Use operators to refine a search in Vault

You can enter keywords and search terms in the Terms field to narrow or broaden a search of your organization's Google Workspace data using Google Vault. The search operators you can use vary by service. Vault supports search operators for Gmail, Google Groups, Drive, Chat, and Voice, but doesn't support search operators for Calendar. 

Search basics

  • Enter search operators in English, even if people in your organization use other languages to communicate. You can use English search operators to find non-English words and phrases.

  • For most services, Vault assumes there is an AND operator between search terms if no Boolean operator is specified.

  • Vault ignores punctuation marks and case in keywords and phrases.

  • To exclude results that match the search term, put a hyphen (-) or NOT before the search operator. For example, to exclude messages sent to username1 from the search results, you can enter either ‑to:username1 or NOT to:username1.

    Note: If your search term starts with hyphen, such as -1000%, put the individual term in quotation marks to ensure the hyphen is not interpreted as a NOT operator. For example, -1000% (with no search operator) matches anything that doesn't contain 1000, while “-1000%” matches -1000 and 1000, because with quotation marks the hyphen and % are ignored.

  • To search for messages or items by account name, always include a colon (:) with no spaces immediately after the operator. For example, use to:username1 in Gmail and owner:username2 in Google Drive.

  • When you enter multiple values for the same operator, group them together in parentheses. For example, to search two recipients of a Gmail message, enter to:(username1 OR username2).

  • Boolean operators (AND, OR, NOT, and AROUND) must be in all caps, otherwise they're treated as keywords. To ensure your terms are processed correctly, on this page review the term complexity guidelines.

Search operators

Expand section  |  Collapse all & go to top

Gmail & Google Groups search operators

Available search operators:

General search operators

Operator Description & usage
AND

Find messages that include 2 given search terms.

Examples:

  • secret AND project (equivalent to secret project)
  • from:username1 AND to:username2
OR

Find messages that include either of 2 given search terms (or both). To ensure your query is processed correctly, use less than 20 OR terms in a query. If your query includes a date term, such as sent_before:, use less than 10 OR terms .

Examples:

  • secret OR alert
  • from:(username1 OR username2)
  • "huge losses" OR "-1000%" (Note: Put quotation marks around terms that start with hyphens to ensure they’re not treated as NOT operators)
NOT

Find messages that do not include a given search term.

Examples:

  • NOT personal
  • from:username1 NOT to:username2
*

Find unknown or wildcard terms.

The wildcard (*) must appear at the end of a search term. For example, invit* returns messages with either invite or invitation (or both). However, *ation isn't supported.

You can append a wildcard (*) to the beginning of an email address to find all messages sent to or from an external domain.

Note: If your wildcard entry results in a phrase that exceeds 100 words, the search will fail. Make your search more specific.

Examples:

  • invit*
  • from:*@solarmora.com
AROUND number

Find messages with words near each other.

Enter a number to specify how many words apart the words can be. Add quotes to return only messages in which the first word appears before the second word.

Usage notes:

  • AROUND can't be combined with a wildcard (*) search
  • AROUND can't be used with parentheses or multiple-word phrases
  • Use no more than 2 AROUND terms in a query.
  • Set the AROUND distance to less than 20.

Example:

  • tax AROUND 10 audit
  • "secret AROUND 15 project"

Text, subject, or ID

Operator Description & usage
no operator

Find messages that contain that word or phrase in the message text or subject.

To search for a phrase, put the words in double quotes (").

Example:

  • alert
  • "Solarmora, Inc." Note: Search ignores the case and punctuation of phrases in quotation marks. This example will also match solarmora inc and Solamora! inc.
subject:

Find messages with a given word or phrase in the subject.

To search for multiple-word subjects, substitute a hyphen (-) for each space.

Example:

  • subject:secret-product-launch-plans
rfc822msgid:

Find messages by Message-ID. Message-ID is a unique identifier for a message that is added by mail servers. Email clients and servers use this identifier to track a message. To get the Message-ID header, open a message in Vault and click original.

Example: 

  • rfc822msgid:AANLkTilQ5MWSp7-iE6SKepvOl-
    Spjupgr1NZTiLGu16Z@mail.solarmora.com

Account

Operator Description & usage
to:

Find messages received by a given account. The account can be a group email address.

Vault returns any messages that include the account in the to, cc, or bcc fields.

When you search accounts in your organization's domain, you don't need to specify the domain. For example, if your domain is solarmora.com, a search for to:sales is the same as a search for to:sales@solarmora.com.

Examples:

  • to:username1
  • to:finance-team@solarmora.com
from:

Find messages sent by the given account. Note:

  • Gmail messages sent on behalf of the user by Google services, such as comment notifications from Drive, might not be included because only the user's name is reported, not their account username.
  • In a Gmail search, a search for messages sent by a Google Group (for example, from:group@solarmora.com) returns messages only if a user subscribed to the group and gets abridged summary or digest emails. Notifications for every message are sent from the senders' individual accounts.

Examples:

  • from:username1
  • from:finance-team@solarmora.com
cc:

Find messages with the given account in the cc field.

Example:

cc:username1

bcc:

Find messages with the given account in the bcc field.

Example:

  • bcc:username1
replyto:

Find messages with the given account as the intended recipient of any replies.

Example:

  • replyto:username1
list:

Find messages sent to or from a group.

Example:

  • list:company-announcements
listid:

Find a message by the unique identifier of the group the message was sent to.

The List-ID is included in the headers of messages sent to or from Google Groups. To find a message's List-ID, open a message thread in Vault, and click Original in the upper-right corner.

Example:

  • listid:employee-announcements.solarmora.com
deliveredto:

Limit search results to Gmail messages successfully delivered to the given account.

Example:

  • deliveredto:username1

Label, folder, & type

Operator Description & usage
label:

Find or exclude messages with a given Gmail label. This operator isn't supported for messages in Google Groups.

If the label includes spaces, substitute a hyphen (-) for each space. Add a slash (/) to search for a nested label. The wildcard (*) isn't supported when you search for labels.

Examples:

  • Find messages with a nested label

    label:purchase-orders/approved

  • Find messages removed from Trash but not yet purged.

    in:trash AND label:^deleted

  • Find messages removed from account mailboxes because a retention rule expired.

    label:^vault_deletion

  • Exclude quarantined messages.

    -label:^admin_quarantine

  • Find messages sent with Gmail confidential mode.

    label:confidentialmode

  • Find messages waiting to be sent on a schedule 

    label:^scheduled

  • Find messages that were sent on a schedule 

    label:^f_sd

  • Exclude old versions of draft messages.

    -label:^r_ad

Note: If you search for a system-generated label, Vault may return an excessive number of messages.

in:

Find messages in a given folder.

Examples:

  • in:inbox
  • in:spam
  • in:trash
is:

Find messages by type or status.

Options:

Find Gmail messages by status.

  • is:read
    is:sent
    is:starred
    is:unread

Date or size

Operator Description & usage

sent_before:

sent_after:

received_before:

received_after:

Find messages by when they were sent or received. Enter dates with the format YYYY-MM-DD.

Matches are inclusive of the specified date. For example, sent_before:2019-12-16 matches messages sent December 16, 2019 or earlier.

Example:

  • sent_after:2017-12-16

older_than:

newer_than:

Find messages older or newer than a given period of time.

Supported units of time include d (day), m (month), and y (year).

Example:

  • newer_than:1m
size:

Find messages by size in bytes, including any attachments.

You can use :, <, >, =, <=, and >= with this operator.

Example:

  • size>=1000000

smaller:

larger:

Find messages smaller or larger than a given size in kilobytes or megabytes, including any attachments.

Use K for kilobytes and M for megabytes.

Example:

  • larger:10M

Attachment properties

Operator Description & usage
has:attachment

Find messages with at least one attachment.

has:attachment

filename:

Find messages that include an attachment with the given file name.

The search term is case insensitive and supports partial matches and wildcards.

Example:

  • filename:secret-plans.pdf
filename_exact:

Find messages that include attachments with the exact file name.

This search term is case sensitive.

Example:

  • filename_exact:sEcReT-PlAnS.PdF
Drive search operators

Available search operators:

General search operators

Operator Description & usage
no operator

For supported file types, find items that contain the given keywords or phrases.

To search for a phrase, put the words in double quotes ("). Case insensitive.

Example:

  • alert
  • "Solarmora, Inc."
AND

Find items that include 2 given search terms.

Examples:

  • secret AND project
  • owner:username1 AND to:username2
OR

Find items that include either of 2 given search terms (or both).

Examples:

  • secret OR confidential
  • type:(spreadsheet OR pdf)
NOT

Find items that do not include a given search term.

Examples:

  • NOT personal
  • username1 NOT type:image

Account

Note: Enter the account as the complete email address, such as user1@example.com or groupA@example.com.

Operator Description & usage
owner:

Matches

  • Files owned by the specified account.
  • If shared drives are included in the search, files created by the specified account.

Doesn't match

  • Files previously owned by the specified account that transferred ownership to another account.

Example

  • owner:user1@example.com matches files owned by user1. Doesn’t match files previously owned by user1 that are now owned by a different account.
sharedwith:

Matches

  • All files the specified account has permission to view, comment, or edit.
  • Files the account owns.
  • If the specified account has permission through a group membership:
    • If the group has less than 200 members, files shared with that group match the query.
    • If the group has 200 or more members, only files the account opened match the query.
  • Files in folders where the folder was shared with the specified account, even if the file wasn’t shared directly.

Doesn't match

  • Files in shared drives that the specified account is a member of, but that weren’t directly shared with the specified account.
  • Files shared with a group before or after the specified account was a member.

Example

  • sharedwith:user1@example.com matches files that were shared with user1 either directly or through a small group that user1 belongs to.
from:

Matches

  • Files shared by the specified account with the accounts in the scope of the search.

Non-matches

  • Files shared prior to March 2021
  • Files shared by link (“anyone with the link can”).

Example

  • from:user1@example.com matches files that were shared by user1.
to:

Matches

  • Files shared by the accounts in the scope of the search directly with the specified account.
  • If the specified account has permission through a group membership, matches the following files:
    • Files shared with the group (if the group has less than 200 members)
    • Files shared with the group that the account opened (if the group has 200 or more members)

    Note: Only files shared with the group while the account was a member are included.

Non-matches

  • Files shared prior to March 2021
  • Files in folders where the folder was shared with the specified account but the file wasn’t shared directly.
  • Files in shared drives that the specified account is a member of, but the files weren’t shared with the specified account directly.
  • Files shared with a group before or after the specified account was a member.
  • Files owned by the specified account.

Example

  • to:admin@solarmora.com matches files that were directly shared with admin@solarmora.com. Files that admin@solarmora.com has indirect access to through a shared drive don’t match.

Item properties

Operator Description & usage
is:

Find items marked with a star.

is:starred

in:

Find or exclude items moved to trash.

in:trash

-in:trash

type:

Find items by type.

Example:

  • type:presentation

Supported item types:

  • audio
  • document (all Google file types & PDFs)
  • drawing (Google Drawings)
  • form (Google Forms)
  • image
  • jam (Jamboard files)
  • pdf
  • presentation (Google Slides)
  • site (new Google Sites)
  • spreadsheet (Google Sheets)
  • textdoc (Google Docs)
  • video

before:

after:

Find items by when they were edited. Enter dates with the format YYYY-MM-DD.

Matches are exclusive of the specified date. For example, before:2019-12-16 matches items edited December 15, 2019 or earlier.

Example:

  • before:2017-12-31
title:

Find items by title.

Example:

  • title:"secret product launch plans"
Google Chat search operators

Available search operators:

Note: Chat doesn't support Boolean operators or terms that are enclosed in quotes.

General search operators

Operator Description & usage
+

Find messages that contain one or more keywords.

Search matches each keyword exactly, such that a search for +tax doesn't return messages that contain "taxes".

Example:

  • +secret +project
-

Exclude messages that contain one or more keywords.

Search matches each keyword exactly, such that a search for -finance still returns messages that contain "finances".

Example:

  • -personal

Account

Operator Description & usage
from:

Find direct messages sent by a user and conversations the user participated in.

This operator requires the full account name, including your organization's domain.

Example:

  • from:jane@solarmora.com
at:

Find conversations that mention a given user.

This operator requires the full account name, including your organization's domain.

Example:

  • at:jack@solarmora.com

Date

Operator Description & usage

before:

after:

Find messages based on when they were sent or updated.

Enter dates with the format YYYY/MM/DD.

Search uses UTC by default. Use the tz: operator to specify a time zone.

Matches are inclusive of the specified date. For example, before:2019/12/16 matches messages sent December 16, 2019 or earlier.

Examples:

  • after:2018/11/21
  • before:2019/03/16 tz:GMT-08:00

older_than:

newer_than:

Find messages older or newer than a given period of time.

Supported units of time include d (day), m (month), and y (year).

Search uses UTC by default. Use the tz: operator to specify a time zone.

Example:

  • older_than:1y
tz:

Specify a time zone for date- and time-based searches.

Specify the time zone with GMT+ or GMT- and the offset from UTC.

Example:

  • older_than:1y tz:GMT-05:30

Message & Chat space properties

Operator Description and usage
has:

Find messages that include a specific type of content.

Example:

  • has:video

Supported content types:

  • file
  • doc
  • sheet
  • slide
  • url
  • video
  • pdf
  • image
is:

Search for only DMs or only messages in spaces. You can also search for messages in a specific type of space.

Options:

  • is:dm (for DMs)
  • is:room (for messages in spaces)
  • is:threadedroom (for messages in threaded spaces)
  • is:flatroom (for messages in unthreaded spaces)
Google Voice search operators

Available search operators:

General search operators

Operator Description & usage
message:

Find text messages that include a keyword. If you enter a word with no search operator, Vault assumes message:.

Examples:

  • message:alert
  • alert
AND

Find text messages, voicemails, and call logs that match two search terms. If you enter multiple search terms, Vault assumes AND between them.

Examples:

  • secret AND project (equivalent to secret project)
  • before:2020-01-31 AND with:+14155550132
OR

Find text messages, voicemails, and call logs that match either of 2 search terms.

Examples:

  • secret OR confidential
  • with:(+14155550132 OR +14155550188)
NOT

Find text messages, voicemails, and call logs that do not include a search term.

Examples:

  • NOT personal
  • with:+14155550132 NOT with:+14155550188

Phone number or date

Operator Description & usage
with:

Find text messages and call log events that involve a phone number, and voicemails from a phone number.

When you search by phone number, your entry must include:

  • the plus sign (+)
  • a country code
  • the full number and area code

Example:

  • with:+14155550132
before:
after:

Find text messages, voicemails and their transcripts, and call log events that occurred before or after a date.

Search is relative to 11:59 PM UTC-7 on the day the text message was sent, the voicemail was created, or the call was made or received.

Matches are exclusive of the specified date. For example, before:2019-12-16 matches messages sent December 15, 2019 or earlier. To run an inclusive search, enter values for the Date sent fields instead of entering these search operators in Terms.

Examples:

  • before:2020-01-31

Data type or attachment

Operator Description & usage
is:

Find a specific type of data from Google Voice.

You can search for the following types:

  • text_message—Text messages
  • voicemail—Voicemail transcripts
  • received_call—Call log events for answered incoming calls
  • placed_call—Call log events for calls made
  • missed_call—Call log events for unanswered incoming calls

Examples:

  • is:text_message after:2020-01-01 with:+14155550132
  • is:voicemail with:+14155550132
has:attachment

Find text messages that have an attachment.

Examples:

  • has:attachment
  • with:+14155550132 AND has:attachment

Troubleshoot query issues

If your search terms return an error or don’t work as expected, the most common reason is a syntax error. Occasionally, a query might be too complex for the service to process.

Common syntax errors

  • Missing operator value, such as to:  instead of to:username1
  • Missing parentheses, such as
    from:(username1 OR username2
    instead of
    from:(username1 OR username2)
  • Missing quotes (Gmail and Drive), such as Solarmora, Inc. (treated as 2 keywords) instead of “Solarmora, Inc.” (treated as 1 keyphrase)
  • Wildcard (*) in a query for a service other than Gmail. Only Gmail supports wildcards.

Term complexity guidelines

To ensure your terms are correctly processed, they should meet the following guidelines:

  • Use less than 20 OR terms. If your query includes a date operator (such as sent_before:), use less than 10 OR terms.
  • Use no more than 2 AROUND operators in a query.
  • Set the AROUND distance to less than 20.
  • Consider splitting long queries into smaller equivalent queries. For example, (tax AND audit) OR (secret AND project) can be run as 2 separate queries:
    1. (tax AND audit)
    2. (secret AND project)

Was this helpful?

How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
17033620620181789379
true
Search Help Center
true
true
true
true
true
96539
false
false