| Excerpt |
|---|
| The query syntax can be used in Squirro to search for items. |
Table of Contents
| Table of Contents | ||||||
|---|---|---|---|---|---|---|
|
Introduction
By default, title and body fields are taken into account when searching. Facets can be configured to also be searchable.
By default, the terms entered are AND combined.
Boolean Operators
Use AND, OR, NOT, + (plus sign) or - (minus sign) to explicitly combine terms. Be aware that the operators need to be in all capital letters.
The following restrictions apply:
- The + or required operator requires that the term after the + symbol exist somewhere.
- The - or prohibit operator excludes documents that contain the term after the - symbol.
Example Queries
...
Grouping
Use round brackets / parentheses for grouping.
Example Queries
...
Phrase Search
Use double quotes at the beginning and ending of a phrase to perform a phrase search. Phrases must match exactly (i.e. no stemming is applied within a phrase). You can also add a slop to the phrase with a tilde ~ at the end of the phrase to do a proximity search.
Example Queries
...
Wildcard Search
Use * and ? to perform a wildcard search. Multiple character wildcard searches look for 0 or more characters and the single character wildcard search looks for terms that match that with the single character replaced. Wildcard search can also apply per field. Leading wildcards are allowed, but note that they can be very slow and potentially timeout within Elasticsearch. In order to prevent extremely slow wildcard queries, a wildcard term should not start with one of the wildcards * or ?
Example Queries
...
1 Note that facet names containing spaces need to be put inside quotes in queries
Field Search
Only search in specific fields
...
$item_created_at >= "2015-02-01T00:00:00"
...
Search documents created in the last 7 days
(see Elasticsearch documentation)
...
Facet Search
Use any document facet to restrict the search.
...
1 Note that facet names containing spaces need to be put inside quotes in queries
Note: this search is case sensitive
Sorting
You can use the following query syntax to sort the result:
sort:<field_name>[:<order>]Where <field_name> is either 'date' (default) or 'relevance' or any item field name you want to sort by and <order> is either 'asc' for ascending or 'desc' for descending. The order suffix is optional, the default order is descending.2
Additionally, you can add a second (or third etc) sorting criteria by adding
[;<2nd_sort_field>[:<2nd_order>]]to the query syntax.
2 Note: The square brackets above mean that those fields are optional. Those brackets are not part of the syntax.
Example Queries
...
sort:date
...
sort:date:asc
...
sort:relevance:desc
...
sort:my_sortable_facet:desc;date:desc
...
Time Increment
It is possible to control the time increments shown in the main timeline and in the dashboard widgets. To do so, add time_increment:<value> to a query.
Here is the Bugzilla Project without a time_increment set:
The same query, with time_increment:year
Possible values are:
| Code Block | ||
|---|---|---|
| ||
time_increment:minute
time_increment:hour
time_increment:day
time_increment:week
time_increment:month
time_increment:quarter
time_increment:year |
This can also be combined with values for more flexibility. For example:
| Code Block | ||
|---|---|---|
| ||
time_increment:12hours
time_increment:4days
time_increment:8weeks
time_increment:6months
time_increment:3year |
| Note |
|---|
There is a performance impact when using a time increment that results in many individual increments. This impact is both in the user interface, where each increment needs to be drawn, as well as on the Elasticsearch level, where they need to be calculated. So use the |
Entity Search
Query syntax to search for items having entities satisfied some criteria:
| No Format |
|---|
entity:{< any query to match a single entity document >} |
Example:
Search for Items containing a specific Entity of type company:
| No Format |
|---|
entity:{type:company AND name:"Thomson Reuters"} |
Search for Items containing at least one company-typed Entity "Thomson Reuters" and another one Entity "Squirro":
| No Format |
|---|
entity:{type:company AND name:"Thomson Reuters"} AND entity:{type:company AND name:Squirro}
|
Search for Items containing a specific Entity of type company with a confidence higher than 80%:
| No Format |
|---|
entity:{type:company AND name:"Thomson Reuters" AND confidence > 0.8} |
Search for Items containing any Entity of type company with confidence higher than 70%:
| No Format |
|---|
entity:{type:company AND NOT confidence < 0.7} |
Search for Items containing no Entity of type company with confidence higher or equal than 20%:
| No Format |
|---|
entity:{type:company AND confidence < 0.2}
|
Search for Items containing any Entity of type deal with at least a 70% confidence:
| No Format |
|---|
entity:{type:deal AND confidence > 0.7} |
Search for Items containing a specific Entity of type deal:
| No Format |
|---|
entity:{type:deal AND properties.size:100 AND properties.region:US AND properties.industry:Tech AND properties.target:Whatsapp AND properties.acquirer:Facebook}
|
Search for Items containing one Entity with target Squirro and another Entity with target Whatsapp:
| No Format |
|---|
entity:{type:deal AND properties.target:Squirro AND properties.industry:Tech} AND entity:{type:deal AND properties.target:Whatsapp AND properties.industry:Tech} |
Search for Items containing an Entity of type deal with a property size bigger than 100:
| No Format |
|---|
entity:{type:deal AND properties.size > 100} |
Starred and Read Items
Starred items are items marked as favourite / bookmarked items.
...
Note: You need to enable flags for your project(s) before you are able to query for starred and read items.
In topic.ini:
| No Format |
|---|
[topic]
...
# For caching reasons the read/starred flags aggregations are now disabled
# by default. You can enable it by configuring a project id here.
# Mulitple ids can be provided by comman separating them.
enable_flags_for_project_ids = |
Query syntax for (un)starred items and (un)read items:
...
This page can now be found at Query Syntax on the Squirro Docs site.