Summary of changes for squert version 1.3.0

Added Elasticsearch capability (so I could query my Bro logs):

depending on where you are within the interface the terms and interval will differ

the data will be placed either at the root (if you aren't pinned to anything) or appended to your current context

The queries are presently very simple; but still quite powerful. I have a bit of work to do here yet but it is functional. I will put together a short video when I have a little more time. This external lookup feature will be generalized eventually, this is just the first kick at bringing in complimentary data.

Added support for sguils new autocat functionality:

this is handy as hell and will be especially helpful for first timers

Added bar overlays to the summary tables:

Added a few more options for the Sankey diagrams; added country flags to the nodes:

Interface cleanup

I have been reading Tufte's books on design and have been trying to adopt suggestions from the books. I have removed a lot of the dark colouring, stark field separators and shifted focus to the actual data not the descriptors. The timepicker is now hidden by default and can be toggled by clicking the interval link.

Progress I hope :)


I have bundled the official Elasticsearch client for php and I hope it will just work for you. Take a look at the basic parameter settings that are in .inc/config.php.sample. If you are having problems try here. If you have logs in ES all you should need to do is edit the "type" fields in .js/squertFunctions.js.

I will make this easier when I have some time.