Tests if a specific substring is present within a given string. It takes two arguments: string and substring, both of which can be provided as plain text, field values, or results of an expression.
Similar to the test()
function,
text:contains()
returns the events where the
condition is met. The function can be negated to find the events, where
the substring is not found in the main string.
Omitted Argument NamesThe argument name for
string
can be omitted; the following forms of this function are equivalent:logscaletext:contains("value",substring="value")
and:
logscaletext:contains(string="value",substring="value")
These examples show basic structure only; full examples are provided below.
text:contains()
Examples
- logscale
text:contains(string=name,substring="download")
name is the name of a field and
download
is the string, and that would be equivalent to:logscalename = /download/
- logscale
text:contains("foobar", substring="oba")
is true (
oba
does exist in the string)logscaletext:contains("foobar", substring="abo")
is false (
abo
does not exist in the string)