4.1.1 Search

Filtering columns

By clicking on the filtering columns icon ( images/download/thumbnails/26167905/font-awesome_4-7-0_filter_22_0_007dff_none.png ) a new row will appear below the table header with filters for the given columns.

images/download/attachments/26167905/Screenshot_from_2018-09-04_12-43-33.png

Using these filters you can search for ICAP requests which have to meet multiple criteria e.g. request where the action was BLOCKED and the client IP was 127.0.0.1 at the same time. This indicates that there is AND relation between the filters.

images/download/attachments/26167905/Screenshot_from_2018-09-04_12-44-37.png

Tokenization

When using text filters, like Result you would expect that writing "Ba" in the filter would return every rows with "Bad request" result however this is not the case since the search is based on tokens. If you would like to get the requests with result "Bad request" you would have to write "Ba*" or "Bad" as the filter string.

Value only search

By default it is possible to search for a certain value among the values of all columns.

Example

List

ID

RESULT

STATUS

1

ALLOWED

BLOCKED

2

BLOCKED

COMPLETED

Search results

Search term

Matching rows

BLOCKED

1, 2

Lists with value only search

The following lists in ICAP Server implement value only search:

  1. Dashboard > Config history

Full text search (FTS)

MetaDefender ICAP Server implements the SQLite MATCH feature of SQLite FTS3 and FTS4 Extensions (see section 3. Full-text Index Queries). In addition to the capabilities the value only search provides, using the MATCH feature makes it possible to search for certain values in certain fields.

Example

List

ID

RESULT

STATUS

1

ALLOWED

BLOCKED

2

BLOCKED

COMPLETED

3

NOT BLOCKED

COMPLETED

4

BLOWN

BLOCKED

Search results

Search term

Matching rows

BLOCKED

1, 2

RESULT:BLOCKED

1, 3

RESULT:^BLOCKED

1

RESULT:BLO*

1, 3, 4

RESULT:^BLO*

1, 4

For a more complete reference of possible search terms see https://www.sqlite.org/fts3.html.

Lists with FTS

The following lists in ICAP Server implement full text search:

  1. Dashboard > ICAP history