{"id":49420,"date":"2025-05-21T11:31:07","date_gmt":"2025-05-21T11:31:07","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=49420"},"modified":"2026-02-21T07:28:43","modified_gmt":"2026-02-21T07:28:43","slug":"new-relic-log-search-tutorial-with-examples","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/new-relic-log-search-tutorial-with-examples\/","title":{"rendered":"New Relic Log Search Tutorial with Examples"},"content":{"rendered":"\n

Here is a comprehensive tutorial for New Relic Log Search<\/strong> covering all the items you’ve listed, with real-world examples<\/strong> specifically tailored for Linux and Apache logs<\/strong>. The queries assume your logs are being forwarded correctly to New Relic and are accessible via Logs UI<\/strong> or Log Search (NRQL\/Lucene)<\/strong>.<\/p>\n\n\n\n

\n\n\n\n

\ud83d\udd0d New Relic Log Search Tutorial with Examples<\/h2>\n\n\n\n
\n\n\n\n

\u2705 1. Single Term Search<\/strong><\/h3>\n\n\n\n

A single term<\/strong> searches for a single word in the log messages.<\/p>\n\n\n\n

Syntax:<\/strong><\/p>\n\n\n

<word<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
Example:<\/strong><\/p>\n\n\n
error\n<\/code><\/span><\/pre>\n\n\n
\n
Matches logs that include the word error<\/code> anywhere in the log message.<\/p>\n<\/blockquote>\n\n\n\n
\ud83d\udd27 Use Case:<\/strong>
Search for generic error logs from Apache or Linux syslog:<\/p>\n\n\n
error\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
\u2705 2. Double Term (Phrase Search)<\/strong><\/h3>\n\n\n\n
To search for an exact phrase<\/strong>, enclose it in double quotes.<\/p>\n\n\n\n
Syntax:<\/strong><\/p>\n\n\n
\"phrase with spaces\"<\/span>\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
Example:<\/strong><\/p>\n\n\n
\"connection timed out\"<\/span>\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
\n
Finds logs that contain the exact phrase<\/strong> connection timed out<\/code>.<\/p>\n<\/blockquote>\n\n\n\n
\ud83d\udd27 Use Case:<\/strong>
Apache logs with specific connection errors:<\/p>\n\n\n
\"client denied by server configuration\"<\/span>\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
\u2705 3. OPERATORS<\/strong><\/h3>\n\n\n\n
\ud83d\udd39 AND (default behavior)<\/h4>\n\n\n\n
Narrows results by requiring both terms<\/strong> to appear.<\/p>\n\n\n\n
Syntax:<\/strong><\/p>\n\n\n
term1 AND term2\n<\/code><\/span><\/pre>\n\n\n
OR just:<\/p>\n\n\n
term1 term2\n<\/code><\/span><\/pre>\n\n\n
Example:<\/strong><\/p>\n\n\n
apache error\n<\/code><\/span><\/pre>\n\n\n
\n
Matches logs containing both<\/strong> apache<\/code> and error<\/code>.<\/p>\n<\/blockquote>\n\n\n\n
\n\n\n\n
\ud83d\udd39 OR<\/h4>\n\n\n\n
Broadens results by matching either<\/strong> term.<\/p>\n\n\n\n
Syntax:<\/strong><\/p>\n\n\n
term1 OR term2\n<\/code><\/span><\/pre>\n\n\n
Example:<\/strong><\/p>\n\n\n
warning OR critical\n<\/code><\/span><\/pre>\n\n\n
\ud83d\udd27 Use Case:<\/strong>
Search Linux logs for multiple log levels:<\/p>\n\n\n
\"kernel\"<\/span> AND (warning OR error)\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
\ud83d\udd39 NOR (Negation)<\/h4>\n\n\n\n
Used for negation<\/strong> of one or more terms.<\/p>\n\n\n\n
Syntax:<\/strong><\/p>\n\n\n
NOT term\n<\/code><\/span><\/pre>\n\n\n
\n
New Relic does not support NOR<\/code>, but you can achieve negation using NOT<\/code>.<\/p>\n<\/blockquote>\n\n\n\n
Example:<\/strong><\/p>\n\n\n
apache NOT error\n<\/code><\/span><\/pre>\n\n\n
\ud83d\udd27 Use Case:<\/strong>
Find Apache logs that do not<\/strong> contain error<\/code>.<\/p>\n\n\n\n
\n\n\n\n
\u2705 4. Regular Expression (RegEx)<\/strong><\/h3>\n\n\n\n
Use regex to match complex patterns.<\/p>\n\n\n\n
Syntax:<\/strong><\/p>\n\n\n
message =~ \/pattern\/<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Example:<\/strong><\/p>\n\n\n
message =~ \/failed.*login\/<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n
Matches messages with phrases like failed user login<\/code>, failed root login<\/code>, etc.<\/p>\n<\/blockquote>\n\n\n\n
\ud83d\udd27 Use Case (Linux auth logs):<\/strong><\/p>\n\n\n
message =~ \/invalid user.*from\/<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n
Detect brute-force attempts on SSH.<\/p>\n<\/blockquote>\n\n\n\n
\n\n\n\n
\u2705 5. FIELD FILTERS<\/strong><\/h3>\n\n\n\n
Filter logs by specific field values.<\/p>\n\n\n\n
\ud83d\udd39 Format:<\/h4>\n\n\n
<field<\/span>><\/span>:<value<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
\ud83d\udd39 Examples:<\/h4>\n\n\n\n
Linux Example:<\/h5>\n\n\n
hostname<\/span>:my-linux-server<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Apache Example:<\/h5>\n\n\n
service<\/span>:apache<\/span> AND<\/span> level<\/span>:error<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Combined:<\/h5>\n\n\n
service<\/span>:apache<\/span> AND<\/span> message<\/span>:\"file<\/span> not<\/span> found<\/span>\"\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Timestamp Range:<\/h5>\n\n\n
timestamp >= '2026-05-20T00:00:00Z'<\/span> AND timestamp < '2026-05-21T00:00:00Z'<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
\ud83e\udde0 Bonus: Apache & Linux Log Examples<\/h3>\n\n\n\n
1. Apache Access Denied Errors<\/strong><\/h4>\n\n\n
service<\/span>:apache<\/span> AND<\/span> message<\/span>:\"client<\/span> denied<\/span> by<\/span> server<\/span> configuration<\/span>\"\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
2. Linux SSH Login Failures<\/strong><\/h4>\n\n\n
service:syslog AND message =~ \/Failed password for invalid user\/<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
3. Filter by Host and Level<\/strong><\/h4>\n\n\n
hostname<\/span>:prod-server-01<\/span> AND<\/span> level<\/span>:error<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
4. Apache 404 Errors<\/strong><\/h4>\n\n\n
service<\/span>:apache<\/span> AND<\/span> message<\/span>:\"404<\/span> Not<\/span> Found<\/span>\"\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
\ud83d\udca1 Tips for Using New Relic Logs UI<\/h2>\n\n\n\n
    \n
  • Use saved queries<\/strong> for repeated searches.<\/li>\n\n\n\n
  • Use faceted search<\/strong> to group logs by fields (like hostname<\/code>, service<\/code>, level<\/code>).<\/li>\n\n\n\n
  • Click on fields to create filters interactively<\/strong>.<\/li>\n<\/ul>\n\n\n\n
    \n\n\n\n
    <\/p>\n","protected":false},"excerpt":{"rendered":"
    Here is a comprehensive tutorial for New Relic Log Search covering all the items you’ve listed, with real-world examples specifically tailored for Linux and Apache logs. The queries assume your… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-49420","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=49420"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49420\/revisions"}],"predecessor-version":[{"id":58983,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49420\/revisions\/58983"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=49420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=49420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=49420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}