Skip to main content
Sumo Logic

2.3 Find messages containing one of a custom list of strings

Problem

You want to match any of a limited set of custom strings.

Solution

Use the in operator, as in this example:

* | parse "day=*:" as day_of_week 
| where day_of_week in ("Saturday","Sunday")​

Discussion

Use the in operator to find log messages that include particular days. In this case, the in operator replaces multiple matches statements. This would be equivalent:

* | parse "day=*:" as day_of_week 
| where (day_of_week matches "Saturday") OR (day_of_week matches "Sunday")