Searching
Asking questions of indexed data, and getting back values the index does not hold.
Searching in Stroom starts from an index and ends, often, back at the original data. A query finds the events that match; an extraction pipeline fetches the fields the index did not store; a table or visualisation shows the result.
There are two ways to ask:
- A dashboard, built from a query expression and one or more tables and visualisations. Interactive, and the usual starting point.
- A query, written in Stroom Query Language, which expresses the same thing as text and can be saved, scheduled and shared.
They reach the same data. A dashboard is easier to explore with; StroomQL is easier to review, version and reuse.
What to read
- Building a dashboard covers the first useful result: source, query, table, time range.
- Finding the original event covers extraction, which is how a search result becomes the raw event it came from.
Dashboards in Concepts explains why a table is required before a visualisation, and how data flows through a dashboard.
Time is the first filter
Every search is bounded by time, and the bound is on the event time recorded during translation, not on when the data arrived or was processed.
That distinction is the source of most "my data is missing" reports. Data received today but describing last week is found by searching last week. If translation did not set an event time, the value used is whatever the pipeline defaulted to, which is worth knowing before concluding the data is absent.