Skip to main content
InfraQL validates each operator against the selected field. The dataset schema is the source of truth for which combinations are available.

​
Operators

: is field-aware. It can mean an exact typed match, contains match, IP or CIDR match, timestamp lower bound, or another safe operation defined by that field. Use = when exact equality is important.

​
Boolean logic

Evaluation order is:
  1. Parentheses
  2. NOT
  3. AND, including implicit AND
  4. OR
Use parentheses whenever the intended grouping would not be obvious to a reader.

​
Collections

A brace-wrapped collection matches any member:
Collections also accept quoted values:
Negating a collection excludes every member:

​
Existence

Use * to require a populated field:
Use :~* to require the field to be absent:
Typed zero values are not treated as meaningful presence where the schema defines them as empty.

​
IP addresses and CIDRs

IP fields accept IPv4, IPv6, and CIDR values:
Infrawatch canonicalizes valid network values and rejects invalid IP or CIDR syntax.

​
Aliases and dataset scope

Friendly aliases such as country, asn, protocol, and port resolve to typed fields. The same concept can have a different path by dataset:
Use the Data Dictionary or dataset schema endpoint for available aliases and operators.