Query Syntax Enforcement for Boolean Expressions (Search)

Sumo Logic will enforce correct syntax for boolean expressions in log search queries. Queries using a shorthand or / and pattern, such as | where a = b or c, are missing an explicit comparison operator for each condition. Because c on its own is not a valid boolean expression, it is being silently skipped rather than evaluated, so these queries may not be returning the results you expect.

Starting September 30, 2026, this validation applies when you create or update a query, monitor, scheduled search, or dashboard panel. Saving one that uses this shorthand will return an error instead of running with misleading results.

note

Existing content that already uses this pattern will keep running as-is. It only errors the next time you edit and save it. We still recommend proactively updating any queries, monitors, scheduled searches, or dashboards that use this shorthand to the explicit form (for example, | where a = b or a = c).