Using the Reblaze Query Box
How to filter results


The Reblaze query command box allows you to query the data in order to present only the records that you want. The structure of a filter is operator:value.
Using the query/filter box to search for blocked XSS attempts
For example, to view only traffic from IP
An exclamation mark ("!") can be used with various filters as a "NOT" operator. So, to exclude requests from an IP, add "!" as a prefix:
Note that filters can be combined to fine-tune a search, by chaining them with a comma. For example, in order to show all traffic from France that was blocked:
country:France, is:blocked

Building Queries Efficiently

The fastest way to build query strings is to double-click on labels of existing log entries. This will add the value of each label as a filter to the query box. When you have constructed the entire query string, click on the search button, or place the cursor into the text field and hit "Return" on your keyboard.
For example, when looking at this entry for a blocked request (the IPs have been censored for privacy reasons):
Let's say you wanted to quickly see what other requests produced a 403 error that came in from the United States on a cloud IP. Double-clicking on the "403" label, the "United States" label, and the "Cloud" label builds the query string for you automatically:
Automatically adding filter parameters to the query box
Then select the "search" button, or place the cursor within the query box and hit "Return" on your keyboard, to process the query.
In some situations, this technique has limited usefulness. In the example screenshot above, double-clicking on the label beginning with "XSS" would add a (very) long filter string to the query, because that label contains the full script from the injection attempt (although the label itself only displays the first few characters in the interface).
If this is what you want (perhaps you need to search only for logged requests which contain that exact script), then this is effective. But if you wanted to build a more general query, then this is not useful.
A better approach is to choose a representative substring.
Queries can be based on substrings. Internally, Reblaze executes a "contains" search, so queries will return everything that contains the string that was specified.
In some situations, you'll want to build queries that produce exact matches. But in many other situations, it's faster just to search for a relevant substring instead.
  • reason:XSS will show all records with "XSS" in their reason label.
  • url:login will include all URLs that include "login".
  • ip:191 will display all IP addresses containing "191".

Filter Use Cases and Examples

Regular expressions can be applied to the filter value to make the search more accurate. The regex matching is done by wrapping the search value with re(REGEX here). Examples:
If you wish to display login requests with method “POST” which were blocked, but not by the origin (upstream server):
This displays those requests which produced 502-504 error codes:
This displays the requests that contain a specific value in an argument:
arg_name:text, arg_value:free_text

Available filters

Log records registered after a given date and time.
Log records registered before a given date and time.
Search for an argument by name
Search for an argument value
Autonomous System Number for the IP
Abbreviation for the country. Example: "US" for the United States.
Name of the country
Reblaze ID cookie value (base64)
Search by cookie name
Search by cookie value
The main domain name in Reblaze (not necessarily the actual Host header).
File extension
Name of header
Value found in header_name
HTTP Host header: usually, the domain name of the application.
Reblaze unique request ID.
IP address of the web client.
IS is a special operator that can be used for almost all attributes of a request. It can be used to filter a certain HTTP method, "flags" and protocol version. For instance, to get blocked POST requests made by a human, type: is:blocked, is:human, is:post.
Multipurpose Internet Mail Extensions