case_find

Description

Returns a value based on whether a string matches one of several specified text patterns.

This function is a shorthand for case expressions with text match (~) logic and helps shorten queries that would otherwise repeat conditional statements. Use case_find when you want pattern matching — the same behavior the find command uses for free-text search. For strict substring containment, use case_contains instead.

Syntax

case_find {
s: string,
pattern1 -> result1,
pattern2 -> result2,
...
patternN -> resultN,
_        -> default
}

Arguments

Example

Use case: Classify requests by client type

Suppose you want to enrich access logs with a client_type field based on patterns in the request user-agent. Consider these log documents:

Example data

{
  "user_agent": "Mozilla/5.0 (Windows NT 10.0) Chrome/120.0"
},
{
  "user_agent": "Mozilla/5.0 (Macintosh) Safari/605.1"
},
{
  "user_agent": "GitHub-Hookshot/abc123"
}

Example query

create client_type from
  case_find {
    $d.user_agent,
    'Chrome'          -> 'Chrome browser',
    'Safari'          -> 'Safari browser',
    'GitHub-Hookshot' -> 'GitHub webhook',
    _                 -> 'Other'
  }

Example output

{
  "user_agent": "Mozilla/5.0 (Windows NT 10.0) Chrome/120.0",
  "client_type": "Chrome browser"
},
{
  "user_agent": "Mozilla/5.0 (Macintosh) Safari/605.1",
  "client_type": "Safari browser"
},
{
  "user_agent": "GitHub-Hookshot/abc123",
  "client_type": "GitHub webhook"
}