This query function may be used to select events in which the given field contains particular values. For instance, you might want to monitor events in which log messages contain error, warning, or other similar words in log entries, or perhaps particular numeric values in other fields.

Although this query function allows for only three parameters, it is very useful and versatile. For the first parameter, you would specify the field on which to filter data. The second parameter sets whether the search should be case-insensitive. The third parameter would be the string or multiple strings on which to match the contents of the field.

ParameterTypeRequiredDefault ValueDescription
field[a]stringrequired   The field on which to filter events.
ignoreCasestringoptional[b] false Allows for case-insensitive searching.
valuesarray of stringsrequired   The values on which to match the field. Only one match is required. Values can contain wildcards (for example, *).

[a] The parameter name field can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

Hide negatable operation for this function

Show negatable operation for this function

in() Examples

Suppose you have a repository which is ingesting data from a few web servers. And suppose that you want to get a list of events in which the user received the HTTP code 404, for web pages Not Found. You could do that easily with this query:

logscale
status = 404

As this suggests, the field on which to check is status.

Suppose further that you want to get a list of events in which the user received the HTTP codes 422 and 200. Those codes represent respectively Unable to be processed, and Successful. You could get those events with the in() function like so:

logscale
in(status, values=["422","200"])

Using the status field for the first parameter; for the second parameter, the two statuses are listed, separated by commas, within an array — within square-brackets. Incidentally, if you wanted to include string values instead of numbers, each string value would have to be contained within double-quotes.

The screenshot in Figure 111, “in() Example” below shows how this would look in the LogScale interface.

in() Example

Figure 111. in() Example


There are a few other HTTP codes related to errors besides these two. You could list all of them in the array, or you could add the wildcard (for example, *) like this:

logscale
in(status, values=["4*"])

This will return all events in which the status has a value starting with 4. Notice that even though only one value is given, you have to include the square-brackets. Also, notice that since the wildcard is used, the double-quotes is required.

Using the field parameter in addition to the =~ syntax:

logscale
in(field=loglevel, values=["ERROR", "WARN"])

Negating an in() filters:

logscale
!in(field=loglevel, values=["ERROR", "WARN"])

and

logscale
loglevel =~ !in(values=["ERROR", "WARN"])

Click + next to an example below to get the full details.

Categorize Errors in Log Levels

Categorize errors in log levels using the in() function in combination with if()

Categorize Events Based on Values in More Fields

Categorize events based on values across multiple fields - the example uses a combination of in() with case, match(), and if()

Differentiate Between Types of Log Levels

Differentiate between types of log levels using the in() function with the match expression

Exclude Events With Specific Values From Searches

Exclude events with specific values from searches using the negated function in()

Filter on a Single Field for One Specific Value

Filter the events using a single field matching a specific value

Perform Case-Insensitive Match on Field

Perform a case-insensitive match on field using in() function

Search Single Field for Multiple Values

Search single field for multiple values using the in() function

Search Status Field for All Status Codes Starting With "1" or "2"

Use a wildcard with in() to select all status codes starting with 1 or 2

Search Two Fields for Multiple Values in Either First Field or Second Field

Search two fields for multiple values using the in() function, using a case statement as an OR