Filter devices in the admin console

Devices in the Machines page of the admin console can be filtered to more easily find devices meeting certain criteria.

Filters are supported for the following criteria:

  • Property: Whether a device is an ephemeral node, an exit node, a subnet router, has Tailscale SSH enabled, or has key expiry disabled.

  • Disabled: Whether a device has an expired key, needs approval, or is managed by a suspended user.

  • Last seen: Whether a device is connected, not connected, last seen before a specified unit, or seen in the last specified unit. For last seen before and seen in the last, the unit can be minutes, hours, days, weeks, or years.

  • Managed by: Whether a device is managed by a specified user or has a specified tag.

  • Shared: Whether a device is shared with your tailnet, shared by your tailnet, or not shared at all.

  • Version: Whether a device’s Tailscale client is a specified version, newer than a specified version, older than a specified version, or has a regular or security update available.

Additionally, the Machines page search bar supports free form search for machine name, host name, Tailscale IP address, the managed by and created by user, operating system, and Tailscale client version, along with text-based equivalents for the filter criteria listed above.

Filter URL queries

When you use a filter, the active URL for the Machines page contains a query string. The string represents the filter parameters.

For example, opening the Machines page without applying any filters make this the active URL:

Adding a Managed by filter to find machines managed by either Alice or Bob adds a query string to the active URL:

You can save your filters by copying the active URL.

For a list of the text strings that can appear in a filter URL, see Text filters.

Filter AND and OR logic

Multiple filters are treated as an intersection. For example, applying a filter to find ephemeral nodes and a filter to find machines seen in the last 5 days will return the set of machines that are ephemeral nodes AND were last seen in the last 5 days (property:ephemeral-node lastseen:<5d).

A filter that supports multiple values is treated as a union. For example, applying a Managed by filter to find machines managed by Alice, Bob, or the tag builder will return the set of machines that are managed by Alice OR Bob OR the tag builder (managedby:alice@example.com,bob@example.com,builder).

As another example, the following filter combination returns the set of machines that are managed by Alice OR Bob, AND have been seen with the last 5 days:

  • managedby:alice@example.com,bob@example.com lastseen:<5d

Using a filter

Filter devices in the Machines page of the admin console by creating a query using the UI filters, the search bar, or both. You can also use multiple filters on the same query.

Filter by Property

  1. In the Machines page of the admin console, click Filters and select Property.

  2. Select one or more properties for your filter:

You cannot multiselect criteria within the Property filter.

Filter by Disabled

  1. In the Machines page of the admin console, click Filters and select Disabled.

  2. Select the disabled states for your filter:

You cannot multiselect criteria within the Disabled filter.

Filter by Last seen

  1. In the Machines page of the admin console, click Filters and select Last seen.

  2. Select one of the connected state or last seen criteria for your filter:

    • Currently connected: Matches devices that are currently connected to your tailnet.
    • Not connected: Matches devices that are currently not connected to your tailnet.
    • Before the last: Matches devices that were last seen before the specified number of units. Available units are m, h, d, w, or y, for minutes, hours, days, weeks, or years, respectively. For example, 5d.
    • In the last: Matches devices that were seen in the last specified number of units. Available units are m, h, d, w, or y, for minutes, hours, days, weeks, or years, respectively. For example, 3h.

You cannot multiselect criteria within the Last seen filter.

Filter by Shared

  1. In the Machines page of the admin console, click Filters and select Shared.

  2. Select one of the sharing states for your filter:

    • Not shared: Matches devices in your tailnet that are not shared.
    • Shared with your tailnet: Matches devices shared by others that have been shared to your tailnet.
    • Shared by your tailnet: Matches devices in your tailnet that are shared to users of other tailnets. Note that if you sent invitations to share a device but no one accepted the invitation, the device is not yet considered shared.

You cannot multiselect criteria within the Shared filter.

Filter by Managed by

  1. In the Machines page of the admin console, click Filters and select Managed by.
  2. Select the users and/or tags for your filter. This filter matches devices that are managed by any of the selected users and tags.

You can multiselect criteria within the Managed by filter.

Filter by Version

  1. In the Machines page of the admin console, click Filters and select Version.

  2. Select the Tailscale client version criteria for your filter:

    • Is: Matches devices that have the specified version, including any patch versions. For example, a value of 1.32 matches 1.32 and 1.32.2.
    • Newer than: Matches devices that have a version later than the specified version.
    • Older than: Matches devices that have a version older than the specified version.
    • Update available: Matches devices that have an update available.
    • Security update available: Matches devices that have a security update available.

You cannot multiselect criteria within the Version filter.

  1. In the Machines page of the admin console, click inside the search bar.

  2. Type in a text string and press Enter. The search text is not case-sensitive.

    The search returns the list of devices that contain the search text in at least one of the following fields:

    • Machine name
    • Host name
    • Tailscale IP address
    • Creator (the user that added the machine to the tailnet and manages the machine)
    • Operating system
    • Tailscale client version

The search text is not an exact string match—if a device contains the search text in one or more of the fields listed above, it is included in the search results. For example, using 1.10 in the search bar will match machines that contain 1.10 in the version number (such as 1.10.2), and it will also match devices that have 1.10 in any of the other fields listed above. Similarly, using Bob in the search bar will match devices that contain bob (not case-sensitive) in any of the fields listed above.

You cannot combine multiple freeform text search filters at the same time. For example, searching with freeform text “1.32.2 alice” won’t return any results even if you have machines running Tailscale v1.32.2 that are managed by Alice. However, you can apply text filters to create a search string like “version:=1.32.2 managedby:alice” to find those machines.

Text filters

The following table shows the URL query strings that result from using the filters in the Machines page of the admin console. You can also enter these text strings directly into the search bar.

Filter term Description
property:ephemeral-node Matches devices that are ephemeral nodes.
property:exit-node Matches devices that are exit nodes.
property:expiry-disabled Matches devices that have key expiry disabled.
property:signing-node Matches devices that can sign new nodes to approve their access to the tailnet.
property:subnet Matches devices that are subnet routers.
property:tailscale-funnel Matches devices that are running a Tailscale Funnel server.
property:tailscale-ssh Matches devices that have Tailscale SSH enabled.
disabled:expired Matches devices that have an expired key.
disabled:needs-approval Matches devices that need approval.
disabled:user-suspended Matches devices that are managed by a suspended user.
lastseen:<value Matches devices that were last seen before the specified number of units. Available units are m, h, d, w, or y, for minutes, hours, days, weeks, or years, respectively. For example, 5d.
lastseen:>value Matches devices that were seen in the last specified number of units. Available units are m, h, d, w, or y, for minutes, hours, days, weeks, or years, respectively. For example, 3h.
lastseen:connected Matches devices that are currently connected to your tailnet.
lastseen:not-connected Matches devices that are currently not connected to your tailnet.
managedby:value[,] Matches devices managed by a specified user or having a specified tag. List multiple values in a comma-separated string.
shared:in Matches devices shared by others that have been shared to your tailnet.
shared:not-shared Matches devices in your tailnet that are not shared.
shared:out Matches devices in your tailnet that are shared to users of other tailnets. Note that if you sent invitations to share a device but no one accepted the invitation, the device is not yet considered shared.
version:<value Matches devices that have a version older than the specified version.
version:=value Matches devices that have the specified version, including any patch versions. For example, a value of 1.32 matches 1.32 and 1.32.2.
version:>value Matches devices that have a version later than the specified version.
version:update-available Matches devices that have an update available.
version:security-update-available Matches devices that have a security update available.

Removing a filter

To remove an individual filter, below the search bar, select the x for the filter that you want to remove.

To remove all filters, within the search bar, select the x.