Skip to content

case_contains

Description

Returns a value based on whether a string contains one of several specified substrings.

This function is a shorthand for case expressions with contains logic and helps shorten queries that would otherwise repeat conditional statements.

Note

Like all case statements, case_contains returns the first matching value. The order of clauses is important.

Syntax

case_contains {
s: string,
substring1 -> result1,
substring2 -> result2,
...
substringN -> resultN,
_          -> default
}

Arguments

NameTypeRequiredDescription
sstringtrueThe string to check for substrings
substringstringtrueA substring to search for within s
resultanytrueThe value to return if the substring is found
_anyfalseDefault value if no substrings match

Example

Use case: Map cluster names to environment names

Suppose you want to convert subsystem metadata into full environment names. Consider these log documents:

{
  "cluster_name": "acme-prod-cluster"
},
{
  "cluster_name": "acme-dev-cluster"
},
{
  "cluster_name": "acme-stg-cluster"
}
create environment_name from 
  case_contains {
    $d.cluster_name,
    '-prod-' -> 'production',
    '-dev-'  -> 'development',
    '-stg-'  -> 'staging',
    _        -> 'test'
  }

Output

{
  "cluster_name": "acme-prod-cluster",
  "environment_name": "production"
},
{
  "cluster_name": "acme-dev-cluster",
  "environment_name": "development"
},
{
  "cluster_name": "acme-stg-cluster",
  "environment_name": "staging"
}