# Search operators

## Table of Contents

- [and, `and`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#and)
- [or, `or`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#or)
- [equal, `=`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#equal)
- [not equal, `!=`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#not-equal)
- [greater than, `>`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#greater-than)
- [greater than or equal, `>=`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#greater-than-or-equal)
- [less than, `<`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#less-than)
- [less than or equal, `<=`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#less-than-or-equal)
- [regex, `=~`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#regex)
- [not regex, `!~`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#not-regex)
- [terms exist, `term`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#terms-exist)
- [not terms exist, `!term`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#not-terms-exist)
- [grep, `"grep"`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#grep)
- [not grep, `!"grep"`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#not-grep)
- [facet terms exist, `==`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#facet-terms-exist)
- [facet terms not exist, `!==`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#facet-terms-not-exist)
- [starts with, `*~`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#starts-with)
- [ends with, `~*`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#ends-with)
- [contains, `**`](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#contains)
- [key exists](https://docs.kloudfuse.com/platform/4.1.0/query-languages/fuseql/search-operators/#key-exists)

## and, `and`

Intersection operator (AND logic) between two search operators. Selects results that satisfy both conditions.

### Syntax

```none
facetName1="value1" facetName2="value2"
```

```none
@facetName1="value1" and @facetName2="value2"
```

### Example

.and operator for facet

```none
level="info" header="map"
```

```none
@level="info" and @header="map"
```

## or, `or`

Union operator (OR logic) between two search operators. Selects results that satisfy either or both conditions.

### Syntax

```none
@facet="valueA OR valueB"
```

```none
@facet="valueA" or @facet="valueB"
```

### Example

or operator for facet

```none
level="info OR warning"
```

```none
@level="info" or @level="warning"
```

## equal, `=`

Searches for specified value; exact match.

### Syntax

```none
label="value"
@facetName="value"
```

### Example

equal operators with facet and label

```none
@http_request_method="POST" and source="nginx"
```

## not equal, `!=`

Searches for values _**other**_ than the specified value; exact match.

### Syntax

```none
label!="value"
@facetName!="value"
```

### Example

not equal operators with facet and label

```none
@facetName!="pinot-server" and level!="info"
```

## greater than, `>`

Searches for values that are greater than the specified number.

### Syntax

```none
@facetName>number
```

### Example

greater than operator with facet

```none
@status_1>300 and source="logs-query-service"
```

## greater than or equal, `>=`

Searches for values that are greater than or equal to the specified number.

### Syntax

```none
@facetName>=number
```

### Example

greater than or equal operator with facet

```none
@status_1>=200 and source="logs-query-service"
```

## less than, `<`

Searches for values that are less than the specified number.

### Syntax

```none
@facetName<number
```

### Example

less than operator with facet

```none
@status_1<500 and source="logs-query-service"
```

## less than or equal, `<=`

Searches for values that are less than or equal to the specified number.

### Syntax

```none
@facetName<=number
```

### Example

less than or equal operator with facet

```none
@status_1<=700 and source="logs-query-service"
```

## regex, `=~`

Searches for results that match a specific character pattern.

### Syntax

```none
label=~"value"
@facetName=~"value"
```

### Example

regex operator with label and facet

```none
availability_zone=~"us" and @partition=~"metadata"
```

## not regex, `!~`

Searches for results that **_do not_** match a specific character pattern.

### Syntax

```none
label!~"value"
@facetName!~"value"
```

### Example

not regex operator with facet

```none
availability_zone=~"west" and @partition=!~"metadata"
```

## terms exist, `term`

Matches complete tokens in the log message body. Terms are based on the tokenized words in the message body. All terms must appear in the log line, in any order. Fast and inexpensive.

### Syntax

```none
token1 token2 token3
```

### Example

term exist

```none
container
```

## not terms exist, `!term`

Excludes log lines that match complete tokens. Terms are determined by tokenization. All terms must appear in the log line, in any order, for the line to be excluded.

### Syntax

```none
!token
```

### Example

no term exist

```none
!container
```

## grep, `"grep"`

Searches for a literal, case-sensitive substring in the log message body. Unlike `term`, this matches character sequences rather than whole tokens, so it can match partial words and phrases.

### Syntax

```none
"expression"
```

### Example

grep expression

```none
"forward NR traces payload"
```

## not grep, `!"grep"`

Excludes log lines containing a literal, case-sensitive substring in the log message body.

### Syntax

```none
!"expression"
```

### Example

not grep expression

```none
!"forward NR traces payload"
```

## facet terms exist, `==`

Searches to match a specific facet and its value.

### Syntax

```none
@facet=="value"
```

### Example

facet terms exist

```none
@traceFlags=="1"
```

## facet terms not exist, `!==`

Searches to exclude a specific facet and its value.

### Syntax

```none
@facet!=="value"
```

### Example

facet terms not exist

```none
@traceFlags!="1"
```

## starts with, `*~`

Searches for labels or facets where the value begins with the specified string.

### Syntax

```none
label*~"value"
@facet*~"value"
```

### Example

starts with operator for facet and label

```none
kube_container_name*~"recommendation" and @trace_sampled*~"T"
```

## ends with, `~*`

Searches for labels or facets where the value ends with the specified string.

### Syntax

```none
label~*"value"
@facet~*"value"
```

### Example

ends with operator for facet and label

```none
@resource_service_name~*"service" and agent~*"dog"
```

## contains, `**`

Searches for labels or facets where the value contains the specified string.

### Syntax

```none
label**"value"
@facet**"value"
```

### Example

.contains operator for facet and label

```none
@ids**"9SIQT8TOJO" and kube_deployment**"otel"
```

## key exists

Searches for the presence of a specific facet, regardless of its value.

### Syntax

```none
key exists = "facet"
```

### Example

key exists operator for facet

```none
key exists="user_agent_original"
```

```none
@user_agent_original
```