Filtering

The filter bar and most CLI commands share one small query language. A filter is a list of terms; a row must match them all.

Combining terms

FormMeans
a bAND — both must match.
a OR bEither may match.
-termNegate — rows that do not match.
"two words"Quote a value that contains spaces.

Operators

OperatorMeans
field:valueContains (case-insensitive).
field=valueEquals exactly.
field~regexMatches a regular expression.
> < >= <=Numeric comparison (status, size, time).
status:4xxA status class: 2xx–5xx.

Sizes accept k and m suffixes (size:>1m); time is in milliseconds (time:>500).

Fields

Field (and aliases)Matches
urlThe full URL.
host, domainThe host.
pathThe path.
methodHTTP method.
status, codeResponse status.
ct, type, mimeContent type.
app, processThe local app that made the request.
device, clientThe capturing device.
header, hAny header, name or value.
reqheader, req / resheader, resRequest- or response-only headers.
body / reqbody / resbodyBody text, either side or one side.
query, param, qA query-string parameter.
all, anywhereEverything, including bodies.
comment, note, ruleYour comment, or a rule note on the row.
gql, graphql, opGraphQL operation name.
color, highlightHighlight color.
size, time, durationNumeric size and timing.

Keyed and path forms

Target one header, parameter or JSON field:

reqheader[authorization]:Bearer
query[page]:2
resbody[$.data.id]:42
req.headers.content-type:json
res.body.user.name~^A

is: states

is: filters by a property the request has:

is:error   is:paused    is:pending
is:ws      is:sse       is:graphql
is:highlighted  is:commented
is:raw     (tcp / udp / socket)
is:sent    (requests you sent, is:mine)

color: names

color: takes red, yellow, green, blue, purple, strike or none.

Examples

status:>=400 host:api            failing API calls
method:POST ct:json -host:analytics   JSON posts, minus analytics
is:graphql op:Login             a GraphQL login
resbody[$.error]: time:>1000     slow responses carrying an error
h[set-cookie]:session           responses that set a session cookie

Prefer clicking? The Filters button builds the same query from scopes and operators (contains, equals, matches regex…) with Match All or Any.

The same language drives elcapture-cli and the HTTP API.