Filters & Operators

Filter where:
├── event_name = "agent_run_completed"
├── AND outcome = "success"
└── OR (
    ├── duration_seconds > 120
    └── AND plan = "enterprise"
)

# Exact match
country is "United States"

# Exclude specific value
browser_name is_not "Safari"

# Partial match
current_url contains "/workflows"
page_title contains "Dashboard"

# Check existence
email is_set
workspace_id is_not_set

# Exact value
successful_runs equal 0            # Never completed a run

# Comparisons
seat_count greater_than 10         # Larger workspaces
duration_seconds less_than 5       # Very fast runs

# Range filtering
mrr_usd between 100 and 10000      # Mid-market accounts

# Existence checks
trial_end_date is_numeric

has_completed_onboarding is_true
is_paid_customer is_false
beta_opt_in is_true

# Relative time filters
timestamp last 30 days             # Last month's activity
timestamp last 24 hours            # Today's events
created_at not_in_the_last 90 days # Older users only

# Date range
timestamp between "2024-01-01" and "2024-01-31"
timestamp not_between "2024-12-24" and "2024-12-26"  # Exclude holidays

# Specific date
timestamp on "2024-01-15"          # Single day
timestamp not_on "2024-01-01"      # Exclude New Year

# Before/after
timestamp before "2024-06-01"      # Before June
timestamp since "2024-01-01"       # This year only
first_seen before_the_last 365 days  # Users over a year old

# Future dates (for expiry, subscription end, etc.)
subscription_end in_the_next 30 days  # Expiring soon

# Any integration is slack OR notion
enabled_integrations any_in_list where item is "slack" OR item is "notion"

# Feature flag prefix
feature_flags any_in_list where item contains "beta_"

# All tags must be from approved list
tags all_in_list where item is "verified" OR item is "premium"

# Any invoice line over $1000
invoice_line_amounts any_in_list where item greater_than 1000

# Seat counts per workspace all above zero
workspace_seats all_in_list where item greater_than 0

Events where:
├── event_name is "agent_run_completed"
├── AND outcome is "success"
├── AND duration_seconds greater_than 10
└── AND timestamp last 7 days

→ Successful runs taking more than 10s in the last week

Users where:
├── plan is "pro"
└── OR successful_runs greater_than 100

→ Pro users OR very heavy users

Events where:
├── event_name is "agent_run_completed"
└── AND (
    ├── workflow_id is "weekly_report"
    └── OR workflow_id is "crm_sync"
)
└── AND (
    ├── duration_seconds greater_than 60
    └── OR plan is "enterprise"
)

→ Long-running or enterprise runs for key workflows

Events:
├── event_name is "agent_run_completed"
├── Properties:
│   ├── outcome is "success"
│   └── AND duration_seconds less_than 60

Users:
├── plan is "pro"
├── AND country is "US"
└── AND has_completed_onboarding is_true

Users:
├── IN cohort "Power Users"
└── AND NOT IN cohort "Churned Users"

Time Range: Last 30 days
Granularity: Daily

OR

Custom Range: Jan 1, 2024 - Jan 31, 2024
Granularity: Weekly

✅ Good: event_name is "agent_run_completed" AND outcome is "success"
❌ Vague: event_name contains "run"

✅ For exact match: is / equal
✅ For ranges: between / greater_than
✅ For text search: contains

❌ Using contains for exact values
❌ Using is for partial matches

# High-engagement paying customers
Users where:
├── plan is "pro"
└── OR (
    ├── successful_runs greater_than 20
    └── AND session_count greater_than 50
)