Comparison operators :: Kloudfuse Docs
Comparison operators
FuseQL comparison operators filter log lines by testing label and facet values against a literal. They must appear before the first pipe (|) in a query and are evaluated against the inverted index — no raw log body scanning is required. To combine multiple filter conditions, use the logical operatorsand and or.
=
Exact-match filter operator. Selects log lines where a label or facet equals the specified value exactly. Use label= for Kubernetes/infrastructure labels and @facet= for indexed log fields in advanced search mode.
Syntax
label="value"
@facetName="value"
Parameters
| Parameter | Required | Description |
|---|---|---|
label or @facetName |
Yes | The label key or (with @ prefix) facet name to filter on. |
"value" |
Yes | The exact string value the field must equal. |
Example
Select nginx access logs from a specific Kubernetes namespace.
source="nginx" kube_namespace="kfuse"
Effect
Returns only log lines where source equals nginx and kube_namespace equals kfuse.
The = operator performs an exact, case-sensitive match. For substring matching use ** (contains); for pattern matching use =~ (regex). The source label is a special system label available in all FuseQL queries — it is not prefixed with @. |
==
Exact facet term match operator. Searches for log lines where a facet has a specific indexed term value. Unlike the = (equal) operator which performs value equality, == matches against tokenized index terms. Use this for precise term lookups in indexed facet fields.
Syntax
@facetName=="value"
Parameters
| Parameter | Required | Description |
|---|---|---|
@facetName |
Yes | The facet name, prefixed with @. |
"value" |
Yes | The exact indexed term value the facet must contain. |
Example
Return log lines where the traceFlags facet has the indexed term value 1.
source="nginx" @traceFlags=="1"
Effect
Returns log lines from the nginx source where the traceFlags facet contains the indexed term 1.
== performs a term-based lookup against the inverted index and is faster than = for facets with many distinct values. Use = for simple string equality on labels; use == for exact term lookups on indexed facet fields where term tokenization applies. |
!==
Exact facet term exclusion operator. Selects log lines where a facet does not have a specific indexed term value. This is the logical complement of the == (facet terms exist) operator.
Syntax
@facetName!="value"
Parameters
| Parameter | Required | Description |
|---|---|---|
@facetName |
Yes | The facet name, prefixed with @. |
"value" |
Yes | The indexed term value the facet must not contain. |
Example
Return log lines where the traceFlags facet does not have the term value 1.
source="nginx" @traceFlags!="1"
Effect
Returns log lines from the nginx source where traceFlags does not contain the indexed term 1, including lines where the facet is absent.
!== is the term-exclusion counterpart to ==. It excludes lines matching the specific term, not all lines where the facet differs from the value — behavior may vary from != when the facet is tokenized into multiple terms. Use alongside == to build inclusion/exclusion term filters on indexed facet fields. |
>=
Numeric comparison filter operator. Selects log lines where a numeric facet value is greater than or equal to the specified number. The boundary value is included. Applies only to numeric facets.
Syntax
@facetName>=number
Parameters
| Parameter | Required | Description |
|---|---|---|
@facetName |
Yes | A numeric facet name, prefixed with @. |
number |
Yes | The inclusive lower bound; values equal to or greater than this are returned. |
Example
Return nginx logs where the HTTP status code indicates a successful or redirect response (status >= 200).
source="nginx" @http_status>=200
Effect
Returns log lines from the nginx source where http_status is 200 or higher, including 2xx, 3xx, 4xx, and 5xx responses.
Use >= when the boundary value should be included in the result set — for example, to capture HTTP 200 responses alongside errors. Pair with ⇐ to form a numeric range: @http_status>=200 and @http_status⇐299 selects only 2xx responses. |
>
Numeric comparison filter operator. Selects log lines where a numeric facet value is strictly greater than the specified number. Applies only to numeric facets; string comparisons are not supported by this operator.
Syntax
@facetName>number
Parameters
| Parameter | Required | Description |
|---|---|---|
@facetName |
Yes | A numeric facet name, prefixed with @. |
number |
Yes | The numeric threshold; only values strictly greater than this are returned. |
Example
Return nginx logs where the HTTP status code indicates a server error (status > 499).
source="nginx" @http_status>499
Effect
Returns log lines from the nginx source where the http_status facet value is 500 or higher.
Numeric comparison operators (>, >=, <, ⇐) apply only to numeric facets (prefixed with @). They cannot be used on plain labels. Combine with = filters on labels such as source to narrow the scope of the numeric filter. |
<=
Numeric comparison filter operator. Selects log lines where a numeric facet value is less than or equal to the specified number. The boundary value is included. Applies only to numeric facets.
Syntax
@facetName<=number
Parameters
| Parameter | Required | Description |
|---|---|---|
@facetName |
Yes | A numeric facet name, prefixed with @. |
number |
Yes | The inclusive upper bound; values equal to or less than this are returned. |
Example
Return nginx logs for requests that did not return a server error (status code 499 or below).
source="nginx" @http_status<=499
Effect
Returns log lines from the nginx source where http_status is 499 or lower, covering 1xx, 2xx, 3xx, and 4xx responses.
Use <= when the boundary value should be included. Combine with >= to form inclusive ranges: @http_status>=400 and @http_status⇐499 selects all 4xx client-error responses. |
<
Numeric comparison filter operator. Selects log lines where a numeric facet value is strictly less than the specified number. The boundary value is excluded. Applies only to numeric facets.
Syntax
@facetName<number
Parameters
| Parameter | Required | Description |
|---|---|---|
@facetName |
Yes | A numeric facet name, prefixed with @. |
number |
Yes | The exclusive upper bound; only values strictly below this are returned. |
Example
Return nginx logs for requests that completed quickly (response time less than 100 ms).
source="nginx" @duration_ms<100
Effect
Returns log lines from the nginx source where the duration_ms facet is below 100 milliseconds.
Use < when the boundary should be excluded. To include it, use ⇐ instead. For range queries, combine with >: @duration_ms>50 and @duration_ms<100 selects durations between 50 and 100 ms, exclusive on both ends. |
!=
Exact-exclusion filter operator. Selects log lines where a label or facet does not equal the specified value. The match is case-sensitive. Use this to exclude a specific value while keeping everything else.
Syntax
label!="value"
@facetName!="value"
Parameters
| Parameter | Required | Description |
|---|---|---|
label or @facetName |
Yes | The label key or (with @ prefix) facet name to filter on. |
"value" |
Yes | The exact string value the field must not equal. |
Example
Return all nginx logs except those at the info level.
source="nginx" level!="info"
Effect
Returns log lines from the nginx source where the level is anything other than info (for example, warning, error, or debug).
!= is the exact-exclusion counterpart to =. For excluding pattern matches, use !~ (not regex). Combining != conditions for the same field produces AND logic — to exclude multiple values from a single field, chain != for each value. |