shiviz icon indicating copy to clipboard operation
shiviz copied to clipboard

Adding query constraints to structured search

Open bestchai opened this issue 4 years ago • 0 comments

This issue has three components:

  1. lang: extending the motif json format with event query constraints
  2. alg: implementing the query constraints matching in the custom motif finder
  3. gui: letting users associate/enter query constraints for nodes in the builder graph
  1. A graph created using the graph-builder has format like this: #motif=[{"host":"a","clock":{"a":1}},{"host":"b","clock":{"b":1,"a":1}}]

This format can be extended to include per-event constraints like this: #motif=[{"host":"a","clock":{"a":1},constraint="'INFO'"},{"host":"b","clock":{"b":1,"a":1},constraint="ip=/128.135.*/"}]

These constraints should support the query language behind the search query text-box.

  1. The custom motif finder needs to re-use the LEM parser/matcher to filter query results using the specified constraints.

  2. The node-selection GUI/overlay menu should be adapted to the graph-builder so that a user can click on an event node to enter a query constraint to associate with the node. These constraints must somehow be visualized in the builder-graph visualization (maybe we just need to show a marker that indicates that a query constraint is present, and let users edit/remove these).

[Issue created by bestchai: 2014-08-16] [Last updated on bitbucket: 2015-08-11]

bestchai avatar May 26 '20 07:05 bestchai