Searching Data

Searching the data held in Stroom using Dashboards, Queries, Views, Analytic Rules and Reports.
Tags:

Data in stroom (and in external Elastic indexes) can be searched using a number of ways:

  • Dashboard Combines multiple query expressions, result tables and visualisations in one configurable layout.

  • Query Executes a single search query written in StroomQl and displays the results as a table or visualisation.

  • Analytic Rule Executes a StroomQl search query either against data as it is ingested into Stroom or on a scheduled basis.

  • Report Executes a StroomQl search query on a scheduled basis and delivers the results as a file by email or to a feed.

Data Sources

Stroom has multiple different types of data sources that can be queried by Stroom using Dashboards, Queries and Analytic Rules.

Dashboards

A Dashboard document is a way to combine multiple search queries, tables and visualisations in a configurable layout.

Query

A Query document defines a search query in text form using the Stroom Query Language and displays the results as a table or a visualisation.

Analytic Rules

Analytic Rules are queries that can be run against the data either as it is ingested or on a scheduled basis.

Reports

Reports run a query on a schedule and deliver the results as a file, by email or to a feed.

Search Extraction

The process of combining data extracted from events with the data stored in an index.

Dictionaries

Last modified October 20, 2026: Merge pull request #144 from gchq/add-7.14-rel-notes (2c6fb22)