Scalar FunctionsString Functions
String Operators
Infix string operators for filtering and matching
String operators test strings using infix notation. Most operators have a case-sensitive variant (suffixed with _cs).
| Operator | Description | Case-Sensitive | Example |
|---|---|---|---|
contains | Indicate whether a string contains another string (case-insensitive). | No | "value" contains "test" |
!contains | Negation of contains | No | |
contains_cs | Indicate whether a string contains another string (case-sensitive). | Yes | "value" contains_cs "test" |
!contains_cs | Negation of contains_cs | Yes | |
endswith | Indicate whether a string ends with another string (case-insensitive). | No | "value" endswith "test" |
!endswith | Negation of endswith | No | |
endswith_cs | Indicate whether a string ends with another string (case-sensitive). | Yes | "value" endswith_cs "test" |
!endswith_cs | Negation of endswith_cs | Yes | |
has | Indicate whether a string contains a whole word (case-insensitive, word boundary matching). | No | "value" has "test" |
!has | Negation of has | No | |
has_cs | Indicate whether a string contains a whole word (case-sensitive, word boundary matching). | Yes | "value" has_cs "test" |
!has_cs | Negation of has_cs | Yes | |
hasprefix | Indicate whether a string starts with a word prefix (case-insensitive, word boundary matching). | No | "value" hasprefix "test" |
!hasprefix | Negation of hasprefix | No | |
hasprefix_cs | Indicate whether a string starts with a word prefix (case-sensitive, word boundary matching). | Yes | "value" hasprefix_cs "test" |
!hasprefix_cs | Negation of hasprefix_cs | Yes | |
hassuffix | Indicate whether a string ends with a word suffix (case-insensitive, word boundary matching). | No | "value" hassuffix "test" |
!hassuffix | Negation of hassuffix | No | |
hassuffix_cs | Indicate whether a string ends with a word suffix (case-sensitive, word boundary matching). | Yes | "value" hassuffix_cs "test" |
!hassuffix_cs | Negation of hassuffix_cs | Yes | |
matches regex | Returns true if the string matches the regular expression pattern. | No | "value" matches regex "test" |
startswith | Indicate whether a string starts with another string (case-insensitive). | No | "value" startswith "test" |
!startswith | Negation of startswith | No | |
startswith_cs | Indicate whether a string starts with another string (case-sensitive). | Yes | "value" startswith_cs "test" |
!startswith_cs | Negation of startswith_cs | Yes |
Function call syntax
Most string operators can also be called as functions (except multi-word operators like matches regex). For example:
T | where contains(name, "search")is equivalent to:
T | where name contains "search"