---
id: contains
title: contains Search Operator
sidebar_label: contains
description: Use the contains operator to compare string values of two parsed fields and check if one field's value exists within another.
slug: /help/docs/search/search-query-language/search-operators/contains/
canonical: https://www.sumologic.com/help/docs/search/search-query-language/search-operators/contains/
---

The `contains` operator compares string values of two [parsed](/docs/search/search-query-language/parse-operators) fields and returns a boolean result based on whether the second field's value exists in the first.


## Syntax

`contains(<field1>, <field2>) as <field>`

`<field1> contains <field2> as <field>`

`| where <field1> contains <field2>`

`| where contains(<field1>, <field2>)`

## Rules

* Requires field values to be strings. You may [cast values](/docs/search/search-query-language/search-operators/manually-cast-data-string-number) if needed.
* The full string of field2 must exist within field1.
* Comparison is case-sensitive.
* Returns `true` when the value from field2 was found and `false` when the value was not found in field1.
* Returns `true` if field1 and field2 are empty, and `false` when only one is empty.

## Examples

### Filter rows where one field exists within another

Given the following example log:

```sh
instance of alertNotification{ EventIdentifier = 100; Address = 123 Main Street, San Francisco, California; City = San Francisco; State = CA;}
```

Parsing the log so the fields are `city` with the value "San Francisco" and `address` with the value "123 Main Street, San Francisco, California" you'd use the contains operator to return the log if the value of `city` is found in the value of `address`.

```sumo
| where contains(address, city)
```

### Return a boolean field indicating whether a path contains a string

Use `contains` with `as` to create a boolean field for downstream filtering:

```sumo
_sourceCategory=Apache/Access
| parse "GET * HTTP" as url
| contains(url, "/admin") as is_admin_request
| where is_admin_request = true
```