Comparison operators

FuseQL comparison operators filter log lines by testing label and facet values against a literal. They must appear before the first pipe (|) in a query and are evaluated against the inverted index — no raw log body scanning is required. To combine multiple filter conditions, use the logical operators and and or.

=

Exact-match filter operator. Selects log lines where a label or facet equals the specified value exactly. Use label= for Kubernetes/infrastructure labels and @facet= for indexed log fields in advanced search mode.

Syntax

label="value"
@facetName="value"
none

Parameters

Parameter Required Description

label or @facetName

Yes

The label key or (with @ prefix) facet name to filter on.

"value"

Yes

The exact string value the field must equal.

Example

Select nginx access logs from a specific Kubernetes namespace.

source="nginx" kube_namespace="kfuse"
Effect

Returns only log lines where source equals nginx and kube_namespace equals kfuse.

The = operator performs an exact, case-sensitive match. For substring matching use ** (contains); for pattern matching use =~ (regex). The source label is a special system label available in all FuseQL queries — it is not prefixed with @.

==

Exact facet term match operator. Searches for log lines where a facet has a specific indexed term value. Unlike the = (equal) operator which performs value equality, == matches against tokenized index terms. Use this for precise term lookups in indexed facet fields.

Syntax

@facetName=="value"
none

Parameters

Parameter Required Description

@facetName

Yes

The facet name, prefixed with @.

"value"

Yes

The exact indexed term value the facet must contain.

Example

Return log lines where the traceFlags facet has the indexed term value 1.

source="nginx" @traceFlags=="1"
Effect

Returns log lines from the nginx source where the traceFlags facet contains the indexed term 1.

== performs a term-based lookup against the inverted index and is faster than = for facets with many distinct values. Use = for simple string equality on labels; use == for exact term lookups on indexed facet fields where term tokenization applies.

!==

Exact facet term exclusion operator. Selects log lines where a facet does not have a specific indexed term value. This is the logical complement of the == (facet terms exist) operator.

Syntax

@facetName!=="value"
none

Parameters

Parameter Required Description

@facetName

Yes

The facet name, prefixed with @.

"value"

Yes

The indexed term value the facet must not contain.

Example

Return log lines where the traceFlags facet does not have the term value 1.

source="nginx" @traceFlags!=="1"
Effect

Returns log lines from the nginx source where traceFlags does not contain the indexed term 1, including lines where the facet is absent.

!== is the term-exclusion counterpart to ==. It excludes lines matching the specific term, not all lines where the facet differs from the value — behavior may vary from != when the facet is tokenized into multiple terms. Use alongside == to build inclusion/exclusion term filters on indexed facet fields.

>=

Numeric comparison filter operator. Selects log lines where a numeric facet value is greater than or equal to the specified number. The boundary value is included. Applies only to numeric facets.

Syntax

@facetName>=number
none

Parameters

Parameter Required Description

@facetName

Yes

A numeric facet name, prefixed with @.

number

Yes

The inclusive lower bound; values equal to or greater than this are returned.

Example

Return nginx logs where the HTTP status code indicates a successful or redirect response (status >= 200).

source="nginx" @http_status>=200
Effect

Returns log lines from the nginx source where http_status is 200 or higher, including 2xx, 3xx, 4xx, and 5xx responses.

Use >= when the boundary value should be included in the result set — for example, to capture HTTP 200 responses alongside errors. Pair with ⇐ to form a numeric range: @http_status>=200 and @http_status⇐299 selects only 2xx responses.

>

Numeric comparison filter operator. Selects log lines where a numeric facet value is strictly greater than the specified number. Applies only to numeric facets; string comparisons are not supported by this operator.

Syntax

@facetName>number
none

Parameters

Parameter Required Description

@facetName

Yes

A numeric facet name, prefixed with @.

number

Yes

The numeric threshold; only values strictly greater than this are returned.

Example

Return nginx logs where the HTTP status code indicates a server error (status > 499).

source="nginx" @http_status>499
Effect

Returns log lines from the nginx source where the http_status facet value is 500 or higher.

Numeric comparison operators (>, >=, <, ⇐) apply only to numeric facets (prefixed with @). They cannot be used on plain labels. Combine with = filters on labels such as source to narrow the scope of the numeric filter.

<=

Numeric comparison filter operator. Selects log lines where a numeric facet value is less than or equal to the specified number. The boundary value is included. Applies only to numeric facets.

Syntax

@facetName<=number
none

Parameters

Parameter Required Description

@facetName

Yes

A numeric facet name, prefixed with @.

number

Yes

The inclusive upper bound; values equal to or less than this are returned.

Example

Return nginx logs for requests that did not return a server error (status code 499 or below).

source="nginx" @http_status<=499
Effect

Returns log lines from the nginx source where http_status is 499 or lower, covering 1xx, 2xx, 3xx, and 4xx responses.

Use <= when the boundary value should be included. Combine with >= to form inclusive ranges: @http_status>=400 and @http_status⇐499 selects all 4xx client-error responses.

<

Numeric comparison filter operator. Selects log lines where a numeric facet value is strictly less than the specified number. The boundary value is excluded. Applies only to numeric facets.

Syntax

@facetName<number
none

Parameters

Parameter Required Description

@facetName

Yes

A numeric facet name, prefixed with @.

number

Yes

The exclusive upper bound; only values strictly below this are returned.

Example

Return nginx logs for requests that completed quickly (response time less than 100 ms).

source="nginx" @duration_ms<100
Effect

Returns log lines from the nginx source where the duration_ms facet is below 100 milliseconds.

Use < when the boundary should be excluded. To include it, use ⇐ instead. For range queries, combine with >: @duration_ms>50 and @duration_ms<100 selects durations between 50 and 100 ms, exclusive on both ends.

!=

Exact-exclusion filter operator. Selects log lines where a label or facet does not equal the specified value. The match is case-sensitive. Use this to exclude a specific value while keeping everything else.

Syntax

label!="value"
@facetName!="value"
none

Parameters

Parameter Required Description

label or @facetName

Yes

The label key or (with @ prefix) facet name to filter on.

"value"

Yes

The exact string value the field must not equal.

Example

Return all nginx logs except those at the info level.

source="nginx" level!="info"
Effect

Returns log lines from the nginx source where the level is anything other than info (for example, warning, error, or debug).

!= is the exact-exclusion counterpart to =. For excluding pattern matches, use !~ (not regex). Combining != conditions for the same field produces AND logic — to exclude multiple values from a single field, chain != for each value.