where — select values based on a Boolean expression
where operator filters its input by applying a Boolean expression
to each input value and dropping each value for which the expression evaluates
false or to an error.
where keyword is optional since it is an
The "where" keyword requires a regular Zed expression and does not support search expressions. Use the search operator if you want search syntax.
When Zed queries are run interactively, it is highly convenient to be able to omit the "where" keyword, but when where filters appear in Zed source files, it is good practice to include the optional keyword.
An arithmetic comparison
echo '1 2 3' | zq -z 'where this >= 2' -
The "where" keyword may be dropped
echo '1 2 3' | zq -z 'this >= 2' -
A filter with Boolean logic
echo '1 2 3' | zq -z 'where this >= 2 AND this <= 2' -
A filter with array containment logic
echo '1 2 3 4' | zq -z 'where this in [1,4]' -
Boolean functions may be called
echo '1 "foo" 10.0.0.1' | zq -z 'where is(<int64>)' -
Boolean functions with Boolean logic
echo '1 "foo" 10.0.0.1' | zq -z 'where is(<int64>) or is(<ip>)' -