not()

The not() function determines whether an expression is true or false and returns its logical negation (NOT).

Syntax

Parameters

EXPR

The expression whose true/false value to determine. What counts as true differs by series. In the 5.0 series (through 5.0.2605.2), only boolean values are determined as true or false; a non-boolean, non-null value (such as a number or string) is not determined and the function returns null. In the 4.0 series starting with 4.0.2609.0, boolean false, the numbers 0 and NaN, an empty string, and an empty list, array, or map are treated as false, and every other value is treated as true. In both series, null is excluded from true/false determination and is returned as-is.

Description

The not() function evaluates EXPR, determines whether it is true or false, and returns the opposite of that result. If it is treated as true, the function returns false; if it is treated as false, it returns true. In the 4.0 series starting with 4.0.2609.0, for example, not(0) returns true, not(5) returns false, and not("") returns true. In the 5.0 series (through 5.0.2605.2), a non-boolean, non-null value like these is not determined as true or false, so not() returns null in each of these cases instead.

If EXPR is null, the function does not determine true or false, and returns null as-is.

The return type is always boolean or null.

Error codes

N/A

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

1. Check whether the status code is not 200

   table limit=5 WEB_APACHE_SAMPLE | eval result = not(status == 200) | fields status, result
   

2. Filter requests that are neither GET nor POST

   table limit=5 WEB_APACHE_SAMPLE | search not(in(method, "GET", "POST"))
   | # Only request records that are not GET or POST are returned.
   

3. Filter User-Agents that are not crawlers

   table limit=5 WEB_APACHE_SAMPLE | eval is_bot = match(agent, "(?i)bot|crawler") | search not(is_bot)
   | # Only request records that are not crawlers are returned.
   

4. NULL input

   json "{'val': null}" | eval result = not(val)
   | # result: null
   

5. Negating the number 0 — result differs by series

   json "{'val': 0}" | eval result = not(val)
   | # 5.0 series (through 5.0.2605.2) result: null / 4.0 series (4.0.2609.0 and later) result: true
   

   In the 5.0 series (through 5.0.2605.2), EXPR is only determined as true or false when it is a boolean value; since 0 is not boolean, the function returns null. In the 4.0 series starting with 4.0.2609.0, the number 0 is treated as false, so the function returns the opposite, true.

Change history