search

Operator

  search — select values based on a search expression

Synopsis

[search] <sexpr>

Description

The search operator filters its input by applying a search expression <sexpr> to each input value and dropping each value for which the expression evaluates to false or to an error.

The search keyword is optional since it is an implied operator.

When Zed queries are run interactively, it is convenient to be able to omit the "search" keyword, but when search filters appear in Zed source files, it is good practice to include the optional keyword.

Examples

A simple keyword search for "world"

echo '"hello, world" "say hello" "goodbye, world"' | zq -z 'search world' -

=>

"hello, world"
"goodbye, world"

Search can utilize arithmetic comparisons

echo '1 2 3' | zq -z 'search this >= 2' -

=>

2
3

The "search" keyword may be dropped

echo '1 2 3' | zq -z '2 or 3' -

=>

2
3

A search with Boolean logic

echo '1 2 3' | zq -z 'search this >= 2 AND this <= 2' -

=>

2

The AND operator may be omitted through predicate concatenation

echo '1 2 3' | zq -z 'search this >= 2 this <= 2' -

=>

2

Concatenation for keyword search

echo '"foo" "foo bar" "foo bar baz" "baz"' | zq -z 'foo bar' -

=>

"foo bar"
"foo bar baz"

Search expressions match fields names too

echo '{foo:1} {bar:2} {foo:3}' | zq -z foo -

=>

{foo:1}
{foo:3}

Boolean functions may be called

echo '1 "foo" 10.0.0.1' | zq -z 'search is(<int64>)' -

=>

1

Boolean functions with Boolean logic

echo '1 "foo" 10.0.0.1' | zq -z 'search is(<int64>) or is(<ip>)' -

=>

1
10.0.0.1