Skip to content

Commit 1d92534

Browse files
Update doc 2 (#238)
* docs update - etcd support removed - Aggregation cache metrics - not match(), not str_match - new patterns for match_all() * update the full-text-search.md file * update the full-text-search.md file
1 parent 97026d0 commit 1d92534

File tree

1 file changed

+74
-1
lines changed

1 file changed

+74
-1
lines changed

docs/sql-functions/full-text-search.md

Lines changed: 74 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,33 @@ This query filters logs from the `default` stream where the `k8s_pod_name` field
2525
<br>
2626
![str_match](../images/sql-reference/str-match.png)
2727

28+
---
29+
30+
### `not str_match(field, 'value')`
31+
**Description**:<br>
32+
33+
- Filters logs where the specified field does NOT contain the exact string value.
34+
- The match is case-sensitive.
35+
- Only logs that do not include the exact characters and casing specified will be returned.
36+
- Can be combined with other conditions using AND/OR operators.
37+
38+
**Example**: <br>
39+
```sql
40+
SELECT * FROM "default" WHERE NOT str_match(k8s_app_instance, 'dev2')
41+
```
42+
![not str_match](../images/sql-reference/not-str-match.png)
43+
44+
**Combining multiple NOT conditions with AND:**
45+
```sql
46+
SELECT * FROM "default" WHERE (NOT str_match(k8s_app_instance, 'dev2')) AND (NOT str_match(k8s_cluster, 'dev2'))
47+
```
48+
![not str_match with AND operator](../images/sql-reference/not-str-match-with-and.png)
49+
50+
**Combining NOT conditions with OR:**
51+
```sql
52+
SELECT * FROM "default" WHERE NOT ((str_match(k8s_app_instance, 'dev2') OR str_match(k8s_cluster, 'dev2')))
53+
```
54+
![not str_match with OR operator](../images/sql-reference/not-str-match-with-or.png)
2855

2956
---
3057
### `str_match_ignore_case`
@@ -46,7 +73,7 @@ SELECT * FROM "default" WHERE str_match_ignore_case(k8s_pod_name, 'MAIN-OPENOBSE
4673
This query filters logs from the `default` stream where the `k8s_pod_name` field contains any casing variation of `main-openobserve-ingester-1`, such as `MAIN-OPENOBSERVE-INGESTER-1`, `Main-OpenObserve-Ingester-1`, or `main-openobserve-ingester-1`.
4774
<br>
4875
![str_match_ignore_case](../images/sql-reference/str-ignore-case.png)
49-
76+
<br>
5077
---
5178

5279
### `match_all`
@@ -69,6 +96,52 @@ This query returns all logs in the `default` stream where the keyword `openobser
6996
<br>
7097
![match_all](../images/sql-reference/match-all.png)
7198

99+
100+
**More pattern support**
101+
The `match_all` function also supports the following patterns for flexible searching:
102+
103+
- **Prefix search**: Matches keywords that start with the specified prefix:
104+
```sql
105+
SELECT * FROM "default" WHERE match_all('ab*')
106+
```
107+
- **Postfix search**: Matches keywords that end with the specified suffix:
108+
```sql
109+
SELECT * FROM "default" WHERE match_all('*ab')
110+
```
111+
- **Contains search**: Matches keywords that contain the substring anywhere:
112+
```sql
113+
SELECT * FROM "default" WHERE match_all('*ab*')
114+
```
115+
- **Phrase prefix search**: Matches keywords where the last term uses prefix matching:
116+
```sql
117+
SELECT * FROM "default" WHERE match_all('key1 key2*')
118+
```
119+
### `not match_all('value')`
120+
**Description**: <br>
121+
122+
- Filters logs by excluding records where the keyword appears in any field that has the Index Type set to Full Text Search in the stream settings.
123+
- This function is case-insensitive and excludes matches regardless of the keyword's casing.
124+
- **Important**: Only searches fields configured as Full Text Search fields. Other fields in the record are not evaluated.
125+
- Provides significant performance improvements when used with indexed fields.
126+
127+
**Example**:
128+
```sql
129+
SELECT * FROM "default" WHERE NOT match_all('foo')
130+
```
131+
This query returns all logs in the `default` stream where the keyword `foo` does NOT appear in any of the full-text indexed fields. Fields not configured for full-text search are ignored.
132+
133+
**Combining NOT match_all with NOT str_match**:
134+
```sql
135+
SELECT * FROM "default" WHERE (NOT str_match(f1, 'bar')) AND (NOT match_all('foo'))
136+
```
137+
This query returns logs where field `f1` does NOT contain `bar` AND no full-text indexed field contains `foo`. In other words, it excludes records that match either condition.
138+
139+
**Using NOT with OR conditions**:
140+
```sql
141+
SELECT * FROM "default" WHERE NOT (str_match(f1, 'bar') OR match_all('foo'))
142+
```
143+
This query returns logs where BOTH conditions are false: field `f1` does NOT contain `bar` AND no full-text indexed field contains `foo`. In other words, it excludes records that match either condition.
144+
72145
---
73146

74147
### `re_match`

0 commit comments

Comments
 (0)