What it is for
This is the filter you write, paste in chat, and save. Facets are great for discovering and poor for repeating: you cannot paste one anywhere, you cannot keep it, and you cannot write "everything except staging".
The syntax
field:value, separated by spaces. A value with a space goes in
quotes. A leading - negates. Whatever is left over becomes a free
text search over the message.
classe:Timeoutcustomer:"Downtown Store"-ambiente:staging(everything except staging)classe:Timeout customer:ACME situacao:abertoversao:1.4.2 connection refused(field plus free text)
The fields
app, classe, empresa,
versao, unidade, ambiente,
origem and situacao. Plus any attribute
some SDK has sent: if your code sends tenant, then
tenant:acme works without anyone declaring anything.
Aliases work: cliente is empresa, env is
ambiente, file and arquivo are
unidade, status is situacao.
Autocomplete
Start typing and the box offers the fields. After the colon, it offers the
values that exist, with a count for each. Arrows to move,
Enter or Tab to pick, Esc to close.
The values offered come from the slice on screen, not from the whole database. Suggesting a value that does not exist in the filtered period would be offering a search you already know is empty.
The way back
Whoever discovered something by clicking facets finds the equivalent expression already written in the box. That is how the syntax gets learned without reading this page.
Saved slices
The save button next to it keeps the current expression under a name. It reappears in the bar on every list screen, and it applies to everyone who signs in: a saved slice belongs to the installation, not to your session.
Not the URL parameters. classe:Timeout customer:ACME is what a
person reads, what they paste in chat, and what still makes sense after the
facet list changes. A parameter stored in a column becomes dead data the day a
facet is renamed.
Asking in plain words
With an AI analyst turned on, you can write "ACME timeouts this week" and get the expression built for you. What it gives back is the expression, not the result: you see the filter before applying it, and you learn to write it yourself.