contains()
The contains()
function is used to check if a substring exists within a given string or the value of a field in an event. It takes two arguments:
-
The first argument is either a literal string or a JSON pointer that represents the field or value to be searched.
-
The second argument is the substring to be searched for within the first argument. The function returns
true
if the substring specified in the second argument is found within the string or field value represented by the first argument. It returnsfalse
if it is not.
For example, if you want to check if the string "abcd"
is contained within the value of a field named message
, you can use the contains()
function as follows:
contains('/message', 'abcd')
This will return true
if the field message
contains the substring abcd
or false
if it does not.
Alternatively, you can also use a literal string as the first argument:
contains('This is a test message', 'test')
In this case, the function will return true
because the substring test
is present within the string This is a test message
.
Note that the contains()
function performs a case-sensitive search by default. If you need to perform a case-insensitive search, you can use the containsIgnoreCase()
function instead.