1. A computer-implemented method, comprising: receiving, by a processor, a query searching for associated events in log data, the associated events being multiple events that are related to one another by a common component; parsing the received query, including: locating a reserved term from the received query; identifying an intermediate component of the received query, the intermediate component including a portion of the received query that is located after the reserved term; and identifying a final component of the received query, the final component including a portion of the received query preceding the reserved term, wherein the reserved term comprises a term indicating that the intermediate component constrains a variable in the final component; forming an intermediate query for the intermediate component, including constructing a first search term for the intermediate component, the first search term explicitly indicating one or more first keywords that appeared in the intermediate component of the received query; performing the intermediate query, including determining, using the intermediate query, one or more second keywords, each second keyword satisfying the search term in the intermediate query; forming a final query for the final component, including constructing a second search term for the final component, the second search term explicitly indicates the one or more second keywords resulted from performing the intermediate query; merging a result of performing the intermediate query and a result of performing the final query; and designating the merged results as the associated events in response to the received query, wherein the method is performed by one or more computers.