Join fellow LogicMonitor users at the Elevate Community Conference and get hands-on with our latest product innovations.

Register Now

Resources

Explore our blogs, guides, case studies, eBooks, and more actionable insights to enhance your IT monitoring and observability.

View Resources

About us

Get to know LogicMonitor and our team.

About us

Documentation

Read through our documentation, check out our latest release notes, or submit a ticket to our world-class customer service team.

View Resources

AppliesTo Function Scripting Syntax Reference

Last updated on 22 May, 2025

The majority of the out-of-the-box AppliesTo expressions require no customization. However, if you are updating or creating LogicModules, or if you are building AppliesTo expressions in other areas of the product, it is important to understand how the scripting language operates.

Important: If you update an AppliesTo expression for the purpose of changing which resources a LogicModule is associated with, do so with extreme caution as all historical data collected by a LogicModule is lost after disassociation. Always test AppliesTo scripting changes before updating the LogicModule definition. For more information, see ApplesTo Function Configuration.

You can leverage the following types of syntax for the AppliesTo function scripting:

You can define your own AppliesTo convenience functions globally, and those functions can then be called from any location within LogicMonitor that takes AppliesTo scripting as input. For more information, see AppliesTo Function Configuration.

Operators for AppliesTo Function Scripting Syntax

The following operators are available for use in AppliesTo expressions:

OperatorBehavior
==equal to
!=not equal to
>greater than
>=greater than or equal to
<less than
<=less than or equal to
=~regular expressions equality (case sensitive)
!~regular expression inequality (case sensitive)
andlogical AND, equivalent to &&
&&logical AND, equivalent to “and”
orlogical OR, equivalent to ||
||logical OR, equivalent to “or”
!logical NOT
()grouping operator

Absolute Functions for AppliesTo Scripting Syntax

The functions true() and false() match all or no resources, respectively. The true() function matches every resource in your portal.

Important: Use the true() function sparingly and with caution.

The false() function can be useful to globally disable a LogicModule without deleting it. The false() function can also be used with a LogicModule under development to prevent it from being applied to any resources prematurely. Neither function accepts parameters.

Warning: Globally disabling a LogicModule results in historical data loss when the LogicModule is disassociated from a resource.

Convenience Functions for AppliesTo Scripting Syntax

LogicMonitor provides several built-in functions designed to identify common resource categories. These functions typically evaluate the system.sysinfo property—populated by WMI for Windows resources and SNMP for platforms such as Linux, NetApp, Netscaler, and Cisco—or the system.categories property, which is generally set by PropertySources but can also be assigned manually. Convenience functions do not accept parameters.

The following table lists the convenience functions for AppliesTo scripting:

Convenience FunctionBehavior
isAWSService()Returns TRUE if the value of the system.devicetype property is “2”.
isAzureService()Returns TRUE if the value of the system.devicetype property is “4”.
isCisco()Returns TRUE if the value of “cisco” is contained in the system.sysinfo or system.categories property.
isCollectorDevice()Returns TRUE if the value of the system.collector property is “true”.
isDevice()Returns TRUE if the value of the system.devicetype property is “0” or if the value of “collectorDataSources” is contained in the system.categories property.
isFreebsd()Returns TRUE if the value of “freebsd” is contained in the system.sysinfo or system.categories property.
isF5()Returns TRUE if the system.sysoid property begins with “1.3.6.1.4.1.3375.2.1.3.4.4” or if the value of “f5” is contained in the system.categories property.
isGCPService()Returns TRUE if the value of the system.devicetype property is “7”.
isLinux()Returns TRUE if the value of “linux” is contained in the system.sysinfo or system.categories property and the value of “Cisco IOS” is not present in the system.sysinfo property.
isMisc()Returns TRUE if none of the criteria for the isWindows(), isLinux(), isNetwork(), isStorage(), and isVirtualization() convenience functions are met.
isNetApp()Returns TRUE if the value of “netapp” is contained in the system.sysinfo or system.categories property.
isNetflow()Returns TRUE if the value of the system.enablenetflow property is “true”.
isNetscaler()Returns TRUE if the value of “netscaler” is contained in the system.sysinfo or system.categories property.
isNetwork()Returns TRUE if the system.sysinfo or system.categories property contains a value that represents systems considered to be a network. A large number of values are inclusive.
isSolaris()Returns TRUE if the value of “solaris” is contained in the system.sysinfo or system.categories property.
isStorage()Returns TRUE if the system.sysinfo or system.categories property contains a value that represents systems considered to be storage. A large number of values are inclusive.
isUnix()Returns TRUE if the value of “solaris” or “linux” or “freebs” is contained in the system.sysinfo or system.categories property.
isVirtualization()Returns TRUE if the value of “vmware” or “xen” is contained in the system.virtualization property or if the value of “hyperv” is contained in the system.categories property.
isWindows()Returns TRUE if the value of “windows” or “hyper-v” is contained in the system.sysinfo or system.categories property.
getCollectorVersion()Returns the value of the system.collectorversion property.

Functions that Operate on Arrays for AppliesTo Scripting Syntax

While most resource properties—system or custom—are string or numeric type, the following are the most common array types:

  • system.categories
  • system.groups
  • system.staticgroups
  • system.ips

The following table lists the specific AppliesTo functions for working with arrays:

FunctionDescriptionExample
contains(<array>,"<string>")This function returns TRUE if the specified string matches an array element. The match is a complete match on the search string, case insensitive.
Regex is not supported.
contains(system.groups,"network")

Matches groups (dynamic and static) at the root of the Resources tree named “network”, “Network”, “nEtWoRk”, and so on.

The system.groups property cannot be used in AppliesTo scripting expressions that are intended to dynamically organize resources into groups. To create a dynamic group that is dependent on group membership, you must use the system.staticgroups property (for example, contains(system.staticgroups,"network"). For more information, see Resource Group Overview.
contains(system.staticgroups,"Acme Corp/Prod")

Matches child groups of “Acme Corp” named “Prod” or “prod”, but not those named “production”, “Prod_QA”, and so on.

Only static group membership (not dynamic group membership) is queried when the system.staticgroups property is referenced.
contains(system.ips,"192.168.170.1")
Matches resources with an IP address of 192.168.170.1.

The contains() function can only be used to match the full IP address of a resource. For partial IP address or range matching, use the join() function.
join(<array>,"<separator>")This function flattens an array to a string with array elements separated by the designated separator.
Required parameters are the array name (for example, system.groups) and the string separator (for example, “,”). Unlike contains(), partial match and regex are supported.
When used alone it returns TRUE for resources which have any value set for the specified array property.
join(system.ips,",")=~"192\\.168\\.100\\."

Matches resources with an IP address on the subnet 192.168.100.X. The ability to match on the partial IP address of a resource is useful for grouping devices by subnet or IP range.

In this example, you need to escape the periods in the IP address with double backslashes (\\).
join(system.groups,",")=~"Prod"

Matches resources in groups with names like “Prod”, “production”, “Prod1”, and so on at any level of the Resources tree.
join(system.staticgroups,",")=~"/.*dev"

Matches resources in any non-dynamic child group whose name contains “dev”, “Dev”, “DEV”, and so on.
!join(system.categories,",")

Matches any resource for which system.categories is empty. Equivalent to !system.categories.
hasCategory("<string>")This function queries the system.categories property for an array element that is a complete, case insensitive match for the specified string. Returns TRUE if there is a match.

Regex is not supported.
hasCategory("sonicwallfw")

Returns TRUE if “sonicwallfw” exists in system.categories.

Functions that Operate on Strings and Numbers for AppliesTo Scripting Syntax

The following table lists the functions that operate on properties that are string or numeric type:

FunctionDescriptionExample
exists("<property value>")This function returns TRUE if the specified value is assigned to any of the resource properties.N/A
sum(x,y,z)This function returns the sum of the numbers passed as parameters.N/A
startsWith(<property>,"<value>")This function returns TRUE if the property value starts with the value specified in the function. Typically, the value will be a string and should be enclosed in double quotes.

It is possible to pass the value as a number, without double quotes. However, partial match is not supported for numeric values, so the match must be complete for the function to return TRUE.

Partial match from the beginning of the string is supported. Regex is not supported.
startsWith(system.sysinfo,"Microsoft")

Matches Windows resources
startsWith(system.collectorversion,"28")

Matches resources monitored by Collector versions 28.xxx.
startsWith(system.collectorversion,"28102")

Matches resources monitored by Collector version 28.102.

Note: This is equivalent to system.collectorversion==23102.

sysoidThis is an alias to the system.sysoid property that removes the need to escape periods in the OID. Use with the ===!=~ and !~ operators to compare resource system OIDs to the specified value. For a partial match, use =~ or !~.

When used alone, it returns TRUE for resources which have a value set for system.sysoid.
sysoid!="1.3.6.1.4.1.8072.3.2.10"

Matches resources with system OIDs that are not “1.3.6.1.4.1.8072.3.2.10”.
sysoid=~"8741.1"

Matches resources with system OIDs containing “8741.1”.
sysoid

When no value is specified, returns TRUE for all resources which have a value set for this property.
<property name>Any property name can be referenced as an AppliesTo function. When used alone, it returns TRUE for any resource which has a value set for the specified property. It can be used with operators for comparison purposes.system.collectorversion>=28000

Matches resources monitored by Collectors version 28.000 or later.
system.collectorid!=system.prefcollectorid

Returns TRUE for resources not being monitored by their preferred Collector.
 auto.serial.number=~"^C0E"

Returns TRUE for resources with values for the auto.serial.number property which start with “C0E”.
getPropValue("<property name>")If the resource property name contains special characters such as “:”, “/”, “*”, “=”, or spaces, you must use the getPropValue("<property name>") function. 

Recommendation: Do not use special characters in your property names. If it cannot be avoided, this function allows you to use the property in an AppliesTo expression.

When getPropValue("<property name>") is used alone, it returns TRUE for all resources which have a value set for the specified property.
If you have a property named “SiteA:unit”, and you want to return resources with this property having values 10 to 19, use the following:

SiteA:unit=~"[10-19]"

However, you will receive a syntax error informing you that characters in regular expressions must be escaped. To get past the error you will need to use this expression instead:

getPropValue("SiteA:unit")=~"[10-19]"

Note: The property name is enclosed in double quotes.

In This Article

Start Your Trial

Full access to the LogicMonitor platform.
Comprehensive monitoring and alerting for unlimited devices.