Use operators to refine a search in Vault

You can enter keywords and search terms in the Terms field to narrow or broaden a search of your organization's Google Workspace data using Google Vault. The search operators you can use vary by service.

Search basics

  • Enter search operators in English, even if people in your organization use other languages to communicate. You can use English search operators to find non-English words and phrases.

  • For most services, Vault assumes there is an AND operator between search terms if no Boolean operator is specified.

  • Vault can search for words and numbers. You can't search for punctuation marks or symbols.

  • To exclude results that match the search term, put a hyphen (-) or NOT before the search operator. For example, to exclude messages sent to username1 from the search results, you can enter either ‑to:username1 or NOT to:username1.

  • To search for messages or items by account name, always include a colon (:) with no spaces immediately after the operator. For example, use to:username1 in Gmail and owner:username2 in Google Drive.

  • When you enter multiple values for the same operator, group them together in parentheses. For example, to search two recipients of a Gmail message, enter to:(username1 OR username2).

  • Boolean operators (AND, OR, NOT, and AROUND) must be in all caps, otherwise they're treated as keywords.

Search operators

Gmail, classic Hangouts, and Google Groups search operators

Available search operators:

General search operators

Operator Description and usage
AND

Find messages that include 2 given search terms.

Examples:

  • secret AND project (equivalent to secret project)
  • from:username1 AND to:username2
OR

Find messages that include either of 2 given search terms (or both).

Examples:

  • secret OR alert
  • from:(username1 OR username2)
NOT

Find messages that do not include a given search term.

Examples:

  • NOT personal
  • from:username1 NOT to:username2
*

Find unknown or wildcard terms.

The wildcard (*) must appear at the end of a search term. For example, invit* returns messages with either invite or invitation (or both). However, *ation isn't supported.

You can append a wildcard (*) to the beginning of an email address to find all messages sent to or from an external domain.

Note: If your wildcard entry results in a phrase that exceeds 100 words, the search will fail. Make your search more specific.

Examples:

  • invit*
  • from:*@ink-42.com
AROUND number

Find messages with words near each other.

Enter a number to specify how many words apart the words can be. Add quotes to return only messages in which the first word appears before the second word.

This term can't be combined with a wildcard search and can't be used with parentheses or multiple-word phrases.

Example:

  • tax AROUND 10 audit
  • "secret AROUND 25 project"

Text, subject, or ID

Operator Description and usage
no operator

Find messages that contain that word or phrase in the message text or subject.

To search for a phrase, put the words in double quotes (").

Example:

  • alert
  • "Solarmora, Inc."
subject:

Find messages with a given word or phrase in the subject.

To search for multiple-word subjects, substitute a hyphen (-) for each space.

Example:

  • subject:secret-product-launch-plans
rfc822msgid:

Find messages by Message-ID. Message-ID is a unique identifier for a message that is added by mail servers. Email clients and servers use this identifier to track a message. To get the Message-ID header, open a message in Vault and click original.

Example: 

  • rfc822msgid:AANLkTilQ5MWSp7-iE6SKepvOl-
    Spjupgr1NZTiLGu16Z@mail.solarmora.com

Account

Operator Description and usage
to:

Find messages received by a given account. The account can be a group email address.

Vault returns any messages that include the account in the to, cc, or bcc fields.

When you search accounts in your organization's domain, you don't need to specify the domain. For example, if your domain is solarmora.com, a search for to:sales is the same as a search for to:sales@solarmora.com.

Examples:

  • to:username1
  • to:finance-team@solarmora.com
cc:

Find messages with the given account in the cc field.

Example:

cc:username1
bcc:

Find messages with the given account in the bcc field.

Example:

  • bcc:username1
replyto:

Find messages with the given account as the intended recipient of any replies.

Example:

  • replyto:username1
list:

Find messages sent to or from a group.

Example:

  • list:company-announcements
listid:

Find a message by the unique identifier of the group the message was sent to.

The List-ID is included in the headers of messages sent to or from Google Groups. To find a message's List-ID, open a message thread in Vault, and click Original in the upper-right corner.

Example:

  • listid:employee-announcements.solarmora.com
deliveredto:

Limit search results to Gmail messages successfully delivered to the given account.

Example:

  • deliveredto:username1

Label, folder, and type

Operator Description and usage
label:

Find or exclude messages with a given Gmail label.

If the label includes spaces, substitute a hyphen (-) for each space. Add a slash (/) to search for a nested label. The wildcard (*) isn't supported when you search for labels.

Examples:

  • Find messages with a nested label

    label:purchase-orders/approved

  • Find messages removed from Trash but not yet purged.

    label:^deleted

  • Find messages removed from account mailboxes because a retention rule expired.

    label:^vault_deletion

  • Exclude quarantined messages.

    -label:^admin_quarantine

  • Find messages sent with Gmail confidential mode.

    label:confidentialmode

  • Exclude old versions of draft messages.

    -label:^r_ad

Note: If you search for a system-generated label, Vault may return an excessive number of messages.
in:

Find messages in a given folder.

Examples:

  • in:inbox
  • in:spam
  • in:trash
is:

Find messages by type or status.

Options:

  • Find only classic Hangouts messages only (excludes Gmail messages).

    is:chat

  • Find Gmail messages by status.

    is:read
    is:sent
    is:starred
    is:unread

Date or size

Operator Description and usage

sent_before:

sent_after:

received_before:

received_after:

Find messages by when they were sent or received. Enter dates with the format YYYY-MM-DD.

Matches are inclusive of the specified date. For example, sent_before:2019-12-16 matches messages sent December 16, 2019 or earlier.

Example:

  • sent_after:2017-12-16

older_than:

newer_than:

Find messages older or newer than a given period of time.

Supported units of time include d (day), m (month), and y (year).

Example:

  • newer_than:1m
size:

Find messages by size in bytes, including any attachments.

You can use :, <, >, =, <=, and >= with this operator.

Example:

  • size>=1000000

smaller:

larger:

Find messages smaller or larger than a given size in kilobytes or megabytes, including any attachments.

Use K for kilobytes and M for megabytes.

Example:

  • larger:10M

Attachment properties

Operator Description and usage
has:attachment

Find messages with at least one attachment.

has:attachment
filename:

Find messages that include an attachment with the given file name.

The search term is case insensitive and supports partial matches and wildcards.

Example:

  • filename:secret-plans.pdf
filename_exact:

Find messages that include attachments with the exact file name.

This search term is case sensitive.

Example:

  • filename_exact:sEcReT-PlAnS.PdF
Drive search operators

Available search operators:

General search operators

Operator Description and usage
no operator

For supported file types, find items that contain the given keywords or phrases. 

To search for a phrase, put the words in double quotes ("). Case insensitive.

Example:

  • alert
  • "Solarmora, Inc."
AND

Find items that include 2 given search terms.

Examples:

  • secret AND project
  • owner:username1 AND to:username2
OR

Find items that include either of 2 given search terms (or both).

Examples:

  • secret OR confidential
  • type:(spreadsheet OR pdf)
NOT

Find items that do not include a given search term.

Examples:

  • NOT personal
  • username1 NOT type:image

Account

Operator Description and usage
owner:

Find items owned by a given account.

Example:

  • owner:username1
from:

Find items shared by a given account.

Example:

  • from:username2
to:

Find files shared with a given account.

Example:

  • to:admin@solarmora.com

Item properties

Operator Description and usage
is:

Find items marked with a star.

is:starred
in:

Find or exclude items moved to trash.

in:trash

-in:trash
type:

Find items by type.

Example:

  • type:presentation

Supported item types:

  • textdoc (Google Docs)
  • spreadsheet (Google Sheets)
  • presentation (Google Slides)
  • drawing (Google Drawings)
  • form (Google Forms)
  • jam (Jamboard files)
  • site (new Google Sites)
  • document (all Google file types and PDFs)
  • pdf
  • image
  • video

before:

after:

Find items by when they were edited. Enter dates with the format YYYY-MM-DD.

Matches are exclusive of the specified date. For example, before:2019-12-16 matches items edited December 15, 2019 or earlier.

Example:

  • before:2017-12-31
title:

Find items by title.

Example:

  • title:secret product launch plans
Google Chat search operators

Available search operators:

Note: Chat doesn't support Boolean operators or terms that are enclosed in quotes.

General search operators

Operator Description and usage
+

Find messages that contain one or more keywords.

Search matches each keyword exactly, such that a search for +tax doesn't return messages that contain "taxes".

Example: 

  • +secret +project
-

Exclude messages that contain one or more keywords.

Search matches each keyword exactly, such that a search for -finance still returns messages that contain "finances".

Example: 

  • -personal

Account

Operator Description and usage
from:

Find direct messages sent by a user and threads the user participated in.

This operator requires the full account name, including your organization's domain.

Example: 

  • from:jane@solarmora.com
at:

Find threads that mention a given user. 

This operator requires the full account name, including your organization's domain.

Example: 

  • at:jack@solarmora.com

Date

Operator Description and usage

before:

after:

Find message threads based on when they were sent or updated.

Enter dates with the format YYYY/MM/DD.

Search uses UTC by default. Use the tz: operator to specify a time zone.

Matches are inclusive of the specified date. For example, before:2019-12-16 matches messages sent December 16, 2019 or earlier.

Examples:

  • after:2018/11/21
  • before:2019/03/16 tz:GMT-08:00

older_than:

newer_than:

Find messages older or newer than a given period of time.

Supported units of time include d (day), m (month), and y (year).

Search uses UTC by default. Use the tz: operator to specify a time zone.

Example:

  • older_than:1y
tz:

Specify a time zone for date- and time-based searches.

Specify the time zone with GMT+ or GMT- and the offset from UTC.

Example:

  • older_than:1y tz:GMT-05:30

Message properties

Operator Description and usage
has:

Find threads and messages that include a specific type of content.

Example: 

  • has:video

Supported content types:

  • file
  • doc
  • sheet
  • slide
  • url
  • video
  • pdf
  • image
is:

Search for only direct messages or only messages in chat rooms.

Options: 

  • is:dm (for direct messages)
  • is:room (for messages in rooms)
Was this helpful?
How can we improve it?