Docs
Open console →

isbool

This page explains how to use the isbool function in APL.

Use the isbool function to check whether an expression evaluates to a boolean value. This is helpful when you need to validate data types, filter boolean values, or handle type checking in conditional logic.

You typically use isbool when working with dynamic or mixed-type data where you need to verify that a value is actually a boolean before performing boolean operations or conversions.

Usage

Syntax

isbool(expression)

Parameters

NameTypeDescription
expressiondynamicThe expression to check for boolean type.

Returns

Returns true if the expression value is a boolean, false otherwise.

Use case examples

Validate that a field contains boolean values before using it in boolean operations or filters.

Query

['sample-http-logs']
| extend is_cached = case(
    ['status'] == '200', true,
    ['status'] == '304', true,
    1 == 1, false
)
| where isbool(is_cached)
| extend cache_hit = is_cached == true
| project _time, ['uri'], ['status'], is_cached, cache_hit

Run in Playground

Output

_timeuristatusis_cachedcache_hit
Jun 24, 09:28:10/api/users200truetrue

This example creates a boolean field and validates it using isbool before using it in further boolean operations, ensuring type safety in your queries.

Check if trace attributes contain boolean values before performing boolean logic on them.

Query

['otel-demo-traces']
| extend is_error = ['status_code'] >= '400'
| where isbool(is_error)
| extend error_occurred = is_error == true
| project _time, ['trace_id'], ['service.name'], is_error, error_occurred

Run in Playground

Output

_timetrace_idservice.nameis_errorerror_occurred
Jun 24, 09:28:10abc123frontendfalsefalse

This example validates that a computed boolean value is actually a boolean type before using it in conditional logic, preventing type-related errors.

Validate boolean flags in security events to ensure they contain proper boolean values before filtering or alerting.

Query

['sample-http-logs']
| extend is_suspicious = ['status'] == '403' or ['status'] == '401'
| extend is_high_risk = ['req_duration_ms'] > 5000
| where isbool(is_suspicious) and isbool(is_high_risk)
| extend security_alert = is_suspicious == true and is_high_risk == true
| project _time, ['uri'], ['status'], is_suspicious, is_high_risk, security_alert

Run in Playground

Output

_timeuristatusis_suspiciousis_high_risksecurity_alert
Jun 24, 09:28:10/admin403truefalsefalse

This example validates multiple boolean flags before combining them in security logic, ensuring that only properly typed boolean values are used in alert conditions.

  • tobool: Converts a value to boolean. Use tobool to convert values to boolean, and isbool to check if a value is already a boolean.
  • gettype: Returns the type of a value as a string. Use gettype when you need to check for multiple types, and isbool when you only need to check for boolean.
  • isnull: Checks if a value is null. Use isnull to check for null values, and isbool to check for boolean type.

Other query languages