The TQL search engine uses an algorithm to figure out what terms to index given the type of input. This algorithm uses a tokenizer to split a message up into words (or tokens) to use for its index. For example, consider a basic log message quick brown fox. The simplest tokenizer is to split by spaces, so this example would have three tokens: quick, brown, and fox.
A log message can be assigned to more than one metaclass. Each metaclass name is added to the metaclass field separated by a comma. For example, a metaclass value could be "ids,firewall".
The tokenizer for the metaclass field is set to also look at commas. Therefore, when the metaclass field is indexed, we would get the tokens: ids, firewall
TQL is able to query tokenized metaclasses. So the query metaclass:ids will return results that have ids, firewall as the metaclass field.