# Query Language
A loglark query is composed of a series of filters separated by the
`|` operator. In the simplest form a query consists of only a single
filter and doesn't have the `|` operator at all.

```
filter1 | filter2 | ... | filterN
```


## Matching

All log records are considered as json documents. Filter matches if it
matches either field name or field value.

For example, consider the following record ...

```json
{"bar":"foo"}
```

| regexp     | matches | why                                                                                                                                     |
|------------|---------|-----------------------------------------------------------------------------------------------------------------------------------------|
| `bar`      | yes     | Field name `bar` matches.                                                                                                               |
| `ba.`      | yes     | Field name `bar` matches.                                                                                                               |
| `"bar"`    | no      | Matching is done on bare field name, without surrounding quotes. Regexp `"bar"` doesn't match bare field name `bar` or bare value `foo` |
| `foo`      | yes     | Field value `foo` matches.                                                                                                              |
| `"foo"`    | no      | Matching is done on bare field value, without surrounding quotes.                                                                       |
| `bar.*foo` | no      | Only field names or field values are matched. It is not possible to match substring that spans across name or value boundary.           |
|            |         |                                                                                                                                         |
    


## Reserved Keywords and Operators

Following keywords and operators are reserved: 

1. `and` and `or`
2. `(` and `)`
3. `|` 

They have special meaning and cannot be used as a search literal. If
you need to find records containing reserved word, quote it with
double quotes: `"and"`, `"("`, etc.


## Filter Types

### Literal

The simplest filter is a literal filter. It is a simple substring
search, which selects all matching records. There are two types of
literals: bare and quoted. 

#### Bare Literal

If a search term starts with `[a-zA-Z0-9]` and contains only
`[a-zA-Z0-9._-]`, then you can use it directly as a filter. However, to
avoid confusion it is usually better to put quotes explicitly.

Examples:

```
hello
```
```
world_42
```

#### Quoted Literal

For all other substring searches use quoted literal. Both single and
double quotes are supported. There is no difference between the two.
You can use usual escapes as well:

| Escape     | Meaning |
|------------|---------|
| `"\x68"`   | `h`     |
| `"\u0068"` | `h`     |
| `"\u{68}"` | `h`     |
| `"\\"`     | `\\`     |
| `"\\""`     | `"`     |
| `'\\''`      | `'`     |

Examples:

```
"hello, world!"
```
```
"こんにちは"
```


### Regexp

Of course, you can use regexp to filter log records.

The following regex constructs are supported by loglark:

1. Literal characters and strings, with all PCRE quoting and character escapes.

2. Character classes such as `.`, `[abc]`, and `[^abc]`, as well as
   the predefined character classes `\s`, `\d`, `\w`, `\v`, and `\h` and their
   negated counterparts (`\S`, `\D`, `\W`, `\V`, and `\H`).

3. The POSIX named character classes `[[:xxx:]]` and negated named character classes `[[:^xxx:]]`.

4. Unicode character properties, such as `\p{L}`, `\P{Sc}`, `\p{Greek}`.

5. Quantifiers:

    a) Quantifiers such as `?`, `*` and `+` are supported when applied to
    arbitrary supported sub-expressions.

    b) Bounded repeat qualifiers such as `{n}`, `{m,n}`, `{n,}` are supported with limitations.

6. Parenthesization, including the named and unnamed capturing and non-capturing forms. However, capturing is ignored.

7. Alternation with the `|` symbol, as in `foo|bar`.

8. The anchors `^`, `$`, `\A`, `\Z` and `\z`.