AppliesTo Function Scripting Syntax Reference
Last updated on 22 May, 2025The majority of the out-of-the-box AppliesTo expressions require no customization. However, if you are updating or creating LogicModules, or if you are building AppliesTo expressions in other areas of the product, it is important to understand how the scripting language operates.
Important: If you update an AppliesTo expression for the purpose of changing which resources a LogicModule is associated with, do so with extreme caution as all historical data collected by a LogicModule is lost after disassociation. Always test AppliesTo scripting changes before updating the LogicModule definition. For more information, see ApplesTo Function Configuration.
You can leverage the following types of syntax for the AppliesTo function scripting:
- Operators—Connects functions within your AppliesTo scripting
For more information, see Operators for AppliesTo Scripting Syntax. - Absolute functions—Enables you to apply boolean logic to your modules
For more information, see Absolute Functions for AppliesTo Scripting Syntax. - Convenience functions—Enables you to leverages LogicMonitor built-in functions to identify common categories of resources
For more information, see Convenience Functions for AppliesTo Scripting Syntax. - Array functions—Use certain resource properties in an array function
For more information, see Functions that Operate on Arrays for AppliesTo Scripting Syntax. - Strings and Numbers functions—Leverage the strings and numbers function for properties that are string or numeric
For more information, see Functions that Operate on Strings and Numbers for AppliesTo Scripting Syntax.
You can define your own AppliesTo convenience functions globally, and those functions can then be called from any location within LogicMonitor that takes AppliesTo scripting as input. For more information, see AppliesTo Function Configuration.
Operators for AppliesTo Function Scripting Syntax
The following operators are available for use in AppliesTo expressions:
Operator | Behavior |
== | equal to |
!= | not equal to |
> | greater than |
>= | greater than or equal to |
< | less than |
<= | less than or equal to |
=~ | regular expressions equality (case sensitive) |
!~ | regular expression inequality (case sensitive) |
and | logical AND, equivalent to && |
&& | logical AND, equivalent to “and” |
or | logical OR, equivalent to || |
|| | logical OR, equivalent to “or” |
! | logical NOT |
() | grouping operator |
Absolute Functions for AppliesTo Scripting Syntax
The functions true()
and false()
match all or no resources, respectively. The true()
function matches every resource in your portal.
Important: Use the true() function sparingly and with caution.
The false()
function can be useful to globally disable a LogicModule without deleting it. The false()
function can also be used with a LogicModule under development to prevent it from being applied to any resources prematurely. Neither function accepts parameters.
Warning: Globally disabling a LogicModule results in historical data loss when the LogicModule is disassociated from a resource.
Convenience Functions for AppliesTo Scripting Syntax
LogicMonitor provides several built-in functions designed to identify common resource categories. These functions typically evaluate the system.sysinfo
property—populated by WMI for Windows resources and SNMP for platforms such as Linux, NetApp, Netscaler, and Cisco—or the system.categories
property, which is generally set by PropertySources but can also be assigned manually. Convenience functions do not accept parameters.
The following table lists the convenience functions for AppliesTo scripting:
Convenience Function | Behavior |
isAWSService() | Returns TRUE if the value of the system.devicetype property is “2”. |
isAzureService() | Returns TRUE if the value of the system.devicetype property is “4”. |
isCisco() | Returns TRUE if the value of “cisco” is contained in the system.sysinfo or system.categories property. |
isCollectorDevice() | Returns TRUE if the value of the system.collector property is “true”. |
isDevice() | Returns TRUE if the value of the system.devicetype property is “0” or if the value of “collectorDataSources” is contained in the system.categories property. |
isFreebsd() | Returns TRUE if the value of “freebsd” is contained in the system.sysinfo or system.categories property. |
isF5() | Returns TRUE if the system.sysoid property begins with “1.3.6.1.4.1.3375.2.1.3.4.4” or if the value of “f5” is contained in the system.categories property. |
isGCPService() | Returns TRUE if the value of the system.devicetype property is “7”. |
isLinux() | Returns TRUE if the value of “linux” is contained in the system.sysinfo or system.categories property and the value of “Cisco IOS” is not present in the system.sysinfo property. |
isMisc() | Returns TRUE if none of the criteria for the isWindows(), isLinux(), isNetwork(), isStorage(), and isVirtualization() convenience functions are met. |
isNetApp() | Returns TRUE if the value of “netapp” is contained in the system.sysinfo or system.categories property. |
isNetflow() | Returns TRUE if the value of the system.enablenetflow property is “true”. |
isNetscaler() | Returns TRUE if the value of “netscaler” is contained in the system.sysinfo or system.categories property. |
isNetwork() | Returns TRUE if the system.sysinfo or system.categories property contains a value that represents systems considered to be a network. A large number of values are inclusive. |
isSolaris() | Returns TRUE if the value of “solaris” is contained in the system.sysinfo or system.categories property. |
isStorage() | Returns TRUE if the system.sysinfo or system.categories property contains a value that represents systems considered to be storage. A large number of values are inclusive. |
isUnix() | Returns TRUE if the value of “solaris” or “linux” or “freebs” is contained in the system.sysinfo or system.categories property. |
isVirtualization() | Returns TRUE if the value of “vmware” or “xen” is contained in the system.virtualization property or if the value of “hyperv” is contained in the system.categories property. |
isWindows() | Returns TRUE if the value of “windows” or “hyper-v” is contained in the system.sysinfo or system.categories property. |
getCollectorVersion() | Returns the value of the system.collectorversion property. |
Functions that Operate on Arrays for AppliesTo Scripting Syntax
While most resource properties—system or custom—are string or numeric type, the following are the most common array types:
system.categories
system.groups
system.staticgroups
system.ips
The following table lists the specific AppliesTo functions for working with arrays:
Function | Description | Example |
contains(<array>,"<string>") | This function returns TRUE if the specified string matches an array element. The match is a complete match on the search string, case insensitive. Regex is not supported. | contains(system.groups,"network") Matches groups (dynamic and static) at the root of the Resources tree named “network”, “Network”, “nEtWoRk”, and so on. The system.groups property cannot be used in AppliesTo scripting expressions that are intended to dynamically organize resources into groups. To create a dynamic group that is dependent on group membership, you must use the system.staticgroups property (for example, contains(system.staticgroups,"network" ). For more information, see Resource Group Overview. |
contains(system.staticgroups,"Acme Corp/Prod") Matches child groups of “Acme Corp” named “Prod” or “prod”, but not those named “production”, “Prod_QA”, and so on. Only static group membership (not dynamic group membership) is queried when the system.staticgroups property is referenced. | ||
contains(system.ips,"192.168.170.1") Matches resources with an IP address of 192.168.170.1. The contains() function can only be used to match the full IP address of a resource. For partial IP address or range matching, use the join() function. | ||
join(<array>,"<separator>") | This function flattens an array to a string with array elements separated by the designated separator. Required parameters are the array name (for example, system.groups ) and the string separator (for example, “,”). Unlike contains() , partial match and regex are supported.When used alone it returns TRUE for resources which have any value set for the specified array property. | join(system.ips,",")=~"192\\.168\\.100\\." Matches resources with an IP address on the subnet 192.168.100.X. The ability to match on the partial IP address of a resource is useful for grouping devices by subnet or IP range. In this example, you need to escape the periods in the IP address with double backslashes (\\). |
join(system.groups,",")=~"Prod" Matches resources in groups with names like “Prod”, “production”, “Prod1”, and so on at any level of the Resources tree. | ||
join(system.staticgroups,",")=~"/.*dev" Matches resources in any non-dynamic child group whose name contains “dev”, “Dev”, “DEV”, and so on. | ||
!join(system.categories,",") Matches any resource for which system.categories is empty. Equivalent to !system.categories . | ||
hasCategory("<string>") | This function queries the system.categories property for an array element that is a complete, case insensitive match for the specified string. Returns TRUE if there is a match.Regex is not supported. | hasCategory("sonicwallfw") Returns TRUE if “sonicwallfw” exists in system.categories. |
Functions that Operate on Strings and Numbers for AppliesTo Scripting Syntax
The following table lists the functions that operate on properties that are string or numeric type:
Function | Description | Example |
exists("<property value>") | This function returns TRUE if the specified value is assigned to any of the resource properties. | N/A |
sum(x,y,z) | This function returns the sum of the numbers passed as parameters. | N/A |
startsWith(<property>,"<value>") | This function returns TRUE if the property value starts with the value specified in the function. Typically, the value will be a string and should be enclosed in double quotes.It is possible to pass the value as a number, without double quotes. However, partial match is not supported for numeric values, so the match must be complete for the function to return TRUE. Partial match from the beginning of the string is supported. Regex is not supported. | startsWith(system.sysinfo,"Microsoft") Matches Windows resources |
startsWith(system.collectorversion,"28") Matches resources monitored by Collector versions 28.xxx. | ||
startsWith(system.collectorversion,"28102") Matches resources monitored by Collector version 28.102. Note: This is equivalent to | ||
sysoid | This is an alias to the system.sysoid property that removes the need to escape periods in the OID. Use with the == , =! , =~ and !~ operators to compare resource system OIDs to the specified value. For a partial match, use =~ or !~ .When used alone, it returns TRUE for resources which have a value set for system.sysoid . | sysoid!="1.3.6.1.4.1.8072.3.2.10" Matches resources with system OIDs that are not “1.3.6.1.4.1.8072.3.2.10”. |
sysoid=~"8741.1" Matches resources with system OIDs containing “8741.1”. | ||
sysoid When no value is specified, returns TRUE for all resources which have a value set for this property. | ||
<property name> | Any property name can be referenced as an AppliesTo function. When used alone, it returns TRUE for any resource which has a value set for the specified property. It can be used with operators for comparison purposes. | system.collectorversion>=28000 Matches resources monitored by Collectors version 28.000 or later. |
system.collectorid!=system.prefcollectorid Returns TRUE for resources not being monitored by their preferred Collector. | ||
auto.serial.number=~"^C0E" Returns TRUE for resources with values for the auto.serial.number property which start with “C0E”. | ||
getPropValue("<property name>") | If the resource property name contains special characters such as “:”, “/”, “*”, “=”, or spaces, you must use the getPropValue("<property name>") function. Recommendation: Do not use special characters in your property names. If it cannot be avoided, this function allows you to use the property in an AppliesTo expression. getPropValue("<property name>") is used alone, it returns TRUE for all resources which have a value set for the specified property. | If you have a property named “SiteA:unit”, and you want to return resources with this property having values 10 to 19, use the following:SiteA:unit=~"[10-19]" However, you will receive a syntax error informing you that characters in regular expressions must be escaped. To get past the error you will need to use this expression instead: getPropValue("SiteA:unit")=~"[10-19]" Note: The property name is enclosed in double quotes. |