KQL (Kibana Query Language) support

quickwit/quickwit-cli/src/tool.rs

@@ -542,6 +542,7 @@ pub async fn local_search_cli(args: LocalSearchArgs) -> anyhow::Result<()> {
     let sort_by: SortBy = args.sort_by_field.map(SortBy::from).unwrap_or_default();
     let search_request_query_string = SearchRequestQueryString {
         query: args.query,
+        kql: None,
         start_offset: args.start_offset as u64,
         max_hits: args.max_hits as u64,
         search_fields: args.search_fields,

quickwit/quickwit-query/Cargo.toml

@@ -29,6 +29,7 @@ rustc-hash = { workspace = true }
 
 quickwit-common = { workspace = true }
 quickwit-datetime = { workspace = true }
+quickwit-metrics = { workspace = true }
 quickwit-proto = { workspace = true }
 
 [dev-dependencies]

quickwit/quickwit-query/src/kql/ast.rs

@@ -0,0 +1,53 @@
+// Copyright 2021-Present Datadog, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/// Parsed KQL expression. This is an internal representation that lowers to
+/// `QueryAst` via `lower_kql_ast`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum KqlAst {
+    /// Conjunction of subqueries. Empty vector is not produced by the parser.
+    And(Vec<KqlAst>),
+    /// Disjunction of subqueries.
+    Or(Vec<KqlAst>),
+    /// Negation of a subquery.
+    Not(Box<KqlAst>),
+    /// `field:value` clause.
+    FieldValue { field: String, value: KqlValue },
+    /// `field:<op><value>` numeric/datetime range bound.
+    FieldRange {
+        field: String,
+        op: RangeOp,
+        value: String,
+    },
+    /// `field:*` — checks whether the field is present on the document.
+    FieldExists { field: String },
+    /// Bare value with no field qualifier — matches against default fields.
+    DefaultValue(KqlValue),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum KqlValue {
+    /// Unquoted token. May contain `*` and `?` wildcards.
+    Literal(String),
+    /// Double-quoted phrase. Wildcards inside are treated literally.
+    Phrase(String),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum RangeOp {
+    Gt,
+    Gte,
+    Lt,
+    Lte,
+}