Query language
NRQL

NRQL Guide for Logs in Grepr

NRQL (New Relic Query Language) allows you to query and analyze log data efficiently. Grepr supports a customized subset of NRQL tailored for log filtering. Note that, currently, Grepr only supports NRQL for filtering logs.

For full details on NRQL, visit the New Relic NRQL documentation (opens in a new tab).

📘 Basic Query Structure

A valid NRQL query consists of:

  • SELECT: Grepr only supports SELECT *.
  • FROM: Specifies the data source — always Log for log events in Grepr.
SELECT * FROM Log

✅ Supported Clauses (Grepr Subset)

WHERE Clause

Used to filter logs based on attribute conditions SELECT * FROM Log WHERE <condition>

SELECT * FROM Log WHERE environment = 'prod'

Logical Operators

Combine conditions with logical operators:

  • AND: All conditions must be true
  • OR: At least one condition must be true
  • NOT: Negates a condition
SELECT * FROM Log WHERE service = 'auth' AND status = 'error'
SELECT * FROM Log WHERE level = 'warn' OR level = 'error'
SELECT * FROM Log WHERE NOT duration > 200

Comparison Operators

Compare field values with standard comparison operators

  • = (equals)
  • != (not equal)
  • > (greater than)
  • < (less than)
  • >= (greater than or equal to)
  • <= (less than or equal to)
SELECT * FROM Log WHERE duration > 200
SELECT * FROM Log WHERE attributes.statusCode != '500'
SELECT * FROM Log WHERE tags.latency <= 1000

LIKE and RLIKE Operator

Grepr supports partial text matching using the LIKE keyword and RE2 using RLIKE keyword.

SELECT * FROM Log WHERE message LIKE '%timeout%'
SELECT * FROM Log WHERE message RLIKE r'timeout|disconnect'
SELECT * FROM Log WHERE message NOT LIKE '%timeout%'
SELECT * FROM Log WHERE message NOT RLIKE r'timeout|disconnect'

IN Operator

Grepr supports contains operator using the IN keyword to match against a list of values.

SELECT * FROM Log WHERE env IN ('prod', 'staging')
SELECT * FROM Log WHERE env NOT IN ('prod', 'staging')

IS NULL Operator

Grepr supports checking existence of a tag or attribute using the IS NULL operator.

SELECT * FROM Log WHERE attribute IS NULL 
SELECT * FROM Log WHERE env IS NOT NULL

Attribute and Tag Access

Grepr allows querying custom attributes and tags using the following syntax:

  • attributes.<attribute_name> for custom log attributes
  • tags.<tag_name> for tag values
SELECT * FROM Log WHERE attributes.env = 'prod'
SELECT * FROM Log WHERE tags.service = 'checkout'

⚠️ Unsupported Features

These features are not currently supported in Grepr’s NRQL implementation:

❌ Unsupported Statements

The follow clauses and statements are not supported JOIN, FACET, LIMIT, SINCE, UNTIL, TIMESERIES, WITH TIMEZONE, ORDER BY, WITH METRIC_FORMAT Subqueries are not supported.

❌ Unsupported Functions

Aggregate Functions

Grepr does not support the following aggregation functions such as count(), average(), max(), min(), sum(), etc

For a full reference, see Aggregator functions (opens in a new tab)

Non-Aggregate / Transformation Functions

Grepr also does not support the following functions such as filter(), rate(), percentage(), etc

For a full reference, see Non-aggregator functions (opens in a new tab)

Notes

  • All field names and values are case-sensitive.
  • Tags and custom attributes can be queried using the attributes. and tags. prefixes.
New Relic LuceneDatadog