Parameters	Parameter type	Required	Default value	Value range	Description
field	String	Yes	/	/	Field name. If the specified field does not exist, the condition is considered unmatched.
regex	String	Yes	/	/	Regular expression.
full	Bool	NOT	False	False True	Determines whether to match exactly. By default, it is False, meaning partial match. For example: If the value of the regular expression is exactly the same as the string, the match is exact match. For example, abcd matches \w+ exactly. You can add ^ at the beginning and $ at the end to convert partial matches into exact matches.

Function examples

Scenario: Determines whether the content field in the log matches the regular expression.

Processing rules:

f_set("f_match_part",f_match("content","12"))
f_set("f_match_full",f_match("content","12",True))

Log example

{
"content": "1234"
}

Processing result:

{
"content": "1234",
"f_match_part": "True",
"f_match_full": "False"
}

f_search function

Checks whether the log contains content that matches the query statement. If yes, return True; otherwise, return False.

Function syntax/format

f_search(query=query condition)

The parameters are described below:

Parameters

Parameter type

Required

Default value

Value range

Description

Parameters	Parameter type	Required	Default value	Value range	Description
query	string	Yes	/	/	A query string used to quickly filter logs. For more details, see Query string syntax.

Function examples

Scenario: Checks whether the count field in the log contains value that is greater than 0.

Processing rules:

f_set("f_search",f_search("count > 0"))

Log example

{
"count": "100"
}

Processing result:

{
"count": "100",
"f_search": "True"
}

Examples of common syntax rules are as follows:

# Full-text query​
f_search("byte dance")    # Full-text query: checks whether the full text contains the keyword byte or dance.​
f_search('"byte dance"')   # Full-text query: checks whether the full text contains the keyword byte dance, which contains a space.​
​
# Key-value query​
f_search('method: get')         # Key-value query: checks whether the method field value contains the keyword get.​
f_search('company: "volc engine"')   # Key-value query: checks whether the value of the company field contains the keyword volc engine, which contains a space.​
f_search('company: byte dance')   # Key-value query: checks whether the value of the company field contains the keyword byte or dance.​
​
# Exact match​
f_search('company== "byte dance"')  ​
​
# Wildcard search. Asterisk (*) matches zero or more characters. Question mark (?) matches one single character.​
f_search('company: do*y?n')  # Fuzzy match. Wildcard asterisk (*) and question mark (?) can be used.​
f_search('company: byt*dance')   # Fuzzy match. Wildcard asterisk (*) can be used.​
f_search('company: tik?ok')    # Fuzzy match. Wildcard question mark (?) can be used.​
​
# Field name escaping​
f_search('"Chinese characters": abc')           # Chinese characters must be enclosed in double quotation marks ("").​
f_search("\*a: value")              # When a field name contains special characters, use a backslash (\) for escaping.​
f_search("__tag__\:field: value")  # When a field name contains special characters, use a backslash (\) for escaping.​
​
# Regular expression matching​
f_search('company~="byt[\w]dance"')   # Regular expression matching: determines whether the company field matches a string containing byt + a letter, number, or underscore + dance.​
​
# Number​
f_search('amount: [10,200]')  # Checks whether the value of the amount field is between [10, 200].​
f_search('distance >=10')     # Checks whether the value of the distance field is greater than or equal to 10.​
f_search('distance > 20')     # Checks whether the value of the distance field is greater than 20.​
​
# Use relational operators​
f_search('byte OR dance') # Relational operators require using uppercase letters.​
f_search('byte AND  ( NOT dancer OR tiktok)')​
f_search('byte AND (dancer OR dance)')​
f_search("byte || !dance")   # OR NOT​
f_search("byte || dance")    # OR​
f_search("byte && dance")    # AND​

Last updated: 2026.05.09 14:33:45

Public security network record in Beijing: No. 11010802032137