Use operators to refine a search in Vault

You can enter keywords and search terms in the Terms field to narrow or broaden a search of your organization's Google Workspace data using Google Vault. The search operators you can use vary by service.

Search basics

• Enter search operators in English, even if people in your organization use other languages to communicate. You can use English search operators to find non-English words and phrases.

• For most services, Vault assumes there is an AND operator between search terms if no Boolean operator is specified.

• Vault ignores punctuation marks and case in keywords and phrases.

• To exclude results that match the search term, put a hyphen (-) or NOT before the search operator. For example, to exclude messages sent to username1 from the search results, you can enter either ‑to:username1 or NOT to:username1.

  Note: If your search term starts with hyphen, such as -1000%, put the individual term in quotation marks to ensure the hyphen is not interpreted as a NOT operator. For example, -1000% (with no search operator) matches anything that doesn't contain 1000, while “-1000%” matches -1000 and 1000, because with quotation marks the hyphen and % are ignored.

• To search for messages or items by account name, always include a colon (:) with no spaces immediately after the operator. For example, use to:username1 in Gmail and owner:username2 in Google Drive.

• When you enter multiple values for the same operator, group them together in parentheses. For example, to search two recipients of a Gmail message, enter to:(username1 OR username2).

• Boolean operators (AND, OR, NOT, and AROUND) must be in all caps, otherwise they're treated as keywords. To ensure your terms are processed correctly, on this page review the term complexity guidelines.

Search operators

Gmail and Google Groups search operators

Available search operators:

• General search operators
• Search by text, subject, or Message-ID
• Search by account
• Search by message label, folder, and type
• Search by date or size
• Search by attachment properties

General search operators

Operator	Description and usage
AND	Find messages that include 2 given search terms. Examples: secret AND project (equivalent to secret project) from:username1 AND to:username2
OR	Find messages that include either of 2 given search terms (or both). To ensure your query is processed correctly, use less than 20 OR terms in a query. If your query includes a date term, such as sent_before:, use less than 10 OR terms . Examples: secret OR alert from:(username1 OR username2) "huge losses" OR "-1000%" (Note: Put quotation marks around terms that start with hyphens to ensure they’re not treated as NOT operators)
NOT	Find messages that do not include a given search term. Examples: NOT personal from:username1 NOT to:username2
*	Find unknown or wildcard terms. The wildcard (*) must appear at the end of a search term. For example, invit* returns messages with either invite or invitation (or both). However, *ation isn't supported. You can append a wildcard (*) to the beginning of an email address to find all messages sent to or from an external domain. Note: If your wildcard entry results in a phrase that exceeds 100 words, the search will fail. Make your search more specific. Examples: invit* from:*@solarmora.com
AROUND number	Find messages with words near each other. Enter a number to specify how many words apart the words can be. Add quotes to return only messages in which the first word appears before the second word. Usage notes: AROUND can't be combined with a wildcard (*) search AROUND can't be used with parentheses or multiple-word phrases Use no more than 2 AROUND terms in a query. Set the AROUND distance to less than 20. Example: tax AROUND 10 audit "secret AROUND 15 project"

Text, subject, or ID

Operator	Description and usage
no operator	Find messages that contain that word or phrase in the message text or subject. To search for a phrase, put the words in double quotes ("). Example: alert "Solarmora, Inc." Note: Search ignores the case and punctuation of phrases in quotation marks. This example will also match solarmora inc and Solamora! inc.
subject:	Find messages with a given word or phrase in the subject. To search for multiple-word subjects, substitute a hyphen (-) for each space. Example: subject:secret-product-launch-plans
rfc822msgid:	Find messages by Message-ID. Message-ID is a unique identifier for a message that is added by mail servers. Email clients and servers use this identifier to track a message. To get the Message-ID header, open a message in Vault and click original. Example:  rfc822msgid:AANLkTilQ5MWSp7-iE6SKepvOl- [e-mail]

Account

Operator	Description and usage
to:	Find messages received by a given account. The account can be a group email address. Vault returns any messages that include the account in the to, cc, or bcc fields. When you search accounts in your organization's domain, you don't need to specify the domain. For example, if your domain is solarmora.com, a search for to:sales is the same as a search for to:[e-mail]. Examples: to:username1 to:[e-mail]
from:	Find messages sent by the given account. Note: Gmail messages sent on behalf of the user by Google services, such as comment notifications from Drive, might not be included because only the user's name is reported, not their account username. In a Gmail search, a search for messages sent by a Google Group (for example, from:[e-mail]) returns messages only if a user subscribed to the group and gets abridged summary or digest emails. Notifications for every message are sent from the senders' individual accounts. Examples: from:username1 from:[e-mail]
cc:	Find messages with the given account in the cc field. Example: cc:username1
bcc:	Find messages with the given account in the bcc field. Example: bcc:username1
replyto:	Find messages with the given account as the intended recipient of any replies. Example: replyto:username1
list:	Find messages sent to or from a group. Example: list:company-announcements
listid:	Find a message by the unique identifier of the group the message was sent to. The List-ID is included in the headers of messages sent to or from Google Groups. To find a message's List-ID, open a message thread in Vault, and click Original in the upper-right corner. Example: listid:employee-announcements.solarmora.com
deliveredto:	Limit search results to Gmail messages successfully delivered to the given account. Example: deliveredto:username1

Label, folder, and type

Operator	Description and usage
label:	Find or exclude messages with a given Gmail label. This operator isn't supported for messages in Google Groups. If the label includes spaces, substitute a hyphen (-) for each space. Add a slash (/) to search for a nested label. The wildcard (*) isn't supported when you search for labels. Examples: Find messages with a nested label label:purchase-orders/approved Find messages removed from Trash but not yet purged. label:^deleted Find messages removed from account mailboxes because a retention rule expired. label:^vault_deletion Exclude quarantined messages. -label:^admin_quarantine Find messages sent with Gmail confidential mode. label:confidentialmode Find messages waiting to be sent on a schedule  label:^scheduled Find messages that were sent on a schedule  label:^f_sd Exclude old versions of draft messages. -label:^r_ad Note: If you search for a system-generated label, Vault may return an excessive number of messages.
in:	Find messages in a given folder. Examples: in:inbox in:spam in:trash
is:	Find messages by type or status. Options: Find Gmail messages by status. is:read is:sent is:starred is:unread

Date or size

Operator	Description and usage
sent_before: sent_after: received_before: received_after:	Find messages by when they were sent or received. Enter dates with the format YYYY-MM-DD. Matches are inclusive of the specified date. For example, sent_before:2019-12-16 matches messages sent December 16, 2019 or earlier. Example: sent_after:2017-12-16
older_than: newer_than:	Find messages older or newer than a given period of time. Supported units of time include d (day), m (month), and y (year). Example: newer_than:1m
size:	Find messages by size in bytes, including any attachments. You can use :, <, >, =, <=, and >= with this operator. Example: size>=1000000
smaller: larger:	Find messages smaller or larger than a given size in kilobytes or megabytes, including any attachments. Use K for kilobytes and M for megabytes. Example: larger:10M

Attachment properties

Operator	Description and usage
has:attachment	Find messages with at least one attachment. has:attachment
filename:	Find messages that include an attachment with the given file name. The search term is case insensitive and supports partial matches and wildcards. Example: filename:secret-plans.pdf
filename_exact:	Find messages that include attachments with the exact file name. This search term is case sensitive. Example: filename_exact:sEcReT-PlAnS.PdF

Drive search operators

Available search operators:

• General search operators
• Search by account (owner and sharing)
• Search by item properties

General search operators

Operator	Description and usage
no operator	For supported file types, find items that contain the given keywords or phrases. To search for a phrase, put the words in double quotes ("). Case insensitive. Example: alert "Solarmora, Inc."
AND	Find items that include 2 given search terms. Examples: secret AND project owner:username1 AND to:username2
OR	Find items that include either of 2 given search terms (or both). Examples: secret OR confidential type:(spreadsheet OR pdf)
NOT	Find items that do not include a given search term. Examples: NOT personal username1 NOT type:image

Account

Note: Enter the account as the complete email address, such as [e-mail] or [e-mail].

Operator	Description and usage
owner:	Matches Files owned by the specified account. If shared drives are included in the search, files created by the specified account. Doesn't match Files previously owned by the specified account that transferred ownership to another account. Example owner:[e-mail] matches files owned by user1. Doesn’t match files previously owned by user1 that are now owned by a different account.
sharedwith:	Matches All files the specified account has permission to view, comment, or edit. Files the account owns. If the specified account has permission through a group membership: If the group has less than 200 members, files shared with that group match the query. If the group has 200 or more members, only files the account opened match the query. Files in folders where the folder was shared with the specified account, even if the file wasn’t shared directly. Doesn't match Files in shared drives that the specified account is a member of, but that weren’t directly shared with the specified account. Files shared with a group before or after the specified account was a member. Example sharedwith:[e-mail] matches files that were shared with user1 either directly or through a small group that user1 belongs to.
from:	Matches Files shared by the specified account with the accounts in the scope of the search. Non-matches Files shared prior to March 2021 Files shared by link (“anyone with the link can”). Example from:[e-mail] matches files that were shared by user1.
to:	Matches Files shared by the accounts in the scope of the search directly with the specified account. If the specified account has permission through a group membership, matches the following files: Files shared with the group (if the group has less than 200 members) Files shared with the group that the account opened (if the group has 200 or more members) Note: Only files shared with the group while the account was a member are included. Non-matches Files shared prior to March 2021 Files in folders where the folder was shared with the specified account but the file wasn’t shared directly. Files in shared drives that the specified account is a member of, but the files weren’t shared with the specified account directly. Files shared with a group before or after the specified account was a member. Files owned by the specified account. Example to:[e-mail] matches files that were directly shared with [e-mail]. Files that [e-mail] has indirect access to through a shared drive don’t match.

Item properties

Operator	Description and usage
is:	Find items marked with a star. is:starred
in:	Find or exclude items moved to trash. in:trash -in:trash
type:	Find items by type. Example: type:presentation Supported item types: textdoc (Google Docs) spreadsheet (Google Sheets) presentation (Google Slides) drawing (Google Drawings) form (Google Forms) jam (Jamboard files) site (new Google Sites) document (all Google file types and PDFs) pdf image video
before: after:	Find items by when they were edited. Enter dates with the format YYYY-MM-DD. Matches are exclusive of the specified date. For example, before:2019-12-16 matches items edited December 15, 2019 or earlier. Example: before:2017-12-31
title:	Find items by title. Example: title:"secret product launch plans"

Google Chat search operators

Available search operators:

• General search operators
• Search by account
• Search by date
• Search by message and Chat space properties (such as direct message (DM) or message in a space, threaded or unthreaded space, or included content, such as video or file links)

Note: Chat doesn't support Boolean operators or terms that are enclosed in quotes.

General search operators

Operator	Description and usage
+	Find messages that contain one or more keywords. Search matches each keyword exactly, such that a search for +tax doesn't return messages that contain "taxes". Example: +secret +project
-	Exclude messages that contain one or more keywords. Search matches each keyword exactly, such that a search for -finance still returns messages that contain "finances". Example: -personal

Account

Operator	Description and usage
from:	Find direct messages sent by a user and conversations the user participated in. This operator requires the full account name, including your organization's domain. Example: from:[e-mail]
at:	Find conversations that mention a given user. This operator requires the full account name, including your organization's domain. Example: at:[e-mail]

Date

Operator	Description and usage
before: after:	Find messages based on when they were sent or updated. Enter dates with the format YYYY/MM/DD. Search uses UTC by default. Use the tz: operator to specify a time zone. Matches are inclusive of the specified date. For example, before:2019/12/16 matches messages sent December 16, 2019 or earlier. Examples: after:2018/11/21 before:2019/03/16 tz:GMT-08:00
older_than: newer_than:	Find messages older or newer than a given period of time. Supported units of time include d (day), m (month), and y (year). Search uses UTC by default. Use the tz: operator to specify a time zone. Example: older_than:1y
tz:	Specify a time zone for date- and time-based searches. Specify the time zone with GMT+ or GMT- and the offset from UTC. Example: older_than:1y tz:GMT-05:30

Message and Chat space properties

Operator	Description and usage
has:	Find messages that include a specific type of content. Example: has:video Supported content types: file doc sheet slide url video pdf image
is:	Search for only DMs or only messages in spaces. You can also search for messages in a specific type of space. Options: is:dm (for DMs) is:room (for messages in spaces) is:threadedroom (for messages in threaded spaces) is:flatroom (for messages in unthreaded spaces)

Google Voice search operators

Available search operators:

• General search operators
• Search by phone number or date
• Search by data type or attachment

General search operators

Operator	Description and usage
message:	Find text messages that include a keyword. If you enter a word with no search operator, Vault assumes message:. Examples: message:alert alert
AND	Find text messages, voicemails, and call logs that match two search terms. If you enter multiple search terms, Vault assumes AND between them. Examples: secret AND project (equivalent to secret project) before:2020-01-31 AND with:[phone]
OR	Find text messages, voicemails, and call logs that match either of 2 search terms. Examples: secret OR confidential with:([phone] OR [phone])
NOT	Find text messages, voicemails, and call logs that do not include a search term. Examples: NOT personal with:[phone] NOT with:[phone]

Phone number or date

Operator	Description and usage
with:	Find text messages and call log events that involve a phone number, and voicemails from a phone number. When you search by phone number, your entry must include: the plus sign (+) a country code the full number and area code Example: with:[phone]
before: after:	Find text messages, voicemails and their transcripts, and call log events that occurred before or after a date. Search is relative to 11:59 PM UTC-7 on the day the text message was sent, the voicemail was created, or the call was made or received. Matches are exclusive of the specified date. For example, before:2019-12-16 matches messages sent December 15, 2019 or earlier. To run an inclusive search, enter values for the Date sent fields instead of entering these search operators in Terms. Examples: before:2020-01-31

Data type or attachment

Operator	Description and usage
is:	Find a specific type of data from Google Voice. You can search for the following types: text_message—Text messages voicemail—Voicemail transcripts received_call—Call log events for answered incoming calls placed_call—Call log events for calls made missed_call—Call log events for unanswered incoming calls Examples: is:text_message after:2020-01-01 with:[phone] is:voicemail with:[phone]
has:attachment	Find text messages that have an attachment. Examples: has:attachment with:[phone] AND has:attachment

Troubleshoot query issues

If your search terms return an error or don’t work as expected, the most common reason is a syntax error. Occasionally, a query might be too complex for the service to process.

Common syntax errors

• Missing operator value, such as to:  instead of to:username1
• Missing parentheses, such as

  from:(username1 OR username2

  instead of

  from:(username1 OR username2)

• Missing quotes (Gmail and Drive), such as Solarmora, Inc. (treated as 2 keywords) instead of “Solarmora, Inc.” (treated as 1 keyphrase)
• Wildcard (*) in a query for a service other than Gmail. Only Gmail supports wildcards.

Term complexity guidelines

To ensure your terms are correctly processed, they should meet the following guidelines:

• Use less than 20 OR terms. If your query includes a date operator (such as sent_before:), use less than 10 OR terms.
• Use no more than 2 AROUND operators in a query.
• Set the AROUND distance to less than 20.
• Consider splitting long queries into smaller equivalent queries. For example, (tax AND audit) OR (secret AND project) can be run as 2 separate queries:
  1. (tax AND audit)
  2. (secret AND project)