WSO2 DAS allows you to search for persisted events using the Data Explorer. In addition to selecting attributes and categories from lists as shown in Searching Data By Categories, you can write Apache Lucene queries to search for data. This section explains the syntax to be followed when searching for persisted data using Lucene queries.
Query syntax
The following table specifies the query syntax that should be used for different search requirements
| Search Requirement | Lucene Query Syntax | Example |
|---|---|---|
| View all the data in the selected event table. | Click Search without entering any value in the query field | N/A |
| Search using a part of the attribute value | Insert the asterisk after the part of the attribute as relevant
| If you are searching for a book by the
|
| Search using more than one attribute | <ATTRIBUTE_NAME>:<ATTRIBUTE_VALUE> AND <ATTRIBUTE_NAME>:<ATTRIBUTE_VALUE> | If you are searching for a book written by Ronald Dahl which belongs to the Children's Fantasy category, you can search by the two attributes named
|
| Search for records that match one of the matching criteria when multiple matching criteria is provided | <ATTRIBUTE_NAME>:<ATTRIBUTE_VALUE> OR <ATTRIBUTE_NAME>:<ATTRIBUTE_VALUE> | If you are searching for a book written by Robin Sharma or a book written by different author on the subject of Leadership, you can search by two attributes named
|
Search for records with a specific attribute value that is within a defined range This type of search can be carried out only with attributes of which the attribute type is | <ATTRIBUTE_NAME>:<MINIMUM_VALUE> TO <MAXIMUM_VALUE> | If you are searching for a book for which the count is between 100 and 200, you can use use the following query.
|
For detailed information about the Lucene syntax, see Apache Lucene - Query Parser Syntax.
It is not possible to search for attributes defined as facets directly using Lucene queries, but should be separately given in the Data Explorer, or used with the Analytics REST API.
WSO2 DAS Lucene Query Extensions
Timestamp Operations on Fields
WSO2 DAS supports only the primitive data types when persisting data. Therefore it does not have a special data type for timestamp. The LONG data type should be used when sending timestamp values. However, because it is convenient to query with a string time stamp format instead of querying for a long value which is exactly the same as the actual value, the following string format is supported.
yyyy-MM-dd HH:mm:ss z
e.g., 2015-01-02 15:22:10 GMT+6
This value is converted to a Unix timestamp long value and then used for searching.
Sample Queries
- The following query can be used to search for a person whose last name is Smith and the date of birth is 2nd of January 2015.
surname:"Smith" AND birthdate:"2015-01-02" - The following query can be used for a log level WARN which occurred at a time between the time stamps 2015-10-01 01:05:20 and 20.15-12-15 00:00:00.
log_level: "WARN" AND timestamp: [2015-10-01 01:05:20 TO 2015-12-15 00:00:00]
Search with Multi-Word Values
If an attribute of the STRING type is instructed to be indexed, Apache Lucene tokenises and indexes it in a manner that allows you to search by that attribute using individual word values. If you want to search by the attribute by using the complete attribute value, WSO2 DAS allows the following query to be used for this purpose.
_X:<EXACT_ATTRIBUTE_Value>
In this query, X = Attribute Name
Sample query
If the Name attribute is indexed and a record with Will Smith as the value of the Name attribute is stored:
- Use the following query to search for all records with
Smithas all or part of the value for theNameattribute.name:"Smith" - Use the following query to search for all records where
Will Smithis the exact value for theNameattribute._name:"Will Smith"