Numerical operators
The types long
, double
and timestamp
real represent numerical types. The following operators can be used between pairs of these types
Operator  Description  Example 

+
 Addition  2+2.5


 Subtraction  0.20.11

*
 Multiplication  4*5, 60*1s

/
 Division  10/2, 1h/60

%
 Modulo  4%2

<
 Lower  8 < 9, now()1m < now()

<=
 Lower than or equal  4<=5

>
 Greater  5 > 4

>=
 Greater than or equal  4 >=4

==
 Equals  2 == 2

!=
 Not equals  1 != 2

ADDITION
ADDITION  Long  Double  String  Boolean  Timestamp  Duration  Timeframe  Binary  Array  Record 

Long  (long)  (double)         
Double  (double)  (double)         
String           
Boolean           
Timestamp       (timestamp)     
Duration      (timestamp)  (duration)  (timeframe)    
Timeframe       (timeframe)     
Binary           
Array           
Record           
SUBTRACT
SUBTRACT  Long  Double  String  Boolean  Timestamp  Duration  Timeframe  Binary  Array  Record 

Long  (long)  (double)         
Double  (double)  (double)         
String           
Boolean           
Timestamp      (duration)  (timestamp     
Duration       (duration)     
Timeframe       (timeframe)     
Binary           
Array           
Record           
MULTIPLY
MULTIPLY  Long  Double  String  Boolean  Timestamp  Duration  Timeframe  Binary  Array  Record 

Long  (long)  (double)     (duration)     
Double  (double)  (double)     (duration, rounded to full nanos)     
String           
Boolean           
Timestamp           
Duration  (duration)  (duration, rounded to full nanos)         
Timeframe           
Binary           
Array           
Record           
DIVIDE
DIVIDE  Long  Double  String  Boolean  Timestamp  Duration  Timeframe  Binary  Array  Record 

Long  (long)  (double)         
Double  (double)  (double)         
String           
Boolean           
Timestamp           
Duration  (duration)  (duration rounded to full nanos)     (double)     
Timeframe           
Binary           
Array           
Record           
MODULO
MODULO  Long  Double  String  Boolean  Timestamp  Duration  Timeframe  Binary  Array  Record 

Long  (long)  (double)         
Double  (double)  (double)         
String           
Boolean           
Timestamp           
Duration       (duration)     
Timeframe           
Binary           
Array           
Record           
NEGATE
NEGATE  Long  Double  String  Boolean  Timestamp  Duration  Timeframe  Binary  Array  Record 

SELF  (long)  (double)     (duration)     
Logical or equality operators
Operator  Description  Example (yields true) 

==  Equals  Yields true if both operands are not null and equal to each other. Otherwise, false.  2==2 , "a" == "a" 
!=  Not equals  Yields true if any of the operands are null, or if the operands are not equal to each other. Otherwise, false.  2!=1, "b" != "a" 
NOT  Negation  Negates a logical state  NOT 2==1 
AND  Logical and (multiplication)  Yields true if both operands are true.  NOT 2==1 AND 1<2 
OR  Logical or (addition)  Yields true if one of the operands is true, regardless of the other operand.  1 < 2 OR 1 > 2 
XOR  Exclusive or  Yields true if one of the operands is true, but false in case both are true.  1 < 2 XOR 1 > 2 
Logical operators and boolean valuesThe behavior of logical operators follows the tristate boolean logic.

AND
true
AND null
= null
null
AND true
= null
false
AND null
= false
null
AND false
= false
null
AND null
= null

OR
true
OR null
= true
null
OR true
= true
false
OR null
= null
null
OR false
= null
null
OR null
= null

XOR
true
XOR null
= null
null
XOR true
= null
false
XOR null
= null
null
XOR false
= null
null
XOR null
= null

NOT
Equality comparisons (==
, !=
) use a tristate boolean algebra (TRUE, FALSE, NULL). This means that if any side of the equality comparison is NULL, the overall result of the comparison is NULL.
There are two DQL functions that cover scenarios where missing or NULL records need to be retrieved:
For example, the below function that uses basic filtering does not provide null or missing records:
fetch logs
 filter log.source != "logsourcename"
However, using the isTrueOrNull
function renders those null and missing values:
fetch logs
 filter isTrueOrNull(log.source != "logsourcename")
String operators
By default, all string values in matching expressions are casesensitive. The caseSensitive
parameter provides the ability to change case sensitivity.
Operator  Description  Example (yields true) 

==  Equals  "ab" == lower("aB") 
!=  Not equals  "ab" != "aB" 
<  Lower  "b" < "c" 
<=  Lower than or equal  "ab" != "aB" 
>  Greater  "a" > "A" 
>=  Greater than or equal  "ab" >= "Ab" 
Comparison operators (==, !=)
 ( )  false for noncomparable types in case of == operator, true for noncompatible types in case of != operator
 ( )  true/false comparable types based on operator
 NULL  if one of the operands is NULL
 NULL == NULL  null
==, !=  Long  Double  String  Boolean  Timestamp  Duration  Timeframe  Binary  Array  Record 

Long           
Double           
String           
Boolean           
Timestamp           
Duration           
Timeframe           
Binary           
Array           
Record           
Comparison operators (<, <=, >, >=)
 ( )  true/false based on result of operator
 ( )  null
<, <=, >, >=  Long  Double  String  Boolean  Timestamp  Duration  Timeframe  Binary  Array  Record 

Long           
Double           
String           
Boolean           
Timestamp           
Duration           
Timeframe           
Binary           
Array           
Record           