Table Of Contents

Previous topic

The Reef Datamodel

Filter Operators

The table below lists the filter term operators that appear in the filter term form’s drop-down list.

Note

The RANGE oprator requires two parameters, both Cmp Val0 and Cmp Val0 must be provided when using this operator.

Operator Description
EXACT Exact match.
IEXACT Case-insensitive exact match.
CONTAINS Case-sensitive containment test.
ICONTAINS Case-insensitive containment test.
IN In a given list. The Cmp Val0 value must be provided as a comma separated list in square brackets, e.g. [1,2,3] to compare a list on numeric values. String values must be in quotes e.g. ['critical', 'major'].
LT Less than. This works on numeric and string event attribute values.
LTE Less than or equal to.
GT Greater than.
GTE Greater than or equal to.
NE Not equal to.
STARTSWITH Case-sensitive starts-with.
ISTARTSWITH Case-insensitive starts-with.
ENDSWITH Case-sensitive ends-with.
IENDSWITH Case-insensitive ends-with.
REGEX Case-sensitive regular expression match.
IREGEX Case-insensitive regular expression match.
RANGE Inclusive range test.

Examples

The table below lists some example behaviour expected whern using the filter term operators.

Operator Cmp Val0 value Event attr value Event in result?
EXACT server server1 False
EXACT server1 server1 True
IEXACT server1 SerVer1 True
CONTAINS server1 server1 True
CONTAINS erver server1 True
IN [‘critical’,’major’] major True
IN [‘critical’,’major’] minor False
IN [10, 20, 30] 33 False
IN [10, 20, 30] 10 True
LT 5 10 True
LT 10 10 False
LT aaa aaaa True
LT bbb aaaa False
LTE 10 10 True
GT 15 10 True
GT 10 10 False
GTE 10 10 True
NE foo bar True
STARTSWITH f foo True
STARTSWITH oo foo False
ISTARTSWITH f Foo True
ENDSWITH oo foo True
ENDSWITH fo foo False
IENDSWITH r baR True
REGEX ^critical$ critical True
REGEX ^critical$ critical... False
IREGEX ^critical$ Critical True

The table below lists some example behaviour expected whern using the filter term RANGE operator.

Operator Cmp Val0 value Cmp Val1 value Event attr value Event in result?
RANGE 10 100 99 True
RANGE 10 100 101 False
RANGE 10 100 9 False
RANGE a c b True
RANGE a c d False