nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

What is the semantics for the search phrase foo:bar and its combinations

unknown

Hi,

I receive alerts which contain extra properties. I figured out that I can search for them by by calling

detailsPair(foo: bar)

But I can also search for

:foo
foo:
:bar
bar:
foo
bar
foo AND bar

These search phrases will return the alerts containing the extra property foo: bar

Can you please explain what OpsGenie is searching for, when passing foo:bar (or one of the alternatives - see list above) to the search bar.

If I have an alert with the extra property foo:whatever and the alert title contain s whatever this title is, then

the search query foo:whatever will also find this alert. Can you explain what the search does in the background.

I am asking this because the search query

foo:(bar OR whatever)

will NOT return alerts ONLY containing either the extra property foo:bar or foo:whatever.
It will also return alerts containing alert containing an extra property key foo and the title starting (?) with bar or whatever

Accepted answers

All comments

Shashwat Khare

Hi @[deleted],

This is Shashwat from Opsgenie support and here to help!

The search query for searching alerts with extra properties should be in the below format:

detailsPair(key:value)

For your use case, here

foo

is the key and

Bar

is the extra property value.

For searching alerts that contain whatever in the alert title, the query would be:

message:whatever

Please refer to the below help document for the search query syntax to be used for each corresponding alert field:
https://support.atlassian.com/opsgenie/docs/search-queries-for-alerts/

Best,
Shashwat

unknown

...

unknown

Hi Shashwat,

sorry - used the wrong input field...

thank you for you answer. Unfortunately, it does not completely answer everything.

It would be great if you could explain:

1. Which alerts will the following query return if I have an extra property with key foo

foo:(bar OR whatever)

Can you also explain the syntax?

2. Which alerts will the following queries return (and why) - which semantic does the colon have resp. what do alerts need to fulfil to be matched by this query?

:test
test:

unknown

Switch answer to reply

Shashwat Khare

Hi @[deleted],

1. This query will return all alerts that have the key value as bar or whatever, in the alert extra properties.

2. For the colon insertion, may I know with which field are you using the syntax for the colon as :test or test: ?

Best,
Shashwat

unknown

Unfortunately,

foo:(bar OR whatever)

will not return all alerts that have the key value as bar or whatever, in the alert extra properties. Please see my initial question

I am asking this because the search query
foo:(bar OR whatever) 
will NOT return alerts ONLY containing either the extra property foo:bar or foo:whatever.
It will also return alerts containing alert containing an extra property key foo and the title starting (?) with bar or whatever

Unfortunately, I do not understand your question

2. For the colon insertion, may I know with which field are you using the syntax for the colon as :test or test: ?

Maybe you can try it yourself by searching in the OpsGenie UI and using a random field/label/extra property and firing a query containing a colon

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

opsgenie

query

details