Logical operators

FuseQL logical operators combine two or more search filter expressions into a single compound condition. They must appear before the first pipe (|) in a query. The and operator requires both conditions to match; the or operator matches if either condition is true. Parentheses control evaluation order when mixing and and or.

and

Intersection operator (AND logic) between two search filter conditions. Selects only log lines that satisfy both conditions simultaneously. Write the keyword and between the conditions; it is required, and AND also works.

Syntax

label1="value1" and label2="value2"
none

Parameters

Parameter Required Description

left condition

Yes

A search filter expression on a label, facet, or term.

right condition

Yes

A second search filter expression that must also match.

Example

Filter nginx logs to show only info-level entries.

source="nginx" and level="info"
Effect

Returns only log lines where both the source label equals nginx and the level label equals info.

Conditions are not combined implicitly. Writing two conditions side by side without and, such as source="nginx" level="info", fails with syntax error. In the Logs search bar, Builder mode joins its filter chips with and for you — switch to Code to see the generated query — but FuseQL that you write yourself, in the Code input, dashboards, alerts, or the API, needs it. Use parentheses to group compound expressions: (source="nginx" and level="info") or source="nginx-error".

or

Union operator (OR logic) between two search filter conditions. Selects log lines that satisfy at least one of the conditions. Write the keyword or between two full conditions; OR also works.

Syntax

label="valueA" or label="valueB"
none

Parameters

Parameter Required Description

left condition

Yes

A search filter expression on a label, facet, or term.

right condition

Yes

A second search filter expression; at least one must match.

Example

Count grafana logs whose level is either info or warn.

source="grafana" and (level="info" or level="warn") | count by level
Effect

Counts log lines from the grafana source where level equals info or warn, one row per level.

Write each alternative as a full condition. A single quoted value such as level="info OR warn" is matched literally, so it returns no log lines.

Use parentheses to group the alternatives. Without them, source="grafana" and level="info" or level="warn" is read as (source="grafana" and level="info") or level="warn", so it also returns warn lines from every other source.