NRQL Guide for Logs in Grepr

NRQL (New Relic Query Language) allows you to query and analyze log data efficiently. Grepr supports a customized subset of NRQL tailored for log filtering. Note that, currently, Grepr only supports NRQL for filtering logs.

For full details on NRQL, visit the New Relic NRQL documentation .

📘 Basic Query Structure

A valid NRQL query consists of:

• SELECT: Grepr only supports SELECT *.
• FROM: Specifies the data source — always Log for log events in Grepr.

SELECT * FROM Log

✅ Supported Clauses (Grepr Subset)

WHERE Clause

Used to filter logs based on attribute conditions SELECT * FROM Log WHERE <condition>

SELECT * FROM Log WHERE environment = 'prod'

Logical Operators

Combine conditions with logical operators:

• AND: All conditions must be true
• OR: At least one condition must be true
• NOT: Negates a condition

SELECT * FROM Log WHERE service = 'auth' AND status = 'error'
SELECT * FROM Log WHERE level = 'warn' OR level = 'error'
SELECT * FROM Log WHERE NOT duration > 200

Comparison Operators

Compare field values with standard comparison operators

• = (equals)
• != (not equal)
• > (greater than)
• < (less than)
• >= (greater than or equal to)
• <= (less than or equal to)

SELECT * FROM Log WHERE duration > 200
SELECT * FROM Log WHERE attributes.statusCode != '500'
SELECT * FROM Log WHERE tags.latency <= 1000

LIKE and RLIKE Operator

Grepr supports partial text matching using the LIKE keyword and RE2 using RLIKE keyword.

SELECT * FROM Log WHERE message LIKE '%timeout%'
SELECT * FROM Log WHERE message RLIKE r'timeout|disconnect'
SELECT * FROM Log WHERE message NOT LIKE '%timeout%'
SELECT * FROM Log WHERE message NOT RLIKE r'timeout|disconnect'

IN Operator

Grepr supports contains operator using the IN keyword to match against a list of values.

SELECT * FROM Log WHERE env IN ('prod', 'staging')
SELECT * FROM Log WHERE env NOT IN ('prod', 'staging')

IS NULL Operator

Grepr supports checking existence of a tag or attribute using the IS NULL operator.

SELECT * FROM Log WHERE attribute IS NULL 
SELECT * FROM Log WHERE env IS NOT NULL

Attribute and Tag Access

Grepr allows querying custom attributes and tags using the following syntax:

• attributes.<attribute_name> for custom log attributes
• tags.<tag_name> for tag values

SELECT * FROM Log WHERE attributes.env = 'prod'
SELECT * FROM Log WHERE tags.service = 'checkout'

⚠️ Unsupported Features

These features are not currently supported in Grepr’s NRQL implementation:

❌ Unsupported Statements

The follow clauses and statements are not supported JOIN, FACET, LIMIT, SINCE, UNTIL, TIMESERIES, WITH TIMEZONE, ORDER BY, WITH METRIC_FORMAT Subqueries are not supported.

❌ Unsupported Functions

Aggregate Functions

Grepr does not support the following aggregation functions such as count(), average(), max(), min(), sum(), etc

For a full reference, see Aggregator functions 

Non-Aggregate / Transformation Functions

Grepr also does not support the following functions such as filter(), rate(), percentage(), etc

For a full reference, see Non-aggregator functions 

Notes

• All field names and values are case-sensitive.
• Tags and custom attributes can be queried using the attributes. and tags. prefixes.