Build OCI Logging search queries with filters and aggregation patterns.
Last verified: May 2026
Output will appear here...OCI Logging provides a centralized log management service that collects logs from OCI services, custom applications, and audit events. Searching these logs requires writing queries using the OCI Logging Query Language, which supports filtering by compartment, log group, log type, time range, and field-level predicates with operators like =, !=, =~, and search(). This builder helps you construct syntactically correct logging queries with proper field paths, time range specifications, and logical operators. It supports building queries for audit logs, service logs, and custom logs.
Your security team needs to investigate who deleted a critical Object Storage bucket yesterday. Without the builder, you'd hunt through OCI Logging docs to figure out the audit log field paths. With it, you select audit log type, set time range to yesterday, filter eventName = 'DeleteBucket', and the query fires in seconds returning the user OCID, source IP, and exact timestamp. Investigation closed in 5 minutes; the audit log query becomes a saved search for future incidents.
Always tighten the time range BEFORE adding field filters. OCI Logging charges per GB scanned, and a 7-day query against busy logs can scan TB. Start with 'last 1 hour', narrow with field filters, then expand the time range only if needed. The cost difference between 1-hour and 7-day queries is enormous.
Audit log queries should filter on `data.eventName` first, NOT free-text `search()`. Field-level filters use the column index and are dramatically faster. Free-text search is for when you genuinely don't know which field contains the value you're looking for.
Save common queries as Saved Searches in the OCI console. The query language is verbose enough that team members will rewrite the same query weekly otherwise. Building a library of standard 'find IAM changes in compartment X' queries saves hours of repeated typing.
The builder generates OCI Logging queries with the correct syntax: filter chains using equality (=), inequality (!=), regex (=~), and search() for full-text. It supports field paths into nested JSON (data.identity.principalName), time range specifications (datetime > '...'), boolean operators (and, or, not), and sorting. Output is a query string ready to paste into the OCI Logging Search console or use with `oci logging-search search-logs`.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.