{"id":27976426,"url":"https://github.com/debugrammer/php-graylog-query-builder","last_synced_at":"2025-05-08T01:26:34.951Z","repository":{"id":56964504,"uuid":"219423005","full_name":"debugrammer/php-graylog-query-builder","owner":"debugrammer","description":"PHP version of Graylog Search Query Builder","archived":false,"fork":false,"pushed_at":"2022-05-13T02:31:43.000Z","size":20,"stargazers_count":5,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-04T16:26:03.237Z","etag":null,"topics":["builder","graylog","graylog-api","graylog-query-builder","graylog-rest-api","graylog-search-query","php","php7"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/debugrammer.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-11-04T05:18:28.000Z","updated_at":"2023-07-30T11:06:57.000Z","dependencies_parsed_at":"2022-08-21T10:20:42.529Z","dependency_job_id":null,"html_url":"https://github.com/debugrammer/php-graylog-query-builder","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/debugrammer%2Fphp-graylog-query-builder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/debugrammer%2Fphp-graylog-query-builder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/debugrammer%2Fphp-graylog-query-builder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/debugrammer%2Fphp-graylog-query-builder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/debugrammer","download_url":"https://codeload.github.com/debugrammer/php-graylog-query-builder/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252515326,"owners_count":21760554,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["builder","graylog","graylog-api","graylog-query-builder","graylog-rest-api","graylog-search-query","php","php7"],"created_at":"2025-05-08T01:26:34.399Z","updated_at":"2025-05-08T01:26:34.931Z","avatar_url":"https://github.com/debugrammer.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Graylog Query Builder for PHP ![build](https://github.com/debugrammer/php-graylog-query-builder/actions/workflows/build.yml/badge.svg)\n\u003e PHP version of [Graylog Search Query](https://docs.graylog.org/en/latest/pages/searching/query_language.html) Builder especially useful for working with [Graylog REST API](https://docs.graylog.org/en/latest/pages/configuration/rest_api.html).\n\n[![Latest Stable Version](https://poser.pugx.org/debugrammer/php-graylog-query-builder/v/stable)](https://packagist.org/packages/debugrammer/php-graylog-query-builder)\n[![Total Downloads](https://poser.pugx.org/debugrammer/php-graylog-query-builder/downloads)](https://packagist.org/packages/debugrammer/php-graylog-query-builder)\n[![License](https://poser.pugx.org/debugrammer/php-graylog-query-builder/license)](https://packagist.org/packages/debugrammer/php-graylog-query-builder)\n\n## Getting Started\nPHP versions 7.0 up to PHP 7.4 are currently supported.\nGraylog Query Builder for PHP is recommended to use [composer](https://getcomposer.org/) to install the library.\n\nAdd php-graylog-query-builder to `composer.json` either by running composer:\n```\n$ composer require debugrammer/php-graylog-query-builder\n```\nor by defining it manually:\n```\n\"require\": {\n   \"debugrammer/php-graylog-query-builder\": \"~1.0\"\n}\n```\n\n## Usage\n```\nuse GraylogQueryBuilder\\GraylogQuery as GraylogQuery;\n\nGraylogQuery::builder()\n    -\u003efield('type', 'ssh')\n    -\u003eand()-\u003eexists('id')\n    -\u003eand()-\u003eopenParen()\n        -\u003eraw('source:(dog.org OR cat.org)')\n    -\u003ecloseParen()\n    -\u003eand()-\u003erange('http_response_code', '[', 200, 300, ']')\n    -\u003ebuild();\n```\nAbove code snippet generates the string below.\n```\ntype:\"ssh\" AND _exists_:id AND ( source:(dog.org OR cat.org) ) AND http_response_code:[200 TO 300]\n```\n\n## Building Queries\n\n### 1. Statements\n\n#### 1.1. Term\nMessages that include the term or phrase.\n\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003eterm('ssh')\n    -\u003ebuild();\n```\n**Output:**\n```\n\"ssh\"\n```\n\n#### 1.2. Fuzz Term\nMessages that include similar term or phrase.\n\n##### 1.2.1. Fuzziness with default distance\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003efuzzTerm('ssh logni')\n    -\u003ebuild();\n```\n**Output:**\n```\n\"ssh logni\"~\n```\n\n##### 1.2.2. Fuzziness with custom distance\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003efuzzTerm('ssh logni', 1)\n    -\u003ebuild();\n```\n**Output:**\n```\n\"ssh logni\"~1\n```\n\n#### 1.3. Exists\nMessages that have the field.\n\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003eexists('type')\n    -\u003ebuild();\n```\n**Output:**\n```\n_exists_:type\n```\n\n#### 1.4. Field\n\n##### 1.4.1. Field (String)\nMessages where the field includes the term or phrase.\n\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003efield('type', 'ssh')\n    -\u003ebuild();\n```\n**Output:**\n```\ntype:\"ssh\"\n```\n\n##### 1.4.2. Field (Numeric)\nMessages where the field includes the number.\n\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003efield('http_response_code', 500)\n    -\u003ebuild();\n```\n**Output:**\n```\nhttp_response_code:500\n```\n\n##### 1.4.3. One side unbounded range query\nMessages where the field satisfies the condition.\n\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003eopField('http_response_code', '\u003e', 500)\n    -\u003ebuild();\n```\n**Output:**\n```\nhttp_response_code:\u003e500\n```\n\n#### 1.5. Fuzz Field\nMessages where the field includes similar term or phrase.\n\n##### 1.5.1. Fuzziness with default distance\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003efuzzField('source', 'example.org')\n    -\u003ebuild();\n```\n**Output:**\n```\nsource:\"example.org\"~\n```\n\n##### 1.5.2. Fuzziness with custom distance\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003efuzzField('source', 'example.org', 1)\n    -\u003ebuild();\n```\n**Output:**\n```\nsource:\"example.org\"~1\n```\n\n#### 1.6. Range\n\n##### 1.6.1. Range query\nRanges in square brackets are inclusive, curly brackets are exclusive and can even be combined.\n\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003erange('bytes', '{', 0, 64, ']')\n    -\u003ebuild();\n```\n**Output:**\n```\nbytes:{0 TO 64]\n```\n\n##### 1.6.2. Date range query\nThe dates needs to be UTC.\n\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003erange('timestamp', '[', '2019-07-23 09:53:08.175', '2019-07-23 09:53:08.575', ']')\n    -\u003ebuild();\n```\n**Output:**\n```\ntimestamp:[\"2019-07-23 09:53:08.175\" TO \"2019-07-23 09:53:08.575\"]\n```\n\n#### 1.6. Raw\nRaw query.\n\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003eraw('/ethernet[0-9]+/')\n    -\u003ebuild();\n```\n**Output:**\n```\n/ethernet[0-9]+/\n```\n\n### 2. Conjunctions\n\n#### 2.1. And\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003eterm('ssh')\n    -\u003eand()-\u003eterm('login')\n    -\u003ebuild();\n```\n**Output:**\n```\n\"ssh\" AND \"login\"\n```\n\n#### 2.2. Or\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003eterm('ssh')\n    -\u003eor()-\u003eterm('login')\n    -\u003ebuild();\n```\n**Output:**\n```\n\"ssh\" OR \"login\"\n```\n\n#### 2.3. Not\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003enot()-\u003eexists('type')\n    -\u003ebuild();\n```\n**Output:**\n```\nNOT _exists_:type\n```\n\n### 3. Parentheses\n**Usage:**\n```\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003eexists('type')\n    -\u003eand()-\u003eopenParen()\n        -\u003eterm('ssh')\n        -\u003eor()-\u003eterm('login')\n    -\u003ecloseParen()\n    -\u003ebuild();\n```\n**Output:**\n```\n_exists_:type AND ( \"ssh\" OR \"login\" )\n```\n\n## Advanced Usage\nSometimes you might want to compose dynamic queries by condition.\n\n### 1. Prepend Graylog query\n**Usage:**\n```\n$query = GraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003enot()-\u003eexists('type');\n\nGraylogQueryBuilder\\GraylogQuery::builder($query)\n    -\u003eand()-\u003eterm('ssh')\n    -\u003ebuild();\n```\n**Output:**\n```\nNOT _exists_:type AND \"ssh\"\n```\n\n### 2. Append Graylog query\n**Usage:**\n```\n$query = GraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003eor()-\u003eexists('type');\n\nGraylogQueryBuilder\\GraylogQuery::builder()\n    -\u003eterm('ssh')\n    -\u003eappend($query)\n    -\u003ebuild();\n```\n**Output:**\n```\n\"ssh\" OR _exists_:type\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdebugrammer%2Fphp-graylog-query-builder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdebugrammer%2Fphp-graylog-query-builder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdebugrammer%2Fphp-graylog-query-builder/lists"}