WSO2 DAS allows you to search for persisted events using the Data Explorer. In addition to selecting attributes and categories from lists as shown in Searching Data By Categories, you can write Apache Lucene queries to search for data. This section explains the syntax to be followed when searching for persisted data using Lucene queries.
It is not possible to search for attributes defined as facets using Lucene queries.
Query syntax
The following table specifies the query syntax that should be used for different search requirements
| Search Requirement | Lucene Query Syntax | Example |
|---|---|---|
| View all the data in the selected event table. | Click Search without entering any value in the query field | N/A |
| Search using a part of the attribute value | Insert the asterisk after the part of the attribute as relevant
| If you are searching for a book by the
|
| Search using more than one attribute | <ATTRIBUTE_NAME>:<ATTRIBUTE_VALUE> AND <ATTRIBUTE_NAME>:<ATTRIBUTE_VALUE> | If you are searching for a book written by Ronald Dahl which belongs to the Children's Fantasy category, you can search by the two attributes named
|
| Search for records that match one of the matching criteria when multiple matching criteria is provided | <ATTRIBUTE_NAME>:<ATTRIBUTE_VALUE> OR <ATTRIBUTE_NAME>:<ATTRIBUTE_VALUE> | If you are searching for a book written by Robin Sharma or a book written by different author on the subject of Leadership, you can search by two attributes named
|
For detailed information about the Lucene syntax, see Apache Lucene - Query Parser Syntax.
WSO2 DAS Lucene Query Extensions
Timestamp Operations on Fields
WSO2 DAS support only the primitive data types in persisting data, thus it does not have special timestamp daa type as such. For this, user should use a LONG data type when sending timestamp values. In the case of querying these fields as timestamp fields, it is convenient for the user to give values in a string timestamp format, rather than direct long values. The string format for this is "yyyy-MM-dd HH:mm:ss z", e.g. "2015-01-02 15:22:10 GMT+6". This value will be converted to a Unix timestamp long value and will be used for searching.
Sample Queries
- surname: "Smith" AND birthdate: "2015-01-02"
- log_level: "WARN" AND timestamp: [2015-10-01 01:05:20 TO 2015-12-15 00:00:00]
Search with Multi-Word Values
In Lucene, if a field of type STRING is instructed to be indexed, it will be tokenized and indexed, so the field can be searched with each individual word values. If the full value must be searched as a whole, and if we consider the target field name is "x", the field we must search would be "_x", which will search for the full value that is given. For example, if we have a field "name" indexed, and if the entry "Will Smith" is stored, among others, we can search for all names which has "Smith", with the following query:-
- name: "Smith"
If we want to search for the whole name, the following query can be used:-
- _name: "Will Smith"