change the search syntax

[zdyj3170101136]

for now, the search syntab is something strange.

full text search:

• service, hasTokenCaseInsensitive(Body, 'service')
• service*, ilike(Body, 'service%')

field search:

• service:a, service ilike '%a%'

the field search is different with full text search, it is strange, it took me many time to understand.

and it is slow, could not benefit from bloom filter, too.

i think the field search by default shoule be equal.

i think the search syntax should sync with datadog: full text search:

• service, hasTokenCaseInsensitive(Body, 'service')
• service*, ilike(Body, '%service%')

field search:

• service:a, service = 'a'
• service:a*, service ilike 'a%'

[MikeShi42]

Hi @zdyj3170101136 if you're looking for exact searches you can do it via quotes today (which iirc is similar to datadog)

service:"a" will do an exact match. We may try to introduce a syntax to make it quicker to express this with ex. service=a in the lucene like syntax though we'll need to make sure it doesn't conflict with other search patterns users are used to already.