Consider an event that contains a person's age and the state in which they live. The first event field might have the name age and the second might have the field name state. The following filter string would match only those events whose age field was greater than 65 and whose state field was equal to "FL."

In this example filter string, age and state represent event fields. This filter also contains an arithmetic constant 65 and a string constant "FL". The boolean operator and is used to combine the field criterion for age and state.

Other example filter specifications:

A filter string may also make use of the filter functions described on Filter Functions.