jcoffey-dev
fb5049a747
Replaces the separate SQL-only /query and text-only /search endpoints with one pipe-syntax query language (plus raw SQL escape hatch) that compiles to a single IR and execution plan across both backends, so a query like `message:"connection refused" | stats count by host` runs as one request instead of two disjoint tools. - api/internal/querylang: lexer -> ast -> parser -> ir -> planner -> executor, each layer independently tested. - Execution generalizes Phase 1's proven Tantivy-prefilter pattern into a 4-way routing table (pure ClickHouse / text-only / text + aggregation / raw SQL passthrough). - Unified web query page and `sentryctl query`, both hitting the same POST /query endpoint. - Benchmarked against a real 1,022,000-row dataset (hack/benchmark-fixture); caught and fixed a real bug where the Tantivy prefilter cap (10,000) produced an IN-clause exceeding ClickHouse's default max_query_size -- lowered to 5,000, documented in docs/query-language-design.md and docs/phase-2-runbook.md. - docs/query-language-reference.md: customer-facing syntax reference.
hack
Local developer tooling that isn't part of any shipped component — scripts
you run against your own machine/dev stack, not code that ends up in a
container image (except dev-certs' output, which mounts into the
ingest container).
Not one of the top-level directories in the original monorepo scaffold —
added because dev-only mTLS cert generation didn't have a natural home in
/deploy (real deployment manifests), /transport, or any other existing
component. /hack is the conventional name for this in a lot of larger Go
monorepos (Kubernetes among them).
dev-certs/— generates a throwaway CA + server/client cert pair for local mTLS between the agent and ingest. See/docs/phase-0-runbook.mdfor when to run it.windows-fixture/— sends synthetic Windows Event Log-shaped records directly toingest, bypassing the real Windows agent. Tests whether the pipeline handles Windows-shaped data; doesn't test the realEvtSubscribe/ETW integration, which needs actual Windows. See/docs/phase-1-runbook.md.