Numerical operators
The types long
, double
and timestamp
real represent numerical types. The following operators can be used between pairs of these types
Operator | Description | Example |
---|
+
| Addition | 2+2.5
|
-
| Subtraction | 0.2-0.11
|
*
| Multiplication | 4*5, 60*1s
|
/
| Division | 10/2, 1h/60
|
%
| Modulo | 4%2
|
<
| Lower | 8 < 9, now()-1m < now()
|
<=
| Lower than or equal | 4<=5
|
>
| Greater | 5 > 4
|
>=
| Greater than or equal | 4 >=4
|
==
| Equals | 2 == 2
|
!=
| Not equals | 1 != 2
|
ADDITION
ADDITION | Long | Double | String | Boolean | Timestamp | Duration | Timeframe | Binary | Array | Record |
---|
Long | (long) | (double) |  |  |  |  |  |  |  |  |
Double | (double) | (double) |  |  |  |  |  |  |  |  |
String |  |  |  |  |  |  |  |  |  |  |
Boolean |  |  |  |  |  |  |  |  |  |  |
Timestamp |  |  |  |  |  | (timestamp) |  |  |  |  |
Duration |  |  |  |  | (timestamp) | (duration) | (timeframe) |  |  |  |
Timeframe |  |  |  |  |  | (timeframe) |  |  |  |  |
Binary |  |  |  |  |  |  |  |  |  |  |
Array |  |  |  |  |  |  |  |  |  |  |
Record |  |  |  |  |  |  |  |  |  |  |
SUBTRACT
SUBTRACT | Long | Double | String | Boolean | Timestamp | Duration | Timeframe | Binary | Array | Record |
---|
Long | (long) | (double) |  |  |  |  |  |  |  |  |
Double | (double) | (double) |  |  |  |  |  |  |  |  |
String |  |  |  |  |  |  |  |  |  |  |
Boolean |  |  |  |  |  |  |  |  |  |  |
Timestamp |  |  |  |  | (duration) | (timestamp |  |  |  |  |
Duration |  |  |  |  |  | (duration) |  |  |  |  |
Timeframe |  |  |  |  |  | (timeframe) |  |  |  |  |
Binary |  |  |  |  |  |  |  |  |  |  |
Array |  |  |  |  |  |  |  |  |  |  |
Record |  |  |  |  |  |  |  |  |  |  |
MULTIPLY
MULTIPLY | Long | Double | String | Boolean | Timestamp | Duration | Timeframe | Binary | Array | Record |
---|
Long | (long) | (double) |  |  |  | (duration) |  |  |  |  |
Double | (double) | (double) |  |  |  | (duration, rounded to full nanos) |  |  |  |  |
String |  |  |  |  |  |  |  |  |  |  |
Boolean |  |  |  |  |  |  |  |  |  |  |
Timestamp |  |  |  |  |  |  |  |  |  |  |
Duration | (duration) | (duration, rounded to full nanos) |  |  |  |  |  |  |  |  |
Timeframe |  |  |  |  |  |  |  |  |  |  |
Binary |  |  |  |  |  |  |  |  |  |  |
Array |  |  |  |  |  |  |  |  |  |  |
Record |  |  |  |  |  |  |  |  |  |  |
DIVIDE
DIVIDE | Long | Double | String | Boolean | Timestamp | Duration | Timeframe | Binary | Array | Record |
---|
Long | (long) | (double) |  |  |  |  |  |  |  |  |
Double | (double) | (double) |  |  |  |  |  |  |  |  |
String |  |  |  |  |  |  |  |  |  |  |
Boolean |  |  |  |  |  |  |  |  |  |  |
Timestamp |  |  |  |  |  |  |  |  |  |  |
Duration | (duration) | (duration rounded to full nanos) |  |  |  | (double) |  |  |  |  |
Timeframe |  |  |  |  |  |  |  |  |  |  |
Binary |  |  |  |  |  |  |  |  |  |  |
Array |  |  |  |  |  |  |  |  |  |  |
Record |  |  |  |  |  |  |  |  |  |  |
MODULO
MODULO | Long | Double | String | Boolean | Timestamp | Duration | Timeframe | Binary | Array | Record |
---|
Long | (long) | (double) |  |  |  |  |  |  |  |  |
Double | (double) | (double) |  |  |  |  |  |  |  |  |
String |  |  |  |  |  |  |  |  |  |  |
Boolean |  |  |  |  |  |  |  |  |  |  |
Timestamp |  |  |  |  |  |  |  |  |  |  |
Duration |  |  |  |  |  | (duration) |  |  |  |  |
Timeframe |  |  |  |  |  |  |  |  |  |  |
Binary |  |  |  |  |  |  |  |  |  |  |
Array |  |  |  |  |  |  |  |  |  |  |
Record |  |  |  |  |  |  |  |  |  |  |
NEGATE
NEGATE | Long | Double | String | Boolean | Timestamp | Duration | Timeframe | Binary | Array | Record |
---|
SELF | (long) | (double) |  |  |  | (duration) |  |  |  |  |
Logical or equality operators
Operator | Description | Example (yields true) |
---|
== | Equals - Yields true if both operands are not null and equal to each other. Otherwise, false. | 2==2 , "a" == "a" |
!= | Not equals - Yields true if any of the operands are null, or if the operands are not equal to each other. Otherwise, false. | 2!=1, "b" != "a" |
NOT | Negation - Negates a logical state | NOT 2==1 |
AND | Logical and (multiplication) - Yields true if both operands are true. | NOT 2==1 AND 1<2 |
OR | Logical or (addition) - Yields true if one of the operands is true, regardless of the other operand. | 1 < 2 OR 1 > 2 |
XOR | Exclusive or - Yields true if one of the operands is true, but false in case both are true. | 1 < 2 XOR 1 > 2 |
Logical operators and boolean valuesThe behavior of logical operators follows the tri-state boolean logic.
-
AND
true
AND null
= null
null
AND true
= null
false
AND null
= false
null
AND false
= false
null
AND null
= null
-
OR
true
OR null
= true
null
OR true
= true
false
OR null
= null
null
OR false
= null
null
OR null
= null
-
XOR
true
XOR null
= null
null
XOR true
= null
false
XOR null
= null
null
XOR false
= null
null
XOR null
= null
-
NOT
Equality comparisons (==
, !=
) use a tri-state boolean algebra (TRUE, FALSE, NULL). This means that if any side of the equality comparison is NULL, the overall result of the comparison is NULL.
There are two DQL functions that cover scenarios where missing or NULL records need to be retrieved:
For example, the below function that uses basic filtering does not provide null or missing records:
fetch logs
| filter log.source != "logsourcename"
However, using the isTrueOrNull
function renders those null and missing values:
fetch logs
| filter isTrueOrNull(log.source != "logsourcename")
String operators
By default, all string values in matching expressions are case-sensitive. The caseSensitive
parameter provides the ability to change case sensitivity.
Operator | Description | Example (yields true) |
---|
== | Equals | "ab" == lower("aB") |
!= | Not equals | "ab" != "aB" |
< | Lower | "b" < "c" |
<= | Lower than or equal | "ab" != "aB" |
> | Greater | "a" > "A" |
>= | Greater than or equal | "ab" >= "Ab" |
Comparison operators (==, !=)
- (
) - false for non-comparable types in case of == operator, true for non-compatible types in case of != operator
- (
) - true/false comparable types based on operator
- NULL - if one of the operands is NULL
- NULL == NULL - null
==, != | Long | Double | String | Boolean | Timestamp | Duration | Timeframe | Binary | Array | Record |
---|
Long |  |  |  |  |  |  |  |  |  |  |
Double |  |  |  |  |  |  |  |  |  |  |
String |  |  |  |  |  |  |  |  |  |  |
Boolean |  |  |  |  |  |  |  |  |  |  |
Timestamp |  |  |  |  |  |  |  |  |  |  |
Duration |  |  |  |  |  |  |  |  |  |  |
Timeframe |  |  |  |  |  |  |  |  |  |  |
Binary |  |  |  |  |  |  |  |  |  |  |
Array |  |  |  |  |  |  |  |  |  |  |
Record |  |  |  |  |  |  |  |  |  |  |
Comparison operators (<, <=, >, >=)
- (
) - true/false based on result of operator
- (
) - null
<, <=, >, >= | Long | Double | String | Boolean | Timestamp | Duration | Timeframe | Binary | Array | Record |
---|
Long |  |  |  |  |  |  |  |  |  |  |
Double |  |  |  |  |  |  |  |  |  |  |
String |  |  |  |  |  |  |  |  |  |  |
Boolean |  |  |  |  |  |  |  |  |  |  |
Timestamp |  |  |  |  |  |  |  |  |  |  |
Duration |  |  |  |  |  |  |  |  |  |  |
Timeframe |  |  |  |  |  |  |  |  |  |  |
Binary |  |  |  |  |  |  |  |  |  |  |
Array |  |  |  |  |  |  |  |  |  |  |
Record |  |  |  |  |  |  |  |  |  |  |