timesketch
timesketch copied to clipboard
Validate input query before executing it
Writing complex search queries can involve invalid search queries that will create ES exceptions. It would be nice if the Search bar in the browser would already indicate, if a search query is not going to work, e.g.:
foobar]
Will create
[token_mgr_error] token_mgr_error: Lexical error at line 1, column 8. Encountered: after : "", [query_shard_exception] Failed to parse query [foobar]]
This can be done in two ways. Either we validate on the client side, and that is not supported with the javascript library IIRC. The other way is to do it on the server side, but without executing the expensive query. I don't believe that the Validate API has been ported to OpenSearch. This need to be investigated.