Query documentation

Operators

• All terms are separated by a blank space
• The default operators between terms is OR unless prefixed by + (AND) or - (NOT)
• Parenthesis (()) can be used to group terms together

Operator	Description	Example
"	Used for precise match of multiple words	"leaving twitter"
+	A condition prefixed with + is required to match	+username:bloodyshell
-	A condition prefixed with - must not match	+username:bloodyshell -server:mastodon.social
:	: is a field delimiter, the name being on the left and the value on the right	server:tea.codes
>	A field suffixed with :> must be greater to match	+account.followers_count:>1024
<	A field suffixed with :< must be lower to match	+created_at:<2022-06-01
()	Used to group terms	+(server:infosec.exchange server:mastodon.social) +username:bloodyshell

Fields

All the fields from Mastodon are populated, check the Mastodon status documentation for a full list, the following is not exhaustive.

Field	Description	Example
created_at	Time at which the event was indexed	created_at:>2020-06-01
server	Source server	server:mastodon.social
tag	Search by hashtag	tag:linux
username	Username accross servers	username:leakix
media_attachments.type	Find post attaching medias	media_attachments.type:video
account.followers_count	Filter by follower count	account.followers_count:>50