> ## Documentation Index
> Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Search with ClickHouse Observability

> Search with ClickHouse Observability

ClickHouse Observability allows you to do a full-text search on your events (logs and traces). You can get started searching by just typing keywords that match your events. For example, if your log contains "Error", you can find it by just typing in "Error" in the search bar.

The same search syntax is used to filter events in dashboards and charts.

## Search features

### Lucene search syntax

* Searches aren't case sensitive
* Searches match by whole word by default (ex. `Error` will match `Error here`
  but not `Errors here`). You can surround a word by wildcards to match partial
  words (ex. `*Error*` will match `AnyError` and `AnyErrors`)
* Search terms are searched in any order (ex. `Hello World` will match logs that
  contain `Hello World` and `World Hello`)
* You can exclude keywords by using `NOT` or `-` (ex. `Error NOT Exception` or
  `Error -Exception`)
* You can use `AND` and `OR` to combine multiple keywords (ex.
  `Error OR Exception`)
* Exact matches can be done via double quotes (ex. `"Error tests not found"`)

![Fully managed Search showing log results for the query failed to watch](https://mintcdn.com/private-7c7dfe99/FqnhjwVWZILRZzw7/images/clickstack/observability-search.png?fit=max\&auto=format\&n=FqnhjwVWZILRZzw7\&q=85\&s=2c0a411d1c2307ca88bbb031fe81b897)

#### Column/property search

* You can search columns and JSON/map properties by using `column:value` (ex. `SeverityText:error`,
  `ServiceName:app`)
* You can search for a range of values by using comparison operators (`>`, `<`,
  `>=`, `<=`) (ex. `Duration:>1000`)
* You can search for the existence of a property by using `property:*` (ex.
  `Duration:*`)

### Time input

* Time input accepts natural language inputs (ex. `1 hour ago`, `yesterday`,
  `last week`)
* Specifying a single point in time will result in searching from that point in
  time up until now.
* Time range will always be converted into the parsed time range upon search for
  easy debugging of time queries.
* You can highlight a histogram bar to zoom into a specific time range as well.

### SQL search syntax

You can optionally toggle search inputs to be in SQL mode. This will accept any valid
`WHERE` clause for searching. This is useful for complex queries that can't be
expressed in Lucene syntax.

### Select statement

To specify the columns to display in the search results, you can use the `SELECT`
input. This is a SQL `SELECT` expression for the columns to select in the search page.
Aliases aren't supported at this time (ex. you cannot use `column as "alias"`).

## Saved searches

You can save your searches for quick access later. Once saved, your searches will appear on the `Saved Searches` page, making it easy to revisit frequently used search queries without having to reconstruct them.

![Saved Searches in fully managed ClickHouse Observability showing My Saved Search](https://mintcdn.com/private-7c7dfe99/dW6bcEakZdn3a5oP/images/clickstack/observability-saved-search-listing.png?fit=max\&auto=format\&n=dW6bcEakZdn3a5oP\&q=85\&s=b1fa1880216d5cf4c7553bd82f495fe5)

To save a search, configure your query, select **Save**, and give the search a descriptive name. When editing an existing saved search, the dialog shows **Update**, as in the example below.

![Save Search dialog showing the query, name, tags, and Update button for an existing saved search](https://mintcdn.com/private-7c7dfe99/dW6bcEakZdn3a5oP/images/clickstack/observability-save-search.png?fit=max\&auto=format\&n=dW6bcEakZdn3a5oP\&q=85\&s=8b8e3ff75e59c7e685c0b5454c0521c7)

### Adding alerts to saved searches

Saved searches can be monitored with alerts to notify you when certain conditions are met. You can set up alerts to trigger when the number of events matching your saved search exceeds or falls below a specified threshold.

For more information on setting up and configuring alerts, see the [Alerts documentation](https://clickhouse.com/docs/clickstack/observability/features/alerts.md).

### Tagging

You can add tags to dashboards and saved searches to help organize them.
Tags provide a flexible way to categorize and filter based on your needs.

#### How tags work

* **Organization**: Tags appear in the left sidebar, where dashboards and saved searches are grouped by their assigned tags
* **Multiple tags**: You can add one or more tags to a single item for better categorization
* **Auto-creation**: If you assign a tag that doesn't exist yet, it will be automatically created
* **Easy management**: You can add or remove tags at any time to adjust your organization structure

This makes it easy to find related items and maintain an organized workspace as your collection grows.

You can assign multiple tags to the same saved search, as shown below:

![Tags in saved search](https://mintcdn.com/private-7c7dfe99/FqnhjwVWZILRZzw7/images/clickstack/observability-search-tags.png?fit=max\&auto=format\&n=FqnhjwVWZILRZzw7\&q=85\&s=fb44878be94cf96fc393004a7ddab985)