--- id: querying-logs title: Querying Delivery Logs sidebar_label: Querying Logs --- import IfApp from '_core/components/IfApp.tsx'; # Querying Delivery Logs Event Notifications records every delivery attempt — payload, destination, timestamp, and status. These records form the **delivery log**, which you search with the **query editor**. A query is an expression built from three parts: > **field** → **operator** → **value** ``` message.status=failure ``` Access the [query editor][event-notifications/logs]. ![Query Editor Interface][event-notifications/query-editor] --- ## Fields Each field, the operators it accepts, and an example. | Field | Description | Operators | Example | |---|---|---|---| | `message.code` | Message's unique identifier | `=` `!=` | `message.code='msg_a1b2c3d4e5'` | | `message.event_type` | Event type, as `NAMESPACE::EVENTNAME` | `=` `!=` | `message.event_type=FBPI::ORDER_SYNC` | | `message.status` | Delivery status: `success`, `failure`, `pending` (case-insensitive) | `=` `!=` | `message.status=success` | | `message.created_at` | Event creation time | `=` `!=` `<` `>` `<=` `>=` | `message.created_at>='2026-05-01T00:00:00Z'` | | `message.last_attempt` | Most recent attempt time | `=` `!=` `<` `>` `<=` `>=` | `message.last_attempt<'2026-05-10T00:00:00Z'` | | `message.next_attempt` | Next scheduled retry time | `=` `!=` `<` `>` `<=` `>=` | `message.next_attempt>='2026-05-20T00:00:00Z'` | | `message.attempts_count` | Number of delivery attempts | `=` `!=` `<` `>` `<=` `>=` | `message.attempts_count>2` | | `message.` | A value from the event payload (e.g. `order_nr`, `po_nr`) | `=` `!=` `~` | `message.order_nr~'ORDER-2026'` | | `destination.name` | Destination display name | `=` `!=` `:` `~` | `destination.name:'Orders'` | | `destination.code` | Destination unique identifier | `=` `!=` | `destination.code='DEST-001'` | Queryable `` depend on your destination subscriptions — if `message.po_nr` isn't recognized, no destination is subscribed to purchase-order events. :::info Event Types Examples use `FBPI::ORDER_SYNC` (order updates) and `FBPO::PO_SYNC` (purchase-order updates). For the complete list, see [Event Types][event-notifications/noon-event-types]. For the complete list, see [Event Types][event-notifications/namshi-event-types]. ::: --- ## Operators | Operator | Meaning | Applies to | |---|---|---| | `=` · `!=` | Equals / not equals | All fields | | `<` `>` `<=` `>=` | Range comparison | Dates and `message.attempts_count` | | `:` | Contains (matches anywhere) | `destination.name` only | | `~` | Starts with (prefix) | `destination.name` and `` | | `AND` | Both conditions must match | — | | `OR` | Either condition matches | — | | new line | Same as `AND` | — | `:` and `~` differ: `:` matches the value anywhere in the text, `~` only at the start. `:` is not supported on `` — use `~` there. --- ## Building a query A single filter is `field operator value`. Combine filters with `AND`, `OR`, or a new line — a new line means `AND`: ``` message.status=failure destination.name='Orders Webhook' ``` is the same as: ``` message.status=failure AND destination.name='Orders Webhook' ``` ### Precedence when mixing `AND` and `OR` `AND` conditions are grouped before `OR`, and parentheses `()` are **not** supported. So this query: ``` message.event_type=FBPI::ORDER_SYNC AND message.status=failure OR message.event_type=FBPO::PO_SYNC ``` is read as *"(order events that failed) **or** (any purchase-order event)"*. To force a different grouping, see [Querying two destinations at once](#querying-two-destinations-at-once). --- ## Value Types - **Text** — single or double quotes; escape an inner quote with `\`, e.g. `destination.name='Orders Webhook'`. - **Event types** — `NAMESPACE::EVENTNAME`; quotes optional (`FBPO::PO_SYNC` or `'FBPO::PO_SYNC'`). - **Status** — `success` (delivered), `failure` (failed), `pending` (awaiting delivery or retry). Case-insensitive. - **Numbers** — no quotes, e.g. `message.attempts_count>=10`. - **Dates** — `YYYY-MM-DDThh:mm:ss`; no timezone means UTC. Append `Z` for UTC or an offset such as `+03:00`. --- ## Example Queries Replace destinations, order numbers, and dates with your own values. ![Query editor showing results for message.status=success][event-notifications/query-results] ### Find all failed messages ``` message.status=failure ``` ### Find failures going to one destination ``` destination.name='Orders Webhook' AND message.status=failure ``` ### Find messages sent to a destination since a date ``` destination.name='Orders Webhook' message.created_at>='2026-05-01T00:00:00' ``` ### Find messages within a time window ``` message.created_at>='2026-05-01T00:00:00Z' message.created_at<='2026-05-13T23:59:59Z' ``` ### Find messages retried more than twice ``` message.attempts_count>2 ``` ### Find retried events of a specific type ``` message.event_type=FBPI::ORDER_SYNC AND message.attempts_count>=2 ``` ### Find one specific message by ID ``` message.code='msg_a1b2c3d4e5' ``` ### Track all delivery attempts for one order ``` message.order_nr='ORDER-99887' ``` ### Find failures for one event type ``` message.event_type=FBPO::PO_SYNC AND message.status=failure ``` ### Find events of either type ``` message.event_type=FBPI::ORDER_SYNC OR message.event_type=FBPO::PO_SYNC ``` ### Exclude a destination from the results ``` message.status=failure AND destination.code!='DEST-TEST' ``` ### Find messages with a retry scheduled ``` message.next_attempt>='2026-05-20T00:00:00Z' ``` ### Querying two destinations at once List two destinations with `OR`: ``` destination.name='Orders Webhook' OR destination.name='PO Webhook' ``` Because parentheses aren't supported, you can't add more `AND` filters to that `OR` group. Instead, run two separate queries — or, if the names share a prefix, match on it: ``` destination.name~'Orders' message.status=failure ``` --- ## Limitations - **No parentheses.** `AND` always groups before `OR`; split into separate queries for other groupings. - **`message.code`** accepts only `=` and `!=`. - **``** support the prefix operator `~` (starts with), not the contains operator `:` (matches anywhere). They are queryable only for event types your destinations receive. - **`destination.name`** is case-sensitive with `=`; use `:` or `~` for partial matches. - **Dates** without a timezone are treated as UTC.