Predicate operators :: Kloudfuse Docs
Predicate operators
in
Checks whether a field value is a member of a specified set of strings or numbers. Use in a where clause to keep only matching rows, or inside if to branch on membership. The check is case-sensitive for string values.
Syntax
where
if
| where in(<field>, <value1>[, <value2>, ...])
| if(in(<field>, <value1>[, <value2>, ...]), <value_if_true>, <value_if_false>) as <alias>
Parameters
| Parameter | Required | Description |
|---|---|---|
<field> |
Yes | The field whose value is tested for membership. |
<value1>, … |
Yes | One or more literal string or numeric values forming the allowed set. |
as <alias> |
Yes (if form) | Name for the output column when used with if. |
Example
Filter nginx access logs to keep only lines where the level label is one of the listed values.
source="nginx"
| where level in ("info", "warning")
| count by level
| _count | level |
|---|---|
| 316858 | info |
isblank
Checks whether a string value is null, empty, or contains only whitespace characters (spaces, tabs, newlines). Returns true for all three cases; returns false for any string that contains at least one non-whitespace character. Use this to detect missing or placeholder field values.
Syntax
| isblank(<string>) as <alias>
Parameters
| Parameter | Required | Description |
|---|---|---|
<string> |
Yes | A string field or literal to test. |
as <alias> |
Yes | Name for the boolean output column. |
Example
Check whether the level label on nginx logs is blank (null, empty, or whitespace-only).
source="nginx"
| isblank(level) as is_blank
| count by is_blank
| is_blank | _count |
|---|---|
| False | 145071 |
isempty
Checks whether a string value is exactly an empty string — zero characters, no content, no whitespace. Returns true only for the empty string ""; returns false for null, whitespace-only strings, or any string with at least one character. Use isblank instead if you also want to catch whitespace-only values.
Syntax
| isempty(<string>) as <alias>
Parameters
Example
Check whether the level label on nginx logs is an empty string.
source="nginx"
| isempty(level) as is_empty
| count by is_empty
| is_empty | _count |
|---|---|
| False | 141834 |
isnumeric
Checks whether a string value can be successfully parsed as a number (integer or floating-point). Returns true if the value is a valid numeric string, false otherwise. Use this before performing arithmetic operations on fields that may contain non-numeric values.
Syntax
| isnumeric(<string>) as <alias>
Parameters
Example
Check whether a literal string value can be parsed as a number.
source="nginx"
| isNumeric("200") as is_num
| count by is_num
| is_num | _count |
|---|---|
| True | 133504 |
isnull
Checks whether a field value is null or missing (absent). Returns true when the field has no value; returns false when the field is present with any value, including an empty string. Use this to detect rows where a field was not populated.
Syntax
| isnull(<field>) as <alias>
Parameters
| Parameter | Required | Description |
|---|---|---|
<field> |
Yes | The field name to test for null or absence. |
as <alias> |
Yes | Name for the boolean output column. |
Example
Check whether the level label on nginx logs is null or missing.
source="nginx"
| isnull(level) as is_null
| count by is_null
| is_null | _count |
|---|---|
| False | 155493 |
luhn
Validates whether a string contains a valid credit card number using the Luhn checksum algorithm. Non-numeric characters (hyphens, spaces) are stripped before validation, so both formatted and unformatted card numbers can be checked. Returns true for valid card numbers, false otherwise.
Syntax
| luhn(<string>) as <alias>
Parameters
| Parameter | Required | Description |
|---|---|---|
<string> |
Yes | A string field or literal containing a potential credit card number. |
as <alias> |
Yes | Name for the boolean output column. |
Example
Filter log lines to keep only those where a literal test card number passes the Luhn check.
source="nginx"
| where luhn("4111111111111111")
| count
| _count |
|---|
| 324933 |
matches
Tests whether a field value matches a RE2-compliant regular expression. Use in a where clause to filter log lines, or inside if to branch on pattern matches. The match is applied to the entire field value unless anchoring is explicitly omitted.
Syntax
| where <field> matches "<regex>"
Parameters
| Parameter | Required | Description |
|---|---|---|
<field> |
Yes | The field whose value is tested against the regular expression. |
"<regex>" |
Yes | A RE2-compliant regular expression string. |
Example
Filter nginx logs to count only lines where the level label matches the pattern inf.*.
source="nginx"
| where level matches "inf.*"
| count
| _count |
|---|
| 317700 |