Specifying filters through the UI in IBM Cloud Logs

You can apply filters to a Lucene or Dataprime query in a view by choosing 1 or more filters that reduce the data that is processed by the query. You can also apply filters to a query that is configured for a widget in a custom dashboard.

By default, in the Logs page, filters for metadata information are displayed: Application, Subsystem, and Severity. For widgets, you must add and configure filters including the ones to filter metadata.

You can add additional filters by clicking Add Filter.

• The list of values for a field that you choose as a filter can be displayed by expanding or collapsing the filter.
• You can select the filter values to be included in the view. You can select individual values, SELECT ALL, or UNSELECT ALL.

Specifying filters by using the filter command in IBM Cloud Logs

Add explicit filter clauses or grep conditions early in your DataPrime Query Assistance or search bar to reduce the working data set before running transformations.

For example, the following sample shows a filter condition before an aggregation expression:

source logs
| filter $d.action == 'create'
| groupby $d.path aggregate count()

For more information, see filter command.