Abstract: In some aspects, search functionality is provided in an observability pipeline system. In some implementations, a search query is received at a computer node from a leader role of an observability pipeline system. The search query represents a request to search event data at the computer node and includes a first search operator that specifies a system state context criterion and a second search operator that specifies an event criterion. An observability pipeline process is configured according to the search query. Search results are generated based on applying the observability pipeline process at the computer node. A current system state of the computer node that matches the system state context criterion specified by the first search operator is determined; and a subset of event data on the computer node that matches the event criterion specified by the second search operator is identified. The search results including the subset of event data are sent to the leader role.