---
title: case_contains
description: |
  Returns a value based on whether a string contains one of several specified substrings.

  This function is a shorthand for `case` expressions with [`contains()`](../string/contains.md) logic and helps shorten queries that would otherwise repeat conditional statements. If no clause matches and no `_` fallback is present, `case_contains` returns `null`.

  !!! warning "Behavior change"
      Earlier implementations of `case_contains` evaluated each clause with the [text match](../../../user-guide/foundations/understanding-expressions.md) (`~`) operator instead of `contains()`, which did not match the documented behavior. `case_contains` now correctly evaluates each clause with [`contains()`](../string/contains.md) for case-sensitive substring matching. If your query relied on the previous text-match behavior, use [`case_find`](case_find.md) instead.

  !!! note
      `case_contains` checks clauses top-to-bottom and returns the **first match**, so order matters.
url: https://coralogix.com/docs/dataprime/language-reference/functions-reference/cases/case_contains/
product: dataengine
feature: DataPrime Language
feature_id: dataprime-language
feature_identifier: dataengine/dataprime-language
last_updated: '2026-10-21'
---

# `case_contains`

## Description

Returns a value based on whether a string contains one of several specified substrings.

This function is a shorthand for `case` expressions with [\`contains()\`](https://coralogix.com/docs/dataprime/language-reference/functions-reference/string/contains.md) logic and helps shorten queries that would otherwise repeat conditional statements. If no clause matches and no `_` fallback is present, `case_contains` returns `null`.

Behavior change

Earlier implementations of `case_contains` evaluated each clause with the [text match](https://coralogix.com/docs/dataprime/user-guide/foundations/understanding-expressions.md) (`~`) operator instead of `contains()`, which did not match the documented behavior. `case_contains` now correctly evaluates each clause with [\`contains()\`](https://coralogix.com/docs/dataprime/language-reference/functions-reference/string/contains.md) for case-sensitive substring matching. If your query relied on the previous text-match behavior, use [\`case\_find\`](https://coralogix.com/docs/dataprime/language-reference/functions-reference/cases/case_find.md) instead.

Note

`case_contains` checks clauses top-to-bottom and returns the **first match**, so order matters.

## Syntax

```
case_contains {

s: string,

substring1 -> result1,

substring2 -> result2,

...

substringN -> resultN,

_          -> default

}
```

## Arguments

| Name        | Type     | Required  | Description                                   |
| ----------- | -------- | --------- | --------------------------------------------- |
| `s`         | `string` | **true**  | The string to check for substrings            |
| `substring` | `string` | **true**  | A substring to search for within `s`          |
| `result`    | `any`    | **true**  | The value to return if the substring is found |
| `_`         | `any`    | **false** | Default value if no substrings match          |

## Example

**Use case: Map cluster names to environment names**

Suppose you want to convert subsystem metadata into full environment names. Consider these log documents:

### Example data

```
{

  "cluster_name": "acme-prod-cluster"

},

{

  "cluster_name": "acme-dev-cluster"

},

{

  "cluster_name": "acme-stg-cluster"

}
```

### Example query

```
create environment_name from 

  case_contains {

    $d.cluster_name,

    '-prod-' -> 'production',

    '-dev-'  -> 'development',

    '-stg-'  -> 'staging',

    _        -> 'test'

  }
```

### Example output

```
{

  "cluster_name": "acme-prod-cluster",

  "environment_name": "production"

},

{

  "cluster_name": "acme-dev-cluster",

  "environment_name": "development"

},

{

  "cluster_name": "acme-stg-cluster",

  "environment_name": "staging"

}
```