Query Syntax

The query syntax can be used in Squirro to search for items.

Table of Contents

Introduction

By default, title and body fields are taken into account when searching. Facets can be configured to also be searchable.
By default, the terms entered are AND combined.

Boolean Operators

Use AND, OR, NOT, + (plus sign) or - (minus sign) to explicitly combine terms. Be aware that the operators need to be in all capital letters.

The following restrictions apply:

• The + or required operator requires that the term after the + symbol exist somewhere.
• The - or prohibit operator excludes documents that contain the term after the - symbol.

Example Queries

Grouping

Use round brackets / parentheses for grouping.

Example Queries

Phrase Search

Use double quotes at the beginning and ending of a phrase to perform a phrase search. Phrases must match exactly (i.e. no stemming is applied within a phrase). You can also add a slop to the phrase with a tilde ~ at the end of the phrase to do a proximity search.

Example Queries

Wildcard Search

Use * and ? to perform a wildcard search. Multiple character wildcard searches look for 0 or more characters and the single character wildcard search looks for terms that match that with the single character replaced. Wildcard search can also apply per field. Leading wildcards are allowed, but note that they can be very slow and potentially timeout within Elasticsearch. In order to prevent extremely slow wildcard queries, a wildcard term should not start with one of the wildcards * or ?

Example Queries

¹ Note that facet names containing spaces need to be put inside quotes in queries

Field Search

Only search in specific fields

Facet Search

Use any document facet to restrict the search.

¹ Note that facet names containing spaces need to be put inside quotes in queries

Note: this search is case sensitive

Sorting

You can use the following query syntax to sort the result:

sort:<field_name>[:<order>]

Where <field_name> is either 'date' (default) or 'relevance' or any item field name you want to sort by and <order> is either 'asc' for ascending or 'desc' for descending. The order suffix is optional, the default order is descending.²

Additionally, you can add a second (or third etc) sorting criteria by adding

[;<2nd_sort_field>[:<2nd_order>]]

to the query syntax.

² Note: The square brackets above mean that those fields are optional. Those brackets are not part of the syntax.

Example Queries

Time Increment

It is possible to control the time increments shown in the main timeline and in the dashboard widgets. To do so, add time_increment:<value> to a query.

Here is the Bugzilla Project without a time_increment set:

The same query, with time_increment:year

Possible values are:

time_increment:minute
time_increment:hour
time_increment:day
time_increment:week
time_increment:month
time_increment:quarter
time_increment:year

This can also be combined with values for more flexibility. For example:

time_increment:12hours
time_increment:4days
time_increment:8weeks
time_increment:6months
time_increment:3year

Entity Search

Query syntax to search for items having entities satisfied some criteria:

entity:{< any query to match a single entity document >}

Example:

• Search for Items containing a specific Entity of type company:

  entity:{type:company AND name:"Thomson Reuters"}

• Search for Items containing at least one company-typed Entity "Thomson Reuters" and another one Entity "Squirro":

  entity:{type:company AND name:"Thomson Reuters"} AND entity:{type:company AND name:Squirro}
  

• Search for Items containing a specific Entity of type company with a confidence higher than 80%:

  entity:{type:company AND name:"Thomson Reuters" AND confidence > 0.8}

• Search for Items containing any Entity of type company with confidence higher than 70%:

  entity:{type:company AND NOT confidence < 0.7}

• Search for Items containing no Entity of type company with confidence higher or equal than 20%:

  entity:{type:company AND confidence < 0.2}
  

• Search for Items containing any Entity of type deal with at least a 70% confidence:

  entity:{type:deal AND confidence > 0.7}

• Search for Items containing a specific Entity of type deal:

  entity:{type:deal AND properties.size:100 AND properties.region:US AND properties.industry:Tech AND properties.target:Whatsapp AND properties.acquirer:Facebook}
  

• Search for Items containing one Entity with target Squirro and another Entity with target Whatsapp:

  entity:{type:deal AND properties.target:Squirro AND properties.industry:Tech} AND entity:{type:deal AND properties.target:Whatsapp AND properties.industry:Tech}

• Search for Items containing an Entity of type deal with a property size bigger than 100:

  entity:{type:deal AND properties.size > 100}

Starred and Read Items

Starred items are items marked as favourite / bookmarked items.

[topic]
...
# For caching reasons the read/starred flags aggregations are now disabled
# by default. You can enable it by configuring a project id here.
# Mulitple ids can be provided by comman separating them.
enable_flags_for_project_ids = 

Query syntax for (un)starred items and (un)read items:

is:starred
is:unstarred
is:read
is:unread