String operators

FuseQL string operators manipulate string values within a query pipeline. Use them in the Advanced Search interface to enrich and transform field values.

concat

Concatenates two or more strings (or numbers coerced to strings) into a single string. Use concat when you need to build composite fields — for example, combining an HTTP method and status code into a single label for grouping or display. Accepts any number of arguments in sequence.

Syntax

| concat(<field1>, <field2>, ...) as <alias>

Parameters

Example

Combine the HTTP method and status code into a single method_status label, then count how often each combination appears.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| concat(method, " ", status) as method_status
| count by method_status

format

Returns a formatted string by substituting fields or literals into a format specifier string. Use format when you need to produce human-readable summaries or labels from multiple fields — for example, combining an HTTP method and status code into a sentence. Supports standard printf-style %s (string) and %d (integer) specifiers.

Syntax

| format(<formatSpecifierString>, <field1>, ...) as <alias>

Parameters

Example

Build a summary sentence combining the HTTP method and status code, then return the first example per method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| format("%s returned %s", method, status) as summary
| first(summary) by method

len

Returns the number of characters in a string. Use len to measure field lengths for filtering, aggregation, or anomaly detection — for example, finding unusually long URLs that may indicate malformed requests or injection attempts.

Syntax

| len(<string>) as <alias>

Parameters

Example

Calculate the average URL length by HTTP method to identify which method types produce longer request paths.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| len(url) as url_len
| avg(url_len) as avg_url_len by method

replace

Replaces all occurrences of a search string or regular expression pattern within a source string. Use replace to normalize field values — for example, stripping version tokens from URLs or redacting numeric IDs before grouping.

Syntax

| replace(<sourceString>, <searchString>, <replaceString>) as <alias>

| replace(<sourceString>, <regexPattern>, <replaceString>) as <alias>

Parameters

Example

Replace the protocol version token HTTP/2.0 with the shorthand h2 in URL fields, then return the first normalized URL per method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| replace(url, "HTTP/2.0", "h2") as url2
| first(url2) by method

substring

Extracts a portion of a string between a start offset and an optional end offset. Offsets are zero-based; omitting the end offset returns everything from the start offset to the end of the string. Use substring to isolate prefixes, suffixes, or fixed-position tokens from structured fields.

Syntax

| substring(<sourceString>, <startOffset>) as <alias>

| substring(<sourceString>, <startOffset>, <endOffset>) as <alias>

Parameters

Example

Extract the first five characters of each URL as a prefix, then count the number of distinct prefixes per HTTP method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| substring(url, 1, 5) as url_prefix
| count_unique(url_prefix) as unique_prefixes by method

tolowercase

Converts all letters of a string to lowercase. Use tolowercase to normalize fields before grouping or comparison — for example, ensuring that HTTP methods parsed from log lines are case-insensitively aggregated.

Syntax

| tolowercase(<string>) as <alias>

Parameters

Example

Normalize the HTTP method field to lowercase and count log lines by lowercased method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| tolowercase(method) as method_lower
| count by method_lower

touppercase

Converts all letters of a string to uppercase. Use touppercase to normalize fields for display or comparison — for example, ensuring that parsed string values appear in a consistent uppercase form in dashboards or alert messages.

Syntax

| touppercase(<string>) as <alias>

Parameters

Example

Normalize the HTTP method field to uppercase and count log lines by uppercased method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| touppercase(method) as method_upper
| count by method_upper

trim

Removes leading and trailing whitespace characters from a string. Use trim to clean up fields that may contain incidental spaces introduced during parsing — for example, stripping whitespace from values extracted with parse before grouping or comparison.

Syntax

| trim(<string>) as <alias>

Parameters

Example

Trim any leading or trailing whitespace from parsed URL fields, then return the first cleaned URL per method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| trim(url) as url_trimmed
| first(url_trimmed) by method