Download the PHP package kiwiz/esquery without Composer
On this page you can find all versions of the php package kiwiz/esquery. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download kiwiz/esquery
More information about kiwiz/esquery
Files in kiwiz/esquery
Package esquery
Short Description Elasticsearch querying library
License MIT
Homepage https://github.com/kiwiz/esquery
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package esquery
ESQuery
ESQuery is a query parser for querying Elasticsearch. Each ESQuery query consists of one or more "commands", separated by the pipe (|) character. During execution, each command is translated into an Elasticsearch DSL query and sent to the server. Any results that are returned get passed off to the next command in the chain.
Structure
Each query is structured as follows:
In English:
- A series of 0 or more options
- A SearchCommand
- A series of 0 or more AggCommands or JoinCommands
- An optional TransactionCommand
with each command separated from the next by a pipe (|) character.
Syntax
Options
Options that can be enabled/disabled within each query. Each option is prefixed by a $.
sort
- A list of fields to sort on.
- Type: List
- Example:
$sort:[time:ASC, type:DESC, duration:DESC]
map
- A mapping of fields and what to rename them to.
- Type: Map
- Example:
$map:[request_ip:ip, geoip_location:loc]
Options
date_field: The name of the field used as the timestamp.to: The latest date to pull results from. (Unix timestamp)from: The earliest date to pull results from. (Unix timestamp)size: The maximum number of results to return.flatten: Flatten any nested structures into a flat key-value map.fields: The list of fields to return.
Commands
Search
A standard Lucene QueryParser query. Almost all of the features are available in ESQuery. The ones that aren't primarily relate to scoring, and are listed here:
- Fuzzy searches
- Proximity searches
- Boosting a term
Must always be the first command.
- Syntax:
QUERY_PARSER_QUERY - Example:
level:99 type:normal
Lists
Inserts an array of values into a query. ESQuery runs a terms filter on the values that are provided.
- Syntax:
KEY:@LIST_NAME - Example:
src_ip:@bad_ip_list
Join
Extracts the values from the previous command and makes them available to the following query.
- Syntax:
'join' 'source:'SOURCE_FIELD 'target:'DEST_FIELD QUERY_PARSER_QUERY - Example:
type:tcp | join source:src_ip target:dst_ip flags:0
Transaction
Combines documents with matching values for a given field. Must always be the final command (if used).
- Syntax:
'trans' 'field:'FIELD_NAME - Example:
trans field:request_uuid
Aggregation
Standard Elasticsearch aggregations. Multiple aggregations can be chained to nest them. ESQuery will return the bucketed data in a table. Any parameters that an aggregation takes can be passed in after setting the field.
Supported aggs: terms, sig_terms, card, max, avg, sum
- Syntax:
'agg:'AGG_TYPE 'field:'FIELD_NAME (AGG_OPT':'AGG_OPT_VAL)* - Example:
agg:terms field:user_id min_doc_count:50
Examples
Match all documents.
Get a count of requests to abc.com bucketed by ip_addr.
Find all requests to abc.com sorted by ip_addr and date.
Find all users with the same email as bob.
Find and group all log lines associated with requests that came from 10.0.0.5.
Find any documents that have a value from @include but not a value from @exclude.
Find the most common useragent.
