sql

type Binary ¶

type Binary struct {
	Op          string
	Left, Right Expr
}

Binary is a comparison, arithmetic or boolean operator.

func (b Binary) String() string

type Call ¶

type Call struct {
	Name     string
	Args     []Expr
	Distinct bool // count(distinct x)
}

Call is a function or aggregate: count, sum, avg, min, max, date, hour, lower, ...

func (c Call) String() string

type Col ¶

type Col struct{ Name string }

Col is a bare event field: name, distinct_id, timestamp, id.

func (c Col) String() string

type Expr ¶

type Expr interface{ String() string }

type InList ¶

type InList struct {
	X      Expr
	Vals   []Expr
	Negate bool
}

InList is `x IN (a, b, c)`.

func (i InList) String() string

type IsNull ¶

type IsNull struct {
	X      Expr
	Negate bool
}

IsNull is `x IS NULL` / `x IS NOT NULL`.

func (i IsNull) String() string

type Limits ¶

type Limits struct {
	MaxRows   int           // rows returned
	MaxGroups int           // distinct GROUP BY keys held at once
	Timeout   time.Duration // wall clock
}

Limits bound what one query may cost. A query surface with no ceiling is an outage waiting for its first curious agent.

func DefaultLimits() Limits

type Lit ¶

type Lit struct{ Val any }

Lit is a literal string, number, boolean or NULL.

func (l Lit) String() string

type OrderItem ¶

type OrderItem struct {
	Expr Expr
	Desc bool
}

type Prop ¶

type Prop struct{ Key string }

Prop is a property lookup, written prop.country or properties.country.

func (p Prop) String() string

type Query ¶

type Query struct {
	Select  []SelectItem
	Where   Expr
	GroupBy []Expr
	Having  Expr
	OrderBy []OrderItem
	Limit   int
}

func Parse(src string) (*Query, error)

type Ref ¶

type Ref struct{ Name string }

Ref is an identifier that is not a known column — it may still be a SELECT alias, which is only knowable once the whole statement is parsed. Resolved by resolveRefs before execution; anything still unresolved then is a genuine typo and becomes an error there.

func (r Ref) String() string

type Result ¶

type Result struct {
	Columns   []string `json:"columns"`
	Rows      [][]any  `json:"rows"`
	Scanned   int      `json:"scanned"`
	Groups    int      `json:"groups,omitempty"`
	Truncated bool     `json:"truncated,omitempty"`
	Elapsed   string   `json:"elapsed"`
}

Result is one answered query. Columns is ordered; Rows are parallel to it.

func Run(q *Query, sc Scanner, lim Limits) (*Result, error)

type Scanner ¶

type Scanner interface {
	Scan(from, to time.Time, fn func(event.Event) error) error
}

Scanner streams events. This is the whole store contract the SQL layer needs, and taking the streaming one rather than a slice is what keeps memory O(groups) instead of O(events).

type SelectItem ¶

type SelectItem struct {
	Expr  Expr
	Alias string
}

type Star ¶

type Star struct{}

Star is `*`, only legal inside count(*).

func (Star) String() string

type Unary ¶

type Unary struct {
	Op string
	X  Expr
}

Unary is NOT, or unary minus.

func (u Unary) String() string