where

Operator

  where — select values based on a Boolean expression

Synopsis

[where] <expr>

Description

The where operator filters its input by applying a Boolean expression <expr> to each input value and dropping each value for which the expression evaluates to false or to an error.

The where keyword is optional since it is an implied operator.

The "where" keyword requires a regular Zed expression and does not support search expressions. Use the search operator if you want search syntax.

When Zed queries are run interactively, it is highly convenient to be able to omit the "where" keyword, but when where filters appear in Zed source files, it is good practice to include the optional keyword.

Examples

An arithmetic comparison

echo '1 2 3' | zq -z 'where this >= 2' -

=>

2
3

The "where" keyword may be dropped

echo '1 2 3' | zq -z 'this >= 2' -

=>

2
3

A filter with Boolean logic

echo '1 2 3' | zq -z 'where this >= 2 AND this <= 2' -

=>

2

A filter with array containment logic

echo '1 2 3 4' | zq -z 'where this in [1,4]' -

=>

1
4

A filter with inverse containment logic

echo '1 2 3 4' | zq -z 'where ! (this in [1,4])' -

=>

2
3

Boolean functions may be called

echo '1 "foo" 10.0.0.1' | zq -z 'where is(<int64>)' -

=>

1

Boolean functions with Boolean logic

echo '1 "foo" 10.0.0.1' | zq -z 'where is(<int64>) or is(<ip>)' -

=>

1
10.0.0.1