All Products
Search
Document Center

Edge Security Acceleration:Operators and grouping symbols

Last Updated:Jul 30, 2026

Rule expressions use comparison operators to match request values and logical operators to combine conditions.

Comparison operators

Comparison operators compare an incoming request value against a value specified in an expression.

contains

Checks if the request value contains the specified string.

  • Operator name: Contains

  • Value type: String

  • Example:

    (http.host contains "example.com")

ends_with

Checks if the request value ends with the specified string.

  • Operator name: Ends with

  • Value type: String

  • Example:

    (ends_with(http.host, "cn"))

eq

Checks if the request value equals the specified value.

  • Operator name: Equal to

  • Value type: String

  • Example:

    (http.host eq "www.example.com")

exists

Checks if a specified field or attribute exists in the request.

  • Operator name: Exists

  • Value type: String

  • Example:

    (exists(http.request.headers["user-agent"]))

ge

Checks if the request value is greater than or equal to the specified numeric value.

  • Operator name: Greater than or equal to

  • Value type: int

  • Example:

    (ip.geoip.asnum ge 45104)

gt

Checks if the request value is greater than the specified numeric value.

  • Operator name: Greater than

  • Value type: int

  • Example:

    (ip.geoip.asnum gt 45104)

in

Checks if the request value matches any value in a specified set. Use the $ symbol to reference a list.

  • Operator name: Is in

  • Value type: Array

  • Example:

    (http.host in {"www.example.com" "blog.example.com"})

    ( ip.src in $<LIST_NAME>)

le

Checks if the request value is less than or equal to the specified numeric value.

  • Operator name: Less than or equal to

  • Value type: int

  • Example:

    (ip.geoip.asnum le 45104)

len eq

Checks if the length of the request value equals the specified numeric value.

  • Operator name: Length equals

  • Value type: String

  • Example:

    (len(http.request.cookies["session"]) eq 330688)

len gt

Checks if the length of the request value is greater than the specified numeric value.

  • Operator name: Length is greater than

  • Value type: String

  • Example:

    (len(http.request.cookies["session"]) gt 330688)

len lt

Checks if the length of the request value is less than the specified numeric value.

  • Operator name: Length is less than

  • Value type: String

  • Example:

    (len(http.request.cookies["session"]) lt 330688)

lt

Checks if the request value is less than the specified numeric value.

  • Operator name: Less than

  • Value type: int

  • Example:

    (ip.geoip.asnum lt 45104)

matches

Checks if the request value matches a specified regular expression (PCRE-compatible).

Note

Only the Premium and Enterprise plans support regular expressions.

  • Operator name: Matches regex

  • Value type: String

  • Example:

    (http.host matches "(www|blog)\.example\.com")

ne

Checks if the request value does not equal the specified value.

  • Operator name: Not equal to

  • Value type: String

  • Example:

    (http.host ne "www.example.com")

not ends_with

Checks if the request value does not end with the specified string.

  • Operator name: Does not end with

  • Value type: String

  • Example:

    (not ends_with(http.host, "cn"))

not exists

Checks if a specified field or attribute does not exist in the request.

  • Operator name: Does not exist

  • Value type: String

  • Example:

    (not exists(http.request.headers["user-agent"]))

not starts_with

Checks if the request value does not start with the specified string.

  • Operator name: Does not start with

  • Value type: String

  • Example:

    (not starts_with(http.host, "blog"))

not...contains

Checks if the request value does not contain the specified string.

  • Operator name: Does not contain

  • Value type: String

  • Example:

    (not http.host contains "example.com")

not...in

Checks if the request value does not match any value in a specified set. Use the $ symbol to reference a list.

  • Operator name: Is not in

  • Value type: Array

  • Example:

    (not http.host in {"www.example.com" "blog.example.com"})

    (not ip.src in $<LIST_NAME>)

not...matches

Checks if the request value does not match a specified regular expression (PCRE-compatible).

Note

Only the Premium and Enterprise plans support regular expressions.

  • Operator name: Does not match regex

  • Value type: String

  • Example:

    (not http.host matches "(www|blog)\.example\.com")

percent

Filters requests based on a specified field and percentage value.

  • Operator name: Percentage

  • Value type: Int

  • Value range: 1 to 100

Note

If the field value is empty (for example, the request does not include the specified header), the rule does not take effect, and the match result is false.

Supported fields:

  • Header: http.request.headers["example"]

  • Client IP: ip.src

  • URI query string: http.request.uri.args["example"]

  • Request timestamp: http.request.timestamp.sec

Examples:

  • percent(http.request.headers["example"],80)

  • percent(ip.src,80)

  • percent(http.request.cookies["example"],80)

  • percent(http.request.args["example"],80)

  • percent(http.request.timestamp.sec,80)

starts_with

Checks if the request value starts with the specified string.

  • Operator name: Starts with

  • Value type: String

  • Example:

    (starts_with(http.host, "blog"))

Other operators

lower

Converts the request value to lowercase for case-insensitive matching.

  • Operator name: Case-insensitive

  • Value type: String

  • Example:

    (lower(http.request.uri))

Logical operators

Logical operators combine multiple expressions into a composite expression.

and

Returns true only when all combined expressions are true.

  • Operator name: Logical AND

  • Example:

    ((http.host eq "www.example.com") and (ip.geoip.country eq "CN"))

not

Negates an expression result, inverting true to false and vice versa.

  • Operator name: Logical NOT

  • Example:

    not (http.host eq "www.example.com")

or

Returns true if any combined expression is true.

  • Operator name: Logical OR

  • Example:

    ((http.host eq "www.example.com") or (ip.geoip.country eq "CN"))

Grouping symbols

Use parentheses ( and ) to group expression parts and control evaluation order.

Grouping symbols are supported in the expression editor and the ESA API, but not in the expression builder.

Nested expression example:

(http.host eq "www.example.com" and ((http.referer in {"download.example.com"}) or (http.referer in {"image.example.com"})))