Menu
AWS X-Ray
Developer Guide

Using Filter Expressions

Use filter expressions to view a service map or traces for requests that have performance issues or that relate to specific requests.

Requests where response time was more than 5 seconds.

responsetime > 5

Request where the total duration was 5 to 8 seconds.

duration >= 5 AND duration <= 8

Requests that included a call to "api.example.com" with a fault (500 series error) or latency above 2.5 seconds, and where one or more segments has an annotation named "account" with value "12345".

service("api.example.com") { fault = true OR responsetime > 2.5 } AND annotation.account = "12345"

Request where the service "api.example.com" made a call to "backend.example.com" that failed with a fault.

edge("api.example.com", "backend.example.com") { fault = true }

Request where the URL begins with "http://api.example.com/" and contains "/v2/" but does not reach a service named "api.example.com".

http.url BEGINSWITH "http://api.example.com/" AND http.url CONTAINS "/v2/" AND !service("api.example.com")

Requests that completed successfully in under 3 seconds, including all downstream calls.

ok !partial duration <3

Boolean Keywords

  • ok – Response status code was 2XX Success.

  • error – Response status code was 4XX Client Error.

  • throttle – Response status code was 429 Too Many Requests.

  • fault – Response status code was 5XX Server Error.

  • partial – Request has incomplete segments.

Number Keywords

  • responsetime – Time that the server took to send a response.

  • duration – Total request duration, including all downstream calls.

  • http.status – Response status code.

String Keywords

  • http.url – Request URL.

  • http.method – Request method.

  • http.useragent – Request user agent string.

  • http.clientip – Requestor's IP address.

  • user – Value of user field on any segment in the trace.

  • annotation.key – Value of annotation with field key.

Complex Keywords

  • service(name) {filter} – Service with name name. Optional curly braces can contain a filter expression that applies to segments created by the service.

  • edge(name) {filter} – Connection between services source and destination. Optional curly braces can contain a filter expression that applies to segments on this connection.