diff --git a/lib/filterx/func-str.c b/lib/filterx/func-str.c
index 1aa4baf88..7d3158a8a 100644
--- a/lib/filterx/func-str.c
+++ b/lib/filterx/func-str.c
@@ -39,6 +39,9 @@
 #define FILTERX_FUNC_ENDSWITH_USAGE "Usage: endswith(string, suffix, ignorecase=true)" \
 "or endswith(string, [suffix_1, suffix_2, ..], ignorecase=true)"
 
+#define FILTERX_FUNC_INCLUDES_USAGE "Usage: includes(string, substring, ignorecase=true)" \
+"or includes(string, [substring_1, substring_2, ..], ignorecase=true)"
+
 typedef struct _FilterXStringWithCache
 {
   FilterXExpr *expr;
@@ -481,3 +484,18 @@ filterx_function_endswith_new(FilterXFunctionArgs *args, GError **error)
   return filterx_function_affix_new(args, "endswith", filterx_function_endswith_process, FILTERX_FUNC_ENDSWITH_USAGE,
                                     error);
 }
+
+gboolean
+filterx_function_includes_process(const gchar *haystack, gsize haystack_len, const gchar *needle, gsize needle_len)
+{
+  if (needle_len > haystack_len)
+    return FALSE;
+  return g_strstr_len(haystack, haystack_len, needle) != NULL;
+}
+
+FilterXExpr *
+filterx_function_includes_new(FilterXFunctionArgs *args, GError **error)
+{
+  return filterx_function_affix_new(args, "includes", filterx_function_includes_process, FILTERX_FUNC_INCLUDES_USAGE,
+                                    error);
+}
diff --git a/lib/filterx/func-str.h b/lib/filterx/func-str.h
index 4b5cef890..81856ed35 100644
--- a/lib/filterx/func-str.h
+++ b/lib/filterx/func-str.h
@@ -29,5 +29,6 @@
 
 FilterXExpr *filterx_function_startswith_new(FilterXFunctionArgs *args, GError **error);
 FilterXExpr *filterx_function_endswith_new(FilterXFunctionArgs *args, GError **error);
+FilterXExpr *filterx_function_includes_new(FilterXFunctionArgs *args, GError **error);
 
 #endif