• PRODUCT
  • WHY OBSERVE
  • LEARN
    • BLOG
    • RESOURCES
    • DOCS
    • OBSERVABILITY COURSE
  • CAREERS
  • ABOUT US
Contents Menu Expand Light mode Dark mode Auto light/dark mode
Observe documentation
Light Logo Dark Logo

Getting started

  • Why Observe?
  • Introducing Observe Concepts
    • Advanced Observe Concepts
  • Getting Started with Observe
  • Tutorial: Modeling Weather Data

Managing your Workspace

  • Navigating the Workspace
    • Customizing the Home Page
    • Apps
    • Explore
    • Favorites
    • Using Search and Notifications
    • Other
    • Introducing O11y GPT Help
    • Settings
    • Help
  • Observe Apps

Working with Data

  • About Queries and On-demand Acceleration
  • Data Ingestion
    • Sources
      • Amazon API Gateway logs
      • Amazon S3
      • AWS AppSync
      • AWS CloudTrail
      • Amazon EventBridge
      • Amazon CloudWatch Metrics Streams
      • Amazon CloudWatch Logs
      • GitHub
      • Google Workspace Audit Logs
      • Jira Tickets
      • Windows Servers
      • Zendesk Tickets
    • Forwarders
      • Amazon Kinesis Firehose
      • Elastic Beats
      • Fluent Bit
      • Fluentd
      • Google Cloud Platform (GCP) Pub/Sub
      • Log4j
      • Logstash
      • Observe Lambda
      • OpenTelemetry
      • Prometheus
      • Telegraf
    • Datastreams
    • Endpoints
      • HTTP
      • DDTrace
      • Elasticsearch
      • Kinesis
      • LogPlex
      • OpenTelemetry
      • Prometheus
      • Zipkin
    • Troubleshooting Data Ingestion
  • Observe Integrations
    • Amazon Web Services (AWS) Integration
      • Amazon CloudFront
      • Amazon EC2
      • Amazon Elastic Container Service
        • Amazon Elastic Container Service metrics
      • Amazon RDS
        • Amazon RDS metrics
      • AWS Lambda
        • AWS Lambda metrics
      • Elastic Load Balancing
        • Elastic Load Balancing metrics
    • Basic Threat Intel Integration (Public Preview)
      • Installing the Basic Threat Intel App
      • Using Unified Basic Threat Intel Datasets with Observe
        • Example: Using Unified Hosts-Domains and URL Threatlists
        • Example: Using Unified IPv4 Threatlists
    • Google Cloud Platform (GCP) App
      • GCP Asset Inventory
      • GCP BigQuery
      • GCP Cloud Functions
        • GCP Cloud Functions metrics
      • GCP Cloud Load Balancing
        • GCP Cloud Load Balancing Metrics
      • GCP Cloud Run
        • GCP Cloud Run metrics
      • GCP Cloud SQL
        • GCP Cloud SQL metrics
      • GCP Cloud Storage
        • GCP Cloud Storage metrics
      • GCP Compute
        • GCP Compute metrics
      • GCP Logging
      • GCP Cloud Metrics
      • Google Kubernetes Engine
      • Memorystore Redis
    • GitHub
      • Installing the GitHub App
      • Uninstalling the GitHub App
      • Upgrading to GitHub App v0.7.0
    • GitLab
      • Installing the GitLab App
      • Uninstalling the GitLab App
      • Upgrading the GitLab App to v0.4.0
    • Host Monitoring
      • Installing the Host Monitoring App
      • Uninstalling the Host Monitoring App
    • Jenkins CI/CD Integration
      • Installing the Jenkins App
      • Uninstalling the Jenkins App
    • Kubernetes
      • Installing the Kubernetes App
    • Microsoft Azure
      • Azure Kubernetes Service (AKS)
      • Azure Functions
      • Azure SQL Database
      • Azure SQL Managed Instances
      • Azure Virtual Machines
    • MySQL Database Service
      • Installing the MySQL DB App
      • Uninstalling the MySQL DB App
    • Node Exporter
    • OpenAI (Public Preview)
    • OpenTelemetry
      • Installing the Observe OpenTelemetry App
      • Uninstalling the Observe OpenTelemetry App
    • PostgreSQL Database Service
      • Installing the PostgreSQL DB App
      • Uninstalling the PostgreSQL DB App
  • Observe Datasets and Time
    • Foreign Keys
    • Resource Primary Keys
    • Resource Times
  • Worksheets

Working with Dashboards

  • Creating and using dashboards

Configuring Monitors and Alerts

  • Introduction to Monitors and Alerts
    • Alerting Example: Shared Actions and Monitors
    • Configuring Threshold metrics monitors
    • Creating a Count Monitor
    • Creating a Text Value monitor
    • Promoting resources into notifications
    • Monitor Notification Options
  • Overview of Shared Actions
    • Customizing Alert Messages
    • Shared Action Integrations
      • PagerDuty
      • Importing Auth0 logs using a Custom Webhook
      • Creating an Alert for Jira Tickets

Working with metrics

  • Introduction to Metrics
  • Metrics Shaping Example: Host System Data
  • Adding Metrics Using the Expression Builder

Managing an Observe Instance

  • Using Acceleration Manager with Datasets
  • Credit Manager
  • Understanding the Usage Dashboard
  • Adding Role-based Access Control with Terraform

OPAL Query Language

  • OPAL — Observe Processing and Analysis Language
    • Data types and operators
    • Language syntax
    • Performance
    • Examples
  • OPAL 101 – Getting Started with OPAL
  • OPAL 102 – Shaping Structured and Unstructured Data Using Stages
  • All OPAL verbs
    • OPAL Verbs By Category
      • OPAL Aggregate Verbs
        • aggregate
        • align
        • dedup
        • distinct
        • make_session
        • merge_events
        • rollup
        • statsby
        • timechart
        • bucketize
        • timestats
      • OPAL Filter Verbs
        • always
        • bottomk
        • ever
        • filter
        • limit
        • never
        • topk
      • OPAL Join Verbs
        • exists
        • follow
        • fulljoin
        • join
        • leftjoin
        • lookup
        • surrounding
        • union
        • update_resource
      • OPAL Metadata Verbs
        • add_key
        • interface
        • make_event
        • make_interval
        • make_resource
        • make_session
        • make_table
        • merge_events
        • set_col_enum
        • set_col_immutable
        • set_col_visible
        • set_label
        • set_link
        • set_metric
        • set_primary_key
        • set_pk
        • set_valid_from
        • set_valid_to
        • sort
        • unset_all_links
        • unset_keys
        • unset_link
        • unsort
      • OPAL Metrics Verbs
        • aggregate
        • align
        • rollup
        • set_metric
      • OPAL Projection Verbs
        • drop_col
        • extract_regex
        • make_col
        • pick_col
        • rename_col
      • OPAL Semistructured Verbs
        • extract_regex
        • flatten
        • flatten_all
        • flatten_leaves
        • flatten_single
      • OPAL Deprecated Verb Aliases
        • addfk
        • addkey
        • addmetric
        • changelog
        • coldrop
        • colenum
        • colimmutable
        • colmake
        • colpick
        • colregex
        • colrename
        • colshow
        • droptime
        • fkdrop
        • flattenall
        • flattenleaves
        • flattensingle
        • makeresource
        • makesession
        • merge_event
        • mergeevent
        • reaggregate
        • setlabel
        • setpk
        • setvf
        • setvt
  • All OPAL functions
    • OPAL Functions By Category
      • OPAL Aggregate Functions
        • any
        • any_not_null
        • array_agg
        • array_agg_distinct
        • avg
        • count
        • count_distinct
        • count_distinct_exact
        • deriv
        • first
        • first_not_null
        • last
        • last_not_null
        • max
        • median
        • median_exact
        • min
        • object_agg
        • percentile
        • percentile_cont
        • percentile_disc
        • prom_quantile
        • rate
        • stddev
        • string_agg
        • string_agg_distinct
        • sum
      • OPAL Boolean Functions
        • array_contains
        • bool
        • bool_null
        • contains
        • ends_with
        • eq
        • gt
        • gte
        • in
        • ipv4_address_in_network
        • is_null
        • like
        • lt
        • lte
        • match_regex
        • ne
        • path_exists
        • same
        • search
        • starts_with
      • OPAL Misc Functions
        • any_null
        • asc
        • coalesce
        • desc
        • frame
        • frame_exact
        • if
        • if_null
        • make_object
        • on
        • order_by
      • OPAL Networking Functions
        • int64_to_ipv4
        • ipv4_address_in_network
        • ipv4_network_int64
        • ipv4_to_int64
        • parse_ip
      • OPAL Numeric Functions
        • abs
        • array_length
        • ceil
        • count
        • count_distinct
        • count_distinct_exact
        • dense_rank
        • exp
        • float64
        • float64_null
        • floor
        • hash
        • haversine_distance_km
        • int64
        • int64_null
        • int_div
        • ipv4_network_int64
        • ipv4_to_int64
        • ln
        • log
        • mod
        • numeric_null
        • parse_hex
        • percentile_disc
        • pow
        • prom_quantile
        • rank
        • round
        • row_number
        • sqrt
        • strlen
        • to_days
        • to_hours
        • to_milliseconds
        • to_minutes
        • to_nanoseconds
        • to_seconds
        • to_weeks
        • width_bucket
      • OPAL Regex Functions
        • get_regex
        • get_regex_all
        • match_regex
        • regex
        • replace_regex
      • OPAL Semistructured Functions
        • append_item
        • array
        • array_agg
        • array_agg_distinct
        • array_null
        • array_to_string
        • concat_arrays
        • detect_browser
        • drop_fields
        • embed_sql_params
        • get_field
        • get_item
        • get_jmespath
        • get_regex_all
        • index_of_item
        • insert_item
        • make_array
        • make_fields
        • match_regex
        • object
        • object_agg
        • object_keys
        • object_null
        • parse_csv
        • parse_ip
        • parse_json
        • parse_url
        • path_exists
        • pick_fields
        • pivot_array
        • prepend_item
        • slice_array
        • split
        • tokenize
        • unpivot_array
      • OPAL Special Functions
        • case
        • group_by
        • m
        • metric
        • options
        • primary_key
        • pk
        • valid_for
        • window
      • OPAL String Functions
        • array_to_string
        • concat_strings
        • contains
        • decode_base64
        • decode_uri
        • decode_uri_component
        • detect_browser
        • editdistance
        • encode_base64
        • encode_uri
        • encode_uri_component
        • format_time
        • get_regex
        • get_regex_all
        • int64_to_ipv4
        • left
        • like
        • lower
        • lpad
        • ltrim
        • match_regex
        • parse_csv
        • parse_kvs
        • parse_timestamp
        • pivot_array
        • position
        • regex
        • replace
        • replace_regex
        • right
        • rpad
        • rtrim
        • search
        • split
        • split_part
        • starts_with
        • string
        • string_agg
        • string_agg_distinct
        • string_null
        • substring
        • tokenize
        • tokenize_part
        • trim
        • unpivot_array
        • upper
        • variant_type_name
      • OPAL Time Functions
        • abs
        • avg
        • bin_end_time
        • bin_start_time
        • deriv
        • duration
        • duration_hr
        • duration_min
        • duration_ms
        • duration_null
        • duration_sec
        • format_time
        • from_milliseconds
        • timestamp_ms
        • from_nanoseconds
        • timestamp_ns
        • from_seconds
        • timestamp_s
        • median
        • median_exact
        • now
        • parse_isotime
        • parse_timestamp
        • percentile
        • percentile_cont
        • percentile_disc
        • query_end_time
        • query_start_time
        • rate
        • row_end_time
        • row_timestamp
        • stddev
        • sum
        • timestamp_null
        • to_days
        • to_hours
        • to_milliseconds
        • to_minutes
        • to_nanoseconds
        • to_seconds
        • to_weeks
        • valid_for
      • OPAL Window Functions
        • any
        • any_not_null
        • avg
        • count
        • count_distinct
        • count_distinct_exact
        • dense_rank
        • deriv
        • first
        • first_not_null
        • lag
        • lag_not_null
        • last
        • last_not_null
        • lead
        • lead_not_null
        • max
        • median
        • median_exact
        • min
        • object_agg
        • percentile
        • percentile_cont
        • percentile_disc
        • rank
        • rate
        • row_number
        • stddev
        • sum
      • OPAL Deprecated Function Aliases
        • array_pivot
        • array_unpivot
        • countdistinct
        • countdistinctexact
        • decodebase64
        • denserank
        • encodebase64
        • endswith
        • groupby
        • ifnull
        • isnull
        • makeobject
        • match_regex_all
        • medianexact
        • milliseconds
        • nanoseconds
        • orderby
        • parsehex
        • parseip
        • parseisotime
        • parsejson
        • parsekvs
        • parseurl
        • percentilecont
        • percentiledisc
        • primarykey
        • queryendtime
        • querystarttime
        • regex_match
        • regex_replace
        • row_endtime
        • rownumber
        • seconds
        • startswith
        • strcat
        • string_concat
        • validfor

Reference

  • Single Sign On (SSO) Configurations for Observe
    • Configuring Azure Active Directory Single Sign On (SSO)
    • Google Workspace SAML and Single Sign On (SSO) Configuration
    • Configuring Okta for SAML and Single Sign On (SSO)
    • Configuring OneLogin for Single Sign On (SSO)
  • Observe Glossary
  • Helpful Hints
  • FAQ
  • Units of Measure

Release Notes

  • Observe OPAL Updates
    • 2023 Release Notes
      • March 3, 2023 Release Notes
      • March 10, 2023 Release Notes
      • March 17, 2023 Release Notes
      • February 3, 2023 Release Notes
      • January 4, 2023 Release Notes
      • January 11, 2023 Release Notes
      • January 20, 2023 Release Notes
      • January 27, 2023 Release Notes
    • 2022 release notes
      • December 1, 2022 release notes
      • December 7, 2022 release notes
      • December 14, 2022 release notes
      • December 20, 2022 release notes
      • November 2, 2022 release notes
      • November 9, 2022 release notes
      • November 16, 2022 release notes
      • October 5, 2022 release notes
      • October 12, 2022 release notes
      • October 20, 2022 release notes
      • October 26, 2022 release notes
      • September 1, 2022 release notes
      • September 7, 2022 release notes
      • September 14, 2022 release notes
      • September 22, 2022 release notes
      • September 28, 2022 release notes
      • August 3, 2022 release notes
      • August 10, 2022 release notes
      • August 17, 2022 release notes
      • August 24, 2022 release notes
      • July 13, 2022 release notes
      • July 20, 2022 release notes
      • July 27, 2022 release notes
      • June 2, 2022 release notes
      • June 15, 2022 release notes
      • May 11, 2022 release notes
      • May 18, 2022 release notes
      • May 25, 2022 release notes
      • April 6, 2022 release notes
      • April 20, 2022 release notes
      • April 27, 2022 release notes
      • March 2, 2022 release notes
      • March 9, 2022 release notes
      • March 16, 2022 release notes
      • February 2, 2022 release notes
      • February 9, 2022 release notes
      • February 17, 2022 release notes
      • January 5, 2022 release notes
      • January 12, 2022 release notes
      • January 19, 2022 release notes
    • 2021 release notes
      • December 1, 2021 release notes
      • December 8, 2021 release notes
      • December 15, 2021 release notes

API Reference

  • Exporting Query Results in CSV or JSON Format

CLI Reference

  • Observe Command Line Interface Tool Overview
    • Get CLI Command
    • Help CLI Command
    • List CLI Command
    • Login Command
    • Query Command

Terraform Reference

  • Working with Observe and Terraform
    • observe_app
    • observe_board
    • observe_dashboard
    • observe_dataset
    • observe_datastream
    • observe_default_dashboard
    • observe_folder
    • observe_link
    • observe_monitor
    • observe_oid
    • observe_query
    • observe_rbac_group
    • observe_terraform
    • observe_user
    • observe_worksheet
    • observe_workspace
    • observe_app_datasource
    • observe_app
    • observe_board
    • observe_bookmark
    • observe_bookmark_group
    • observe_channel
    • observe_channel_action
    • observe_dashboard
    • observe_dashboard_link
    • observe_dataset
    • observe_datastream
    • observe_datastream_token
    • observe_default_dashboard
    • observe_folder
    • observe_http_post
    • observe_layered_setting_record
    • observe_link
    • observe_monitor
    • observe_monitor_action
    • observe_poller
    • observe_preferred_path
    • observe_rbac_default_group
    • observe_rbac_group
    • observe_rbac_group_member
    • observe_rbac_statement
    • observe_source_dataset
    • observe_worksheet
    • observe_workspace

search¶

Description¶

Return true if the for text is matched in the input string in (case-insensitive). All the for arguments must individually match, but ordering between them doesn’t matter.

See also contains

Return type¶

bool

Domain¶

This is a scalar function (calculates a single output value for a single input row.)

Categories¶

  • Boolean

  • String

Usage¶

search( in, for ... )

Argument

Type

Required

Multiple

in

string

Required

Only one

for

string

Required

Can be multiple

Examples¶

filter search(log, "ERROR")

Pass through all observations where field log contains the string ERROR.

filter search("foo bar baz", "FOO B", "baz", "aR")

This will return true, because each of the sub-strings "FOO B", "baz" and "aR" match, ignoring case, and ignoring relative ordering. Note that the match "FOO B" and "baz" overlap each other.

Next
starts_with
Previous
same
Copyright © 2023 Observe, Inc.

Have comments about the Observe docs?

Contents
  • search
    • Description
    • Return type
    • Domain
    • Categories
    • Usage
    • Examples