1. Using Oracle Log Analytics Search
  2. Explore Log Data
  3. Write Search Queries
  4. Use Boolean Expressions

Use Boolean Expressions

The Oracle Log Analytics Search feature has the capabilities of LIKE and REGEX, as per standard conventions. Boolean Expressions can have a value of either true or false.

The following table lists the supported Boolean Expressions, along with a brief description of each.

Boolean Expression Description
AND Use this expression to view only those logs which contain both specified parameters.
NOT IN or IN Use this expression to find data which is in a specified subset of available data. For example, ‘Entity Type’ IN (‘Database Instance’,‘Automatic Storage Management’,’Listener’,’Cluster’) will first consider only those logs which contain ‘Database Instance’, ‘Automatic Storage’, Listener, or Cluster, and then identify those logs containing ‘Entity Type’. However, when you use NOT IN, then log entries with the specified keyword or phrase are returned, excluding the specified entries. For example, ‘Entity Type’ NOT IN (‘Database Instance’,’Automatic Storage Management’,’Listener’,’Cluster’) first filters out log entries with ‘Database Instance’, ‘Automatic Storage Management’, Listener, and Cluster, and then returns those log entries where the value of ‘Target Type’ is not one of the specified values.

The reserved word NULL is supported with this Boolean operator.

NOT LIKE or LIKE Use this expression to find data which either matches or does not match the specified character pattern. The character pattern is a string that can contain one or more wildcard characters.
NOT LIKE IN or LIKE IN Similar to [NOT] IN, this expression allows you to use a shorthand for expressing multiple LIKE clauses together.
OR Use this to view those logs which contain either of the specified parameters.

The Oracle Log Analytics Search language supports nesting Boolean expressions within other Boolean expressions. For example, consider the following query: 

fatal ('order' OR host LIKE '*.oracle.com')

Running this query returns all logs which contain fatal and either contain the keyword order or originated from a host whose name ends with .oracle.com.