> ## Documentation Index
> Fetch the complete documentation index at: https://repost.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Repost Bucket and Forwarder History with Query Syntax

> Filter Repost bucket and forwarder history with field clauses, ranges, boolean operators, and JSON-path queries to find any webhook event.

History search filters the current bucket or forwarder history view. You write a query using field clauses, range expressions, and boolean operators, and Repost narrows the event list to only the rows that match. The same query language works in both bucket event history and forwarder history — learn it once and apply it everywhere.

## How the query works

The page supplies the scope. Bucket history searches one bucket; forwarder history searches one forwarder inside that bucket. Your query narrows the rows within that scope.

<CardGroup cols={3}>
  <Card title="Empty query" icon="asterisk">
    Shows every row in the selected time window. A blank query or a comment-only query is treated as empty.
  </Card>

  <Card title="Field clause" icon="terminal">
    Narrows rows to those matching a specific field value, such as `method:POST` or `status:FAILED`.
  </Card>

  <Card title="Time window" icon="calendar-clock">
    The date picker limits the retained history window used by both the list and the timeline histogram.
  </Card>
</CardGroup>

<Info>
  Organisation, bucket, and forwarder scope is applied by the page before your query runs. Adding a `bucket_id` or `forwarder_id` clause can narrow results further, but it cannot expand the view beyond the currently selected scope.
</Info>

<Note>
  Press `Cmd` + `Enter` on macOS or `Ctrl` + `Enter` on Windows and Linux to run the query. Keep shared queries under 10 240 characters — live tail, timeline histograms, and broad replay actions enforce that limit.
</Note>

## Field clauses

A clause takes the form `field:value`. Field names use lowercase or snake\_case. Enum values such as delivery statuses are uppercase. Quote string values that contain spaces, punctuation, or URL characters.

### Bucket event history fields

Use these fields when searching inbound webhooks in bucket history.

| Field                  | Description                                                              | Example                                   |
| ---------------------- | ------------------------------------------------------------------------ | ----------------------------------------- |
| `event_id`             | Repost event identifier                                                  | `event_id:"evt_..."`                      |
| `received_at`          | Time Repost received the webhook                                         | `received_at:[2024-06-01T00:00:00Z TO *]` |
| `method`               | Incoming HTTP method                                                     | `method:POST`                             |
| `path_original`        | Path the provider called                                                 | `path_original:"/webhooks/stripe"`        |
| `received_domain`      | Domain that received the request                                         | `received_domain:"hooks.example.com"`     |
| `query_string`         | Raw URL query string                                                     | `query_string:"account=live"`             |
| `status`               | Event processing status: `RECEIVED`, `PROCESSING`, `COMPLETED`, `FAILED` | `status:COMPLETED`                        |
| `duration_ms`          | End-to-end event processing duration in milliseconds                     | `duration_ms:[1000 TO *]`                 |
| `response.status`      | HTTP status code returned to the sender                                  | `response.status:200`                     |
| `response_status`      | Same status code as a top-level numeric field                            | `response_status:[500 TO 599]`            |
| `source_ip`            | IP address of the sender                                                 | `source_ip:"203.0.113.42"`                |
| `request.body`         | Raw request body text                                                    | `request.body:invoice`                    |
| `request.content_type` | Incoming content type                                                    | `request.content_type:"application/json"` |
| `request.size_bytes`   | Incoming request size in bytes                                           | `request.size_bytes:[1000 TO *]`          |
| `request.body_json.*`  | JSON request payload fields (dot-notation)                               | `request.body_json.type:"invoice.paid"`   |
| `response.body`        | Raw response body text                                                   | `response.body:accepted`                  |
| `response.body_json.*` | JSON response payload fields                                             | `response.body_json.received:true`        |

### Forwarder history fields

Use these fields when searching delivery attempts in forwarder history.

| Field                   | Description                                                                                            | Example                                         |
| ----------------------- | ------------------------------------------------------------------------------------------------------ | ----------------------------------------------- |
| `forward_id`            | Delivery attempt identifier                                                                            | `forward_id:"fwd_..."`                          |
| `event_id`              | Event that created the delivery                                                                        | `event_id:"evt_..."`                            |
| `received_at`           | Time Repost received the originating webhook                                                           | `received_at:[2024-06-01T00:00:00Z TO *]`       |
| `status`                | Delivery state: `PENDING`, `IN_PROGRESS`, `SUCCESS`, `FAILED`, `RETRYING`, `SCHEDULED`, `USER_SKIPPED` | `status:FAILED`                                 |
| `target_status`         | Destination HTTP response status code                                                                  | `target_status:504`                             |
| `error_code`            | Machine-readable failure code                                                                          | `error_code:TIMEOUT`                            |
| `error_message`         | Failure detail text                                                                                    | `error_message:"connection refused"`            |
| `target_url`            | Destination URL                                                                                        | `target_url:"https://api.example.com/webhooks"` |
| `method`                | Forwarded HTTP method                                                                                  | `method:POST`                                   |
| `path`                  | Original request path                                                                                  | `path:"/webhooks/stripe"`                       |
| `attempt`               | Current attempt number                                                                                 | `attempt:[2 TO *]`                              |
| `max_attempts`          | Configured attempt ceiling                                                                             | `max_attempts:3`                                |
| `forward_type`          | Delivery category: `ATTEMPT` or `REPLAY`                                                               | `forward_type:ATTEMPT`                          |
| `replay_job_id`         | Replay job that created this attempt                                                                   | `replay_job_id:"rj_..."`                        |
| `duration_ms`           | End-to-end delivery duration in milliseconds                                                           | `duration_ms:[1000 TO *]`                       |
| `transform_duration_ms` | Function transform duration in milliseconds                                                            | `transform_duration_ms:[50 TO *]`               |
| `request.body_json.*`   | Forwarded request JSON payload fields                                                                  | `request.body_json.customer.id:"cus_123"`       |
| `response.body_json.*`  | Destination response JSON payload fields                                                               | `response.body_json.ok:false`                   |

## Ranges

Use range syntax to filter numeric and time fields. Square brackets `[ ]` include the endpoints; curly braces `{ }` exclude them. Use `*` for an open-ended boundary.

```text theme={"languages":{"custom":["/languages/repost.json"]}}
received_at:[2024-06-01T00:00:00Z TO 2024-06-02T00:00:00Z]
target_status:[500 TO 599]
attempt:[2 TO *]
duration_ms:{1000 TO *}
```

<Note>
  Use whole-second UTC timestamps for time fields. In bucket history, a typed `received_at` clause takes priority when the page loads from a deep link. Selecting a date picker or timeline range replaces that clause.
</Note>

## Boolean operators and grouping

Combine clauses with `AND`, `OR`, and `NOT`. Use parentheses to make precedence explicit when mixing operators.

```text theme={"languages":{"custom":["/languages/repost.json"]}}
(method:POST OR method:PUT)
AND response.status:[200 TO 299]
AND NOT path:"/health"
```

<AccordionGroup>
  <Accordion title="AND" icon="plus">
    Returns rows that match both sides. Use `AND` as the default when you want to narrow results with each additional clause.
  </Accordion>

  <Accordion title="OR" icon="git-branch">
    Returns rows that match either side. Always wrap `OR` expressions in parentheses when you mix them with `AND` or `NOT`.
  </Accordion>

  <Accordion title="NOT" icon="minus">
    Excludes rows that match the following clause. In multiline queries, writing `AND NOT field:value` on its own line is the clearest pattern.
  </Accordion>

  <Accordion title="Comments" icon="message-square">
    Lines beginning with `//` are ignored by the query engine. Press `Cmd` + `/` on macOS or `Ctrl` + `/` on Windows and Linux to toggle comments in the editor. Inline `//` text after a value is treated as part of the value, not a comment.
  </Accordion>
</AccordionGroup>

## JSON path queries

You can search directly into request and response payloads using dot-notation paths. The editor suggests paths and values from rows already loaded in the current page.

```text theme={"languages":{"custom":["/languages/repost.json"]}}
request.body_json.customer.id:"cus_123"
AND response.body_json.ok:true
```

<CardGroup cols={3}>
  <Card title="Scalar values" icon="list-filter">
    Strings, finite numbers, booleans, and `null` are all searchable. Objects are containers — search the nested scalar fields inside them.
  </Card>

  <Card title="Array values" icon="brackets">
    Omit numeric indexes when searching arrays. Search the scalar value at the shared array field path and Repost matches any element.
  </Card>

  <Card title="Suggested paths" icon="sparkles">
    Autocomplete suggestions come from rows already loaded in the page. A missing suggestion does not mean a field is invalid — type valid paths manually when they have not appeared in loaded rows yet.
  </Card>
</CardGroup>

## Example queries

<Tabs>
  <Tab title="Bucket history">
    ```text theme={"languages":{"custom":["/languages/repost.json"]}}
    // All successful POST events
    method:POST
    AND response.status:200

    // Stripe subscription cancellations
    request.body_json.type:"customer.subscription.deleted"

    // One-day window
    received_at:[2024-06-01T00:00:00Z TO 2024-06-02T00:00:00Z]

    // Exclude GET requests
    NOT method:GET

    // Large payloads that took over a second
    request.size_bytes:[10000 TO *]
    AND duration_ms:[1000 TO *]
    ```
  </Tab>

  <Tab title="Forwarder history">
    ```text theme={"languages":{"custom":["/languages/repost.json"]}}
    // All failed delivery attempts
    status:FAILED

    // Destination returned a server error
    status:FAILED
    AND target_status:[500 TO 599]

    // Slow retried attempts
    attempt:[2 TO *]
    AND duration_ms:[1000 TO *]

    // Replay attempts only
    forward_type:REPLAY

    // Stripe invoices on a specific path
    path:"/webhooks/stripe"
    AND request.body_json.type:"invoice.paid"
    ```
  </Tab>
</Tabs>

<Warning>
  A query with invalid syntax returns an empty result set in historical mode. In live tail, a syntax error shows a query error and turns off live streaming. Remove the last clause or test one clause at a time to isolate the problem.
</Warning>

## Build queries from the detail drawer

You do not have to type every clause by hand. The detail drawer gives you a shortcut for any scalar value you can see.

<Steps>
  <Step title="Open an event or forward detail">
    Click any row in bucket or forwarder history to open the detail drawer.
  </Step>

  <Step title="Hover a scalar JSON value">
    Hover over any string, number, boolean, or null value in the payload viewer. A small action menu appears.
  </Step>

  <Step title="Include, exclude, or copy">
    Choose **Include** to add a matching clause, **Exclude** to add a `NOT` clause, or **Copy** to place the raw value on your clipboard. Repost inserts the clause into the query editor and runs it immediately.
  </Step>

  <Step title="Combine with manual clauses">
    Detail actions replace an existing simple clause for the same field. Manually authored multi-clause lines are preserved so your existing query is not overwritten.
  </Step>
</Steps>

<Tip>
  Add custom columns from frequently queried JSON paths so the values you filter on are visible directly in the table without opening every row.
</Tip>