want to search for the keyword "INFO" in uppercase, you could use this query:

| parse regex "(?<sample>INFO)"

To convert a string to all lowercase or all uppercase letters, you can use the toUpperCase and toLowerCase operators.