一键搜索语法说明

M³Meta平台提供全文检索技术，允许用户进行异构数据的统一检索。一键搜索语法是一种自然搜索语法，具有搜索简单、快速，并支持管道符逐级搜索等特点。

关键字搜索

语法

<string> ...

示例

search:
    error
result: 
    +----+------+-----------------------+
    | id | host | msg                   |
    +----+------+-----------------------+
    |  1 | svr1 | Runtime error.        |
    |  2 | svr2 | Nil pointer error.    |
    |  3 | svr3 | File not exist error. |
    +----+------+-----------------------+

search:
    error svr1
result: 
    +----+------+-----------------------+
    | id | host | msg                   |
    +----+------+-----------------------+
    |  1 | svr1 | Runtime error.        |
    +----+------+-----------------------+

[!NOTE] 查询关键字可以是任意字符串，查询会全文检索关键字返回结果。

指定类搜索

语法

class <class name> ...

示例

search:
    class /matrix/devops/event
result: 
    +----+----------------------+------+
    | id | class                | host |
    +----+----------------------+------+
    |  1 | /matrix/devops/event | svr1 |
    |  2 | /matrix/devops/event | svr2 |
    |  3 | /matrix/devops/event | svr3 |
    +----+----------------------+------+

search:
    class /matrix/devops/event /matrix/devops/performance
result: 
    +----+----------------------------+------+
    | id | class                      | host |
    +----+----------------------------+------+
    |  1 | /matrix/devops/event       | svr1 |
    |  2 | /matrix/devops/event       | svr2 |
    |  3 | /matrix/devops/event       | svr3 |
    | 10 | /matrix/devops/performance | svr4 |
    +----+----------------------------+------+

[!NOTE] 根据具体类查询，可以指定多个类进行查询。

指定返回记录数量

语法

<search command> | top <number>

示例

search:
    error | top 2
result: 
    +----+------+-----------------------+
    | id | host | msg                   |
    +----+------+-----------------------+
    |  1 | svr1 | Runtime error.        |
    |  2 | svr2 | Nil pointer error.    |
    +----+------+-----------------------+

[!NOTE] 返回指定数量的结果集，需要与查询命令连接使用。

搜索结果排序

语法

<search command> | sort <field>, ... asc/desc

示例

search:
    error | sort host desc
result: 
    +----+------+-----------------------+
    | id | host | msg                   |
    +----+------+-----------------------+
    |  4 | svr4 | Runtime error.        |
    |  3 | svr3 | Nil pointer error.    |
    |  2 | svr2 | File not exist error. |
    |  1 | svr1 | Nil pointer error.    |
    +----+------+-----------------------+

[!NOTE] 根据指定字段排序结果集，需要与查询命令连接使用。

指定返回属性

语法

<search command> | print <field>, ...

示例

search:
    error | print host, msg
result: 
    +------+-----------------------+
    | host | msg                   |
    +------+-----------------------+
    | svr1 | Runtime error.        |
    | svr2 | Nil pointer error.    |
    | svr3 | File not exist error. |
    | svr4 | Nil pointer error.    |
    +------+-----------------------+

[!NOTE] 输出指定字段，需要与查询命令连接使用。

指定时间范围搜索

语法

<search command> | within <number>year/month/week/day/hour/minute/second
<search command> | after <date string yyyy-MM-dd HH:mm:ss>
<search command> | today/yestoday/week/month/year/last week/last month/last year
<search command> | at <date string yyyy-MM-dd HH:mm:ss>

示例

search:
    error | within 1day
result: 
    +----+------+----------------------+---------------------+
    | id | host | msg                  | ctime               |
    +----+------+----------------------+---------------------+
    |  1 | svr1 | Runtime error.       | 2017-09-14 17:35:00 |
    |  2 | svr2 | Process error.       | 2017-09-14 14:20:48 |
    |  3 | svr3 | IO read error.       | 2017-09-14 08:43:05 |
    |  4 | svr4 | Print message error. | 2017-09-14 11:08:12 |
    +----+------+----------------------+---------------------+

search:
    error | after '2017-09-14 14:00:00'
result: 
    +----+------+----------------------+---------------------+
    | id | host | msg                  | ctime               |
    +----+------+----------------------+---------------------+
    |  1 | svr1 | Runtime error.       | 2017-09-14 17:35:00 |
    |  2 | svr2 | Process error.       | 2017-09-14 14:20:48 |
    +----+------+----------------------+---------------------+

search:
    error | today
result: 
    +----+------+----------------------+---------------------+
    | id | host | msg                  | ctime               |
    +----+------+----------------------+---------------------+
    |  1 | svr1 | Runtime error.       | 2017-09-14 17:35:00 |
    |  2 | svr2 | Process error.       | 2017-09-14 14:20:48 |
    |  3 | svr3 | IO read error.       | 2017-09-14 08:43:05 |
    |  4 | svr4 | Print message error. | 2017-09-14 11:08:12 |
    +----+------+----------------------+---------------------+

search:
    error | at '2017-09-14 17:35:00'
result: 
    +----+------+----------------------+---------------------+
    | id | host | msg                  | ctime               |
    +----+------+----------------------+---------------------+
    |  1 | svr1 | Runtime error.       | 2017-09-14 17:35:00 |
    +----+------+----------------------+---------------------+