Query filters

info

Apache Druid supports two query languages: Druid SQL and native queries. This document describes the native language. For information about aggregators available in SQL, refer to the SQL documentation.

A filter is a JSON object indicating which rows of data should be included in the computation for a query. It’s essentially the equivalent of the WHERE clause in SQL. Filters are commonly applied on dimensions, but can be applied on aggregated metrics, for example, see Filtered aggregator and Having filters.

By default, Druid uses SQL compatible three-value logic when filtering. See Boolean logic for more details.

Apache Druid supports the following types of filters.

Selector filter

The simplest filter is a selector filter. The selector filter matches a specific dimension with a specific value. Selector filters can be used as the base filters for more complex Boolean expressions of filters.

The selector filter can only match against STRING (single and multi-valued), LONG, FLOAT, DOUBLE types. Use the newer null and equality filters to match against ARRAY or COMPLEX types.

When the selector filter matches against numeric inputs, the string value will be best-effort coerced into a numeric value.

Example: equivalent of WHERE someColumn = 'hello'

{ "type": "selector", "dimension": "someColumn", "value": "hello" }

Example: equivalent of WHERE someColumn IS NULL

{ "type": "selector", "dimension": "someColumn", "value": null }

Equality Filter

The equality filter is a replacement for the selector filter with the ability to match against any type of column. The equality filter is designed to have more SQL compatible behavior than the selector filter and so can not match null values. To match null values use the null filter.

Druid’s SQL planner uses the equality filter by default instead of selector filter whenever druid.generic.useDefaultValueForNull=false, or if sqlUseBoundAndSelectors is set to false on the SQL query context.

Example: equivalent of WHERE someColumn = 'hello'

{ "type": "equals", "column": "someColumn", "matchValueType": "STRING", "matchValue": "hello" }

Example: equivalent of WHERE someNumericColumn = 1.23

{ "type": "equals", "column": "someNumericColumn", "matchValueType": "DOUBLE", "matchValue": 1.23 }

Example: equivalent of WHERE someArrayColumn = ARRAY[1, 2, 3]

{ "type": "equals", "column": "someArrayColumn", "matchValueType": "ARRAY<LONG>", "matchValue": [1, 2, 3] }

Null Filter

The null filter is a partial replacement for the selector filter. It is dedicated to matching NULL values.

Druid’s SQL planner uses the null filter by default instead of selector filter whenever druid.generic.useDefaultValueForNull=false, or if sqlUseBoundAndSelectors is set to false on the SQL query context.

Example: equivalent of WHERE someColumn IS NULL

{ "type": "null", "column": "someColumn" }

Column comparison filter

The column comparison filter is similar to the selector filter, but compares dimensions to each other. For example:

dimensions is list of DimensionSpecs, making it possible to apply an extraction function if needed.

Note that the column comparison filter converts all values to strings prior to comparison. This allows differently-typed input columns to match without a cast operation.

Example: equivalent of WHERE someColumn = someLongColumn

{
  "type": "columnComparison",
  "dimensions": [
    "someColumn",
    {
      "type" : "default",
      "dimension" : someLongColumn,
      "outputType": "LONG"
    }
  ]
}

Logical expression filters

AND

Example: equivalent of WHERE someColumn = 'a' AND otherColumn = 1234 AND anotherColumn IS NULL

{
  "type": "and",
  "fields": [
    { "type": "equals", "column": "someColumn", "matchValue": "a", "matchValueType": "STRING" },
    { "type": "equals", "column": "otherColumn", "matchValue": 1234, "matchValueType": "LONG" },
    { "type": "null", "column": "anotherColumn" } 
  ]
}

OR

Example: equivalent of WHERE someColumn = 'a' OR otherColumn = 1234 OR anotherColumn IS NULL

{
  "type": "or",
  "fields": [
    { "type": "equals", "column": "someColumn", "matchValue": "a", "matchValueType": "STRING" },
    { "type": "equals", "column": "otherColumn", "matchValue": 1234, "matchValueType": "LONG" },
    { "type": "null", "column": "anotherColumn" } 
  ]
}

NOT

Example: equivalent of WHERE someColumn IS NOT NULL

{ "type": "not", "field": { "type": "null", "column": "someColumn" }}

In filter

The in filter can match input rows against a set of values, where a match occurs if the value is contained in the set.

If an empty values array is passed to the “in” filter, it will simply return an empty result.

If the values array contains null, the “in” filter matches null values. This differs from the SQL IN filter, which does not match NULL values.

Example: equivalent of WHERE outlaw IN ('Good', 'Bad', 'Ugly')

{
    "type": "in",
    "dimension": "outlaw",
    "values": ["Good", "Bad", "Ugly"]
}

Bound filter

Bound filters can be used to filter on ranges of dimension values. It can be used for comparison filtering like greater than, less than, greater than or equal to, less than or equal to, and “between” (if both “lower” and “upper” are set).

When the bound filter matches against numeric inputs, the string lower and upper bound values are best-effort coerced into a numeric value when using the "numeric" mode of ordering.

The bound filter can only match against STRING (single and multi-valued), LONG, FLOAT, DOUBLE types. Use the newer range to match against ARRAY or COMPLEX types.

Note that the bound filter matches null values if you don’t specify a lower bound. Use the range filter if SQL-compatible behavior.

Example: equivalent to WHERE 21 <= age <= 31

{
    "type": "bound",
    "dimension": "age",
    "lower": "21",
    "upper": "31" ,
    "ordering": "numeric"
}

Example: equivalent to WHERE 'foo' <= name <= 'hoo', using the default lexicographic sorting order

{
    "type": "bound",
    "dimension": "name",
    "lower": "foo",
    "upper": "hoo"
}

Example: equivalent to WHERE 21 < age < 31

{
    "type": "bound",
    "dimension": "age",
    "lower": "21",
    "lowerStrict": true,
    "upper": "31" ,
    "upperStrict": true,
    "ordering": "numeric"
}

Example: equivalent to WHERE age < 31

{
    "type": "bound",
    "dimension": "age",
    "upper": "31" ,
    "upperStrict": true,
    "ordering": "numeric"
}

Example: equivalent to WHERE age >= 18

{
    "type": "bound",
    "dimension": "age",
    "lower": "18" ,
    "ordering": "numeric"
}

Range filter

The range filter is a replacement for the bound filter. It compares against any type of column and is designed to have has more SQL compliant behavior than the bound filter. It won’t match null values, even if you don’t specify a lower bound.

Druid’s SQL planner uses the range filter by default instead of bound filter whenever druid.generic.useDefaultValueForNull=false, or if sqlUseBoundAndSelectors is set to false on the SQL query context.

Example: equivalent to WHERE 21 <= age <= 31

{
    "type": "range",
    "column": "age",
    "matchValueType": "LONG",
    "lower": 21,
    "upper": 31
}

Example: equivalent to WHERE 'foo' <= name <= 'hoo', using STRING comparison

{
    "type": "range",
    "column": "name",
    "matchValueType": "STRING",
    "lower": "foo",
    "upper": "hoo"
}

Example: equivalent to WHERE 21 < age < 31

{
    "type": "range",
    "column": "age",
    "matchValueType": "LONG",
    "lower": "21",
    "lowerOpen": true,
    "upper": "31" ,
    "upperOpen": true
}

Example: equivalent to WHERE age < 31

{
    "type": "range",
    "column": "age",
    "matchValueType": "LONG",
    "upper": "31" ,
    "upperOpen": true
}

Example: equivalent to WHERE age >= 18

{
    "type": "range",
    "column": "age",
    "matchValueType": "LONG",
    "lower": 18
}

Example: equivalent to WHERE ARRAY['a','b','c'] < arrayColumn < ARRAY['d','e','f'], using ARRAY comparison

{
    "type": "range",
    "column": "name",
    "matchValueType": "ARRAY<STRING>",
    "lower": ["a","b","c"],
    "lowerOpen": true,
    "upper": ["d","e","f"],
    "upperOpen": true
}

Like filter

Like filters can be used for basic wildcard searches. They are equivalent to the SQL LIKE operator. Special characters supported are “%” (matches any number of characters) and “_“ (matches any one character).

Like filters support the use of extraction functions, see Filtering with Extraction Functions for details.

Example: equivalent of WHERE last_name LIKE "D%" (last_name starts with “D”)

{
    "type": "like",
    "dimension": "last_name",
    "pattern": "D%"
}

Regular expression filter

The regular expression filter is similar to the selector filter, but using regular expressions. It matches the specified dimension with the given pattern.

Note that it is often more optimal to use a like filter instead of a regex for simple matching of prefixes.

Example: matches values that start with “50.”

{ "type": "regex", "dimension": "someColumn", "pattern": ^50.* }

Array contains element filter

The arrayContainsElement filter checks if an ARRAY contains a specific element but can also match against any type of column. When matching against scalar columns, scalar columns are treated as single-element arrays.

Example: equivalent of WHERE ARRAY_CONTAINS(someArrayColumn, 'hello')

{ "type": "arrayContainsElement", "column": "someArrayColumn", "elementMatchValueType": "STRING", "elementMatchValue": "hello" }

Example: equivalent of WHERE ARRAY_CONTAINS(someNumericArrayColumn, 1.23)

{ "type": "arrayContainsElement", "column": "someNumericArrayColumn", "elementMatchValueType": "DOUBLE", "elementMatchValue": 1.23 }

Example: equivalent of WHERE ARRAY_CONTAINS(someNumericArrayColumn, ARRAY[1, 2, 3])

{
  "type": "and",
  "fields": [
    { "type": "arrayContainsElement", "column": "someNumericArrayColumn", "elementMatchValueType": "LONG", "elementMatchValue": 1 },
    { "type": "arrayContainsElement", "column": "someNumericArrayColumn", "elementMatchValueType": "LONG", "elementMatchValue": 2 },
    { "type": "arrayContainsElement", "column": "someNumericArrayColumn", "elementMatchValueType": "LONG", "elementMatchValue": 3 }
  ]
}

Example: equivalent of WHERE ARRAY_OVERLAPS(someNumericArrayColumn, ARRAY[1, 2, 3])

{
 "type": "or",
 "fields": [
  { "type": "arrayContainsElement", "column": "someNumericArrayColumn", "elementMatchValueType": "LONG", "elementMatchValue": 1 },
  { "type": "arrayContainsElement", "column": "someNumericArrayColumn", "elementMatchValueType": "LONG", "elementMatchValue": 2 },
  { "type": "arrayContainsElement", "column": "someNumericArrayColumn", "elementMatchValueType": "LONG", "elementMatchValue": 3 }
 ]
}

Interval filter

The Interval filter enables range filtering on columns that contain long millisecond values, with the boundaries specified as ISO 8601 time intervals. It is suitable for the __time column, long metric columns, and dimensions with values that can be parsed as long milliseconds.

This filter converts the ISO 8601 intervals to long millisecond start/end ranges and translates to an OR of Bound filters on those millisecond ranges, with numeric comparison. The Bound filters will have left-closed and right-open matching (i.e., start <= time < end).

The interval filter supports the use of extraction functions, see Filtering with Extraction Functions for details.

If an extraction function is used with this filter, the extraction function should output values that are parseable as long milliseconds.

The following example filters on the time ranges of October 1-7, 2014 and November 15-16, 2014.

{
    "type" : "interval",
    "dimension" : "__time",
    "intervals" : [
      "2014-10-01T00:00:00.000Z/2014-10-07T00:00:00.000Z",
      "2014-11-15T00:00:00.000Z/2014-11-16T00:00:00.000Z"
    ]
}

The filter above is equivalent to the following OR of Bound filters:

{
    "type": "or",
    "fields": [
      {
        "type": "bound",
        "dimension": "__time",
        "lower": "1412121600000",
        "lowerStrict": false,
        "upper": "1412640000000" ,
        "upperStrict": true,
        "ordering": "numeric"
      },
      {
         "type": "bound",
         "dimension": "__time",
         "lower": "1416009600000",
         "lowerStrict": false,
         "upper": "1416096000000" ,
         "upperStrict": true,
         "ordering": "numeric"
      }
    ]
}

True filter

A filter which matches all values. You can use it to temporarily disable other filters without removing them.

{ "type" : "true" }

False filter

A filter matches no values. You can use it to force a query to match no values.

{"type": "false" }

Search filter

You can use search filters to filter on partial string matches.

{
    "filter": {
        "type": "search",
        "dimension": "product",
        "query": {
          "type": "insensitive_contains",
          "value": "foo"
        }
    }
}

Search query spec

Contains

Insensitive contains

Note that an “insensitive_contains” search is equivalent to a “contains” search with “caseSensitive”: false (or not provided).

Fragment

Expression filter

The expression filter allows for the implementation of arbitrary conditions, leveraging the Druid expression system. This filter allows for complete flexibility, but it might be less performant than a combination of the other filters on this page because it can’t always use the same optimizations available to other filters.

Example: expression based matching

{ 
    "type" : "expression" ,
    "expression" : "((product_type == 42) && (!is_deleted))"
}

JavaScript filter

The JavaScript filter matches a dimension against the specified JavaScript function predicate. The filter matches values for which the function returns true.

Example: matching any dimension values for the dimension name between 'bar' and 'foo'

{
  "type" : "javascript",
  "dimension" : "name",
  "function" : "function(x) { return(x >= 'bar' && x <= 'foo') }"
}

info

JavaScript-based functionality is disabled by default. Please refer to the Druid JavaScript programming guide for guidelines about using Druid’s JavaScript functionality, including instructions on how to enable it.

Extraction filter

info

The extraction filter is now deprecated. The selector filter with an extraction function specified provides identical functionality and should be used instead.

Extraction filter matches a dimension using a specific extraction function. The following filter matches the values for which the extraction function has a transformation entry input_key=output_value where output_value is equal to the filter value and input_key is present as a dimension.

Example: matching dimension values in [product_1, product_3, product_5] for the column product

{
    "filter": {
        "type": "extraction",
        "dimension": "product",
        "value": "bar_1",
        "extractionFn": {
            "type": "lookup",
            "lookup": {
                "type": "map",
                "map": {
                    "product_1": "bar_1",
                    "product_5": "bar_1",
                    "product_3": "bar_1"
                }
            }
        }
    }
}

Filtering with extraction functions

All filters except the “spatial” filter support extraction functions. An extraction function is defined by setting the “extractionFn” field on a filter. See Extraction function for more details on extraction functions.

If specified, the extraction function will be used to transform input values before the filter is applied. The example below shows a selector filter combined with an extraction function. This filter will transform input values according to the values defined in the lookup map; transformed values will then be matched with the string “bar_1”.

Example: matches dimension values in [product_1, product_3, product_5] for the column product

{
    "filter": {
        "type": "selector",
        "dimension": "product",
        "value": "bar_1",
        "extractionFn": {
            "type": "lookup",
            "lookup": {
                "type": "map",
                "map": {
                    "product_1": "bar_1",
                    "product_5": "bar_1",
                    "product_3": "bar_1"
                }
            }
        }
    }
}

Column types

Druid supports filtering on timestamp, string, long, and float columns.

Note that only string columns and columns produced with the ‘auto’ ingestion spec also used by type aware schema discovery have bitmap indexes. Queries that filter on other column types must scan those columns.

Filtering on multi-value string columns

All filters return true if any one of the dimension values is satisfies the filter.

Example: multi-value match behavior

Given a multi-value STRING row with values ['a', 'b', 'c'], a filter such as

{ "type": "equals", "column": "someMultiValueColumn", "matchValueType": "STRING", "matchValue": "b" }

will successfully match the entire row. This can produce sometimes unintuitive behavior when coupled with the implicit UNNEST functionality of Druid GroupBy and TopN queries.

Additionally, contradictory filters may be defined and perfectly legal in native queries which will not work in SQL.

Example: SQL “contradiction”

This query is impossible to express as is in SQL since it is a contradiction that the SQL planner will optimize to false and match nothing.

Given a multi-value STRING row with values ['a', 'b', 'c'], and filter such as

{
  "type": "and",
  "fields": [
    {
      "type": "equals",
      "column": "someMultiValueColumn",
      "matchValueType": "STRING",
      "matchValue": "a"
    },
    {
      "type": "equals",
      "column": "someMultiValueColumn",
      "matchValueType": "STRING",
      "matchValue": "b"
    }
  ]
}

will successfully match the entire row, but not match a row with value ['a', 'c'].

To express this filter in SQL, use SQL multi-value string functions such as MV_CONTAINS, which can be optimized by the planner to the same native filters.

Filtering on numeric columns

Some filters, such as equality and range filters allow accepting numeric match values directly since they include a secondary matchValueType parameter.

When filtering on numeric columns using string based filters such as the selector, in, and bounds filters, you can write filter match values as if they were strings. In most cases, your filter will be converted into a numeric predicate and will be applied to the numeric column values directly. In some cases (such as the “regex” filter) the numeric column values will be converted to strings during the scan.

Example: filtering on a specific value, myFloatColumn = 10.1

{
  "type": "equals",
  "dimension": "myFloatColumn",
  "matchValueType": "FLOAT",
  "value": 10.1
}

or with a selector filter:

{
  "type": "selector",
  "dimension": "myFloatColumn",
  "value": "10.1"
}

Example: filtering on a range of values, 10 <= myFloatColumn < 20

{
  "type": "range",
  "column": "myFloatColumn",
  "matchvalueType": "FLOAT",
  "lower": 10.1,
  "lowerOpen": false,
  "upper": 20.9,
  "upperOpen": true
}

or with a bound filter:

{
  "type": "bound",
  "dimension": "myFloatColumn",
  "ordering": "numeric",
  "lower": "10",
  "lowerStrict": false,
  "upper": "20",
  "upperStrict": true
}

Filtering on the timestamp column

Query filters can also be applied to the timestamp column. The timestamp column has long millisecond values. To refer to the timestamp column, use the string __time as the dimension name. Like numeric dimensions, timestamp filters should be specified as if the timestamp values were strings.

If you want to interpret the timestamp with a specific format, timezone, or locale, the Time Format Extraction Function is useful.

Example: filtering on a long timestamp value

{
  "type": "equals",
  "dimension": "__time",
  "matchValueType": "LONG",
  "value": 124457387532
}

or with a selector filter:

{
  "type": "selector",
  "dimension": "__time",
  "value": "124457387532"
}

Example: filtering on day of week using an extraction function

{
  "type": "selector",
  "dimension": "__time",
  "value": "Friday",
  "extractionFn": {
    "type": "timeFormat",
    "format": "EEEE",
    "timeZone": "America/New_York",
    "locale": "en"
  }
}

Example: filtering on a set of ISO 8601 intervals

{
    "type" : "interval",
    "dimension" : "__time",
    "intervals" : [
      "2014-10-01T00:00:00.000Z/2014-10-07T00:00:00.000Z",
      "2014-11-15T00:00:00.000Z/2014-11-16T00:00:00.000Z"
    ]
}