Struct libquery::query::Query

pub struct Query {
    pub start: Option<Time>,
    pub end: Option<Time>,
    pub filter: Headers,
    pub aggregate: Vec<Ident>,
    pub columns: Vec<Ident>,
    pub details: bool,
}

The whole query.

This represents a query for some data. Note that any option can be omitted in the JSON representation and a sensible default will be used.

If a flow fits into the time interval only partially, only the relevant part (with some rounding to whole time slices) is included.

Fields

start: Option<Time>

Include only data from this time on.

If not present, data from the beginning of the time itself (or at least from the oldest data present) is included.

It is represented as number of milliseconds since 1.1.1970. Note that the resolution of stored data is usually not this good, but the milliseconds are used for consistency with the rest of the system.

end: Option<Time>

Include only data up to this time.

If not present, data up to now are used.

It is represented as number of milliseconds since 1.1.1970. Note that the resolution of stored data is usually not this good, but the milliseconds are used for consistency with the rest of the system.

filter: Headers

Filter data according to the given criteria.

Each supplied filter must be satisfied. Note that the filters allow specifying multiple alternative values each.

If not present, no filters apply and all the data (in the given time interval) are included.

aggregate: Vec<Ident>

Aggregate according to these „columns“.

The columns that have the same values form the results. The other columns are summed up together. Note that some reasonable way of summing is used for each column (eg. the set of names are unified, while amount of sent data is added up).

If no aggregation is present, every flow would form a separate result. Note however, that the system doesn't keep such detailed information for the whole history and may refuse to answer if too historical data is requested without any aggregation.

columns: Vec<Ident>

In addition to „aggregate“, include these columns in each result.

details: bool

Produce further details about the results.

If this is false (the default), then each result is simply the sum over the whole time. If set to true, the time is split into non-overlapping intervals and each result is sequence of these intervals. Some of the columns are at the „head“ of the result and are the same over the whole time (eg. the requested domain name), while others are present in each interval (amount of transferred data or average speed). The length of the intervals depend on how far into the past the request goes (records close to now are finer grained).

Trait Implementations

impl Clone for Query

fn clone(&self) -> Query

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Query

fn fmt(&self, __arg_0: &mut Formatter) -> Result

Formats the value using the given formatter.

impl Default for Query

fn default() -> Query

Returns the "default value" for a type.

impl Eq for Query

impl PartialEq for Query

fn eq(&self, __arg_0: &Query) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, __arg_0: &Query) -> bool

This method tests for !=.