Comparison operators

FuseQL comparison operators filter log lines by testing label and facet values against a literal. They must appear before the first pipe (|) in a query and are evaluated against the inverted index — no raw log body scanning is required. To combine multiple filter conditions, use the logical operators and and or.

=

Exact-match filter operator. Selects log lines where a label or facet equals the specified value exactly. Use label= for Kubernetes/infrastructure labels and @facet= for indexed log fields in advanced search mode.

Syntax

label="value"
@facetName="value"
none

Parameters

Parameter Required Description

label or @facetName

Yes

The label key or (with @ prefix) facet name to filter on.

"value"

Yes

The exact string value the field must equal.

Example

Select nginx access logs from a specific Kubernetes namespace.

source="nginx" and kube_namespace="kfuse"
Effect

Returns only log lines where source equals nginx and kube_namespace equals kfuse.

The = operator performs an exact, case-sensitive match. For substring matching use ** (contains); for pattern matching use =~ (regex). The source label is a special system label available in all FuseQL queries — it is not prefixed with @.

>=

Numeric comparison filter operator. Selects log lines where a numeric facet value is greater than or equal to the specified number. The boundary value is included. Applies only to numeric facets.

Syntax

@facetName>=number
none

Parameters

Parameter Required Description

@facetName

Yes

A numeric facet name, prefixed with @.

number

Yes

The inclusive lower bound; values equal to or greater than this are returned.

Example

Return nginx logs where the HTTP status code indicates a successful or redirect response (status >= 200).

source="nginx" and @http_status>=200
Effect

Returns log lines from the nginx source where http_status is 200 or higher, including 2xx, 3xx, 4xx, and 5xx responses.

Use >= when the boundary value should be included in the result set — for example, to capture HTTP 200 responses alongside errors. Pair with <= to form a numeric range: @http_status>=200 and @http_status<=299 selects only 2xx responses.

>

Numeric comparison filter operator. Selects log lines where a numeric facet value is strictly greater than the specified number. Applies only to numeric facets; string comparisons are not supported by this operator.

Syntax

@facetName>number
none

Parameters

Parameter Required Description

@facetName

Yes

A numeric facet name, prefixed with @.

number

Yes

The numeric threshold; only values strictly greater than this are returned.

Example

Return nginx logs where the HTTP status code indicates a server error (status > 499).

source="nginx" and @http_status>499
Effect

Returns log lines from the nginx source where the http_status facet value is 500 or higher.

Numeric comparison operators (>, >=, <, <=) apply only to numeric facets (prefixed with @). They cannot be used on plain labels. Combine with = filters on labels such as source to narrow the scope of the numeric filter.

<=

Numeric comparison filter operator. Selects log lines where a numeric facet value is less than or equal to the specified number. The boundary value is included. Applies only to numeric facets.

Syntax

@facetName<=number
none

Parameters

Parameter Required Description

@facetName

Yes

A numeric facet name, prefixed with @.

number

Yes

The inclusive upper bound; values equal to or less than this are returned.

Example

Return nginx logs for requests that did not return a server error (status code 499 or below).

source="nginx" and @http_status<=499
Effect

Returns log lines from the nginx source where http_status is 499 or lower, covering 1xx, 2xx, 3xx, and 4xx responses.

Use <= when the boundary value should be included. Combine with >= to form inclusive ranges: @http_status>=400 and @http_status<=499 selects all 4xx client-error responses.

<

Numeric comparison filter operator. Selects log lines where a numeric facet value is strictly less than the specified number. The boundary value is excluded. Applies only to numeric facets.

Syntax

@facetName<number
none

Parameters

Parameter Required Description

@facetName

Yes

A numeric facet name, prefixed with @.

number

Yes

The exclusive upper bound; only values strictly below this are returned.

Example

Return nginx logs for requests that completed quickly (response time less than 100 ms).

source="nginx" and @duration_ms<100
Effect

Returns log lines from the nginx source where the duration_ms facet is below 100 milliseconds.

Use < when the boundary should be excluded. To include it, use <= instead. For range queries, combine with >: @duration_ms>50 and @duration_ms<100 selects durations between 50 and 100 ms, exclusive on both ends.

!=

Exact-exclusion filter operator. Selects log lines where a label or facet does not equal the specified value. The match is case-sensitive. Use this to exclude a specific value while keeping everything else.

Syntax

label!="value"
@facetName!="value"
none

Parameters

Parameter Required Description

label or @facetName

Yes

The label key or (with @ prefix) facet name to filter on.

"value"

Yes

The exact string value the field must not equal.

Example

Return all nginx logs except those at the info level.

source="nginx" and level!="info"
Effect

Returns log lines from the nginx source where the level is anything other than info (for example, warning, error, or debug).

!= is the exact-exclusion counterpart to =. For excluding pattern matches, use !~ (not regex). Combining != conditions for the same field produces AND logic — to exclude multiple values from a single field, chain != for each value.