how to use filter type support wildcard？

[trustnote-wang]

[transforms.service_logs]
type = "filter"
inputs = [ "parse_logs_download" ]
condition = '''
.service = "*cross"
'''

I want to filter out that the service field contains 'cross' string，but it doesn't work, how to do it?

[spencergilbert]

👋

Hi, @trustnote-wang. You can use the VRL functions documented at https://vrl.dev/functions. You probably want to use ends_with based on your example glob.

[transforms.service_logs]
type = "filter"
inputs = [ "parse_logs_download" ]
condition = '''
ends_with!(.service, "cross")
'''

[trustnote-wang]

thank you very much!