The Reblaze query command box allows you to query the data in order to present only the records that you want. The structure of a filter is operator:value.
For example, to view only traffic from IP 10.11.12.13:
An exclamation mark ("!") can be used with various filters as a "NOT" operator. So, to exclude requests from an IP, add "!" as a prefix:
Note that filters can be combined to fine-tune a search, by chaining them with a comma. For example, in order to show all traffic from France that was blocked:
For example, when looking at this entry for a blocked request (the IPs have been censored for privacy reasons):
Let's say you wanted to quickly see what other requests produced a 403 error that came in from the United States on a cloud IP. Double-clicking on the "403" label, the "United States" label, and the "Cloud" label builds the query string for you automatically:
Then select the "search" button, or place the cursor within the query box and hit "Return" on your keyboard, to process the query.
In some situations, this technique has limited usefulness. In the example screenshot above, double-clicking on the label beginning with "XSS" would add a (very) long filter string to the query, because that label contains the full script from the injection attempt (although the label itself only displays the first few characters in the interface).
If this is what you want (perhaps you need to search only for logged requests which contain that exact script), then this is effective. But if you wanted to build a more general query, then this is not useful.
A better approach is to choose a representative substring.
reason:XSS will show all records with "XSS" in their reason label.
url:login will include all URLs that include "login".
ip:191 will display all IP addresses containing "191".
Regular expressions can be applied to the filter value to make the search more accurate. The regex matching is done by wrapping the search value with re(REGEX here). Examples:
If you wish to display login requests with method “POST” which were blocked, but not by the origin (upstream server):
This displays those requests which produced 502-504 error codes:
This displays the requests that contain a specific value in an argument:
Log records registered after a given date and time.
Log records registered before a given date and time.
Search for an argument by name
Search for an argument value
Autonomous System Number for the IP
Abbreviation for the country. Example: "US" for the United States.
Name of the country
Reblaze ID cookie value (base64)
Search by cookie name
Search by cookie value
The main domain name in Reblaze (not necessarily the actual Host header).
Name of header
Value found in header_name
HTTP Host header: usually, the domain name of the application.
Reblaze unique request ID.
IP address of the web client.
IS is a special operator that can be used for almost all attributes of a request. It can be used to filter a certain HTTP method, "flags" and protocol version. For instance, to get blocked POST requests made by a human, type: is:blocked, is:human, is:post.
Multipurpose Internet Mail Extensions
The IP address of the origin server.
The path of the request (the URL without the query string part).
The IP address of the particular Reblazer server.
Hash value of Reblaze ID cookie value (md5).
Reason the request was blocked or passed.
HTTP referer header.
The chosen SSL cipher.
The chosen SSL protocol.
Response status code (regex is acceptable, e.g. \d\d).
HTTP User Agent header.
Response status code from upstream servers (regex is acceptable, e.g. \d\d).
A substring to search for within the complete URL request line (including the query string).