Predicate operators

FuseQL predicate operators evaluate conditions on field values, returning a boolean result. Use them to filter, validate, and classify log data within a query pipeline.

in

Checks whether a field value is a member of a specified set of strings or numbers. Use in a where clause to keep only matching rows, or inside if to branch on membership. The check is case-sensitive for string values.

Syntax

| where in(<field>, <value1>[, <value2>, ...])
none

Parameters

Parameter Required Description

<field>

Yes

The field whose value is tested for membership.

<value1>, …​

Yes

One or more literal string or numeric values forming the allowed set.

as <alias>

Yes (if form)

Name for the output column when used with if.

Example

Filter nginx access logs to keep only lines where the level label is one of the listed values.

source="nginx"
| where level in ("info", "warning")
| count by level
Expected output
_count level

316858

info

in is preferred over chaining multiple or conditions when testing the same field against many values — it is more readable and compiles to the same execution plan. For case-insensitive matching, normalize the field with toLowerCase before the in check.

isblank

Checks whether a string value is null, empty, or contains only whitespace characters (spaces, tabs, newlines). Returns true for all three cases; returns false for any string that contains at least one non-whitespace character. Use this to detect missing or placeholder field values.

Syntax

| isblank(<string>) as <alias>
none

Parameters

Parameter Required Description

<string>

Yes

A string field or literal to test.

as <alias>

Yes

Name for the boolean output column.

Example

Check whether the level label on nginx logs is blank (null, empty, or whitespace-only).

source="nginx"
| isblank(level) as is_blank
| count by is_blank
Expected output
is_blank _count

False

145071

isblank is a superset of isempty: a blank string is also empty, but a string containing only spaces is blank without being empty. Use | where isblank(field) to find rows with missing or placeholder values before aggregating. Prefer isblank over isempty when upstream systems may produce whitespace-only field values.

isempty

Checks whether a string value is exactly an empty string — zero characters, no content, no whitespace. Returns true only for the empty string ""; returns false for null, whitespace-only strings, or any string with at least one character. Use isblank instead if you also want to catch whitespace-only values.

Syntax

| isempty(<string>) as <alias>
none

Parameters

Parameter Required Description

<string>

Yes

A string field or literal to test.

as <alias>

Yes

Name for the boolean output column.

Example

Check whether the level label on nginx logs is an empty string.

source="nginx"
| isempty(level) as is_empty
| count by is_empty
Expected output
is_empty _count

False

141834

isempty returns false for strings that contain only spaces — use isblank if you also want to treat whitespace-only values as missing. Use | where isempty(field) to filter rows where a field was not populated, or | where not isempty(field) to keep only rows with non-empty values.

isnumeric

Checks whether a string value can be successfully parsed as a number (integer or floating-point). Returns true if the value is a valid numeric string, false otherwise. Use this before performing arithmetic operations on fields that may contain non-numeric values.

Syntax

| isnumeric(<string>) as <alias>
none

Parameters

Parameter Required Description

<string>

Yes

A string field or literal to test.

as <alias>

Yes

Name for the boolean output column.

Example

Check whether a literal string value can be parsed as a number.

source="nginx"
| isNumeric("200") as is_num
| count by is_num
Expected output
is_num _count

True

133504

Use isnumeric to guard against type errors before applying arithmetic aggregations (sum, avg, max) to parsed fields that may occasionally contain non-numeric values. If any rows return False, add | where is_num before aggregating. Both integers and floating-point strings ("1.234") return True.

isnull

Checks whether a field value is null or missing (absent). Returns true when the field has no value; returns false when the field is present with any value, including an empty string. Use this to detect rows where a field was not populated.

Syntax

| isnull(<field>) as <alias>
none

Parameters

Parameter Required Description

<field>

Yes

The field name to test for null or absence.

as <alias>

Yes

Name for the boolean output column.

Example

Check whether the level label on nginx logs is null or missing.

source="nginx"
| isnull(level) as is_null
| count by is_null
Expected output
is_null _count

False

155493

isnull detects completely absent fields; it returns false for empty strings ("") or whitespace-only values. Use isempty to also catch empty strings, or isblank to catch whitespace-only values. Use | where isnull(field) to filter rows with missing fields before aggregating, or combine with | where not isnull(field) to keep only rows where a field is populated.

luhn

Validates whether a string contains a valid credit card number using the Luhn checksum algorithm. Non-numeric characters (hyphens, spaces) are stripped before validation, so both formatted and unformatted card numbers can be checked. Returns true for valid card numbers, false otherwise.

Syntax

| luhn(<string>) as <alias>
none

Parameters

Parameter Required Description

<string>

Yes

A string field or literal containing a potential credit card number.

as <alias>

Yes

Name for the boolean output column.

Example

Filter log lines to keep only those where a literal test card number passes the Luhn check.

source="nginx"
| where luhn("4111111111111111")
| count
Expected output
_count

324933

4111111111111111 is a standard Luhn-valid test number — it has no real financial value. In practice, apply luhn to a parsed field that may contain card data to detect accidental logging of payment information as part of PCI compliance scanning. Non-numeric characters (hyphens, spaces) are stripped before validation, so formatted card numbers like 4111-1111-1111-1111 are also valid.

matches

Tests whether a field value matches a RE2-compliant regular expression. Use in a where clause to filter log lines, or inside if to branch on pattern matches. The match is applied to the entire field value unless anchoring is explicitly omitted.

Syntax

| where <field> matches "<regex>"
none

Parameters

Parameter Required Description

<field>

Yes

The field whose value is tested against the regular expression.

"<regex>"

Yes

A RE2-compliant regular expression string.

Example

Filter nginx logs to count only lines where the level label matches the pattern inf.*.

source="nginx"
| where level matches "inf.*"
| count
Expected output
_count

317700

FuseQL uses RE2 syntax — look-ahead and look-behind assertions are not supported. The where clause syntax is field matches "pattern" (not matches(field, "pattern")). For simple substring checks, the ** (contains) search operator is faster. Use matches when you need anchoring (^, $), character classes ([a-z]), or alternation (a|b).