Extend the search API to enable chaining multiple queries
Closed this issue · 0 comments
oyvindhagberg commented
Proposed changes to the search
API method:
- Allow multiple query- and filename-parameters, on the format
q1
,f1
,q2
,f2
and so on. (File names are optional.) The searches will be performed one after another. Each search internally produces a list of files as the result. - After each additional search, starting from number 2 and upwards, the result will be combined with the previous result using an operation given by a parameter
op2
,op3
and so on.
Supported operations will be:
- and (intersection)
- or (union)
- subtract (difference)
- Often the user wants a list of hosts, not files. Unless the
fields
parameter contains file-specific fields such asfileID
,filename
, orcontent
, it can be assumed that only unique hosts should be returned. No need to return a list ofipAddress
orhostname
with duplicate values, for example. - Consider adding a
count
parameter like hostlist has. Let's say someone searches with justfields=os
and wants to see unique results. - This could be a separate issue: Consider adding support for a new pseudo-field
lines
, which for each file in the result list should contain an array of the lines in that matched (full text). Sort of like grep does.