166 lines
3.3 KiB
Markdown
166 lines
3.3 KiB
Markdown
# 🔍 Searchcraft Query Guide
|
|
|
|
Searchcraft lets you construct powerful search queries with structured JSON. This guide shows how to:
|
|
|
|
* Combine **exact and fuzzy** queries
|
|
* Search logs **within a time range**
|
|
* Use **curl**, **Python (httpx)**, and **JavaScript (fetch)** to query
|
|
|
|
---
|
|
|
|
## ✅ Mixing Exact and Fuzzy Queries
|
|
|
|
You can combine multiple types using a `boolean` query with `must`, `should`, or `must_not` clauses.
|
|
|
|
### JSON Query Example
|
|
|
|
```json
|
|
{
|
|
"query": {
|
|
"type": "boolean",
|
|
"must": [
|
|
{ "type": "term", "field": "username", "value": "wyatt" },
|
|
{ "type": "fuzzy", "field": "message", "value": "falcon" }
|
|
]
|
|
}
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## 🕓 Searching Logs by Time Range
|
|
|
|
Use a `range` query on a timestamp field:
|
|
|
|
```json
|
|
{
|
|
"query": {
|
|
"type": "range",
|
|
"field": "timestamp",
|
|
"gte": "now-24h",
|
|
"lte": "now"
|
|
}
|
|
}
|
|
```
|
|
|
|
Or combine it:
|
|
|
|
```json
|
|
{
|
|
"query": {
|
|
"type": "boolean",
|
|
"must": [
|
|
{ "type": "term", "field": "username", "value": "wyatt" },
|
|
{
|
|
"type": "range",
|
|
"field": "timestamp",
|
|
"gte": "now-24h",
|
|
"lte": "now"
|
|
},
|
|
{ "type": "fuzzy", "field": "message", "value": "falcon" }
|
|
]
|
|
}
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## 💻 curl Example
|
|
|
|
```bash
|
|
curl -X POST https://your.searchcraft.domain/index/logs/search \
|
|
-H "Content-Type: application/json" \
|
|
-d '{
|
|
"query": {
|
|
"type": "boolean",
|
|
"must": [
|
|
{ "type": "term", "field": "username", "value": "wyatt" },
|
|
{ "type": "fuzzy", "field": "message", "value": "falcon" },
|
|
{
|
|
"type": "range",
|
|
"field": "timestamp",
|
|
"gte": "now-24h",
|
|
"lte": "now"
|
|
}
|
|
]
|
|
}
|
|
}'
|
|
```
|
|
|
|
---
|
|
|
|
## 🐍 Python (httpx) Example
|
|
|
|
```python
|
|
import httpx
|
|
|
|
payload = {
|
|
"query": {
|
|
"type": "boolean",
|
|
"must": [
|
|
{"type": "term", "field": "username", "value": "wyatt"},
|
|
{"type": "fuzzy", "field": "message", "value": "falcon"},
|
|
{
|
|
"type": "range",
|
|
"field": "timestamp",
|
|
"gte": "now-24h",
|
|
"lte": "now"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
response = httpx.post(
|
|
"https://your.searchcraft.domain/index/logs/search",
|
|
json=payload
|
|
)
|
|
print(response.json())
|
|
```
|
|
|
|
---
|
|
|
|
## 🌐 JavaScript (fetch) Example
|
|
|
|
```js
|
|
const payload = {
|
|
query: {
|
|
type: "boolean",
|
|
must: [
|
|
{ type: "term", field: "username", value: "wyatt" },
|
|
{ type: "fuzzy", field: "message", value: "falcon" },
|
|
{
|
|
type: "range",
|
|
field: "timestamp",
|
|
gte: "now-24h",
|
|
lte: "now"
|
|
}
|
|
]
|
|
}
|
|
};
|
|
|
|
fetch("https://your.searchcraft.domain/index/logs/search", {
|
|
method: "POST",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify(payload)
|
|
})
|
|
.then(res => res.json())
|
|
.then(console.log)
|
|
.catch(console.error);
|
|
```
|
|
|
|
---
|
|
|
|
## 🧠 Summary Table
|
|
|
|
| Task | Query Type |
|
|
| ------------------------------ | ---------- |
|
|
| Exact match | `term` |
|
|
| Fuzzy match (typo-tolerant) | `fuzzy` |
|
|
| Filter by date or number range | `range` |
|
|
| Combine multiple conditions | `boolean` |
|
|
| OR logic | `should` |
|
|
| Exclude conditions | `must_not` |
|
|
|
|
---
|
|
|
|
Want help customizing this to your logs/index schema? Just ask!
|