diff --git a/configuration/accelerators.md b/configuration/accelerators.md index 2109815b..b8ce1e13 100644 --- a/configuration/accelerators.md +++ b/configuration/accelerators.md @@ -249,6 +249,11 @@ Note that the tag `zeekconn` can be matched against both accelerators, however t Tags=foo* ``` +(intrinsic-acceleration-target)= +## Acceleration with Intrinsic Enumerated Values + +When acceleration is enabled, [intrinsic enumerated values](#attach-target) will always be accelerated with the fulltext engine. This enables queries using the [intrinsic](/search/intrinsic/intrinsic) module to be accelerated. No specific configuration is required for acceleration with intrinsic EVs other than having acceleration enabled. + ## Fulltext The fulltext accelerator is designed to index words within text logs and is considered the most flexible acceleration option. Many of the other search modules support invoking the fulltext accelerator when executing queries. However, the primary search module for engaging with the fulltext accelerator is the [grep](/search/grep/grep) module with the `-w` flag. Much like the Unix grep utility, `grep -w` specifies that the provided filter is expected to a word, rather than a subset of bytes. Running a search with `words foo bar baz` will look for the words foo, bar, and baz and engage the fulltext accelerator. @@ -686,7 +691,6 @@ The results show why fulltext may often be worth the storage and ingest penalty: | fulltextindex | 2.99s | 12.49X | | fulltextbloom | 3.40s | 12.49X | - #### Query AX modules The AX definition file for all four tags is below, see the [AX](/configuration/autoextractors) documentation for more information: diff --git a/ingesters/ingesters.md b/ingesters/ingesters.md index c420c785..b7da4138 100644 --- a/ingesters/ingesters.md +++ b/ingesters/ingesters.md @@ -326,6 +326,7 @@ Log-Source-Override=DEAD:BEEF::FEED:FEBE Log-Source-Override=::1 ``` +(attach-target)= ### Attach All ingesters support the `Attach` global configuration stanza, which allows [intrinsic enumerated values](intrinsic_enumerated_values) to be attached to entries during ingest. Intrinsic enumerated values can later be accessed with the [intrinsic](/search/intrinsic/intrinsic) search module. diff --git a/search/search.md b/search/search.md index 0c38b1b5..e105f17d 100644 --- a/search/search.md +++ b/search/search.md @@ -137,10 +137,12 @@ Further examples throughout the documentation should help clarify the use of enu (intrinsic_enumerated_values)= ## Intrinsic Enumerated Values -Intrinsic Enumerated Values are Enumerated Values which are created at the time of ingest. Intrinsic enumerated values are optionally created by ingesters and often contain metadata or pre-processed extractions. Use the [intrinsic](intrinsic/intrinsic) module to work with intrinsic enumerated values. +Intrinsic Enumerated Values are Enumerated Values which are created at the time of ingest. Intrinsic enumerated values are optionally [created by ingesters](#attach-target) and often contain metadata or pre-processed extractions. Use the [intrinsic](intrinsic/intrinsic) module to work with intrinsic enumerated values. After extracting an intrinsic enumerated value, they are treated the same as regular enumerated values. +Intrinsic EVs are [automatically accelerated](#intrinsic-acceleration-target) when using acceleration. + ## Quoting and tokenizing When specifying arguments to Gravwell modules, be mindful of special characters. Most modules treat spaces, tabs, newlines, and the following characters as separators: !#$%&'()*+,-./:;<=>?@