Skip to content

Commit a10aa54

Browse files
Address Kirk's comments
1 parent 5fed1f2 commit a10aa54

File tree

2 files changed

+48
-42
lines changed

2 files changed

+48
-42
lines changed

docs/src/user-guide/quick-start/clp-json.md

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ To compress logs from object storage, see
6161

6262
### Sample logs
6363

64-
For some sample logs, check out the open-source [datasets](../resources-datasets).
64+
For some sample logs, check out the [open-source datasets](../resources-datasets).
6565

6666
---
6767

@@ -70,12 +70,24 @@ For some sample logs, check out the open-source [datasets](../resources-datasets
7070
You can search your compressed logs from CLP's [UI](#searching-from-the-ui) or the
7171
[command line](#searching-from-the-command-line).
7272

73-
Queries must be in the form of a set of conditions (predicates) on key-value pairs (kv-pairs). For
74-
example, consider the logs in [Figure 1](#figure-1) and the query in [Figure 2](#figure-2).
73+
In clp-json, queries are written as a set of conditions (predicates) on key-value pairs (kv-pairs).
74+
For example, [Figure 1](#figure-1) shows a query that matches the first log event in
75+
[Figure 2](#figure-2).
7576

7677
(figure-1)=
7778
:::{card}
7879

80+
```sql
81+
ctx: "conn11" AND msg: "*write concern*"
82+
```
83+
84+
+++
85+
**Figure 1**: An example query.
86+
:::
87+
88+
(figure-2)=
89+
:::{card}
90+
7991
```json lines
8092
{
8193
"t": {
@@ -93,23 +105,12 @@ example, consider the logs in [Figure 1](#figure-1) and the query in [Figure 2](
93105
```
94106

95107
+++
96-
**Figure 1**: A set of JSON log events.
97-
:::
98-
99-
(figure-2)=
100-
:::{card}
101-
102-
```sql
103-
ctx: "conn11" AND msg: "*write concern*"
104-
```
105-
106-
+++
107-
**Figure 2**: An example query.
108+
**Figure 2**: A set of JSON log events.
108109
:::
109110

110111
The query in [Figure 2](#figure-2) will match log events that contain the kv-pair `"ctx": "conn11"`
111112
as well as a kv-pair with key `"msg"` and a value that matches the wildcard query
112-
`"*write concern*"`. This query will match the first log event in [Figure 1](#figure-1).
113+
`"*write concern*"`.
113114

114115
A complete reference for clp-json's query syntax is available on the
115116
[JSON syntax reference page](../reference-json-search-syntax).
@@ -131,8 +132,8 @@ the following features:
131132
* You can click and drag to zoom into a time range, or use the time range filter in (4).
132133
3. The table displays the search results for your query.
133134
4. Clicking the <i class="fa fa-bars"></i> icon reveals additional filters for your query.
134-
* The time range filter allows you to specify the period of time that matching log events must
135-
be in.
135+
* The time range filter allows you to specify the period of time that matching log events must be
136+
in.
136137
* The case sensitivity filter allows you to specify whether CLP should respect the case of your
137138
query.
138139
5. Clicking the <i class="fa fa-cog"></i> icon reveals options for displaying results.

docs/src/user-guide/quick-start/clp-text.md

Lines changed: 29 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ text logs.
55

66
:::{caution}
77
If you're using a `clp-text` release, you should only compress unstructured text logs. `clp-text`
8-
is able to compress and search JSON logs as if it was unstructured text, but `clp-text` cannot
8+
is able to compress and search JSON logs as if they were unstructured text, but `clp-text` cannot
99
query individual fields. This limitation will be addressed in a future version of CLP.
1010
:::
1111

@@ -54,63 +54,68 @@ For some sample logs, check out the [open-source datasets](../resources-datasets
5454
You can search your compressed logs from CLP's [UI](#searching-from-the-ui) or the
5555
[command line](#searching-from-the-command-line).
5656

57-
Unstructured text log queries are written as plain text. You can use a couple of special
58-
characters to make these queries more versatile. `*` can be used as a placeholder for an unknown
59-
number of characters, and `?` can be used for a single character. For example, consider the logs in
60-
[Figure 1](#figure-1) and the query in [Figure 2](#figure-2).
57+
In clp-text, queries are written as wildcard expressions. A wildcard expression is a plain text
58+
query where:
59+
60+
* `*` matches zero or more characters
61+
* `?` matches any single character
62+
63+
For example, consider the query in [Figure 1](#figure-1) and the logs in [Figure 2](#figure-2).
6164

6265
(figure-1)=
6366
:::{card}
6467

65-
```text
66-
1 abc
67-
2 axbc
68-
3 abxc
69-
4 axxbxc
70-
5 a b c
68+
```bash
69+
"INFO container_? Transitioned*ACQUIRED"
7170
```
7271

7372
+++
74-
**Figure 1**: A set of unstructured text log events.
73+
**Figure 1**: An example query.
7574
:::
7675

7776
(figure-2)=
7877
:::{card}
7978

80-
```bash
81-
"a*b?c"
79+
```text
80+
2015-03-23T15:50:17.926Z INFO container_1 Transitioned from ALLOCATED to ACQUIRED
81+
2015-03-23T15:50:17.927Z ERROR Scheduler: Error trying to assign container token
82+
java.lang.IllegalArgumentException: java.net.UnknownHostException: i-e5d112ea
83+
at org.apache.hadoop.security.buildTokenService(SecurityUtil.java:374)
84+
at org.apache.hadoop.ipc.Server$Handler.run(Server.java:2033)
85+
Caused by: java.net.UnknownHostException: i-e5d112ea
86+
... 17 more
8287
```
8388

8489
+++
85-
**Figure 2**: An example query.
90+
**Figure 2**: A set of unstructured text log events.
8691
:::
8792

88-
The query in [Figure 2](#figure-2) will match with lines 3, 4, and 5 in [Figure 1](#figure-1), as
89-
they are the only lines which contain the character `"a"` followed by any number (including zero)
90-
of other characters, followed by `"b"`, followed by one other character, followed by `"c"`.
93+
The query in [Figure 2](#figure-2) will match with the first log message, as the `?` will stand in
94+
for any one character (in this case, `1`), and the `*` will stand in for the characters
95+
` from ALLOCATED to `.
9196

9297
A complete reference for clp-text's query syntax is available on the
9398
[text syntax reference page](../reference-text-search-syntax).
9499

95100
### Searching from the UI
96101

97-
To search your compressed logs from CLP's UI, open [http://localhost:4000](http://localhost:4000)
98-
in your browser (if you changed `webui.host` or `webui.port` in `etc/clp-config.yml`, use the new
102+
To search your compressed logs from CLP's UI, open [http://localhost:4000](http://localhost:4000) in
103+
your browser (if you changed `webui.host` or `webui.port` in `etc/clp-config.yml`, use the new
99104
values).
100105

101106
:::{image} clp-search-ui.png
102107
:::
103108

104-
The image above shows the search page after running a query. The numbered circles correspond to
105-
the following features:
109+
The image above shows the search page after running a query. The numbered circles correspond to the
110+
following features:
106111

107112
1. The search box is where you can enter your query.
108113
2. The timeline shows the number of results across the time range of your query.
109114
* You can click and drag to zoom into a time range, or use the time range filter in (4).
110115
3. The table displays the search results for your query.
111116
4. Clicking the <i class="fa fa-bars"></i> icon reveals additional filters for your query.
112-
* The time range filter allows you to specify the period of time that matching log events must
113-
be in.
117+
* The time range filter allows you to specify the period of time that matching log events must be
118+
in.
114119
* The case sensitivity filter allows you to specify whether CLP should respect the case of your
115120
query.
116121
5. Clicking the <i class="fa fa-cog"></i> icon reveals options for displaying results.

0 commit comments

Comments
 (0)