# `contains`

## Description

Returns `true` if the given substring appears anywhere in a string; otherwise return `false`. The check is case sensitive. For case-insensitive matching, normalize both values with `toLowerCase()` or `toUpperCase()` before calling `contains`.

## Syntax

Like many functions in DataPrime, `contains` supports [two notations](https://coralogix.com/docs/dataprime/language-reference/functions-reference/index.md), **function** and **method** notation. These interchangeable forms allow flexibility in how you structure expressions.

```dataprime
contains(value: string, substring: string): bool
```

```dataprime
(value: string).contains(substring: string): bool
```

## Arguments

| Name      | Type   | Required | Description                                               |
| --------- | ------ | -------- | --------------------------------------------------------- |
| value     | string | **true** | The full string to search (haystack)                      |
| substring | string | **true** | The substring to look for within the full string (needle) |

## Example 1

**Check if an AWS Account ID appears in an ARN**

Sometimes only a broader field such as an ARN is available. Use `contains` to test for the presence of the account ID.

### Example query

```dataprime
create is_from_account from contains(arn_field, '074157727657')
```

```dataprime
create is_from_account from arn_field.contains('074157727657')
```

### Example output

Both notations produce a field `is_from_account` that is `true` if the ARN contains the account ID.

## Example 2

**Use case 2: Check if a domain appears within a URL**

Use `contains` to verify if a domain name exists inside a given URL.

### Example query

```dataprime
create is_from_google from contains(url, 'google.com')
```

```dataprime
create is_from_google from url.contains('google.com')
```

### Example output

Both notations produce a field `is_from_google` that is `true` if the URL contains `google.com`.