Filter log data using New Relic Query Language

New Relic Query Language (NRQL) allows you to query and analyze log data efficiently. Grepr supports a customized subset of NRQL tailored for log filtering. Grepr supports NRQL for filtering logs only.

For full details on NRQL, visit the New Relic NRQL documentation .

Basic query structure

A valid NRQL query consists of:

• SELECT: Grepr only supports SELECT *.
• FROM: Specifies the data source — always Log for log events in Grepr.

SELECT * FROM Log

Supported clauses

WHERE Clause

Used to filter logs based on attribute conditions SELECT * FROM Log WHERE <condition>

SELECT * FROM Log WHERE environment = 'prod'

Logical Operators

Combine conditions with logical operators:

• AND: All conditions must be true
• OR: At least one condition must be true
• NOT: Negates a condition

SELECT * FROM Log WHERE service = 'auth' AND status = 'error'
SELECT * FROM Log WHERE level = 'warn' OR level = 'error'
SELECT * FROM Log WHERE NOT duration > 200

Comparison Operators

Compare field values with standard comparison operators

• = (equals)
• != (not equal)
• > (greater than)
• < (less than)
• >= (greater than or equal to)
• <= (less than or equal to)

SELECT * FROM Log WHERE duration > 200
SELECT * FROM Log WHERE attributes.statusCode != '500'
SELECT * FROM Log WHERE tags.latency <= 1000

LIKE and RLIKE Operator

Grepr supports partial text matching using the LIKE keyword and RE2 using RLIKE keyword.

SELECT * FROM Log WHERE message LIKE '%timeout%'
SELECT * FROM Log WHERE message RLIKE r'timeout|disconnect'
SELECT * FROM Log WHERE message NOT LIKE '%timeout%'
SELECT * FROM Log WHERE message NOT RLIKE r'timeout|disconnect'

IN Operator

Grepr supports contains operator using the IN keyword to match against a list of values.

SELECT * FROM Log WHERE env IN ('prod', 'staging')
SELECT * FROM Log WHERE env NOT IN ('prod', 'staging')

IS NULL Operator

Grepr supports checking existence of a tag or attribute using the IS NULL operator.

SELECT * FROM Log WHERE attribute IS NULL
SELECT * FROM Log WHERE env IS NOT NULL

Access attributes and tags

Grepr allows querying custom attributes and tags using the following syntax:

• attributes.<attribute_name> for custom log attributes
• tags.<tag_name> for tag values

SELECT * FROM Log WHERE attributes.env = 'prod'
SELECT * FROM Log WHERE tags.service = 'checkout'

Limitations

These features are not supported in Grepr’s NRQL implementation:

• The following clauses and statements are not supported: JOIN, FACET, LIMIT, SINCE, UNTIL, TIMESERIES, WITH TIMEZONE, ORDER BY, WITH METRIC_FORMAT. Subqueries are not supported.

Unsupported functions

Aggregate functions

Grepr does not support the following aggregation functions such as count(), average(), max(), min(), sum(), etc.

For a full reference, see Aggregator functions 

Non-aggregate and transformation functions

Grepr does not support the following functions such as filter(), rate(), percentage(), etc.

For a full reference, see Non-aggregator functions