Mastering Sentry Search Queries: Practical Key:Value Syntax Guide

Overview

Sentry’s search engine interprets queries as a series of key:value tokens, with an optional raw search string that is also treated as a single token. Each token maps to an issue or event attribute, enabling powerful filtering of monitoring data.

Basic Syntax

A query consists of one or more key:value tokens separated by spaces. For example:

is:resolved user.username:"Jane Doe" server:web-8 example error

In this example there are three distinct keys ( is, user.username, server) but four tokens because the final free‑text example error is a raw search token.

Logical Operators

The operators OR and AND are only supported in the Discover, Performance, and Metric Alerts sections of Sentry.

When used, AND has higher precedence than OR. Parentheses () can be added to change grouping.

# Valid OR query
browser:Chrome OR browser:Opera

# Invalid OR query (mixing aggregate filter)
user.username:janedoe OR count():>100

Multiple Values for the Same Key

Values can be listed to search the same key multiple times, e.g. "x:[value1, value2]" is equivalent to "x:value1 OR x:value2". This returns issues or events matching any of the listed values.

Exclusion

By default tokens are combined with AND. To exclude results, prepend the token with !: is:unresolved !user.email:[email protected] This returns unresolved issues that are not associated with the specified email address.

Wildcard

The asterisk * can replace characters in a string. Example: browser:"Safari 11*" Matches browsers such as Safari 11.0.2 or Safari 11.0.3. Wildcards can also be combined with negation: !message:"*Timeout" Filters out messages containing any form of timeout.

Searchable Attributes

Sentry provides a set of reserved keys for both issue and event levels. Below are the most commonly used keys.

Issue Keys

age : Limits results to issues created within a time window. Suffixes m, h, d, w represent minutes, hours, days, weeks (e.g., age:-24h for issues from the last 24 hours).

assigned : Filters issues assigned to a user, team, or special values me, me_or_none.

bookmarks : Issues bookmarked by a specific user.

first-release : Issues that first appeared in a given release (e.g., first-release:latest).

has : Issues that have any tag.

is : Issue state filters such as is:unresolved, is:resolved, is:ignored, is:assigned, is:unassigned, is:linked, is:unlinked.

lastSeen : Limits results based on the most recent occurrence (e.g., lastSeen:-2d for the past two days).

timesSeen : Filters by the number of times an issue was seen (e.g., timesSeen:>10).

Event Keys

location , message , environment , release (including release.package, release.version, release.build, release.stage).

transaction : Filters by transaction name.

geo.country_code , geo.region , geo.city : Geographic filters.

http.method , http.referer , http.url : HTTP request context.

user.id , user.email , user.username , user.ip : User‑centric filters.

event.timestamp : Time‑range filtering using comparison operators ( >, >=, <, <=).

device.* and os.* : Device and OS attributes.

stack.* : Stack trace properties (e.g., stack.filename, stack.lineno).

error.type , error.value , error.mechanism , error.handled : Error details.

Custom Tags

Any user‑defined tag can be used as a token. Tags are key/value pairs attached to events and can be referenced later for segmentation or quick lookup. Common uses include server hostname, platform version, or user language.

Saved Searches

Sentry lets you save frequently used queries. Saved searches can be:

Recommended : Auto‑suggested common queries.

Pinned : Personal default view for the Issues page.

Organization‑wide : Persistent views created by owners or managers that apply to all projects in the organization.

Pinning a Search

Enter a query in the search bar.

Click the pin icon next to the query.

The query appears under “My Pinned Search” in the Saved Searches dropdown.

Managing Organization‑wide Saved Searches

Enter a query, open the actions menu (three dots), and select “Create Saved Search”.

In the modal, give the search a name, set the sort order for the issues list, optionally edit the query, and click “Save”.

The new view becomes part of the “Saved Search” dropdown for all organization members.

Deleting a Saved Search

Only organization owners or managers can delete organization‑wide saved searches.

Hover over a custom saved search, click the trash‑can icon that appears, and confirm deletion.