Event Search
The Inbound Events page includes a search bar above the event table for finding events quickly, without needing the dropdown filters. It's built for the same kind of quick, typed search you'd use in CloudWatch Logs Insights or the Cloudflare dashboard.
The search bar and the dropdown filters (Source, Status, Method, Date range, etc.) work together — whichever one you touch last for a given field wins. Use whichever is faster for what you're doing: dropdowns for a couple of clicks, the search bar for typing a specific query or sharing a link to it.
Basic search
Type any word to search across event type, event ID, source name, and payload content:
stripeMultiple bare words are combined with AND — an event must match all of them:
stripe checkout.sessionWrap a phrase in quotes to search for it as a single term, spaces included:
"payment failed"Filter keys
Prefix a term with a key and a colon to filter a specific field instead of doing a free-text match. Filter keys can be combined with each other and with free-text terms — everything is ANDed together.
| Key | Example | Matches |
|---|---|---|
status: | status:failed | Delivery status: delivered, failed, pending, partial, duplicate, no_routes |
source: | source:stripe | Events from a source, matched by name or slug |
method: | method:POST | The inbound HTTP method: GET, POST, PUT, PATCH, DELETE, HEAD |
signature: | signature:valid | Signature verification result: valid or invalid |
payload.<path>: | payload.customer.email:"[email protected]" | A specific JSON field in the event payload |
A few examples:
status:failed source:stripeFailed events from the Stripe source.
signature:invalid method:POSTPOST requests that failed signature verification.
payload.type:"checkout.session.completed"Events whose payload has type equal to that value. Quote the value if it contains spaces or punctuation.
How filter keys behave
- Filter keys write into the same filters as the dropdowns above the table. Typing
status:failedin the search bar sets the Status dropdown to "Failed", and vice versa — clearing a term in the search bar clears the matching dropdown. - Unrecognized keys or values fall back to free text.
status:bogusisn't a real status, so it's searched as the literal textstatus:bogusinstead, with a warning shown under the search bar. - Only one
payload.<path>:filter is applied at a time. If you type more than one, the last one wins — the others are dropped with a warning. Searching on multiple payload fields at once isn't supported yet. - Search results are shareable. The typed query is saved in the page URL as
?q=..., so a link you copy while searching reproduces the same results for anyone you send it to.
Limits
- Free-text search matches against event type, event ID (prefix), source name, and indexed payload content. It isn't a substring search inside arbitrarily large payloads — see Observability Export if you need to search full historical payload data at scale.
- Payload search only covers events received after this feature shipped — it isn't backfilled for events received earlier.
- Very large payloads aren't indexed for search (there's a size ceiling on what gets indexed at ingest time); those events are still stored and viewable, just not matched by payload search terms.
- Fields configured for Field Encryption are stored as ciphertext and never match a search — the rest of the payload is indexed and searchable as normal.