Tests if a specific substring is present within a given string. It takes two arguments: string and substring, both of which can be provided as plain text, field values, or results of an expression.

Similar to the test() function, text:contains() returns the events where the condition is met. The function can be negated to find the events, where the substring is not found in the main string.

ParameterTypeRequiredDefaultDescription
string[a]stringrequired  The main string where the search will be performed.
substringstringrequired  The string that is searched for in the main string.

[a] The argument name string can be omitted.

Omitted Argument Names

The argument name for string can be omitted; the following forms of this function are equivalent:

logscale
text:contains("value",substring="value")

and:

logscale
text:contains(string="value",substring="value")

These examples show basic structure only; full examples are provided below.

  • logscale
    text:contains(string=name,substring="download")

    name is the name of a field and download is the string, and that would be equivalent to:

    logscale
    name = /download/
  • logscale
    text:contains("foobar", substring="oba")

    is true (oba does exist in the string)

    logscale
    text:contains("foobar", substring="abo")

    is false (abo does not exist in the string)