twoEqualsOr
from employees | where emp_no == 10010 or emp_no == 10011 | keep emp_no, first_name | sort emp_no;  

emp_no:integer | first_name:keyword
10010          |Duangkaew      
10011          |Mary       
;


twoEqualsOrKeyword
from employees | where first_name == "Duangkaew" or first_name == "Mary" | keep emp_no, first_name | sort emp_no;  

emp_no:integer | first_name:keyword
10010          |Duangkaew      
10011          |Mary       
;


twoEqualsAndOr
from employees | where emp_no == 10010 and first_name == "Duangkaew" or emp_no == 10011 and first_name == "Mary" | keep emp_no, first_name | sort emp_no;  

emp_no:integer | first_name:keyword
10010          |Duangkaew      
10011          |Mary       
;


twoEqualsAndOr2
from employees | where emp_no == 10010 and first_name == "Duangkaew" or emp_no == 10011 and first_name == "FooBar" | keep emp_no, first_name | sort emp_no;  

emp_no:integer | first_name:keyword
10010          |Duangkaew
;


twoEqualsOrBraces
from employees | where (emp_no == 10010 or emp_no == 10011) | keep emp_no, first_name | sort emp_no;  

emp_no:integer | first_name:keyword
10010          |Duangkaew      
10011          |Mary       
;


twoInequalityAnd
from employees | where emp_no >= 10010 and emp_no <= 10011 | keep emp_no, first_name | sort emp_no;  

emp_no:integer | first_name:keyword
10010          |Duangkaew      
10011          |Mary       
;

threeEqualsOr
from employees | where emp_no == 10010 or emp_no == 10011 or emp_no == 10012  | keep emp_no, first_name | sort emp_no;  

emp_no:integer | first_name:keyword
10010          |Duangkaew      
10011          |Mary       
10012          |Patricio       
;


evalTwoEqualsOr
from employees | eval x = emp_no + 10010 - emp_no | where emp_no == x or emp_no == 10011 | keep emp_no, first_name | sort emp_no;  

emp_no:integer | first_name:keyword
10010          |Duangkaew      
10011          |Mary       
;


evalTwoInequalityAnd
from employees | eval x = emp_no + 10010 - emp_no | where emp_no >= x and emp_no <= 10011 | keep emp_no, first_name | sort emp_no;  

emp_no:integer | first_name:keyword
10010          |Duangkaew      
10011          |Mary       
;

docsGettingStartedWhere
// tag::gs-where[]
FROM sample_data
| WHERE event_duration > 5000000
// end::gs-where[]
| LIMIT 0
;

@timestamp:date | client_ip:ip | event_duration:long | message:keyword
;