Filter devices in the admin console

Devices in the Machines page of the admin console can be filtered to more easily find devices meeting certain criteria.

Filters are supported for the following criteria:

• Property: Whether a device is an ephemeral node, an exit node, a subnet router, has Tailscale SSH enabled, or has key expiry disabled.

• Disabled: Whether a device has an expired key, needs approval, or is managed by a suspended user.

• Last seen: Whether a device is connected, not connected, last seen before a specified unit, or seen in the last specified unit. For last seen before and seen in the last, the unit can be minutes, hours, days, weeks, or years.

• Managed by: Whether a device is managed by a specified user or has a specified tag.

• Shared: Whether a device is shared with your tailnet, shared by your tailnet, or not shared at all.

• Version: Whether a device's Tailscale client is a specified version, newer than a specified version, older than a specified version, or has a regular or security update available.

Additionally, the Machines page search bar supports free form search for machine name, host name, Tailscale IP address, the managed by and created by user, operating system, and Tailscale client version, along with text-based equivalents for the filter criteria listed above.

Filter URL queries

When you use a filter, the active URL for the Machines page contains a query string. The string represents the filter parameters.

For example, opening the Machines page without applying any filters make this the active URL:

• https://login.tailscale.com/admin/machines

Adding a Managed by filter to find machines managed by either Alice or Bob adds a query string to the active URL:

• https://login.tailscale.com/admin/machines?q=managedby%3Aalice%40example.com%2Cbob%40example.com

You can save your filters by copying the active URL.

For a list of the text strings that can appear in a filter URL, see Text filters.

Filter AND and OR logic

Multiple filters are treated as an intersection. For example, applying a filter to find ephemeral nodes and a filter to find machines seen in the last 5 days will return the set of machines that are ephemeral nodes AND were last seen in the last 5 days (property:ephemeral-node lastseen:<5d).

A filter that supports multiple values is treated as a union. For example, applying a Managed by filter to find machines managed by Alice, Bob, or the tag builder will return the set of machines that are managed by Alice OR Bob OR the tag builder (managedby:alice@example.com,bob@example.com,builder).

As another example, the following filter combination returns the set of machines that are managed by Alice OR Bob, AND have been seen with the last 5 days:

• managedby:alice@example.com,bob@example.com lastseen:<5d

Using a filter

Filter devices in the Machines page of the admin console by creating a query using the UI filters, the search bar, or both. You can also use multiple filters on the same query.

Filter by Property

1. In the Machines page of the admin console, select Filters and select Property.

2. Select one or more properties for your filter:

   • Ephemeral node: Matches devices that are ephemeral nodes.
   • Exit node: Matches devices that are exit nodes.
   • Subnet: Matches devices that are subnet routers.
   • Tailscale SSH: Matches devices that have Tailscale SSH enabled.
   • Tailscale Funnel: Matches devices that are running a Tailscale Funnel server.
   • Expiry disabled: Matches devices that have key expiry disabled.
   • Signing node: Matches devices that can sign new nodes to approve their access to the tailnet.

You cannot multiselect criteria within the Property filter.

Filter by Disabled

1. In the Machines page of the admin console, select Filters and select Disabled.

2. Select the disabled states for your filter:

   • Expired: Matches devices that have an expired key.
   • Locked out: Matches devices that need to be signed in a tailnet that has tailnet lock enabled.
   • Needs approval: Matches devices that need approval.
   • User needs approval: Matches devices that are managed by a user that needs approval.
   • User suspended: Matches devices that are managed by a suspended user.

You cannot multiselect criteria within the Disabled filter.

Filter by Last seen

1. In the Machines page of the admin console, select Filters and select Last seen.

2. Select one of the connected state or last seen criteria for your filter:

   • Currently connected: Matches devices that are currently connected to your tailnet.
   • Not connected: Matches devices that are currently not connected to your tailnet.
   • Before the last: Matches devices that were last seen before the specified number of units. Available units are m, h, d, w, or y, for minutes, hours, days, weeks, or years, respectively. For example, 5d.
   • In the last: Matches devices that were seen in the last specified number of units. Available units are m, h, d, w, or y, for minutes, hours, days, weeks, or years, respectively. For example, 3h.

You cannot multiselect criteria within the Last seen filter.

Filter by Shared

1. In the Machines page of the admin console, select Filters and select Shared.

2. Select one of the sharing states for your filter:

   • Not shared: Matches devices in your tailnet that are not shared.
   • Shared with your tailnet: Matches devices shared by others that have been shared to your tailnet.
   • Shared by your tailnet: Matches devices in your tailnet that are shared to users of other tailnets. Note that if you sent invitations to share a device but no one accepted the invitation, the device is not yet considered shared.

You cannot multiselect criteria within the Shared filter.

Filter by Managed by

1. In the Machines page of the admin console, select Filters and select Managed by.
2. Select the users and/or tags for your filter. This filter matches devices that are managed by any of the selected users and tags.

You can multiselect criteria within the Managed by filter.

Filter by Version

1. In the Machines page of the admin console, select Filters and select Version.

2. Select the Tailscale client version criteria for your filter:

   • Is: Matches devices that have the specified version, including any patch versions. For example, a value of 1.32 matches 1.32 and 1.32.2.
   • Newer than: Matches devices that have a version later than the specified version.
   • Older than: Matches devices that have a version older than the specified version.
   • Update available: Matches devices that have an update available.
   • Security update available: Matches devices that have a security update available.

You cannot multiselect criteria within the Version filter.

Filter with the search bar

1. In the Machines page of the admin console, select inside the search bar.

2. Type in a text string and press Enter. The search text is not case-sensitive.

   The search returns the list of devices that contain the search text in at least one of the following fields:

   • Machine name
   • Host name
   • Tailscale IP address
   • Creator (the user that added the machine to the tailnet and manages the machine)
   • Operating system
   • Tailscale client version

The search text is not an exact string match—if a device contains the search text in one or more of the fields listed above, it is included in the search results. For example, using 1.10 in the search bar will match machines that contain 1.10 in the version number (such as 1.10.2), and it will also match devices that have 1.10 in any of the other fields listed above. Similarly, using Bob in the search bar will match devices that contain bob (not case-sensitive) in any of the fields listed above.

You cannot combine multiple freeform text search filters at the same time. For example, searching with freeform text "1.32.2 alice" won't return any results even if you have machines running Tailscale v1.32.2 that are managed by Alice. However, you can apply text filters to create a search string like "version:=1.32.2 managedby:alice" to find those machines.

Text filters

The following table shows the URL query strings that result from using the filters in the Machines page of the admin console. You can also enter these text strings directly into the search bar.

Filter term	Description
property:ephemeral-node	Matches devices that are ephemeral nodes.
property:exit-node	Matches devices that are exit nodes.
property:expiry-disabled	Matches devices that have key expiry disabled.
property:signing-node	Matches devices that can sign new nodes to approve their access to the tailnet.
property:subnet	Matches devices that are subnet routers.
property:tailscale-funnel	Matches devices that are running a Tailscale Funnel server.
property:tailscale-ssh	Matches devices that have Tailscale SSH enabled.
disabled:expired	Matches devices that have an expired key.
disabled:needs-approval	Matches devices that need approval.
disabled:user-suspended	Matches devices that are managed by a suspended user.
lastseen:<value	Matches devices that were last seen before the specified number of units. Available units are m, h, d, w, or y, for minutes, hours, days, weeks, or years, respectively. For example, 5d.
lastseen:>value	Matches devices that were seen in the last specified number of units. Available units are m, h, d, w, or y, for minutes, hours, days, weeks, or years, respectively. For example, 3h.
lastseen:connected	Matches devices that are currently connected to your tailnet.
lastseen:not-connected	Matches devices that are currently not connected to your tailnet.
managedby:value[,]	Matches devices managed by a specified user or having a specified tag. List multiple values in a comma-separated string.
shared:in	Matches devices shared by others that have been shared to your tailnet.
shared:not-shared	Matches devices in your tailnet that are not shared.
shared:out	Matches devices in your tailnet that are shared to users of other tailnets. Note that if you sent invitations to share a device but no one accepted the invitation, the device is not yet considered shared.
version:<value	Matches devices that have a version older than the specified version.
version:=value	Matches devices that have the specified version, including any patch versions. For example, a value of 1.32 matches 1.32 and 1.32.2.
version:>value	Matches devices that have a version later than the specified version.
version:update-available	Matches devices that have an update available.
version:security-update-available	Matches devices that have a security update available.

Removing a filter

To remove an individual filter, below the search bar, select the x for the filter that you want to remove.

To remove all filters, within the search bar, select the x.