where
Filters events according to an expression.
Synopsis
where <expression>
Description
The where
operator only keeps events that match the provided
expression and discards all other events.
Use where
to extract the subset of interest of the data. Tenzir's expression
language offers various ways to describe the desired data. In particular,
expressions work across schemas and thus make it easy to concisely articulate
constraints.
<expression>
The expression to evaluate for each event.
Examples
Select all events that contain a field with the value 1.2.3.4
:
where 1.2.3.4
This expression internally completes to :ip == 1.2.3.4
. The type extractor
:ip
describes all fields of type ip
. Use field extractors to only consider a
single field:
where src_ip == 1.2.3.4
As a slight variation of the above: use a nested field name and a temporal
constraint of the field with name ts
:
where id.orig_h == 1.2.3.4 and ts > 1 hour ago
Subnets are first-class values:
where 10.10.5.0/25
This expression unfolds to :ip in 10.10.5.0/25 or :subnet == 10.10.5.0/25
. It
means "select all events that contain a field of type ip
in the subnet
10.10.5.0/25
, or a field of type subnet
the exactly matches 10.10.5.0/25
".
Expressions consist of predicates that can be connected with and
, or
, and
not
:
where 10.10.5.0/25 and (orig_bytes > 1 Mi or duration > 30 min)