blob: 96d0fd11b494ed01e66e7c988bd463f5e4e777c2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
DTail Query Language
====================
The query language allows you to run mapreduce queries on log files. This page intends to be a reference to the language.
## Prerequisites
For this to work, DTail needs to understand your log format. DTail already understands its own log format. You can have a look at all examples of the [examples](./examples.md) page using `-query` (these would be all examples of the `dmap` command, and some examples using the `dtail` command).
DTail also ships with a generic log format, which only allows you to run very basic queries. Check out the [log format](./logformats.md) documentation for this. To implement your own log format, please also check out the log format documentation.
## The complete language
```shell
QUERY :=
select SELECT1[,SELECT2...]
from TABLE
[where COND1[,COND2...]]
[group by GROUPFIELD1[,GROUPFIELD2...]]
[order|rorder by ORDERFIELD]
[interval SECONDS]
[limit NUM]
[outfile "FILENAME.csv"]
[logformat LOGFORMAT]
SELECT := FIELD|AGGREGATION(FIELD)
TABLE := The mapreduce table name, e.g. WRITE in MAPREDUCE:WRITE
AGGREGATION := count|sum|min|max|avg|last|len
COND := ARG1 OPERATOR ARG2
ARG := This is either
a string: "foo bar"
a float number: 3.14
a bareword e.g.: responsecode
a field or a $variable
OPERATOR := This is one of ...
Floating point operators:
== != < <= > >=
String operators:
eq ne contains lacks (lacks is the opposite of contains, e.g. "not contains")
GROUPFIELD := bareword|$variable
ORDERFIELD := This must be a AGGREGATION(FIELD) or FIELD which was specified in
select clause already.
LOGFORMAT := The name of the log format implementation. It's 'default' by default.
```
Note, that the available fields and variables vary from the log format used. There is also a subtle difference between a field and a variable. Check out the [log format](./logformats.md) documentation for more information.
|
