1. A method, comprising: receiving a query searching for associated events in log data, the associated events being multiple events that are related to one another by a common component; parsing the received query, including: locating a reserved term from the received query; identifying, from a portion of the received query after the reserved term, an intermediate component of the received query; and identifying, from a portion of the received query preceding the reserved term, a final component of the received query; forming and then performing an intermediate query for the intermediate component, including determining, using the intermediate query, one or more keywords for including in a final query for the final component; forming the final query using a result of performing the intermediate query; merging the result of performing the intermediate query and a result of performing the final query; and designating the merged results as the associated events in response to the received query, wherein the method is performed by one or more computers.