> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Operators and values

> Combine typed comparisons, boolean logic, collections, and existence checks

InfraQL validates each operator against the selected field. The dataset schema
is the source of truth for which combinations are available.

## Operators

| Operator | Meaning                   | Example                         |
| -------- | ------------------------- | ------------------------------- |
| `:`      | Normal field match        | `protocol:ssh`                  |
| `:~`     | Does not contain or match | `banner:~"test server"`         |
| `=`      | Exact equality            | `port=443`                      |
| `!=`     | Not equal                 | `status!=closed`                |
| `=~`     | Regular expression        | ``domain=~`^api\\..*` ``        |
| `<`      | Less than                 | `port<1024`                     |
| `<=`     | Less than or equal        | `tls.not_after<=2026-08-01`     |
| `>`      | Greater than              | `http.response.status_code>399` |
| `>=`     | Greater than or equal     | `timestamp>=now-24h`            |

`:` is field-aware. It can mean an exact typed match, contains match, IP or
CIDR match, timestamp lower bound, or another safe operation defined by that
field. Use `=` when exact equality is important.

## Boolean logic

```text theme={null}
protocol:ssh AND (port:22 OR port:2222) AND NOT status:closed
```

Evaluation order is:

1. Parentheses
2. `NOT`
3. `AND`, including implicit `AND`
4. `OR`

Use parentheses whenever the intended grouping would not be obvious to a
reader.

## Collections

A brace-wrapped collection matches any member:

```text theme={null}
port:{80,443,8080,8443}
```

Collections also accept quoted values:

```text theme={null}
country_code:{"GB","DE","NL"}
```

Negating a collection excludes every member:

```text theme={null}
NOT country_code:{US,CA}
```

## Existence

Use `*` to require a populated field:

```text theme={null}
tls.leaf_certificate.sha256:*
```

Use `:~*` to require the field to be absent:

```text theme={null}
tls.leaf_certificate.sha256:~*
```

Typed zero values are not treated as meaningful presence where the schema
defines them as empty.

## IP addresses and CIDRs

IP fields accept IPv4, IPv6, and CIDR values:

```text theme={null}
ip:203.0.113.4
ip:203.0.113.0/24
ip:"2001:db8::/32"
```

Infrawatch canonicalizes valid network values and rejects invalid IP or CIDR
syntax.

## Aliases and dataset scope

Friendly aliases such as `country`, `asn`, `protocol`, and `port` resolve to
typed fields. The same concept can have a different path by dataset:

```text theme={null}
# Host search
services.protocol:ssh

# Service search
protocol:ssh
```

Use the [Data Dictionary](/data-dictionary) or dataset schema endpoint for
available aliases and operators.