@@ -5,7 +5,7 @@ text logs.
5
5
6
6
:::{caution}
7
7
If you're using a ` clp-text ` release, you should only compress unstructured text logs. ` clp-text `
8
- is able to compress and search JSON logs as if it was unstructured text, but ` clp-text ` cannot
8
+ is able to compress and search JSON logs as if they were unstructured text, but ` clp-text ` cannot
9
9
query individual fields. This limitation will be addressed in a future version of CLP.
10
10
:::
11
11
@@ -54,63 +54,68 @@ For some sample logs, check out the [open-source datasets](../resources-datasets
54
54
You can search your compressed logs from CLP's [ UI] ( #searching-from-the-ui ) or the
55
55
[ command line] ( #searching-from-the-command-line ) .
56
56
57
- Unstructured text log queries are written as plain text. You can use a couple of special
58
- characters to make these queries more versatile. ` * ` can be used as a placeholder for an unknown
59
- number of characters, and ` ? ` can be used for a single character. For example, consider the logs in
60
- [ Figure 1] ( #figure-1 ) and the query in [ Figure 2] ( #figure-2 ) .
57
+ In clp-text, queries are written as wildcard expressions. A wildcard expression is a plain text
58
+ query where:
59
+
60
+ * ` * ` matches zero or more characters
61
+ * ` ? ` matches any single character
62
+
63
+ For example, consider the query in [ Figure 1] ( #figure-1 ) and the logs in [ Figure 2] ( #figure-2 ) .
61
64
62
65
(figure-1)=
63
66
:::{card}
64
67
65
- ``` text
66
- 1 abc
67
- 2 axbc
68
- 3 abxc
69
- 4 axxbxc
70
- 5 a b c
68
+ ``` bash
69
+ " INFO container_? Transitioned*ACQUIRED"
71
70
```
72
71
73
72
+++
74
- ** Figure 1** : A set of unstructured text log events .
73
+ ** Figure 1** : An example query .
75
74
:::
76
75
77
76
(figure-2)=
78
77
:::{card}
79
78
80
- ``` bash
81
- " a*b?c"
79
+ ``` text
80
+ 2015-03-23T15:50:17.926Z INFO container_1 Transitioned from ALLOCATED to ACQUIRED
81
+ 2015-03-23T15:50:17.927Z ERROR Scheduler: Error trying to assign container token
82
+ java.lang.IllegalArgumentException: java.net.UnknownHostException: i-e5d112ea
83
+ at org.apache.hadoop.security.buildTokenService(SecurityUtil.java:374)
84
+ at org.apache.hadoop.ipc.Server$Handler.run(Server.java:2033)
85
+ Caused by: java.net.UnknownHostException: i-e5d112ea
86
+ ... 17 more
82
87
```
83
88
84
89
+++
85
- ** Figure 2** : An example query .
90
+ ** Figure 2** : A set of unstructured text log events .
86
91
:::
87
92
88
- The query in [ Figure 2] ( #figure-2 ) will match with lines 3, 4, and 5 in [ Figure 1 ] ( #figure-1 ) , as
89
- they are the only lines which contain the character ` "a" ` followed by any number (including zero)
90
- of other characters, followed by ` "b" ` , followed by one other character, followed by ` "c" ` .
93
+ The query in [ Figure 2] ( #figure-2 ) will match with the first log message, as the ` ? ` will stand in
94
+ for any one character (in this case, ` 1 ` ), and the ` * ` will stand in for the characters
95
+ ` from ALLOCATED to ` .
91
96
92
97
A complete reference for clp-text's query syntax is available on the
93
98
[ text syntax reference page] ( ../reference-text-search-syntax ) .
94
99
95
100
### Searching from the UI
96
101
97
- To search your compressed logs from CLP's UI, open [ http://localhost:4000 ] ( http://localhost:4000 )
98
- in your browser (if you changed ` webui.host ` or ` webui.port ` in ` etc/clp-config.yml ` , use the new
102
+ To search your compressed logs from CLP's UI, open [ http://localhost:4000 ] ( http://localhost:4000 ) in
103
+ your browser (if you changed ` webui.host ` or ` webui.port ` in ` etc/clp-config.yml ` , use the new
99
104
values).
100
105
101
106
:::{image} clp-search-ui.png
102
107
:::
103
108
104
- The image above shows the search page after running a query. The numbered circles correspond to
105
- the following features:
109
+ The image above shows the search page after running a query. The numbered circles correspond to the
110
+ following features:
106
111
107
112
1 . The search box is where you can enter your query.
108
113
2 . The timeline shows the number of results across the time range of your query.
109
114
* You can click and drag to zoom into a time range, or use the time range filter in (4).
110
115
3 . The table displays the search results for your query.
111
116
4 . Clicking the <i class =" fa fa-bars " ></i > icon reveals additional filters for your query.
112
- * The time range filter allows you to specify the period of time that matching log events must
113
- be in.
117
+ * The time range filter allows you to specify the period of time that matching log events must be
118
+ in.
114
119
* The case sensitivity filter allows you to specify whether CLP should respect the case of your
115
120
query.
116
121
5 . Clicking the <i class =" fa fa-cog " ></i > icon reveals options for displaying results.
0 commit comments