# Event logs search query limitations **URL:** \ **Category:** Get Help\ **Tags:** logs, lucene, auth0\ **Created:** [June 27, 2022, 8:07pm UTC](https://community.auth0.com/t/event-logs-search-query-limitations/86011 "2022-06-27T20:07:54Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![nicolasbouchard](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nicolasbouchard/32/36580_2.png) [@nicolasbouchard](https://community.auth0.com/u/nicolasbouchard)\ **Post date:** [June 27, 2022, 8:07pm UTC](https://community.auth0.com/t/event-logs-search-query-limitations/86011/1 "2022-06-27T20:07:54Z")
Hi, We’re trying to read the logs generated from the management API using a Lucene query to filter the result as documented here: - [Auth0 Management API v2](https://auth0.com/docs/api/management/v2/#!/Logs/get_logs) - [Log Search Query Syntax](https://auth0.com/docs/deploy-monitor/logs/log-search-query-syntax) The problem is when we use some fields present in the JSON representation of the log, we receive 0 results while others are working as expected. I’m aware there’s a list of searchable fields, but we we’re able to filter on fields that are undocumented so… For example, I get results when filtering the field details.request.method:“post”, but no result when filtering details.request.query.user\_id:“[REDACTED]”. It’s not throwing an error, we just have no result. Here’s the simplified log (JSON representation) `{ "date": "2022-06-27T19:13:54.992Z", "type": "sapi", "description": "Assign one or more roles to a given user that will be applied in the context of the provided organization", "client_id": "REDACTED", "client_name": "", "ip": "REDACTED", "user_agent": "CREDACTED", "details": { "request": { "method": "post", "path": "[REDACTED]", "query": { "user_id": "[REDACTED]" }, "userAgent": "REDACTED", ...REDACTED }, "user_id": "REDACTED", "log_id": "REDACTED", "_id": "REDACTED", "isMobile": false, "id": "REDACTED" }` We would like to use the lucene query to avoid re-filtering the logs in our backend. Is this a limitation or maybe we’re not using the query correctly? Either way I think it should be documented because it’s confusing. Thanks ---
**Author:** ![lihua.zhang](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lihua.zhang/32/39683_2.png) [@lihua.zhang](https://community.auth0.com/u/lihua.zhang)\ **Post date:** [June 28, 2022, 7:25pm UTC](https://community.auth0.com/t/event-logs-search-query-limitations/86011/3 "2022-06-28T19:25:58Z")
Hi @nicolasbouchard , Welcome to the Auth0 Community! I noticed that the `details.request.query.user_id:“[REDACTED]”` contains the square brackets. As per the [doc](https://auth0.com/docs/deploy-monitor/logs/log-search-query-syntax#ranges), the square brackets are used to specify the range of search query. I suspect that caused no results returned. If you could save the `details.request.query.user_id` without the bracket, it should work. Do you mind giving it a try? Hope this helps! ---
**Author:** ![nicolasbouchard](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nicolasbouchard/32/36580_2.png) [@nicolasbouchard](https://community.auth0.com/u/nicolasbouchard)\ **Post date:** [June 28, 2022, 7:49pm UTC](https://community.auth0.com/t/event-logs-search-query-limitations/86011/4 "2022-06-28T19:49:55Z")
Hi Lihua, Thanks for your response! The square bracket were added to demonstrate a redacted value. In fact, we use a real user\_id value in this field, more like: details.request.query.user\_id:“auth0|redacted”. Thanks! ---
**Author:** ![lihua.zhang](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lihua.zhang/32/39683_2.png) [@lihua.zhang](https://community.auth0.com/u/lihua.zhang)\ **Post date:** [June 28, 2022, 9:01pm UTC](https://community.auth0.com/t/event-logs-search-query-limitations/86011/5 "2022-06-28T21:01:54Z")
Hi @nicolasbouchard , Thank you for providing additional context. user\_id is a searchable field. I tried using user\_id only and it works. ![image](https://global.discourse-cdn.com/auth0/original/3X/3/4/3406fcb33af5cfab707343a9e52a331262e0a0cd.jpeg) Please let us know how it goes on your end. Thanks! ---
**Author:** ![nicolasbouchard](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nicolasbouchard/32/36580_2.png) [@nicolasbouchard](https://community.auth0.com/u/nicolasbouchard)\ **Post date:** [June 29, 2022, 12:05pm UTC](https://community.auth0.com/t/event-logs-search-query-limitations/86011/6 "2022-06-29T12:05:43Z")
Hi Lihua, Yes, but I can’t use the user\_id because the API Operations are done with an Access Token obtained by a Machine-to-machine Application. In this case I don’t even have a user\_id property in the JSON representation of the log. ![image](https://global.discourse-cdn.com/auth0/original/3X/2/4/240d4ce3dc55fdd80b010638989d120f0ed0dc6b.png) What were trying to do is to identify the user who made the operation, so we had to append the “Logged In” user\_id in the query string of each POST/PUT/DELETE request. We though we could then use the JSON node details.request.query.user\_id to filter our logs. If you know another way of achieving this, please let us know! Thanks Nicolas ---
**Author:** ![lihua.zhang](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lihua.zhang/32/39683_2.png) [@lihua.zhang](https://community.auth0.com/u/lihua.zhang)\ **Post date:** [February 2, 2023, 8:01pm UTC](https://community.auth0.com/t/event-logs-search-query-limitations/86011/8 "2023-02-02T20:01:20Z")