Scalar Operators

String operators

Axiom processing language provides you with different query operators for searching string data types.

Below are the list of string operators we support on Axiom processing language.

Note:

The following abbreviations are used in the table below:

• RHS = right hand side of the expression.
• LHS = left hand side of the expression.

Operators with an _cs suffix are case sensitive

When two operators do the same task, use the case-sensitive one for better performance.

For example:

• instead of =~, use ==
• instead of in~, use in
• instead of contains, use contains_cs

The table below shows the list of string operators supported by Axiom processing language:

Performance Tips

String operators are fundamental in comparing, searching, or matching strings. Understanding the performance implications of different operators can significantly optimize your queries. Below are performance tips and query examples.

Equality and Inequality Operators

• Operators: ==, !=, =~, !~, in, !in, in~, !in~

Query Examples:

"get" == "get"
"get" != "GET"
"get" =~ "GET"
"get" !~ "put"
"get" in ("get", "put", "delete")

• Use == or != for exact match comparisons when case sensitivity is important, as they are faster.
• Use =~ or !~ for case-insensitive comparisons, or when the exact case is unknown.
• Use in or !in for checking membership within a set of values, which can be efficient for a small set of values.

Subsequence Matching Operators

• Operators: contains, !contains, contains_cs, !contains_cs, startswith, !startswith, startswith_cs, !startswith_cs, endswith, !endswith, endswith_cs, !endswith_cs.

Query Examples:

"parentSpanId" contains "Span" // True
"parentSpanId" !contains "xyz" // True
"parentSpanId" startswith "parent" // True
"parentSpanId" endswith "Id" // True
"parentSpanId" contains_cs "Span" // True if parentSpanId is "parentSpanId", False if parentSpanId is "parentspanid" or "PARENTSPANID"
"parentSpanId" startswith_cs "parent" // True if parentSpanId is "parentSpanId", False if parentSpanId is "ParentSpanId" or "PARENTSPANID"
"parentSpanId" endswith_cs "Id" // True if parentSpanId is "parentSpanId", False if parentSpanId is "parentspanid" or "PARENTSPANID"

• Use case-sensitive operators (contains_cs, startswith_cs, endswith_cs) when the case is known, as they are faster.

Regular Expression Matching Operators

• Operators: matches regex, !matches regex

"parentSpanId" matches regex "p.*Id" // True
"parentSpanId" !matches regex "x.*z" // True

• Avoid complex regular expressions or use string operators for simple substring, prefix, or suffix matching.

Term Matching Operators

• Operators: has, has_cs

Query Examples:

"content type" has "type" // True
"content type" has_cs "Type" // False

• Use has or has_cs for term matching which can be more efficient than regular expression matching for simple term searches.
• Use has_cs when the case is known, as it is faster due to case-sensitive matching.

Best Practices

• Always use case-sensitive operators when the case is known, as they are faster.
• Avoid complex regular expressions for simple matching tasks; use simpler string operators instead.
• When matching against a set of values, ensure the set is as small as possible to improve performance.
• For substring matching, prefer prefix or suffix matching over general substring matching for better performance.

has operator

The has operator in APL filters rows based on whether a given term or phrase appears within a string field.

Importance of the has operator:

• Precision Filtering: Unlike the contains operator, which matches any substring, the has operator looks for exact terms, ensuring more precise results.

• Simplicity: Provides an easy and readable way to find exact terms in a string without resorting to regex or other more complex methods.

The following table compares the has operators using the abbreviations provided:

• RHS = right-hand side of the expression
• LHS = left-hand side of the expression

Syntax

['Dataset'] 
| where Field has (Expression)

Parameters

Returns

The has operator returns rows from the dataset where the specified term is found in the given field. If the term is present, the row is included in the result set; otherwise, it is filtered out.

Example

['sample-http-logs']
| summarize event_count = count() by content_type
| where content_type has "text"
| where event_count > 10
| project event_count, content_type

Output