---
title: "Search"
url: "https://axoflow.com/docs/axoflow/0.86/storage/search/"
last_modified: "2026-07-20T11:34:38+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/0.86/llms.txt).

# Search

The **Search Logs** page provides a federated search console to query all data stored in AxoStores (the storage component of AxoRouter) and external stores (AxoLake). Note that AxoStore is only available on an AxoRouter if it was enabled when the AxoRouter host was deployed or updated. For details, see [Install AxoRouter on Linux](https://axoflow.com/docs/axoflow/0.86/provisioning/axorouter/linux/index.md).

To display data from the specified period without any specific search keywords, just select **Search**.

- **Basic Search** mode searches in the values of the following fields of the messages: `body`, `host_name`

  Basic Search is case insensitive. Adding multiple keywords searches for matches in any of the previous fields. This is equivalent to the `@ANY =* keyword1 AND @ANY =* keyword2` AQL query.
- **AQL Query Search** mode allows you to search in specific labels of the hosts using different operators.

  It also makes more complex filtering possible, using the Equals, Contains (partial match), and Match (regular expression match) operators. Note that:

  - To execute the search, click **Search**, or hit ESC then ENTER.
  - AxoConsole autocompletes the built-in and custom labels and field names, as well as their most frequent values, but doesn’t autocomplete labels and variables created by data parsing and processing steps.
  - You can use the AND and OR operators to combine expressions, and also parenthesis if needed. For details on AQL, see [AQL operator reference](https://axoflow.com/docs/axoflow/0.86/reference/aql/index.md).
  - The precedence of the operators is the following: parentheses, AND, OR, comparison operators.
  - Use the usual keyboard shortcuts to undo (⌘/Ctrl + Z) or redo (⌘/Ctrl + Shift + Z) your edits.

  For example, `meta.vendor = palo-alto-networks`, `meta.host.labels.location != us-east-1`, or `meta.connection.src_ip =* 192.168`.

  When searching in stores, you can use the [following fields](https://axoflow.com/docs/axoflow/0.86/reference/storage-schema/index.md) (depending on the configuration of the store).

To limit the search, you can:

- Adjust the **Time range** of the search (default is 1 day). Note that AxoStore retains data only for 7 days.
- Search only the data stored on a specific **Router** (by default, AxoConsole searches in the data of every AxoRouter that has AxoStore deployed).
- Search only the data in a specific **Store**. (By default, every AxoRouter that has AxoStore deployed has a `default` store. To create a new store, see [Create Store](https://axoflow.com/docs/axoflow/0.86/storage/create-store/index.md) or [Create External Store](https://axoflow.com/docs/axoflow/0.86/storage/create-external-store/index.md).)

![AxoStore search bar](https://axoflow.com/docs/axoflow/0.86/storage/search/storage-search-bar_hu_c686bed207995b0d.webp)

The time distribution of the search results allows you to quickly zoom in on a specific time period. You can select multiple bars to zoom in on them.

## Events

The **Events** section of the page shows the search results.

> **Note:**
>
> The \*\*search
>
> Find\*\* field allows you to filter the current page of the search results.

![AxoStore search results](https://axoflow.com/docs/axoflow/0.86/storage/search/storage-search-results_hu_bf30de4762999b61.webp)

Select **View Options** to customize how the search results are displayed:

- Adjust the number of **Results Per Page**.
- Increase **Raw Log Lines** to show (wrap) multiple lines of long events
- Switch the **Timestamp Format** between `HH:MM:SS`, `YYYY-MM-DD HH:MM:SS`, and `YYYY-MM-DD HH:MM:SS +-TIMEZONE_OFFSET` (with fractions of a second, for example, milliseconds).
- Enable **Format Log** to format JSON messages into human-readable format.
- Select **Hide Fields Summary** to hide the **Fields** sidebar.

![AxoStore search result formatting](https://axoflow.com/docs/axoflow/0.86/storage/search/storage-search-results-format_hu_db18ce5559e610f1.webp)

Select the info
icon next to an event to see its details.

The **Event Details** panel allows you to inspect a specific event. For details on the available fields and their structure, see [Storage schema](https://axoflow.com/docs/axoflow/0.86/reference/storage-schema/index.md).

- To display the original log message, select **Raw Log**.

  ![Raw log](https://axoflow.com/docs/axoflow/0.86/img/event-details-raw-log_hu_ff5c908c56ea48e9.webp)
- To copy the entire event as JSON to the clipboard, select **Copy as JSON**.
- To search the event body and metadata, enter a search keyword into the **Find** field. This searches for the string on the **Event Details** panel, including the log, metadata, or label names and values.

  ![Event search](https://axoflow.com/docs/axoflow/0.86/img/event-details-search_hu_28c03164c2c3943e.webp)
- To add a field to the **Pinned Fields** and display it for every event, click the checkbox before the field. Pinned fields show up in the event details, and also in the list of the events, making it easy to get a quick glance on the distribution of the field values. They’re included as separate fields when you **Export** the search results into a CSV file.

  To unpin a field, select the field in any of the events, then select **Unpin** from the local menu.

  ![Event search](https://axoflow.com/docs/axoflow/0.86/img/event-details-context-menu_hu_9358f2f91dac68f4.webp)
- To copy the name or the value of a field, select the name of the field, then select content_copy
  or **Copy Value**.
- To copy an AQL query that matches this field and its current value, select the name of the field, then select **Copy as AQL Query**. You can paste this query into the **AQL** search field, and use it for filtering.
- If the field refers to a pipeline element in Axoflow (for example, a flow in the `meta.flow` field, a store, or an AxoRouter), you can jump to the page of the related element.

## Fields

The sidebar shows the **Frequent** and **Infrequent** fields that appear in the events of the current page (and the number of their occurrence).

![AxoStore fields](https://axoflow.com/docs/axoflow/0.86/storage/search/storage-fields_hu_f2df5d8e0b6e1c20.webp)

You can hover over any field and select add_circle_outline
to show the selected field and its value under each event that has this field.

![AxoStore show field](https://axoflow.com/docs/axoflow/0.86/storage/search/storage-fields-selected_hu_f677f88d89202e76.webp)

To show other fields (and their occurrence) in the sidebar, select **See all**, then select the fields you want to display. Depending on the configuration of the store, you can access the [following fields](https://axoflow.com/docs/axoflow/0.86/reference/storage-schema/index.md).

![AxoStore select event field](https://axoflow.com/docs/axoflow/0.86/storage/search/storage-fields-select_hu_ce76dbbfaaf5863c.webp)

## Export search results

To export the search results, select **Export as CSV**. Note that:

- Only the search results shown on the current page will be exported (50 entries by default, change **View Options > Results Per Page** for more).
- By default, the timestamp and the message fields are exported. To include other fields, add them to the [selected fields](https://axoflow.com/docs/axoflow/0.86/storage/search/index.md#fields) before exporting the data.

To send the selected data to another destination for further analysis, see [Rehydrate data](https://axoflow.com/docs/axoflow/0.86/data-management/rehydration/index.md).

## Rehydrate search results

You can retrieve the selected data from your stores and send ([rehydrate](https://axoflow.com/docs/axoflow/0.86/data-management/rehydration/index.md)) it to other destination for further analysis as needed. For details, see [Rehydrate data](https://axoflow.com/docs/axoflow/0.86/data-management/rehydration/index.md).