Filters

# FleX
modifyTimestamp ge today
createTimestamp ge last 3 days

# SCIM
modifyTimestamp ge "today"
createTimestamp ge "last 3 days"

# LDAP
(modifyTimestamp>=today)
(createTimestamp>=last 3 days)

# JSON
{"modifyTimestamp": {"ge": "today"}}
{"createTimestamp": {"ge": "last 3 days"}}

# Simple equality
status = active
status is active

# Multiple conditions (implicit AND)
result=ok duration<=50ms

# OR conditions
result=ok or result=warn
result=ok, result=warn

# Natural language
duration is at most 100ms
name starts with John

result=ok duration<=50ms
result=ok and duration<=50ms
result=ok & duration<=50ms
result=ok && duration<=50ms

result=ok or result=warn
result=ok, result=warn
result=ok | result=warn
result=ok || result=warn

# Parses as: (channel=LDAP AND op=Search) OR (channel=REST AND op=Search)
channel=LDAP op=Search or channel=REST op=Search

# Use parentheses to override
channel=LDAP (op=Search or op=Bind)

# These are all equivalent
age != 5
age ! = 5     # space after ! is OK
age !eq 5     # attached to word operator
age ! eq 5    # space after ! is OK

# Natural language prefixes
age is greater than 5
age is not greater than 5    # negated with "is not"
age isn't greater than 5     # contraction form
age isnt greater than 5      # without apostrophe

# "not" prefix works with all operators
name not contains foo
path not starts with /tmp
email not exists

result != ok
result !eq ok
result not eq ok
cn !starts with 'Test'
cn not starts with 'Test'
email !exists
email not exists

!(result = ok)
not(result = ok)

status = active
priority = 42
enabled = true
duration <= 50ms

cn = `John Doe`
cn = 'John Doe'
cn = "John Doe"

value = null       # Treated as "not exists"
value = nil        # Same as null
value = true       # Boolean
value = false      # Boolean

value = `null`     # Matches the string "null"

# Pipe syntax (no whitespace)
sn|givenName|name contains 'admin'

# Brace syntax (whitespace allowed)
{sn, givenName, name} contains 'admin'

# Both expand to:
sn contains 'admin' or givenName contains 'admin' or name contains 'admin'

status in (active, pending, review)
status in [active, pending, review]
role not in (admin, superuser)

status in ()       # Same as: status exists
status not in ()   # Same as: status not exists

member:dn := "cn=John,ou=users,dc=example,dc=com"
ou:dn := Engineering

monitoring {
  rules = [
    { action = exclude, where = "scribe.result=ok duration.seconds<=50ms" }
    { action = exclude, name = "Hints.*", where = "duration.seconds is at most 100ms" }
    { action = include, where = "scribe.result != ok, duration.seconds >= 5s" }
  ]
}

transcribes {
  ldap {
    filter = "objectClass=Person employeeStatus!=terminated"
    filter = "objectClass=Person (employeeType=FTE or employeeType=Contractor)"
  }
}

// Simple equality
{"cn": "john"}

// Multiple conditions (AND)
{"cn": "john", "sn": "doe"}

// Array of values (OR)
{"cn": ["john", "jane"]}

// Operator with value
{"cn": {"sw": "A"}}

// Explicit logical operators
{"_or_": [{"cn": "a"}, {"cn": "b"}]}
{"_not_": {"disabled": "true"}}

// Object root - all conditions ANDed
{"cn": "john", "sn": "doe", "active": "true"}

// Array root - all elements ANDed
[{"cn": "john"}, {"sn": "doe"}]

// OR - any condition matches
{"_or_": [{"status": "active"}, {"status": "pending"}]}

// AND - all conditions match (explicit)
{"_and_": [{"role": "admin"}, {"active": "true"}]}

// NOT - negate condition
{"_not_": {"disabled": "true"}}

// Nested logic
{"_and_": [
  {"type": "user"},
  {"_or_": [{"role": "admin"}, {"role": "operator"}]}
]}

{"age": 25}           // age = "25"
{"active": true}      // active = "true"
{"deleted": null}     // deleted not exists

// Search across multiple name fields
{"sn|givenName|cn": {"co": "admin"}}

// Equivalent to:
{"_or_": [
  {"sn": {"co": "admin"}},
  {"givenName": {"co": "admin"}},
  {"cn": {"co": "admin"}}
]}

// Complex query with mixed operators
{
  "objectClass": "user",
  "cn": {"sw": "A"},
  "department": ["Engineering", "Product"],
  "_not_": {"status": "terminated"}
}

// Array operator (IN)
{"status": {"in": ["active", "pending", "review"]}}

// Multiple operators on same attribute
{"age": {"ge": "18", "lt": "65"}}

cn eq "john"
cn sw "A" and sn pr
not (disabled eq "true")
userName eq "john" or email co "@example.com"

userName eq "john" and active eq true
userName eq "john" or userName eq "jane"
not (disabled eq "true")

userName sw "a" and (role eq "admin" or role eq "operator")

(cn=john)
(cn=john*)
(&(objectClass=user)(cn=john*))
(|(cn=john)(cn=jane))
(!(disabled=true))

// AND - all must match
(&(objectClass=user)(status=active)(department=Engineering))

// OR - any must match
(|(cn=john)(cn=jane)(cn=bob))

// NOT - negate
(!(disabled=true))

// Nested
(&(objectClass=user)(|(role=admin)(role=operator)))

(member:dn:=cn=John,ou=users,dc=example,dc=com)
(ou:dn:=Engineering)