Use Vault to search Google Chat

To search your Google Chat messages in Chat, go here instead.

Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin needs to set up your account. Who is my administrator?

As part of your Google Workspace data eDiscovery projects, you can use Vault to search Google Chat messages, review message contents and participants, download attachments, and create an export of your search results. To search classic Hangouts messages, search in Gmail.

Things to know before you search

Before you search for messages, we recommend you review the Chat messages supported in Vault and the Vault Search FAQ.

Open all  |  Close all

Search for Chat messages by specific accounts, an organizational unit, or specific spaces and group chats

Account-based search: Search for messages sent or received by specific accounts or all accounts in an organizational unit. By default, only direct messages (DMs) and group messages (in group conversations created before early December 2020) are searched. Optionally, you can include messages in Chat spaces, which include group chats created after early December 2020 and spaces. The type of space determines what messages are returned. Learn more

Chat spaces-based search: Search for messages in group chats that were created after early December 2020 and spaces. You can’t search across all spaces. To select spaces and group chats, you enter the account of a member of the space. Learn more about the differences between group messages and spaces.

Use search terms and operators to filter your results

You can filter your search by sent date, time zone, and other terms such as keywords, attachment type, and space type. Learn more about Chat search operators.

The way Vault matches search terms depends on the message type and location:

  • DMs, group chats, and messages in unthreaded spaces—search terms are matched to individual messages. Only messages that match all search terms are returned.
  • Threaded spaces—search terms are matched to conversations (across messages). All messages in a conversation are returned if all search terms are matched by messages in the conversation. No single message must match all search terms.

For details, review the examples.

Some files attached to messages can't be searched or exported

Files shared with links aren't searched or exported—When someone shares a file stored in Drive in a message, Chat inserts a link rather than attaching a copy of the file to the message. You can search by the URL of the file, but Vault doesn't index the title or content of the file. These link-based attachments aren't included when you search or export Chat messages.

Files directly attached to messages are searched and exported—For files that are directly attached to a Chat message, Vault indexes the filename for search. Vault also indexes the content of most text-based file types (for example, files with .pdf, .xlsx, and .docx extensions). These file attachments are included when you search and export Chat messages, and they're covered by Chat retention rules and holds.

You can preview a maximum of 1000 messages per conversation or unthreaded space

Vault can export all messages that match your search, but you can preview only up to 1000 messages per conversation or unthreaded space.

Chat space properties control how Vault searches for messages associated with specific accounts or organizational units

When you search by accounts or organizational unit and include results from spaces, the messages Vault returns depend on the type of space:

  • Threaded spaces—Vault returns conversations in threaded spaces only if the searched participant or any account in the organizational unit sent at least one message. Conversations where a searched account may have viewed messages but didn't respond aren't included in search results.
  • Group chats created after early December 2020 and unthreaded spaces—Vault searches all unthreaded spaces and group chats the searched account or any account in the organizational unit is a member of, even if they didn’t send any messages. If the account is no longer a member of a space, Vault searches only the messages sent before they left.
  • Spaces owned by another organization—You can't search for messages sent by users in your organization in spaces owned by another organization.
  • External user messages in your spaces—You can search for and export messages sent by external users in spaces created by someone in your organization.
For held data searches, the type of space controls which messages are searched

You can restrict your search to held data, which is messages associated with a user account that's on hold. When you search held data, the messages Vault returns from spaces depends on the type of space:

  • Threaded spaces—Vault returns a conversation in threaded spaces only if a user on hold who matches your search parameters sent at least one message in the space.
  • Group chats created after early December 2020 and unthreaded spaces—Vault returns messages from a space if a user on hold who matches your search parameters was a member, even if they didn’t send any messages in the space. If all users on hold leave a space or group chat, a search for held messages returns only messages in the space or group chat that were sent before the last user on hold left.
Retention rules and holds don’t affect account-based Chat search results

When participants in a DM or group chat are subject to different retention rules or holds, some participants might be able to review the message history while others can’t. However, Vault searches all available messages (unless you restrict the search to only held data).

For example, participant 1 is in an organizational unit subject to a retention rule that purges DMs after 7 days and they chat with participant 2 who’s in an organizational unit subject to an indefinite retention rule for DMs. Seven days after participant 1 sends or receives a DM with participant 2, participant 1 loses access to the DM. But, because participant 2’s DMs are retained indefinitely, the DMs aren’t purged and participant 2 still has access to them.

Vault search isn’t affected by which account can still open the message, it only knows that the message is still available for search. Thus, you get the same messages returned when you search for messages by participant 1’s organizational unit as when you search by participant 2’s organizational unit.

Chat search includes most group conversations from classic Hangouts

As of early December 2020, if your organization still has classic Hangouts turned on, most messages in group conversations in classic Hangouts are synchronized to Chat. However, messages deleted by users but retained by Vault don't sync to Chat. To make sure your search returns all matching messages available to Vault, search in Gmail.

Chat search examples

How search terms apply to messages in Chat spaces

For example, you have a space that contains the following exchange:

    participant 1: hi

    participant 2: hello

 

If you use search terms, search, preview, and export process the messages as follows:

Search term Threaded spaces Unthreaded spaces and group chats created after early December 2020
hi All messages in the conversation are returned by search, available for preview (up to 1000 messages), and exported.

Search: Only the message from participant 1 is returned because only that message matches the search term.

Preview and export: Participant 1's message plus all messages in the space that were sent 12 hours before and 12 hours after are included.

hello All messages in the conversation are returned by search, available for preview (up to 1000 messages), and exported.

Search: Only the message from participant 2 is returned because only that message matches the search term.

Preview and export: Participant 2's message plus all messages in the space that were sent 12 hours before and 12 hours after are included.

hi hello All messages in the conversation are returned by search, available for preview (up to 1000 messages), and exported.

No messages are returned or exported because no individual message contains both search terms.

hi from:participant1@example.com All messages in the conversation are returned by search, available for preview (up to 1000 messages), and exported.

Search: Only the message from participant 1 is returned because only that message matches both search terms.

Preview and export: Participant 1's message plus all messages in the space that were sent 12 hours before and 12 hours after are included.

hi from:participant2@example.com All messages in the conversation are returned by search, available for preview (up to 1000 messages), and exported. No messages are returned or exported because no individual message matches both search terms.
‑hi from:participant1@example.com No messages from the sample conversation are returned or exported because the conversation doesn't match both search terms. No messages from the sample conversation are returned or exported because no individual message matches both search terms.
‑hi from:participant2@example.com No messages from the sample conversation are returned or exported because the conversation doesn't match both search terms.

Search: Only the message from participant 2 is returned because only that message matches the search term.

Preview and export: Participant 2's message plus all messages in the space that were sent 12 hours before and 12 hours after are included.

Search for Chat messages

  1. Sign in to vault.google.com.
  2. Click Matters. You search for data in matters, which are workspaces for your Vault projects. Matters let you group related holds, searches, and exports together. Matters don't restrict what data you can search—all data that you are allowed to access is searchable from any matter.
  3. If the matter you want to run the search query in exists, click it to open it. Otherwise, create a matter:
    1. Click Create.
    2. Enter a name for the matter and, optionally, a description.
    3. Click Create.

    The Search tab automatically opens.

  4. For the service, select Chat.
  5. Select the source data to search:
    • All data—Search all messages in your organization.
    • Held data—Search only messages on hold for the matter.
  6. Select the entity to search:
    • Specific accounts—Enter up to 5,000 account email addresses.
    • Organizational unit—Search all accounts in a specific organizational unit. In the dialog that opens, select an organizational unit.

      If you choose an organizational unit with child organizational units, accounts in the child organizational units are also searched.

    • Chat spaces—Search one or more spaces:
      1. In the dialog that opens, enter one or more email addresses of members of the spaces you want to search.
      2. Click Find.
      3. In the list of spaces, select the spaces you want to search and click Add.
  7. (Optional) If you search accounts or an organizational unit, to include messages in spaces, click Include messages in Chat spaces "". Vault searches a space only when a searched account is a member of the space.
  8. (Optional) Select a time zone.
  9. (Optional) Enter a range for Date sent.

    Note: If you enter dates, Vault returns all conversations that have messages in that date range and match your query terms. The results might also include messages that match query terms but occur outside of your date range.

    • If you enter a start date, Vault returns all messages sent on or after that date.
    • If you enter an end date, Vault returns all messages sent on or before that date.
  10. (Optional) In Terms, enter one or more search terms:

    Search terms can't exceed 2,000 characters.

    • To search for one or more keywords in the message, enter words preceded by a plus (+) and separated by spaces. For example, +project +goals.
    • To search for a phrase, put the words in quotes and precede with a plus (+). For example, +"project goals".
    • To search only direct messages, enter is:dm. To search only messages in spaces, enter is:space.
    • To search by account, date, or message properties use search operators.
  11. Click one of the following:
    • Search—Run your search and return a list of messages that match your query.
    • Export—Directly export the search results and skip the search results preview. Learn more about exports
  12. After your search or export completes, you can take the following actions:
    • To edit your search, click Expand.
    • To open a preview of a message and its conversation, click the message.
    • To create an export of your search results, click Export. Learn more
    • To save your query, click Save. Learn more
    • To clear all fields and start a new search, click Clear.

Preview messages in search results

After you run a search, you can review the messages that matched your query, review the participants, and download attachments.

To preview a message, in the search results list, click the message. A list of messages opens.

  • Messages with a "" have one or more attachments. To download an attachment, click Download.
  • For DMs and group chats created before early December 2020, preview and export include messages sent on the same day as the matched message, starting at 12:00:00 AM.
  • For threaded spaces, the entire conversation that a message was part of is available in preview, but Vault exports only the messages that match your search.
  • For unthreaded spaces and group chats created after early December 2020, messages sent 12 hours before and 12 hours after the matched message are included in your preview and export.
  • For long conversations, only the most recent 1000 messages are available in preview. However, an export of the search results includes all messages that match your query or are provided for context, including messages not in preview.
Was this helpful?
How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
96539
false