Queries

Info

Project menu: Analytic → Query Editor → Queries (/custom-query)
Administration mode: Analytic → Query Editor → Queries (/admin/custom-query)
Create a query from Create on the list; save from the edit screen with Save and Deploy. Saved queries show an Audit and Rollback tab.

Query Definition

You can create and manage condition sets to analyze log records.

Filter Management

During testing you can define filters inline or pick saved filters for time range, API Proxy, and result type.

Test and Validation

You can run the query with Try it after choosing an environment, then review the result table or export to Excel.

Globalization

You can move query definitions to Admin scope so they are available in all projects.

Use Cases

Query Editor definitions are used on:

• Anomaly Detector — abnormal situation detection
• Report Generator — customized reports
• API Proxy trace filter — which live requests are traced

Info

All query definitions can be moved to Admin scope with Globalize. Globalized queries leave the project list; administration moves to the system administrator.

Query Creation and Testing

The edit screen General tab contains name, description, conditions, test filters, query result fields, and the test section. After adding conditions you can use Try it for a quick check, then select a filter row and environment to execute the query.

Query edit — conditions, test filters, result fields, and query execution

Configuration Fields

Field	Description
Name	Unique name of the query.
Description	Optional description.
Conditions	Criteria the log record must match; Must, Should, and Must Not groups plus Try it validation.
Filters	For testing only: New Filter, Select Filter, or inline rows. Mark the row to run with the Filter Selection radio button. See Filters.
Query Result Fields	Log fields shown in the test table; Select All / Unselect All and Common / Request / Response groups.
Test	Environment selection, Try it (execute query), and Excel export. A warning appears when Elasticsearch integration is missing.

Query Criteria

Condition rows can use API Proxy name, client IP, HTTP method, status code, duration, size, and API Proxy Type (REST, SOAP, gRPC, WebSocket, AI, MCP, A2A).

And (Must)

All conditions must be satisfied

Or (Should)

At least one condition must be satisfied

Not (Must Not)

Conditions must not be satisfied

Keyword criterion — message region and part

A Keyword condition searches one part of one message region. Choose the region first, then the part.

Region	Header	Parameter	Body
1. Request from Client	✓	✓	✓
2. Request to Backend API	✓	✓	✓
3. Response from Backend API	✓	—	✓
4. Response to Client	✓	—	✓

• Header and Parameter parts require the name; the operator applies to its value.
• Body searches the full text of that region (case-insensitive; */? wildcards supported).
• The same condition is used by the API Proxy trace filter; a region that does not exist for a request (for example the backend request of a blocked call) never matches.

Tip

To see the routing target, select the route address field under Query Result Fields.

Related Topics

Filters

Filter creation and management

Anomaly Detector

Using queries for anomaly detection

Report Generator

Using queries for report creation

Analytics

Analytics module overview