Skip to main content
Version: v4.27

where

Keeps only events for which the given predicate is true.

where predicate:bool

Description​

The where operator only keeps events that match the provided predicate and discards all other events. Only events for which it evaluates to true pass.

Examples​

Keep only events where src_ip is 1.2.3.4​

where src_ip == 1.2.3.4

Use a nested field name and a temporal constraint on the ts field​

where id.orig_h == 1.2.3.4 and ts > now() - 1h

Combine subnet, size and duration constraints​

where src_ip in 10.10.5.0/25 and (orig_bytes > 1Mi or duration > 30min)