Typeahead

[reissmann]

How to implement typeahead?

This depends on #21. There are the following solutions:

• Use the prefix filter -> Bad idea!
• Use the Completion Suggester:
  Better, but needs additional data fields to be stored
  (http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-suggesters-completion.html)
• Use NGram as suggested here:
  http://jontai.me/blog/2013/02/adding-autocomplete-to-an-elasticsearch-search-application/

[reissmann]

Working solution using the completion suggester:

Create index:

curl -X PUT "http://localhost:9200/syslog" -d '{
"mappings" : {
    "event" : {
        "properties" : {
            "host" : {
                "type" : "string",
                "index" : "not_analyzed"
            },
            "host_suggest" : {
                "type" :     "completion"
            },
            [...]
        }
    }
}
}'

Configure rsyslog:

set $!host = $hostname;
set $!host_suggest = $hostname;
template(name="outfmt" type="list") {
    property(name="$!")
    constant(value="\n")
}

module(load="omelasticsearch")
action(type="omelasticsearch" template="outfmt"
            searchIndex="syslog"
            asyncrepl="on"
            searchType="event"
            server="127.0.0.1"
            serverport="9200"

Search for documents:

{
  "event": {
    "text": "lo",
    "completion": {
      "field": "host_suggest"
    }
  }
}