History search filters the current bucket or forwarder history view. You write a query using field clauses, range expressions, and boolean operators, and Repost narrows the event list to only the rows that match. The same query language works in both bucket event history and forwarder history. Learn it once and apply it everywhere.
How the query works#
The page supplies the scope. Bucket history searches one bucket; forwarder history searches one forwarder inside that bucket. Your query narrows the rows within that scope.
Shows every row in the selected time window. A blank query or a comment-only query is treated as empty.
Narrows rows to those matching a specific field value, such as method:POST or status:FAILED.
The date picker limits the retained history window used by both the list and the timeline histogram.
Organisation, bucket, and forwarder scope is applied by the page before your query runs. Adding a bucket_id or forwarder_id clause can narrow results further, but it cannot expand the view beyond the currently selected scope.
Press Cmd + Enter on macOS or Ctrl + Enter on Windows and Linux to run the query. Keep shared queries under 10 240 characters: live tail, timeline histograms, and broad replay actions enforce that limit.
Field clauses#
A clause takes the form field:value. Field names use lowercase or snake_case. Enum values such as delivery statuses are uppercase. Quote string values that contain spaces, punctuation, or URL characters.
Bucket event history fields#
Use these fields when searching inbound webhooks in bucket history.
| Field | Description | Example |
|---|---|---|
event_id | Repost event identifier | event_id:"evt_..." |
received_at | Time Repost received the webhook | received_at:[2024-06-01T00:00:00Z TO *] |
method | Incoming HTTP method | method:POST |
path_original | Path the provider called | path_original:"/webhooks/stripe" |
received_domain | Domain that received the request | received_domain:"hooks.example.com" |
query_string | Raw URL query string | query_string:"account=live" |
status | Event processing status: RECEIVED, PROCESSING, COMPLETED, FAILED | status:COMPLETED |
duration_ms | End-to-end event processing duration in milliseconds | duration_ms:[1000 TO *] |
response.status | HTTP status code returned to the sender | response.status:200 |
response_status | Same status code as a top-level numeric field | response_status:[500 TO 599] |
source_ip | IP address of the sender | source_ip:"203.0.113.42" |
request.body | Raw request body text | request.body:invoice |
request.content_type | Incoming content type | request.content_type:"application/json" |
request.size_bytes | Incoming request size in bytes | request.size_bytes:[1000 TO *] |
request.body_json.* | JSON request payload fields (dot-notation) | request.body_json.type:"invoice.paid" |
response.body | Raw response body text | response.body:accepted |
response.body_json.* | JSON response payload fields | response.body_json.received:true |
Forwarder history fields#
Use these fields when searching delivery attempts in forwarder history.
| Field | Description | Example |
|---|---|---|
forward_id | Delivery attempt identifier | forward_id:"fwd_..." |
event_id | Event that created the delivery | event_id:"evt_..." |
received_at | Time Repost received the originating webhook | received_at:[2024-06-01T00:00:00Z TO *] |
status | Delivery state: PENDING, IN_PROGRESS, SUCCESS, FAILED, RETRYING, SCHEDULED, USER_SKIPPED | status:FAILED |
target_status | Destination HTTP response status code | target_status:504 |
error_code | Machine-readable failure code | error_code:TIMEOUT |
error_message | Failure detail text | error_message:"connection refused" |
target_url | Destination URL | target_url:"https://api.example.com/webhooks" |
method | Forwarded HTTP method | method:POST |
path | Original request path | path:"/webhooks/stripe" |
attempt | Current attempt number | attempt:[2 TO *] |
max_attempts | Configured attempt ceiling | max_attempts:3 |
forward_type | Delivery category: ATTEMPT or REPLAY | forward_type:ATTEMPT |
replay_job_id | Replay job that created this attempt | replay_job_id:"rj_..." |
duration_ms | End-to-end delivery duration in milliseconds | duration_ms:[1000 TO *] |
transform_duration_ms | Function transform duration in milliseconds | transform_duration_ms:[50 TO *] |
request.body_json.* | Forwarded request JSON payload fields | request.body_json.customer.id:"cus_123" |
response.body_json.* | Destination response JSON payload fields | response.body_json.ok:false |
Ranges#
Use range syntax to filter numeric and time fields. Square brackets [ ] include the endpoints; curly braces { } exclude them. Use * for an open-ended boundary.
received_at:[2024-06-01T00:00:00Z TO 2024-06-02T00:00:00Z]
target_status:[500 TO 599]
attempt:[2 TO *]
duration_ms:{1000 TO *}Use whole-second UTC timestamps for time fields. In bucket history, a typed received_at clause takes priority when the page loads from a deep link. Selecting a date picker or timeline range replaces that clause.
Boolean operators and grouping#
Combine clauses with AND, OR, and NOT. Use parentheses to make precedence explicit when mixing operators.
(method:POST OR method:PUT)
AND response.status:[200 TO 299]
AND NOT path:"/health"AND
Returns rows that match both sides. Use AND as the default when you want to narrow results with each additional clause.
OR
Returns rows that match either side. Always wrap OR expressions in parentheses when you mix them with AND or NOT.
NOT
Excludes rows that match the following clause. In multiline queries, writing AND NOT field:value on its own line is the clearest pattern.
Comments
Lines beginning with // are ignored by the query engine. Press Cmd + / on macOS or Ctrl + / on Windows and Linux to toggle comments in the editor. Inline // text after a value is treated as part of the value, not a comment.
JSON path queries#
You can search directly into request and response payloads using dot-notation paths. The editor suggests paths and values from rows already loaded in the current page.
request.body_json.customer.id:"cus_123"
AND response.body_json.ok:trueStrings, finite numbers, booleans, and null are all searchable. Objects are containers: search the nested scalar fields inside them.
Omit numeric indexes when searching arrays. Search the scalar value at the shared array field path and Repost matches any element.
Autocomplete suggestions come from rows already loaded in the page. A missing suggestion does not mean a field is invalid. Type valid paths manually when they have not appeared in loaded rows yet.
Example queries#
// All successful POST events
method:POST
AND response.status:200
// Stripe subscription cancellations
request.body_json.type:"customer.subscription.deleted"
// One-day window
received_at:[2024-06-01T00:00:00Z TO 2024-06-02T00:00:00Z]
// Exclude GET requests
NOT method:GET
// Large payloads that took over a second
request.size_bytes:[10000 TO *]
AND duration_ms:[1000 TO *]A query with invalid syntax returns an empty result set in historical mode. In live tail, a syntax error shows a query error and turns off live streaming. Remove the last clause or test one clause at a time to isolate the problem.
Build queries from the detail drawer#
You do not have to type every clause by hand. The detail drawer gives you a shortcut for any scalar value you can see.
Click any row in bucket or forwarder history to open the detail drawer.
Hover over any string, number, boolean, or null value in the payload viewer. A small action menu appears.
Choose Include to add a matching clause, Exclude to add a NOT clause, or Copy to place the raw value on your clipboard. Repost inserts the clause into the query editor and runs it immediately.
Detail actions replace an existing simple clause for the same field. Manually authored multi-clause lines are preserved so your existing query is not overwritten.
Add custom columns from frequently queried JSON paths so the values you filter on are visible directly in the table without opening every row.