Functions Reference Guide

This guide covers functions available for querying array fields in SigNoz.

Available Functions

hasToken() Function

Check if a whole token is present in a string.

The needle must be a single token: one uninterrupted run of ASCII letters and digits (A-Z, a-z, 0-9) with no separator characters. hasToken matches the needle only as a complete word, never as a substring inside another word (for example, it matches uuid123 but not abcuuid123xyz).

Syntax:

hasToken(field, value)

Examples:

# Valid: the needle is a single alphanumeric token
hasToken(body, 'uuid123')
hasToken(body, 'timeout')

# Invalid: the needle contains separators (@ and .), returns HTTP 400
hasToken(body, 'john@test.com')
 
# Correct: CONTAINS matches across separators
body CONTAINS 'john@test.com'

has() Function

Checks if an array contains a specific value.

Syntax:

has(field, value)

Examples:

has(body.user_ids, 123)
has(body.tags, 'production')
has(body.regions, 'us-east')

Important Notes

1. Body fields only - Functions currently work only with JSON body fields (fields prefixed with body.) except for the hasToken function.
2. Array data - The field must contain an array for these functions to work properly

Combining with Other Conditions

Functions can be combined with other query conditions:

# Find production logs with error status codes
has(body.tags, 'production') AND status_code IN [500, 502, 503]

Common Use Cases

Filtering by Tags

# Find all logs with production tag
has(body.tags, 'production')
 
## Error Messages
 
Common errors you might encounter:
 
- **"unknown function"** - Check function name spelling and case
- **"function expects key and value parameters"** - Ensure you're providing both field and value
- **"function supports only body JSON search"** - Use only with `body.` prefixed fields