This topic describes the syntax of logical operators. This topic also provides examples on how to use the logical operators.

Notice
  • If you want to use strings in analytic statements, you must enclose the strings in single quotation marks (''). Strings that are not enclosed or are enclosed in double quotation marks ("") are considered field names or column names. For example, 'status' is considered the status string, and status or "status" is considered a log field whose name is status.
  • The following logical operators are in descending order of priority: not, and, or. You can use parentheses () to change the calculation order.
  • Logical operations support only Boolean expressions whose input value is true, false, or null.
Operator Syntax Description
AND operator x and y If both x and y evaluate to true, the result is true.
OR operator x or y If either x or y evaluates to true, the result is true.
NOT operator not x If x evaluates to false, the result is true.

AND operator

If both x and y evaluate to true, the result is true.

Syntax

x and y 

Parameters

Parameter Description
x The value of this parameter is a Boolean expression.
y The value of this parameter is a Boolean expression.

Return value type

The Boolean type.

Examples

If the value of the status field is 200 and the value of the request_method field is GET, true is returned. Otherwise, false is returned.

  • Query statement
    *|select status=200 and request_method='GET'
  • Query and analysis resultsAND operator

OR operator

If either x or y evaluates to true, the result is true.

Syntax

x or y 

Parameters

Parameter Description
x The value of this parameter is a Boolean expression.
y The value of this parameter is a Boolean expression.

Return value type

The Boolean type.

Examples

Search for the logs whose value of the request_uri field ends with file-8 or file-6.

  • Query statement
    *|select *  where request_uri like '%file-8' OR request_uri like '%file-6'
  • Query and analysis resultsOR

NOT operator

If x evaluates to false, the result is true.

Syntax

 not x 

Parameters

Parameter Description
x The value of this parameter is a Boolean expression.

Return value type

The Boolean type.

Examples

Measure the durations of requests for which the HTTP 200 status code is not returned.

  • Query statement
    *|select request_time where not status=200
  • Query and analysis resultsNOT

Additional information: Truth table

The following table describes the results if x and y evaluate to true, false, or null.

x y x AND y x OR y NOT x
true true true true false
true false false true false
true null null true false
false true false true true
false false false false true
false null false null true
null true null true null
null false false null null
null null null null null