Search and filters
The search box above the traffic list (⌘/Ctrl+F) takes plain words, field filters, or both. Separate terms with spaces; every term must match. The ? button next to the box lists examples you can click.
status>=400 host=api.* -path~healthThat finds errors from hosts starting with api., except health checks.
Plain words
A plain word matches anywhere in the method, status, URL, content type or failure, ignoring case: login, POST, json, ENOTFOUND. Use double quotes to keep spaces: "not found".
Field filters
A field filter is field, an operator, and a value, with no spaces between them: status=404, path~login, size>1mb.
| Operator | Means | Works on |
|---|---|---|
= | Equals, ignoring case. On text fields, * matches any run of characters and ? one character, and the whole value must match. | All fields |
!= | Doesn't equal | All fields |
~ | Contains, ignoring case | Text fields |
> >= < <= | Compares numbers | status, size, time |
Start any term with - to exclude what it matches: -host=*.google.com, -png.
| Field | Also | Matches |
|---|---|---|
method | GET, POST… | |
status | code | The response code. status=4xx or status!=5xx matches a class. |
host | domain | The host name, e.g. host=api.* or host=*.example.com |
path | The path, with the query string | |
url | The whole URL | |
type | json, html, js, css, image, font, media, xml, text, websocket, other | |
size | The response body's size, e.g. size>1mb | |
time | duration | How long it took, e.g. time>500ms |
protocol | proto | http or https |
rule | The name of the Pro rule that handled it, or its summary if it has no name | |
failure | error | Why it failed: dns, refused, tls, timeout, reset, unreachable, client-closed, rule, other, or an error code such as ENOTFOUND |
Units. Sizes take b, kb, mb or gb (1 KB is 1,024 bytes), and decimals: size>1.5mb. Times take ms, s or min: time>2s. A number with no unit is bytes or milliseconds.
If a value can't be read, such as size>abc, a message under the box says so and that term is ignored. A field name Wirescry doesn't know, such as page=2, is searched as plain text.
Examples
| Search | Finds |
|---|---|
status>=400 | Errors from the server |
status=5xx | Any 5xx status |
method=POST | POST requests |
host=api.* | Hosts starting with api. |
path~login | Paths containing "login" |
size>1mb | Responses over 1 MB |
time>500ms | Slower than half a second |
type=json | JSON responses |
failure=dns | DNS failures |
-host=*.google.com | Everything except Google hosts |
The quick filters above the list (JSON, HTML, Errors and so on) combine with the search: both must match. HAR export saves what the list shows, so a search also chooses what gets exported.