This topic describes the syntax of logical operators. This topic also provides examples on how to use the logical operators.
- If you want to use strings in analytic statements, you must enclose the strings in single quotation marks (''). Strings that are not enclosed or are enclosed in double quotation marks ("") are considered field names or column names. For example, 'status' is considered the status string, and status or "status" is considered a log field whose name is status.
- The following logical operators are in descending order of priority: not, and, or. You can use parentheses () to change the calculation order.
- Logical operations support only Boolean expressions whose input value is true, false, or null.
| Operator | Syntax | Description |
|---|---|---|
| AND operator | x AND y | If both x and y evaluate to true, the result is true. |
| OR operator | x OR y | If either x or y evaluates to true, the result is true. |
| NOT operator | NOT x | If x evaluates to false, the result is true. |
AND operator
If both x and y evaluate to true, the result is true.
Syntax
x AND y Parameters
| Parameter | Description |
|---|---|
| x | The value of this parameter is a Boolean expression. |
| y | The value of this parameter is a Boolean expression. |
Return value type
The Boolean type.
Examples
If the value of the status field is 200 and the value of the request_method field is GET, true is returned. Otherwise, false is returned.
- Query statement
*|select status=200 AND request_method='GET' - Query and analysis results
OR operator
If either x or y evaluates to true, the result is true.
Syntax
x OR y Parameters
| Parameter | Description |
|---|---|
| x | The value of this parameter is a Boolean expression. |
| y | The value of this parameter is a Boolean expression. |
Return value type
The Boolean type.
Examples
Search for the logs whose value of the request_uri field ends with file-8 or file-6.
- Query statement
*|SELECT * WHERE request_uri LIKE '%file-8' OR request_uri LIKE '%file-6' - Query and analysis results
NOT operator
If x evaluates to false, the result is true.
Syntax
NOT x Parameters
| Parameter | Description |
|---|---|
| x | The value of this parameter is a Boolean expression. |
Return value type
The Boolean type.
Examples
Measure the durations of requests for which the HTTP 200 status code is not returned.
- Query statement
*|SELECT request_time WHERE NOT status=200 - Query and analysis results
Additional information: Truth table
The following table describes the results if x and y evaluate to true, false, or null.
| x | y | x AND y | x OR y | NOT x |
|---|---|---|---|---|
| true | true | true | true | false |
| true | false | false | true | false |
| true | null | null | true | false |
| false | true | false | true | true |
| false | false | false | false | true |
| false | null | false | null | true |
| null | true | null | true | null |
| null | false | false | null | null |
| null | null | null | null | null |