# Logs

_Filter and search Evervault logs in the dashboard using Evervault Query Language (EQL) syntax and operator-based expressions._

Any time you send a request to an Evervault resource, a log of the request and response will be created inside of your app. You can use the Logs view in the [Evervault Dashboard](https://app.evervault.com) to view and filter these log events.

## EQL

Logs can be queried using the Evervault Query Language (EQL), which allows you to filter logs based on their attributes.

```text
// e.g., EQL query to find all logs with a relay category and response
// status code of 400 or higher
category="relay" AND response.status>=400
```

## Operators

The following operators are supported in EQL queries, but not every operator is available for every field. See the [searchable fields](#searchable-fields) section below for details.

| Operator | Meaning | Example |
| --- | --- | --- |
| `=` | Exact match | `request.method="POST"` |
| `!=` | Not equal | `function.status!="success"` |
| `>` | Greater than | `response.status>399` |
| `<` | Less than | `response.status<500` |
| `>=` | Greater than or equal to | `response.status>=400` |
| `<=` | Less than or equal to | `response.status<=299` |
| `:` | Contains | `url.path:"/checkout"` |

## Compound queries

You can combine filters with `AND` when all conditions must match, `OR` when any condition can match, and parentheses to group conditions.

```text
// AND: all conditions must match
category="relay" AND response.status>=400

// OR: any condition can match
request.method="POST" OR request.method="PUT"

// Grouped: control evaluation order
(category="function" AND function.status="failure") OR response.status>=500
```

## Searchable fields

| Field | Operators |
| --- | --- |
| `log.id`<br />The unique identifier of the log. | `=`, `!=` |
| `resource.id`<br />The ID of the Evervault resource. | `=`, `!=` |
| `category`<br />The event category. | `=`, `!=` |
| `request.method`<br />The request method used in the HTTP request. | `=`, `!=` |
| `response.content_type`<br />The content type of the response. | `=`, `!=` |
| `request.headers`<br />The headers sent in the HTTP request. | `=`, `:`, `!=` |
| `request.body`<br />The body of the HTTP request. | `=`, `:`, `!=` |
| `response.status`<br />The status code of the HTTP response. | `=`, `!=`, `>`, `<`, `>=`, `<=` |
| `response.headers`<br />The headers sent in the HTTP response. | `=`, `:`, `!=` |
| `response.body`<br />The body of the HTTP response. | `=`, `:`, `!=` |
| `request.content_type`<br />The content type of the request. | `=`, `!=` |
| `url.full`<br />The full URL requested. | `=`, `:`, `!=` |
| `url.domain`<br />The domain part of the URL. | `=`, `!=` |
| `url.path`<br />The path part of the URL. | `=`, `:`, `!=` |
| `url.query`<br />The query string part of the URL. | `=`, `!=` |
| `url.port`<br />The port part of the URL. | `=`, `!=`, `>`, `<`, `>=`, `<=` |
| `function.id`<br />The unique identifier of the function. | `=`, `!=` |
| `function.run_id`<br />The unique identifier of the function run. | `=`, `!=` |
| `function.name`<br />The name of the function. | `=`, `!=` |
| `function.log`<br />The log output of the function. | `=`, `:`, `!=` |
| `function.status`<br />The status of the function. | `=`, `!=` |
| `function.initialisation.duration`<br />The duration of the function initialisation. | `=`, `!=`, `>`, `<`, `>=`, `<=` |
| `function.duration`<br />The duration of the function. | `=`, `!=`, `>`, `<`, `>=`, `<=` |
| `crypto.fields.encryptCount`<br />The number of fields encrypted. | `=`, `!=`, `>`, `<`, `>=`, `<=` |
| `crypto.fields.decryptCount`<br />The number of fields decrypted. | `=`, `!=`, `>`, `<`, `>=`, `<=` |
| `crypto.files.encryptCount`<br />The number of files encrypted. | `=`, `!=`, `>`, `<`, `>=`, `<=` |
| `crypto.files.decryptCount`<br />The number of files decrypted. | `=`, `!=`, `>`, `<`, `>=`, `<=` |
| `network_token.id`<br />The unique identifier of the network token. | `=`, `!=` |
| `3ds.id`<br />The unique identifier of the 3D Secure session. | `=`, `!=` |
| `3ds.status`<br />The status of a 3D Secure session. | `=`, `!=` |
| `3ds.authentication_flow`<br />The authentication flow used in the 3D Secure session. | `=`, `!=` |
| `3ds.card.last_four`<br />The last four digits of a card number. | `=`, `!=` |
| `3ds.card.funding`<br />The card funding type. | `=`, `!=` |
| `3ds.card.issuer`<br />The issuer of the card. | `=`, `!=` |
| `3ds.card.country`<br />The country the card is issued in. | `=`, `!=` |
| `3ds.card.currency`<br />The currency of the card. | `=`, `!=` |
| `3ds.card.segment`<br />The card segment. | `=`, `!=` |
| `3ds.payment_type`<br />The type of payment. | `=`, `!=` |
| `3ds.card.brand`<br />The brand of the card. | `=`, `!=` |
| `3ds.initiator`<br />The initiator of the 3D Secure session. | `=`, `!=` |
| `3ds.version`<br />The version of the 3D Secure protocol used. | `=`, `!=` |