Filters

The filter supports primitive filters and logical filters (“not”, “and”, “or”) comprised of one or more primitive filters. Format of primitive filter is as follows:

    {"type" : "<OPERATOR>", "field": "<COLUMN_NAME>", "value": "<COLUMN_VALUE>"}

For primitive filters, operator can be a comparison operator like eq, ne, lt, lte, gt or gte. Operator could also be in, regex, subnet, contains or range.

Some examples of primitive filters might include:

   {"type": "eq", "field": "src_address", "value": "7.7.7.7"}

   {"type": "regex", "field": "src_hostname", "value": "prod.*"}

   {"type": "subnet", "field": "src_addr", "value": "1.1.11.0/24"}

   # Note, 'in' clause uses 'values' key instead of 'value'
   {"type": "in", "field": "src_port", "values": [80, 443]}

You can also specify complex filters using boolean operations like not, and or or. Following are some examples of these type of filters:

    # "and" and "or" operators need to specify list of "filters"
    {"type": "and",
        "filters": [
            {"type": "in", "field": "src_port", "values": [80, 443]},
            {"type": "regex", "field": "src_hostname", "value": "prod.*"}
        ]
    }

    # "not" operator needs to specify a "filter"
    {"type": "not",
        "filter": {"type": "subnet", "field": "src_addr", "value": "1.1.11.0/24"}
    }

More formally, schema of filter in the flow search request is as follows: