Stay organized with collections
Save and categorize content based on your preferences.
strings.ends_with
strings.ends_with(value, suffix)
Description
Function takes two STRINGs (value, suffix). Returns TRUE if suffix is non-empty and at end of value.
Param data types
STRING, STRING
Return type
BOOL
Code samples
Example 1
Returns true when suffix is found at end of value.
strings.ends_with("this is a test", "test") = true
Example 2
Returns false when suffix is not at end of value.
strings.ends_with("this is a test", "is") = false
Example 3
Returns false when suffix and value are identical.
strings.ends_with("str", "str") = true
Example 4
Returns false when suffix is an empty string.
strings.ends_with("str", "") = false
Example 5
Returns false when value is an empty string.
strings.ends_with("", "str") = false
Example 6
Returns false when suffix and value are empty strings.
strings.ends_with("", "") = false
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-07-14 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-07-14 UTC."],[[["\u003cp\u003e\u003ccode\u003estrings.ends_with\u003c/code\u003e is a function that checks if a given suffix exists at the end of a specified string value.\u003c/p\u003e\n"],["\u003cp\u003eThe function accepts two string inputs, \u003ccode\u003evalue\u003c/code\u003e and \u003ccode\u003esuffix\u003c/code\u003e, and returns a boolean (\u003ccode\u003eTRUE\u003c/code\u003e or \u003ccode\u003eFALSE\u003c/code\u003e) result.\u003c/p\u003e\n"],["\u003cp\u003eThe function returns \u003ccode\u003eTRUE\u003c/code\u003e only when the suffix is non-empty and is found precisely at the end of the value string.\u003c/p\u003e\n"],["\u003cp\u003eThe function returns \u003ccode\u003eFALSE\u003c/code\u003e when either the suffix or the value is an empty string, or when the suffix is not found at the end of the string.\u003c/p\u003e\n"],["\u003cp\u003eThis function is supported in both Rules and Search within the Chronicle platform.\u003c/p\u003e\n"]]],[],null,["### strings.ends_with\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n strings.ends_with(value, suffix)\n\n#### Description\n\nFunction takes two STRINGs (value, suffix). Returns TRUE if suffix is non-empty and at end of value.\n\n#### Param data types\n\n`STRING`, `STRING`\n\n#### Return type\n\n`BOOL`\n\n#### Code samples\n\n##### Example 1\n\nReturns true when suffix is found at end of value. \n\n strings.ends_with(\"this is a test\", \"test\") = true\n\n##### Example 2\n\nReturns false when suffix is not at end of value. \n\n strings.ends_with(\"this is a test\", \"is\") = false\n\n##### Example 3\n\nReturns false when suffix and value are identical. \n\n strings.ends_with(\"str\", \"str\") = true\n\n##### Example 4\n\nReturns false when suffix is an empty string. \n\n strings.ends_with(\"str\", \"\") = false\n\n##### Example 5\n\nReturns false when value is an empty string. \n\n strings.ends_with(\"\", \"str\") = false\n\n##### Example 6\n\nReturns false when suffix and value are empty strings. \n\n strings.ends_with(\"\", \"\") = false"]]
