shiviz
shiviz copied to clipboard
Adding query constraints to structured search
This issue has three components:
- lang: extending the motif json format with event query constraints
- alg: implementing the query constraints matching in the custom motif finder
- gui: letting users associate/enter query constraints for nodes in the builder graph
- A graph created using the graph-builder has format like this:
#motif=[{"host":"a","clock":{"a":1}},{"host":"b","clock":{"b":1,"a":1}}]
This format can be extended to include per-event constraints like this:
#motif=[{"host":"a","clock":{"a":1},constraint="'INFO'"},{"host":"b","clock":{"b":1,"a":1},constraint="ip=/128.135.*/"}]
These constraints should support the query language behind the search query text-box.
-
The custom motif finder needs to re-use the LEM parser/matcher to filter query results using the specified constraints.
-
The node-selection GUI/overlay menu should be adapted to the graph-builder so that a user can click on an event node to enter a query constraint to associate with the node. These constraints must somehow be visualized in the builder-graph visualization (maybe we just need to show a marker that indicates that a query constraint is present, and let users edit/remove these).
[Issue created by bestchai: 2014-08-16] [Last updated on bitbucket: 2015-08-11]