Logical operators (AND, OR, NOT) - Log Service - Simple Log Service

Learn the syntax, usage, and truth table for the AND, OR, and NOT logical operators in Log Service.

Log Service supports the following logical operators.

Important

In query and analysis statements, strings must be enclosed in single quotation marks ('). Unquoted characters or characters in double quotation marks (") represent field or column names. For example, 'status' is the string status, whereas status or "status" is the status field.
Precedence from highest to lowest: NOT, AND, OR. Use parentheses () to override.
Logical operators apply only to Boolean expressions (true, false, or null).

Operator	Syntax	Description	SQL support	SPL support
AND operator	x AND y	Returns true if both x and y evaluate to true.	√	√
OR operator	x OR y	Returns true if either x or y evaluates to true.	√	√
NOT operator	NOT x	Returns true if x evaluates to false.	√	√

AND operator

Returns true if both x and y evaluate to true.

Syntax

x AND y

Parameters

Parameter	Description
x	A Boolean expression.
y	A Boolean expression.

Return value type

boolean

Examples

SQL

Returns true if status is 200 and request_method is GET.

Query and analysis statement

*|SELECT status=200 AND request_method='GET'

Results appear in the _col0 column as true or false, indicating whether each log meets both the status=200 and request_method='GET' conditions.

SPL

Creates a field a that is true when status is 200 and request_method is 'GET'.

SPL statement

*|extend a = status=200 AND request_method='GET'

SPL results
```
a: true
```

OR operator

Returns true if either x or y evaluates to true.

Syntax

x OR y

Parameters

Parameter	Description
x	A Boolean expression.
y	A Boolean expression.

Return value type

boolean

Examples

SQL

Finds logs where request_uri ends with 'file-8' or 'file-6'.

Query and analysis statement

*|SELECT *  WHERE request_uri LIKE '%file-8' OR request_uri LIKE '%file-6'

Returns two records whose request_uri values are /request/path-2/file-6 and /request/path-0/file-6. The request methods are DELETE and PUT, and the status code for both is 200.

SPL

Finds logs where request_uri ends with 'file-8' or 'file-6'.

SPL statement

*|WHERE request_uri LIKE '%file-8' OR request_uri LIKE '%file-6'

Returns log entries matching the filter. For example, a log with request_uri value /request/path-2/file-6 matches the 'file-6' suffix condition.

NOT operator

Returns true if x evaluates to false.

Syntax

 NOT x

Parameters

Parameter	Description
x	A Boolean expression.

Return value type

boolean

Examples

SQL

Retrieves request duration for requests with a non-200 status code.

Query and analysis statement

*|SELECT request_time WHERE NOT status=200

Returns request_time values for matching logs. Sample results: 53.0, 24.0, 56.0, and 32.0.

SPL

Filters log entries with a non-200 status code.

SPL statement

*|WHERE NOT status=200

Returns log entries with a status code other than 200. For example, a log with status = 500 and request_uri = /request/path-2/file-6.

Truth table

Results when x and y evaluate to true, false, or null:

x	y	x AND y	x OR y	NOT x
true	true	true	true	false
true	false	false	true	false
true	null	null	true	false
false	true	false	true	true
false	false	false	false	true
false	null	false	null	true
null	true	null	true	null
null	false	false	null	null
null	null	null	null	null