..  _database description:

Database
========


Database structure
------------------

The "searchapp" table
+++++++++++++++++++++

+--------------+-----------+----------------------------------+
| Column       | Type      | Comment                          |
+==============+===========+==================================+
| timestamp    | FLOAT     | the record's timestamp           |
+--------------+-----------+----------------------------------+
| hash         | TEXT      | the records hash value           |
+--------------+-----------+----------------------------------+
| timestampstr | TEXT      | the record's timestamp, readable |
+--------------+-----------+----------------------------------+
| node         | TEXT      | the node that logged the record  |
+--------------+-----------+----------------------------------+
| user         | TEXT      | the user originating the search  |
+--------------+-----------+----------------------------------+
| sent         | BOOL      | "Y" indicates that the record    |
|              |           | has been submitted to syslog     |
+--------------+-----------+----------------------------------+
| record       | TEXT      | the original log record          |
+--------------+-----------+----------------------------------+

Records in this table are indicating when which user (from which IP address) executed a search
query.


The "solrquery" table
+++++++++++++++++++++

+--------------+-----------+----------------------------------+
| Column       | Type      | Comment                          |
+==============+===========+==================================+
| timestamp    | FLOAT     | the record's timestamp           |
+--------------+-----------+----------------------------------+
| hash         | TEXT      | the records hash value           |
+--------------+-----------+----------------------------------+
| timestampstr | TEXT      | the record's timestamp, readable |
+--------------+-----------+----------------------------------+
| node         | TEXT      | the node that logged the record  |
+--------------+-----------+----------------------------------+
| shard        | TEXT      | the shard to which the query was |
|              |           | sent                             |
+--------------+-----------+----------------------------------+
| filter       | TEXT      | an eventual exclusion filter     |
|              |           | string                           |
+--------------+-----------+----------------------------------+
| query        | TEXT      | the query string used            |
+--------------+-----------+----------------------------------+
| sent         | BOOL      | "Y" indicates that the record    |
|              |           | has been submitted to syslog     |
+--------------+-----------+----------------------------------+
| record       | TEXT      | the original log record          |
+--------------+-----------+----------------------------------+

Records in this table indicate when the *Search app* made a query to *Solr*, in behalf of
an user. The search term itself can be found in the ``q=`` parameter; eventually applied
filters can be found in the ``fq=`` parameter.