contains

contains #

KindAccepts
Value operatorone or more field/substring pairs

Tests whether a string field contains a given substring. Also works on arrays of strings — returns true if any element contains the substring.

Parameters #

ParameterTypeDescription
field namestringThe substring the field must contain.

Multiple entries are combined with AND.

Examples #

contains:
  _ctx.request.uri: "/api"

contains:
  file.path: "nginx"

Notes #

Inside a per-record sub-chain (e.g. for_each), field names resolve against the current record’s own attributes (file.path, log_level, …); at pipeline level they resolve against the pipeline context through the _ctx. prefix. See the Conditions reference for details.

Edit Edit this page