Boolean operators include AND, OR, and NOT.
By default, a space between query terms is considered an implicit “and”, and the search is inclusive of all terms specified.
The order of precedence for AND, OR, and NOT is:
NOT, which binds to what immediately follows it
AND (explicit)
AND (implicit, or no AND is entered, but a space exists between two terms)
OR
The valid symbols for AND are:
AND
and
&&
(single empty space)
The valid symbols for OR are:
OR
or
|| (double bars)
For example:
(network.srcIp="192.168.1.1" OR network.srcIp="192.168.1.4") and network.dstIp="192.26.65.230"
network.srcIp="192.168.1.1" OR network.srcIp="192.168.1.1"
The operator NOT binds to what is immediately after it. For example:
not eventType=api
The valid symbols for NOT are:
NOT
Not
! (exclamation point with no space before next search term)
Note
The exclamation point (
!) can only be used as a prefix for the colon (:) and equal (=) operators.