I have message filter

fields @timestamp, @message
| sort @timestamp desc
| filter @message ~= 'simple query'
| limit 20

What query should I use for searching results with messages:

simple query
simple query 1
simple query 2
simple query error
simple query etc...

Big thx!

CodePudding user response：

Two options that you have are the strcontains and like methods:

strcontains:

fields @timestamp, @message
| filter strcontains(@message, "simple query")
| sort @timestamp desc
| limit 20

like:

fields @timestamp, @message
| filter @message like /simple query/
| sort @timestamp desc
| limit 20