3 ms·

I only wish that the matching could be 'fuzzy' in easily defined ways. My use case is MAC addresses. So, if I search for 'dead.beef.cafe', this would be perfec

I only wish that the matching could be 'fuzzy' in easily defined ways. My use case is MAC addresses. So, if I search for 'dead.beef.cafe', this would be perfect if it could know that I wanted to see entries indexed by 'DE:AD:BE:EF:CA:FE" also. Is that possible? This tool is so amazing. If it did this, it would be able to hugely improve my daily workflow. edit: Actually, it is going to be able to hugely improve my workflow anyway, because I often want to see data about IP version 4 addresses, too, and it handles those fine. But I'd still like to be able to use it for MACs.

deleted 11y ago
[deleted]
- hackmiester 11y ago
  edit: The deleted comment suggested to store the index in all lowercase, with no separators, like 'deadbeefcafe,' and then apply the same transform to my query before running it. I like that idea! But the way to provide the index criterion seems to be via regex, and I don't think I can use just a regex to apply transformations to the index before storing it. If I were better with C-type languages, I would likely submit a pull request.
  - cjbprime 11y ago
    Sorry, deleted after realizing that zindex just wanted a regex match. If we could make zindex allow specifying a substitution regex when deciding what string to index under, that would work; your regex could be one that matches a MAC address and converts it to lowercase/strips punctuation, and then on the query side you could do the same with e.g. sed before piping to zq.
mattgodbolt 11y ago
Great idea. zq uses the SQLite index built by zindex; so in theory I can modify it to use a 'WHERE index LIKE xxx' instead of 'WHERE index=xxx' -- then SQLish wildcards would be supported. I've raised an issue to capture this use case; feel free to chime in there! :) https://github.com/mattgodbolt/zindex/issues/12 https://github.com/mattgodbolt/zindex/issues/12
mattgodbolt 11y ago
Great idea. zq uses the SQLite index built by zindex; so in theory I can modify it to use a 'WHERE index LIKE xxx' instead of 'WHERE index=xxx' -- then SQLish wildcards would be supported. I've raised an issue to capture this use case; feel free to chime in there! :) https://github.com/mattgodbolt/zindex/issues/12 https://github.com/mattgodbolt/zindex/issues/12

deleted 11y ago

[deleted]

hackmiester 11y ago
edit: The deleted comment suggested to store the index in all lowercase, with no separators, like 'deadbeefcafe,' and then apply the same transform to my query before running it. I like that idea! But the way to provide the index criterion seems to be via regex, and I don't think I can use just a regex to apply transformations to the index before storing it. If I were better with C-type languages, I would likely submit a pull request.
- cjbprime 11y ago
  Sorry, deleted after realizing that zindex just wanted a regex match. If we could make zindex allow specifying a substitution regex when deciding what string to index under, that would work; your regex could be one that matches a MAC address and converts it to lowercase/strips punctuation, and then on the query side you could do the same with e.g. sed before piping to zq.

mattgodbolt 11y ago

Great idea. zq uses the SQLite index built by zindex; so in theory I can modify it to use a 'WHERE index LIKE xxx' instead of 'WHERE index=xxx' -- then SQLish wildcards would be supported. I've raised an issue to capture this use case; feel free to chime in there! :) https://github.com/mattgodbolt/zindex/issues/12 https://github.com/mattgodbolt/zindex/issues/12

mattgodbolt 11y ago