Extending search language to support aggregations and multi-phase queries

[avleen]

Hi folks,

I'm interested in changing the search language use slightly. Currently the two options are to use Lucene Query Syntax or send JSON.

Is there any ability to change the language and provide, maybe, some kind of translation from what I want to JSON, which would then be executed?
Specifically, I'm interested in being able to write queries like this:

type:web_log AND request_uri:/ | _aggs:terms _field:user_ip_address

This would ideally go to the Visualize page and set up the request and the terms aggregation on that field.

I can easily map this query language to RISON, and if you folks have any pointers on how to integrate this into the existing UI, I'd love to hear them. I'm happy to do all the heavy lifting to make it work, if it's even a remote possibility, as it's our only major blocker to moving to Kibana 4.

Thanks!

[rashidkpc]

More than a possibility! We're actually investigating new languages for describing how data should be extracted, transformed and viewed right now. I totally agree with you that this would be awesome

[avleen]

Hi @rashidkpc! Just wondering if you folks had any more time to think about this? :)

[Bargs]

Timelion supports a query syntax like this now. We're starting to think about a replacement for the standard kibana query language at the moment, however we're mainly focused on search, not aggregations.

[avleen]

Hi @Bargs , thanks for the update :)
Is there any existing discussion on this in a ticket somewhere?
My view on this might be simplistic, but in theory going from search -> aggregations could be easy.
Eg:

.es(log:web, response:200) | .agg(type:terms, field:host, size=50)

[Bargs]

Is there any existing discussion on this in a ticket somewhere?

It's not, but I'd like to write up a ticket soon. I'll try to remember to drop a reference here once I do.

[avleen]

Thanks Matt :-)

…

On Mon, Feb 13, 2017 at 7:07 PM Matt Bargar ***@***.***> wrote: Is there any existing discussion on this in a ticket somewhere? It's not, but I'd like to write up a ticket soon. I'll try to remember to drop a reference here once I do. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#4437 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAg7hXRVUzpzs4aV4qJh5PBoTcnhQ9LVks5rcPBZgaJpZM4FZY3e> .

[Bargs]

As promised #10789

[elasticmachine]

Pinging @elastic/kibana-app-arch (Team:AppArch)

[vadimkibana]

Thank you for contributing to this issue, however, we are closing this issue due to inactivity as part of a backlog grooming effort. If you believe this feature/bug should still be considered, please reopen with a comment.