Search and filter traffic

The search field at the right of the toolbar filters the traffic list. Type text to match part of a URL, or type a token such as host: to filter by one field.

Search by text#

1. Press ⌘F, or click the Search traffic field.
2. Type part of a URL, a method, a status code or a host.
3. Stop typing to see the results, or press Return to search at once.

Text matches in any case. It does not search headers or bodies. To search inside a body, use the inspector's own field, as Inspect a request describes.

Search filters the sidebar entry you have selected. To search all captured traffic, select All traffic first.

Requests an app cancels itself are hidden before any search runs. outcome:aborted shows them only while Settings ▸ Capture ▸ Requests that did not complete ▸ Show cancelled requests is on.

Each press of Esc in the field does one thing. It closes the suggestions when they are showing. Otherwise it clears the whole search, chips included. With nothing to clear, it leaves the field. With a chip selected, it deselects the chip first. Leaving the field gives the traffic list the keyboard, so a Delete after that removes the selected requests. See Clear and delete.

Tokens#

Type a token's prefix and a value, then press Return. The token becomes a chip in the field. While suggestions are showing, Return picks the highlighted one, as Suggestions describes.

• host:api.myshop.dev matches neither cdn.myshop.dev nor api.myshop.dev:8443. A request on a port other than 80 or 443 keeps the port in its host, so include it, as in host:api.myshop.dev:8443. Use text for part of a host.
• A request with no status never matches status:. That covers a request still waiting for its response, a relayed connection, and a request that failed before any response, such as one whose app refused ReqRes's certificate. A Failed row that ReqRes answered with a 502 matches status:502 and status:5xx. ReqRes answers a gRPC call that fails this way with HTTP 200 instead, so use outcome:failed for those.
• outcome: and grpc: ignore case, _ and -. outcome:timeout means timed_out. grpc:not_found, grpc:NotFound and grpc:5 all mean NOT_FOUND. proto: also takes http2, websocket and tcp.
• A row that is not an RPC call matches no grpc: token, not even grpc:error. A row with no recorded protocol matches no proto: token.
• The chips read the value, as in "Failed", "gRPC NOT_FOUND" or "HTTP/2". See why a request failed explains outcome:, and Capture HTTP/2 and gRPC explains grpc: and proto:.
• country: also takes a country name. Pick the country from the suggestions, or type country:germany and press Return. The chip shows the name. When no suggestion matches, a name that fits several countries, such as country:united, stays a text search.
• See which app sent a request explains app: and pid:. See where requests go explains country:.

To remove a chip, click the ⊗ on it. Or press Delete at the start of the field to select the last chip, and press it again to delete it. The ⊗ at the end of the field clears the whole search.

How tokens combine#

• Tokens of the same kind match either one. status:4xx and status:5xx together show both.
• Tokens of different kinds must all match. host:api.myshop.dev and method:POST together show only POST requests to that host.
• Text typed after the chips must match as well.
• A token ReqRes cannot read becomes a text search. status:banana and pid:curl search for that text.

Suggestions#

Click the empty field to see the busiest hosts and apps. A line under them lists the prefixes: host:, app:, pid:, country:, method:, status: and path:. It does not list outcome:, grpc: or proto:, which work the same way.

After you type a prefix, the suggestions offer values:

path: has no suggestions.

Use the up and down arrow keys to move through the list, and Return to pick. The first suggestion is highlighted after each key you type, so Return picks it. Check it before you press Return: pid:123 commits pid 1234 when that process is the first suggestion.

When no suggestion matches, Return adds what you typed. host:api.example.com works before any request to that host arrives.

When nothing matches#

The list shows "No Requests Found" with one of these messages:

The "Nothing captured from…" message has an Open Capture Settings button. Capture command-line tools and agents explains the setup it opens.

Related#

• See which app sent a request
• See where requests go
• Read the traffic list