Skip to main content

Lucene Queries

Query attributes

Fluency uses its own attribute names to search for such as “sip: A.B.C.D” to search for a source IP address. These attribute names such as “sip” are defined by Fluency and do not follow any public standard. Further chapters will describe common attributes. Please know that these attributes are case sensitive!

Query syntax behavior

If Fluency is queried for attributes such as “sip: A.B.C.D”, it is important to know that Fluency searches for results that are EQUAL to “A.B.C.D”. A query with the string “sip: A.B.C.” could indicate that any source IP within the range “A.B.C.” is searched. This query though will fail as Fluency will search for results with a value equal to “A.B.C.”. In this case operators of the Lucene syntax should be used instead such as “*”.

A query with string “sip: A.B.C.*” will be able return multiple results with any value at the fourth octet of the source IP.

AttributeValue TypeDescription
@tags:squidStringAny events tagged with “squid”
methodStringHTTP request method
http_hostStringRemote HTTP host
request_urlStringURL of HTTP query
src_ipStringClient source IP
src_portNumericProxy outbound source port
dest_ipStringRemote host IP
protoStringProtocol name
actionStringProxy TCP action
src_port_clientNumericClient source port
userStringAt proxy authenticated domain user account
dest_portNumericRemote host port
user_agentStringClient User-Agent string
statusNumericHTTP response code from remote host

Page last updated: 2023 Aug 10