What is the semantics for the search phrase foo:bar and its combinations

[Eva-Maria_Mueller]

Hi,

I receive alerts which contain extra properties. I figured out that I can search for them by by calling

detailsPair(foo: bar)

But I can also search for

• :foo
• foo:
• :bar
• bar:
• foo
• bar
• foo AND bar

These search phrases will return the alerts containing the extra property foo: bar

Can you please explain what OpsGenie is searching for, when passing foo:bar (or one of the alternatives - see list above) to the search bar.

If I have an alert with the extra property foo:whatever and the alert title contain s whatever this title is, then 

the search query foo:whatever will also find this alert. Can you explain what the search does in the background.

I am asking this because the search query

foo:(bar OR whatever) 

will NOT return alerts ONLY containing either the extra property foo:bar or foo:whatever. 
It will also return alerts containing alert containing an extra property key foo and the title starting (?) with bar or whatever

[Eva-Maria_Mueller]

...

[Eva-Maria_Mueller]

Switch answer to reply

[Shashwat Khare]

Hi @Eva-Maria_Mueller ,

This is Shashwat from Opsgenie support and here to help! :) 

The search query for searching alerts with extra properties should be in the below format:

detailsPair(key:value)

For your use case, here 

foo

is the key and 

Bar

is the extra property value.

For searching alerts that contain whatever in the alert title, the query would be:

message:whatever

Please refer to the below help document for the search query syntax to be used for each corresponding alert field:
https://support.atlassian.com/opsgenie/docs/search-queries-for-alerts/

Best,
Shashwat

[Eva-Maria_Mueller]

Hi Shashwat,

sorry - used the wrong input field...

thank you for you answer. Unfortunately, it does not completely answer everything.

It would be great if you could explain:

1. Which alerts will the following query return if I have an extra property with key foo 

foo:(bar OR whatever)

Can you also explain the syntax?

2. Which alerts will the following queries return (and why) - which semantic does the colon have resp. what do alerts need to fulfil to be matched by this query?

• :test
• test:

[Shashwat Khare]

Hi @Eva-Maria_Mueller ,

1. This query will return all alerts that have the key value as bar or whatever, in the alert extra properties.

2. For the colon insertion, may I know with which field are you using the syntax for the colon as :test or test: ?

Best,
Shashwat