jcoffey-dev
fb5049a747
Replaces the separate SQL-only /query and text-only /search endpoints with one pipe-syntax query language (plus raw SQL escape hatch) that compiles to a single IR and execution plan across both backends, so a query like `message:"connection refused" | stats count by host` runs as one request instead of two disjoint tools. - api/internal/querylang: lexer -> ast -> parser -> ir -> planner -> executor, each layer independently tested. - Execution generalizes Phase 1's proven Tantivy-prefilter pattern into a 4-way routing table (pure ClickHouse / text-only / text + aggregation / raw SQL passthrough). - Unified web query page and `sentryctl query`, both hitting the same POST /query endpoint. - Benchmarked against a real 1,022,000-row dataset (hack/benchmark-fixture); caught and fixed a real bug where the Tantivy prefilter cap (10,000) produced an IN-clause exceeding ClickHouse's default max_query_size -- lowered to 5,000, documented in docs/query-language-design.md and docs/phase-2-runbook.md. - docs/query-language-reference.md: customer-facing syntax reference.
92 lines
2.4 KiB
Go
92 lines
2.4 KiB
Go
// Package ast defines the parsed pipe-syntax tree. Internal to
|
|
// querylang -- not exposed outside it. See
|
|
// /docs/query-language-design.md for the grammar this mirrors.
|
|
package ast
|
|
|
|
// Query is `base_search ("|" pipe_stage)*`.
|
|
type Query struct {
|
|
Base BoolExpr
|
|
Pipes []PipeStage
|
|
}
|
|
|
|
// PipeStage is one of WhereStage, StatsStage, SortStage, FieldsStage,
|
|
// HeadStage, TailStage.
|
|
type PipeStage interface{ isPipeStage() }
|
|
|
|
type WhereStage struct{ Expr BoolExpr }
|
|
type StatsStage struct {
|
|
Aggs []AggCall
|
|
By []string
|
|
}
|
|
type SortStage struct{ Fields []SortField }
|
|
type FieldsStage struct{ Fields []string }
|
|
type HeadStage struct {
|
|
N int
|
|
HasN bool // false => default limit, decided by the planner
|
|
}
|
|
type TailStage struct {
|
|
N int
|
|
HasN bool
|
|
}
|
|
|
|
func (WhereStage) isPipeStage() {}
|
|
func (StatsStage) isPipeStage() {}
|
|
func (SortStage) isPipeStage() {}
|
|
func (FieldsStage) isPipeStage() {}
|
|
func (HeadStage) isPipeStage() {}
|
|
func (TailStage) isPipeStage() {}
|
|
|
|
// BoolExpr is a sequence of terms joined by "and"/"or". An empty Conjs
|
|
// entry between two terms (i.e. no explicit keyword in the source) means
|
|
// implicit AND -- SPL's convention for adjacent bare search terms, e.g.
|
|
// `error timeout` means `error AND timeout`. Conjs has len(Terms)-1
|
|
// elements once Terms has more than one.
|
|
type BoolExpr struct {
|
|
Terms []Term
|
|
Conjs []string // "and" | "or", one per gap between consecutive Terms
|
|
}
|
|
|
|
// Term is one of Comparison, TimeBound, FreeText.
|
|
type Term interface{ isTerm() }
|
|
|
|
type Comparison struct {
|
|
Field string
|
|
Op string // "=", "!=", ">", ">=", "<", "<="
|
|
Value string
|
|
}
|
|
|
|
type TimeBound struct {
|
|
Kind string // "earliest" | "latest"
|
|
Expr TimeExpr
|
|
}
|
|
|
|
type FreeText struct {
|
|
Query string
|
|
}
|
|
|
|
func (Comparison) isTerm() {}
|
|
func (TimeBound) isTerm() {}
|
|
func (FreeText) isTerm() {}
|
|
|
|
// TimeExpr is either an absolute RFC3339 timestamp or a relative offset
|
|
// like -1h/-7d, resolved to an absolute time by the planner (relative to
|
|
// compile time), not the parser -- the parser has no notion of "now".
|
|
type TimeExpr struct {
|
|
Absolute string
|
|
IsRelative bool
|
|
RelativeSign int // -1 or +1
|
|
RelativeN int
|
|
RelativeUnit string // "s" | "m" | "h" | "d" | "w"
|
|
}
|
|
|
|
type AggCall struct {
|
|
Func string // count, sum, avg, min, max
|
|
Field string // empty for count()/count(*)
|
|
Alias string // empty => planner assigns a default alias
|
|
}
|
|
|
|
type SortField struct {
|
|
Field string
|
|
Desc bool
|
|
}
|