This topic describes the syntax of logical operators. This topic also provides examples on how to use the logical operators.
The following table describes the logical operators that are supported by Simple Log Service.
If you want to use strings in analytic statements, you must enclose the strings in single quotation marks (''). Strings that are not enclosed or strings that are enclosed in double quotation marks ("") indicate field names or column names. For example, 'status' indicates the status string, and status or "status" indicates the status log field.
The following logical operators are in descending order of priority: not, and, or. You can use parentheses () to change the calculation order.
Logical operations support only Boolean expressions whose input value is true, false, or null.
Operator | Syntax | Description | Supported in SQL | Supported in SPL |
x AND y | If both x and y evaluate to true, true is returned. | √ | √ | |
x OR y | If either x or y evaluates to true, true is returned. | √ | √ | |
NOT x | If x evaluates to false, true is returned. | √ | √ |
AND operator
If both x and y evaluate to true, true is returned.
Syntax
x AND y Parameters
Parameter | Description |
x | The value of this parameter is a Boolean expression. |
y | The value of this parameter is a Boolean expression. |
Return value type
The Boolean type.
Examples
SQL
If the value of the status field is 200 and the value of the request_method field is GET, true is returned. Otherwise, false is returned.
Query statement
*|SELECT status=200 AND request_method='GET'Query and analysis results
SPL
If the value of the status field is 200 and the value of the request_method field is GET, true is returned. Otherwise, false is returned.
SPL statement
*|extend a = status=200 AND request_method='GET'SPL results
OR operator
If either x or y evaluates to true, true is returned.
Syntax
x OR y Parameters
Parameter | Description |
x | The value of this parameter is a Boolean expression. |
y | The value of this parameter is a Boolean expression. |
Return value type
The Boolean type.
Examples
SQL
Query the logs whose value of the request_uri field ends with file-8 or file-6.
Query statement
*|SELECT * WHERE request_uri LIKE '%file-8' OR request_uri LIKE '%file-6'Query and analysis results
SPL
Query the logs whose value of the request_uri field ends with file-8 or file-6.
SPL statement
*|WHERE request_uri LIKE '%file-8' OR request_uri LIKE '%file-6'SPL results
NOT operator
If x evaluates to false, true is returned.
Syntax
NOT x Parameters
Parameter | Description |
x | The value of this parameter is a Boolean expression. |
Return value type
The Boolean type.
Examples
SQL
Measure the durations of requests for which the HTTP 200 status code is not returned.
Query statement
*|SELECT request_time WHERE NOT status=200Query and analysis results
SPL
Query the logs for which the HTTP 200 status code is not returned.
SPL statement
*|WHERE NOT status=200SPL results
Appendix: Truth table
The following table describes the results if x and y evaluate to true, false, or null.
x | y | x AND y | x OR y | NOT x |
true | true | true | true | false |
true | false | false | true | false |
true | null | null | true | false |
false | true | false | true | true |
false | false | false | false | true |
false | null | false | null | true |
null | true | null | true | null |
null | false | false | null | null |
null | null | null | null | null |