README
¶
zq 
The zq repository contains tools and components used to search, analyze,
and store structured log data, including:
- The zq command line tool, for searching and analyzing log files
- The zqd daemon, which serves a REST-like API to manage and query log archives, and is the backend for the Brim application
- The zar command line tool, for working with log data archives
- The zapi command line tool, for interacting with the API provided by zqd
- The ZQL query language definition and implementation
- The ZNG structured log specification and supporting components
Installation
To install zq or any other tool from this repo, you can either clone the repo
and compile from source, or use a pre-compiled
release, available for Windows, macOS, and Linux.
If you don't have Go installed, download and install it from the Go downloads page. Go version 1.14 or later is required.
To install the binaries in $GOPATH/bin, clone this repo and
execute make install:
git clone https://github.com/brimsec/zq
cd zq
make install
Contributing
See the contributing guide on how you can help improve zq!
Join the Community
Join our Public Slack workspace for announcements, Q&A, and to trade tips!
Directories
¶
| Path | Synopsis |
|---|---|
|
Package ast declares the types used to represent syntax trees for zql queries.
|
Package ast declares the types used to represent syntax trees for zql queries. |
|
cmd
|
|
|
Package microindex provides an API for creating, merging, indexing, and querying microindexes.
|
Package microindex provides an API for creating, merging, indexing, and querying microindexes. |
|
pkg
|
|
|
bufwriter
Package bufwriter provides a wrapper for a io.WriteCloser that uses buffered output via a bufio.Writer and calls Flush on close.
|
Package bufwriter provides a wrapper for a io.WriteCloser that uses buffered output via a bufio.Writer and calls Flush on close. |
|
byteconv
Package byteconv implements conversions from byte slice representations of various data types.
|
Package byteconv implements conversions from byte slice representations of various data types. |
|
colw
Package colw lays out columns for display of a list when you don't know ahead of time how many columns should exist.
|
Package colw lays out columns for display of a list when you don't know ahead of time how many columns should exist. |
|
ctxio
Package ctxio provides functionality similar to package io but with the ability to abort long running operations by passing through a context.Context.
|
Package ctxio provides functionality similar to package io but with the ability to abort long running operations by passing through a context.Context. |
|
glob
Package glob implements glob-style pattern matching
|
Package glob implements glob-style pattern matching |
|
iosrc/mock
Package mock is a generated GoMock package.
|
Package mock is a generated GoMock package. |
|
joe
Package joe provides helper types and methods for encoding and decoding JSON.
|
Package joe provides helper types and methods for encoding and decoding JSON. |
|
ranger
Package ranger provides a way to take a function expressed as cartesian points, downsample the points to a bounded number of bins by computing a range of the points that represent the downsampled bins (called the Envelope), then querying the Envelope with a range to find the smallest domain of X values that cover the range queried.
|
Package ranger provides a way to take a function expressed as cartesian points, downsample the points to a bounded number of bins by computing a range of the points that represent the downsampled bins (called the Envelope), then querying the Envelope with a range to find the smallest domain of X values that cover the range queried. |
|
repl
Package repl is a simple read-eval-print loop.
|
Package repl is a simple read-eval-print loop. |
|
rlimit
Package rlimit provides a single function, RaiseOpenFilesLimit.
|
Package rlimit provides a single function, RaiseOpenFilesLimit. |
|
signalctx
Package signalctx provides a context.Context that can be canceled by an operating system signal.
|
Package signalctx provides a context.Context that can be canceled by an operating system signal. |
|
slicer
Package slicer provides an io.Reader that returns subsets of a file.
|
Package slicer provides an io.Reader that returns subsets of a file. |
|
python
|
|
|
Package zcode implements serialization and deserialzation for ZNG values.
|
Package zcode implements serialization and deserialzation for ZNG values. |
|
ndjsonio
Package ndjsonio parses ndjson records.
|
Package ndjsonio parses ndjson records. |
|
zngio
Package zngio provides an API for reading and writing zng values and directives in binary zng format.
|
Package zngio provides an API for reading and writing zng values and directives in binary zng format. |
|
Package zng implements a data typing system based on the zeek type system.
|
Package zng implements a data typing system based on the zeek type system. |
|
search
Package search provides an implementation for launching zq searches and performing analytics on zng files stored in the server's root directory.
|
Package search provides an implementation for launching zq searches and performing analytics on zng files stored in the server's root directory. |
|
Package zqe provides a mechanism to create or wrap errors with information that will aid in reporting them to users and returning them to api callers.
|
Package zqe provides a mechanism to create or wrap errors with information that will aid in reporting them to users and returning them to api callers. |
|
Package zst implements reading and writing zst storage objects to and from zng row format.
|
Package zst implements reading and writing zst storage objects to and from zng row format. |
|
column
Package column implements the organization of columns on storage for a zst columnar storage object.
|
Package column implements the organization of columns on storage for a zst columnar storage object. |
|
Package ztest runs formulaic tests ("ztests") that can be (1) run in-process with the compiled-ini zq code base, (2) run as a sub-process using the zq executable build artifact, or (3) run as a bash script running a sequence of arbitrary shell commands invoking any of the build artifacts.
|
Package ztest runs formulaic tests ("ztests") that can be (1) run in-process with the compiled-ini zq code base, (2) run as a sub-process using the zq executable build artifact, or (3) run as a bash script running a sequence of arbitrary shell commands invoking any of the build artifacts. |
Click to show internal directories.
Click to hide internal directories.