String operators

FuseQL string operators manipulate string values within a query pipeline. Use them in the Advanced Search interface to enrich and transform field values.

concat

Concatenates two or more strings (or numbers coerced to strings) into a single string. Use concat when you need to build composite fields — for example, combining an HTTP method and status code into a single label for grouping or display. Accepts any number of arguments in sequence.

Syntax

| concat(<field1>, <field2>, ...) as <alias>
none

Parameters

Parameter Required Description

<field1>, <field2>, …​

Required

Two or more string or numeric fields or literals to join, in order.

<alias>

Required

Name for the resulting field.

Example

Combine the HTTP method and status code into a single method_status label, then count how often each combination appears.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| concat(method, " ", status) as method_status
| count by method_status
Expected output
method_status _count

POST 200

2,159,442

GET 200

2,891

GET 304

198

HEAD 200

183

Numeric arguments are automatically coerced to strings before concatenation. Use a literal space " " as a separator argument to add spacing between fields.

format

Returns a formatted string by substituting fields or literals into a format specifier string. Use format when you need to produce human-readable summaries or labels from multiple fields — for example, combining an HTTP method and status code into a sentence. Supports standard printf-style %s (string) and %d (integer) specifiers.

Syntax

| format(<formatSpecifierString>, <field1>, ...) as <alias>
none

Parameters

Parameter Required Description

<formatSpecifierString>

Required

A string containing %s or %d placeholders, replaced in order by the subsequent arguments.

<field1>, …​

Required

One or more fields or literals to substitute into the format string.

<alias>

Required

Name for the resulting field.

Example

Build a summary sentence combining the HTTP method and status code, then return the first example per method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| format("%s returned %s", method, status) as summary
| first(summary) by method
Expected output
method first(summary)

GET

GET returned 200

POST

POST returned 200

HEAD

HEAD returned 200

Values shown are illustrative; actual results depend on your log data. Use %s for string fields and %d for integer fields in the format specifier.

len

Returns the number of characters in a string. Use len to measure field lengths for filtering, aggregation, or anomaly detection — for example, finding unusually long URLs that may indicate malformed requests or injection attempts.

Syntax

| len(<string>) as <alias>
none

Parameters

Parameter Required Description

<string>

Required

A string field or literal whose length to measure.

<alias>

Required

Name for the resulting numeric field.

Example

Calculate the average URL length by HTTP method to identify which method types produce longer request paths.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| len(url) as url_len
| avg(url_len) as avg_url_len by method
Expected output
method avg_url_len

GET

31.4

POST

26.8

HEAD

27.1

Values shown are illustrative; actual results depend on your log data. Combine len with where to filter out-of-range values, for example | where len(url) > 200.

replace

Replaces all occurrences of a search string or regular expression pattern within a source string. Use replace to normalize field values — for example, stripping version tokens from URLs or redacting numeric IDs before grouping.

Syntax

| replace(<sourceString>, <searchString>, <replaceString>) as <alias>

| replace(<sourceString>, <regexPattern>, <replaceString>) as <alias>
none

Parameters

Parameter Required Description

<sourceString>

Required

The string field or literal to search within.

<searchString> or <regexPattern>

Required

The literal string or regex pattern to find. All occurrences are replaced.

<replaceString>

Required

The string to substitute for each match. Use an empty string "" to delete matches.

<alias>

Required

Name for the resulting field.

Example

Replace the protocol version token HTTP/2.0 with the shorthand h2 in URL fields, then return the first normalized URL per method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| replace(url, "HTTP/2.0", "h2") as url2
| first(url2) by method
Expected output
method first(url2)

GET

/ingester/health/ h2

POST

/ingester/otlp/v1/logs HTTP/1.1

HEAD

/ingester/health/ h2

Values shown are illustrative; actual results depend on your log data. Use a regex pattern such as [0-9]{5,} to strip long numeric IDs from path segments — for example, | replace(url, "[0-9]{5,}", "").

substring

Extracts a portion of a string between a start offset and an optional end offset. Offsets are zero-based; omitting the end offset returns everything from the start offset to the end of the string. Use substring to isolate prefixes, suffixes, or fixed-position tokens from structured fields.

Syntax

| substring(<sourceString>, <startOffset>) as <alias>

| substring(<sourceString>, <startOffset>, <endOffset>) as <alias>
none

Parameters

Parameter Required Description

<sourceString>

Required

The string field or literal to extract from.

<startOffset>

Required

Zero-based index of the first character to include.

<endOffset>

Optional

Zero-based index of the first character to exclude (exclusive upper bound). If omitted, extraction continues to the end of the string.

<alias>

Required

Name for the resulting field.

Example

Extract the first five characters of each URL as a prefix, then count the number of distinct prefixes per HTTP method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| substring(url, 1, 5) as url_prefix
| count_unique(url_prefix) as unique_prefixes by method
Expected output
method unique_prefixes

GET

42

POST

18

HEAD

5

Values shown are illustrative; actual results depend on your log data. Offsets are zero-based, so substring(s, 0, 5) returns the first five characters.

tolowercase

Converts all letters of a string to lowercase. Use tolowercase to normalize fields before grouping or comparison — for example, ensuring that HTTP methods parsed from log lines are case-insensitively aggregated.

Syntax

| tolowercase(<string>) as <alias>
none

Parameters

Parameter Required Description

<string>

Required

A string field or literal to convert to lowercase.

<alias>

Required

Name for the resulting field.

Example

Normalize the HTTP method field to lowercase and count log lines by lowercased method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| tolowercase(method) as method_lower
| count by method_lower
Expected output
method_lower _count

get

3,091

post

2,159,649

head

183

Results are confirmed from a 5-minute nginx log window. Non-alphabetic characters (digits, punctuation) are unaffected.

touppercase

Converts all letters of a string to uppercase. Use touppercase to normalize fields for display or comparison — for example, ensuring that parsed string values appear in a consistent uppercase form in dashboards or alert messages.

Syntax

| touppercase(<string>) as <alias>
none

Parameters

Parameter Required Description

<string>

Required

A string field or literal to convert to uppercase.

<alias>

Required

Name for the resulting field.

Example

Normalize the HTTP method field to uppercase and count log lines by uppercased method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| touppercase(method) as method_upper
| count by method_upper
Expected output
method_upper _count

GET

3,091

POST

2,159,649

HEAD

183

Non-alphabetic characters (digits, punctuation) are unaffected. For case-insensitive grouping, tolowercase and touppercase produce equivalent results.

trim

Removes leading and trailing whitespace characters from a string. Use trim to clean up fields that may contain incidental spaces introduced during parsing — for example, stripping whitespace from values extracted with parse before grouping or comparison.

Syntax

| trim(<string>) as <alias>
none

Parameters

Parameter Required Description

<string>

Required

A string field or literal from which to remove leading and trailing whitespace.

<alias>

Required

Name for the resulting field.

Example

Trim any leading or trailing whitespace from parsed URL fields, then return the first cleaned URL per method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| trim(url) as url_trimmed
| first(url_trimmed) by method
Expected output
method first(url_trimmed)

GET

/ingester/health/ HTTP/2.0

POST

/ingester/otlp/v1/logs HTTP/2.0

HEAD

/ingester/health/ HTTP/2.0

Values shown are illustrative; actual results depend on your log data. Only leading and trailing whitespace is removed — internal spaces within the string are preserved.