> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Patterns and text

> Use contains, wildcards, regular expressions, phrases, and banner terms

String fields can support contains, wildcard, or regular-expression matching.
The dataset schema lists the operators available for each field.

## Contains

The `:` operator performs the field's normal match:

```text theme={null}
isp:"Cloudflare"
banner:"OpenSSH"
```

For contains-enabled strings, Infrawatch performs a case-insensitive substring
match. Keyword-like enums and identifiers remain exact.

## Wildcards

Use `*` inside a value where the field supports wildcard matching:

```text theme={null}
host:*.example.com
http.title:*dashboard*
```

An unescaped `*` by itself is an existence check.

## Regular expressions

Use `=~` with a backtick-delimited expression:

```text theme={null}
domain=~`^api-[0-9]+\\.example\\.com$`
```

Regular expressions are validated and bounded before execution. Not every
field enables them.

## Quoted phrases

Quote values containing spaces, punctuation, or boolean words:

```text theme={null}
banner:"Dovecot ready"
http.title:"Sign in to your account"
```

Quoted banner values use exact and phrase-oriented matching. They do not use
fuzzy matching.

## Bare terms

On host and service search, a bare term searches observed banner text:

```text theme={null}
BusyBox
```

Quote a bare phrase when word order matters:

```text theme={null}
"Index of /"
```

Prefer a fielded query in saved searches and automation because it communicates
intent and is easier to validate.

## Negate a pattern

Use `:~` to exclude the normal contains match:

```text theme={null}
banner:~"test server"
```

Or use `NOT` around any expression:

```text theme={null}
NOT (host:*.internal.example.com OR http.title:*staging*)
```

<Card title="Browse field policies" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/data-dictionary.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=7610d618bf3603732c6f9102b62101df" href="/data-dictionary" horizontal width="32" height="32" data-path="images/products/data-dictionary.svg">
  Check field types, supported operators, and aliases before building a
  long-lived query.
</Card>