Use Vault to search Google Chat

To search your Google Chat messages in Chat, go here instead.

Google Vault is for administrators and legal personnel. Before you can use Vault, your Google Workspace admin must set up your account. Who is my administrator?

As part of your Google Workspace data eDiscovery projects, you can use Vault to search Google Chat messages, review message contents and participants, download attachments, and create an export of your search results. 

In this article: 

• Things to know before you search
• Chat search examples
• Search for chat messages
• Preview messages in search results

Things to know before you search

Before you search for messages, we recommend you review the Chat messages supported in Vault and the Vault Search FAQ.

Expand all  |  Collapse all

What data can be searched and exported

Searched and exported:

• Messages and their attachments sent with history on
• Text-based attachment content
• Attachment metadata
• Direct messages sent by external users to your users
• Messages sent by external users in your organization’s group messages and spaces

Not searched or exported:

• Messages sent with history off
• Linked files
• Messages in external Chat spaces
• Previewed messages

For details, see Supported services and data types and the following sections.

Search for Chat messages by specific accounts, an organizational unit, or specific spaces and group conversations

Account-based search—Search for messages sent or received by specific accounts or all accounts in an organizational unit. By default, only direct messages and group messages in group conversations created before early December 2020 are searched. Optionally, you can include messages in Chat spaces the accounts were members of. Learn more

Chat spaces-based search—Search for messages in group conversations that were created after early December 2020 and spaces. You can’t search across all spaces. To select spaces and group conversations, you enter the account of a member of the space. Learn more about the differences between group messages and spaces.

Use search terms to filter your results

You can filter your search by sent date, time zone, and other terms such as keywords, attachment type, and room type. Learn more about Chat search operators.

Vault matches the search conditions to each message. Only messages that match all search conditions are returned. For details, review the examples.

Some files associated with messages can't be searched or exported

Files shared with links aren't searched or exported—When someone shares a file stored in Drive in a message, Chat inserts a link rather than attaching a copy of the file to the message. You can search by the URL of the file, but Vault doesn't index the title or content of the file. The files aren't included when you search or export Chat messages.

Files attached to messages are searched and exported—For files that are attached to a Chat message, Vault indexes the filename for search. Vault also indexes the content of most text-based file types (for example, files with .pdf, .xlsx, and .docx extensions). These files are included when you search and export Chat messages, and they're covered by Chat retention rules and holds.

Preview a maximum of 1500 messages

You can preview up to 1500 messages in your search results, including the messages provided for context. For details about the contextual messages, on this page see Preview messages in search results.

Vault searches chat spaces based on membership

For account-based searches, Vault searches the Chat spaces that the searched account, or any account in the organizational unit, is a member of. If the account is no longer a member of a Chat space, Vault searches only the messages sent before they left.

External Chat spaces and users—You can't search for messages sent by users in your organization in Chat spaces owned by another organization.

You can search for messages sent by external users in Chat spaces created by someone in your organization.

Held data—You can restrict your search to held data, which is messages associated with a user account that's on hold. In this case, Vault searches messages if a user on hold who matches your search parameters was a member. If all users on hold leave Chat space, a search for held messages returns only messages that were sent before the last user on hold left.

Vault can search Chat messages not visible to some users

When participants in a direct message or group chat are subject to different retention rules or holds, some participants might be able to review the message history while others can’t. 

For example, participant 1 is in an organizational unit subject to a retention rule that purges direct messages after 7 days. Participant 1 chats with participant 2, who’s in an organizational unit subject to an indefinite retention rule for direct messages. Seven days after participant 1 sends or receives a direct message with participant 2, participant 1 loses access to the direct message. But, because participant 2’s direct messages are retained indefinitely, the direct messages aren’t purged and participant 2 still has access to them.

A Vault search specifying participant 1 will not return messages beyond their 7-day retention rule and the standard 30-day retention period set by Chat. A Vault search specifying participant 2 returns all messages not yet purged.

Chat spaces in migration mode

Chat spaces that are in migration mode won't appear in search results. Once a space completes migration, it appears in results like regular spaces. 

Chat search examples

How search terms apply to messages in Chat spaces

For example, you have a space that contains the following exchange:

    Participant 1: hi

    Participant 2: hello

 

If you use search terms, search, preview, and export process the messages as follows:

Search term	Chat space search, preview, and export behavior
hi	Search: Only the message from Participant 1 is returned because only that message matches the search term. Preview and export: Includes Participant 1's message and all messages in the space or thread (for threaded rooms) that were sent 12 hours before and 12 hours after.
hello	Search: Only the message from Participant 2 is returned because only that message matches the search term. Preview and export: Includes Participant 2's message and all messages in the space or thread (for threaded rooms) that were sent 12 hours before and 12 hours after.
hi hello	No messages are returned or exported because no individual message contains both search terms.
hi from:[e-mail]	Search: Only the message from Participant 1 is returned because only that message matches both search terms. Preview and export: Includes Participant 1's message and all messages in the space or thread (for threaded rooms) that were sent 12 hours before and 12 hours after.
hi from:[e-mail]	No messages are returned or exported because no individual message matches both search terms.
‑hi from:[e-mail]	No messages from the sample conversation are returned or exported because no individual message matches both search terms.
‑hi from:[e-mail]	Search: Only the message from Participant 2 is returned because only that message matches the search term. Preview and export: Includes Participant 2's message plus all messages in the space that were sent 12 hours before and 12 hours after.

Search for Chat messages

1. Sign in to vault.google.com.
2. Click Matters. You search for data in matters, which are workspaces for your Vault projects. Matters let you group related holds, searches, and exports together. Matters don't restrict what data you can search—all data that you are allowed to access is searchable from any matter.
3. If the matter you want to run the search query in exists, click it to open it. Otherwise, create a matter:
   1. Click Create.
   2. Enter a name for the matter and, optionally, a description.
   3. Click Create.

   The Search tab automatically opens.

4. For the service, select Chat.
5. Select the source data to search:
   • All data—Search all messages in your organization.
   • Held data—Search only messages on hold for the matter.
6. Select the entity to search:
   • Specific accounts—Enter up to 5,000 account email addresses.
   • Organizational unit—Search accounts in a specific child organizational unit.

   • You can't search the top-level organizational unit (your entire organization). Selecting this unit won't return any results. 
   • If the organizational unit has child organizational units, accounts in the child organizational units are also searched.
   • If you have a large organizational structure, selecting a parent organizational unit might not show any results. Instead, you must select a specific child organizational unit. 
   • Each organizational unit must have fewer that 5,000 members. 

• Chat spaces—Search one or more spaces:
  1. In the dialog that opens, enter one or more email addresses of members of the spaces you want to search.
  2. Click Find.
  3. In the list of spaces, select the spaces you want to search and click Add.

1. (Optional) If you search accounts or an organizational unit, to include messages in spaces, click Include messages in Chat spaces . Vault searches a space only when a searched account is a member of the space.
2. (Optional) Select a time zone.
3. (Optional) Enter a range for Date sent.

   Note: If you enter dates, Vault returns all conversations that have messages in that date range and match your query terms. The results might also include messages that match query terms but occur outside of your date range.

   • If you enter a start date, Vault returns all messages sent on or after that date.
   • If you enter an end date, Vault returns all messages sent on or before that date.
4. (Optional) In Terms, enter one or more search terms:

   Search terms can't exceed 2,000 characters.

   • To search for one or more keywords in the message, enter words preceded by a plus (+) and separated by spaces. For example, +project +goals.
   • To search for a phrase, put the words in quotes and precede with a plus (+). For example, +"project goals".
   • To search only direct messages, enter is:dm. To search only messages in spaces, enter is:room.
   • To search by account, date, or message properties use search operators.
5. Click one of the following:
   • Search—Run your search and return a list of messages that match your query.
   • Export—Directly export the search results and skip the search results preview. Learn more about exports
6. After your search or export completes, you can take the following actions:
   • To edit your search, click Expand.
   • To open a preview of a message and its conversation, click the message.
   • To create an export of your search results, click Export. Learn more
   • To save your query, click Save. Learn more
   • To clear all fields and start a new search, click Clear.

Preview messages in search results

After you run a search, you can review the messages that matched your query, review the participants, and download attachments.

To preview a message, in the search results list, click the message. A list of messages opens.

To provide context for matching messages in DMs, group chats, and spaces with in-line threading, Vault includes messages from the same conversation as follows:

• Messages sent 12 hours before and 12 hours after the matched message.
• If the matched message is an in-line reply in a space, the time window is calculated from the main message (the message the matched message was in reply to). All main messages within that window are included for context, plus all in-line replies to those main messages.

For long conversations, only the first 1500 messages (up to 900 MB, starting from 12 hours before) are available in preview. However, an export of the search results includes all messages that match your query or are provided for context, including messages not in preview.

Messages with a  have one or more attachments. To download an attachment, preview the message and click Download.