KQL

You’re reading the main branch’s readme. Please visit hexdocs for the latest published documentation.

Parser for a simplified version of the Kibana query language into an AST.

What is supported?

• Comparison operators: >, >=, <, <=, :
• Quoted and unquoted values, including escape characters: make:"foo bar", make:foo\ bar
• Not, and, & or operators: NOT make:foo, make:foo AND model:bar, make:foo OR model:bar
• Grouping expressions with (): make:foo OR (make:bar AND model:bar)
• UTF-8 values: make:苹果
• Glob values: make:foo*
• Value lists: make: (foo OR bar)

What is missing?

• Nested fields: first.second: foo
• Matching multiple fields (glob values in field name): make*:foo
• Querying nested fields: make:{ first: foo and second: bar }

Installation

def deps do
  [
    {:kql, "~> 0.1.0"}
  ]
end

Examples

iex> KQL.parse("make:foo")
{:ok, %{
  "ast" => %{
    "field" => "make",
    "operator" => "=",
    "type" => "comparison",
    "value" => %{
      "type" => "value",
      "term" => "foo",
      "glob" => false,
      "quoted" => false
    }
  },
  "meta" => %{
    "original_query" => "make:foo",
    "version" => "0.1.0"
  }
}}

Globs are supported too:

iex> KQL.parse("make:A* AND model:*X")
{:ok, %{
  "ast" => %{
    "type" => "and",
    "terms" => [%{
      "type" => "comparison",
      "field" => "make",
      "operator" => "=",
      "value" => %{
        "type" => "value",
        "term" => "A*",
        "glob" => true,
        "quoted" => false
      }
    },
    %{
      "type" => "comparison",
      "field" => "model",
      "operator" => "=",
      "value" => %{
        "type" => "value",
        "term" => "*X",
        "glob" => true,
        "quoted" => false
      }
    }]
  },
  "meta" => %{
    "original_query" => "make:A* AND model:*X",
    "version" => "0.1.0"
  }
}}