PHPackages                             debugrammer/php-graylog-query-builder - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [API Development](/categories/api)
4. /
5. debugrammer/php-graylog-query-builder

ActiveLibrary[API Development](/categories/api)

debugrammer/php-graylog-query-builder
=====================================

Graylog Search Query Builder for Graylog REST API

1.0.0(6y ago)5398.7k↓21.2%1MITPHPPHP >=7.0.0CI failing

Since Nov 5Pushed 4y ago1 watchersCompare

[ Source](https://github.com/debugrammer/php-graylog-query-builder)[ Packagist](https://packagist.org/packages/debugrammer/php-graylog-query-builder)[ Docs](https://github.com/debugrammer/php-graylog-query-builder)[ RSS](/packages/debugrammer-php-graylog-query-builder/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (1)Dependencies (1)Versions (2)Used By (0)

Graylog Query Builder for PHP [![build](https://github.com/debugrammer/php-graylog-query-builder/actions/workflows/build.yml/badge.svg)](https://github.com/debugrammer/php-graylog-query-builder/actions/workflows/build.yml/badge.svg)
========================================================================================================================================================================================================================================

[](#graylog-query-builder-for-php-)

> PHP version of [Graylog Search Query](https://docs.graylog.org/en/latest/pages/searching/query_language.html) Builder especially useful for working with [Graylog REST API](https://docs.graylog.org/en/latest/pages/configuration/rest_api.html).

[![Latest Stable Version](https://camo.githubusercontent.com/ec3314ea9e4b4fe9d926343fc63857768b5edd52cfb9369807a77914d99cdb05/68747470733a2f2f706f7365722e707567782e6f72672f646562756772616d6d65722f7068702d677261796c6f672d71756572792d6275696c6465722f762f737461626c65)](https://packagist.org/packages/debugrammer/php-graylog-query-builder)[![Total Downloads](https://camo.githubusercontent.com/b7c4e79e3e612afa7b6779d823f6d9e5ef17f0282df45c478ee55dcab3f7b9fc/68747470733a2f2f706f7365722e707567782e6f72672f646562756772616d6d65722f7068702d677261796c6f672d71756572792d6275696c6465722f646f776e6c6f616473)](https://packagist.org/packages/debugrammer/php-graylog-query-builder)[![License](https://camo.githubusercontent.com/40f975d53e922cbd5970c6a1cab95bc21ef05ba6bfd22271df6c13d0986c247e/68747470733a2f2f706f7365722e707567782e6f72672f646562756772616d6d65722f7068702d677261796c6f672d71756572792d6275696c6465722f6c6963656e7365)](https://packagist.org/packages/debugrammer/php-graylog-query-builder)

Getting Started
---------------

[](#getting-started)

PHP versions 7.0 up to PHP 7.4 are currently supported. Graylog Query Builder for PHP is recommended to use [composer](https://getcomposer.org/) to install the library.

Add php-graylog-query-builder to `composer.json` either by running composer:

```
$ composer require debugrammer/php-graylog-query-builder

```

or by defining it manually:

```
"require": {
   "debugrammer/php-graylog-query-builder": "~1.0"
}

```

Usage
-----

[](#usage)

```
use GraylogQueryBuilder\GraylogQuery as GraylogQuery;

GraylogQuery::builder()
    ->field('type', 'ssh')
    ->and()->exists('id')
    ->and()->openParen()
        ->raw('source:(dog.org OR cat.org)')
    ->closeParen()
    ->and()->range('http_response_code', '[', 200, 300, ']')
    ->build();

```

Above code snippet generates the string below.

```
type:"ssh" AND _exists_:id AND ( source:(dog.org OR cat.org) ) AND http_response_code:[200 TO 300]

```

Building Queries
----------------

[](#building-queries)

### 1. Statements

[](#1-statements)

#### 1.1. Term

[](#11-term)

Messages that include the term or phrase.

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->term('ssh')
    ->build();

```

**Output:**

```
"ssh"

```

#### 1.2. Fuzz Term

[](#12-fuzz-term)

Messages that include similar term or phrase.

##### 1.2.1. Fuzziness with default distance

[](#121-fuzziness-with-default-distance)

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->fuzzTerm('ssh logni')
    ->build();

```

**Output:**

```
"ssh logni"~

```

##### 1.2.2. Fuzziness with custom distance

[](#122-fuzziness-with-custom-distance)

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->fuzzTerm('ssh logni', 1)
    ->build();

```

**Output:**

```
"ssh logni"~1

```

#### 1.3. Exists

[](#13-exists)

Messages that have the field.

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->exists('type')
    ->build();

```

**Output:**

```
_exists_:type

```

#### 1.4. Field

[](#14-field)

##### 1.4.1. Field (String)

[](#141-field-string)

Messages where the field includes the term or phrase.

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->field('type', 'ssh')
    ->build();

```

**Output:**

```
type:"ssh"

```

##### 1.4.2. Field (Numeric)

[](#142-field-numeric)

Messages where the field includes the number.

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->field('http_response_code', 500)
    ->build();

```

**Output:**

```
http_response_code:500

```

##### 1.4.3. One side unbounded range query

[](#143-one-side-unbounded-range-query)

Messages where the field satisfies the condition.

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->opField('http_response_code', '>', 500)
    ->build();

```

**Output:**

```
http_response_code:>500

```

#### 1.5. Fuzz Field

[](#15-fuzz-field)

Messages where the field includes similar term or phrase.

##### 1.5.1. Fuzziness with default distance

[](#151-fuzziness-with-default-distance)

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->fuzzField('source', 'example.org')
    ->build();

```

**Output:**

```
source:"example.org"~

```

##### 1.5.2. Fuzziness with custom distance

[](#152-fuzziness-with-custom-distance)

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->fuzzField('source', 'example.org', 1)
    ->build();

```

**Output:**

```
source:"example.org"~1

```

#### 1.6. Range

[](#16-range)

##### 1.6.1. Range query

[](#161-range-query)

Ranges in square brackets are inclusive, curly brackets are exclusive and can even be combined.

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->range('bytes', '{', 0, 64, ']')
    ->build();

```

**Output:**

```
bytes:{0 TO 64]

```

##### 1.6.2. Date range query

[](#162-date-range-query)

The dates needs to be UTC.

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->range('timestamp', '[', '2019-07-23 09:53:08.175', '2019-07-23 09:53:08.575', ']')
    ->build();

```

**Output:**

```
timestamp:["2019-07-23 09:53:08.175" TO "2019-07-23 09:53:08.575"]

```

#### 1.6. Raw

[](#16-raw)

Raw query.

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->raw('/ethernet[0-9]+/')
    ->build();

```

**Output:**

```
/ethernet[0-9]+/

```

### 2. Conjunctions

[](#2-conjunctions)

#### 2.1. And

[](#21-and)

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->term('ssh')
    ->and()->term('login')
    ->build();

```

**Output:**

```
"ssh" AND "login"

```

#### 2.2. Or

[](#22-or)

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->term('ssh')
    ->or()->term('login')
    ->build();

```

**Output:**

```
"ssh" OR "login"

```

#### 2.3. Not

[](#23-not)

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->not()->exists('type')
    ->build();

```

**Output:**

```
NOT _exists_:type

```

### 3. Parentheses

[](#3-parentheses)

**Usage:**

```
GraylogQueryBuilder\GraylogQuery::builder()
    ->exists('type')
    ->and()->openParen()
        ->term('ssh')
        ->or()->term('login')
    ->closeParen()
    ->build();

```

**Output:**

```
_exists_:type AND ( "ssh" OR "login" )

```

Advanced Usage
--------------

[](#advanced-usage)

Sometimes you might want to compose dynamic queries by condition.

### 1. Prepend Graylog query

[](#1-prepend-graylog-query)

**Usage:**

```
$query = GraylogQueryBuilder\GraylogQuery::builder()
    ->not()->exists('type');

GraylogQueryBuilder\GraylogQuery::builder($query)
    ->and()->term('ssh')
    ->build();

```

**Output:**

```
NOT _exists_:type AND "ssh"

```

### 2. Append Graylog query

[](#2-append-graylog-query)

**Usage:**

```
$query = GraylogQueryBuilder\GraylogQuery::builder()
    ->or()->exists('type');

GraylogQueryBuilder\GraylogQuery::builder()
    ->term('ssh')
    ->append($query)
    ->build();

```

**Output:**

```
"ssh" OR _exists_:type

```

###  Health Score

33

—

LowBetter than 75% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity37

Limited adoption so far

Community10

Small or concentrated contributor base

Maturity52

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 68.4% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

2387d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/e45ba357097cc276fd1df31adfdfef3a653100ae8c6d0a83fc2e81ad9b532fe3?d=identicon)[debugrammer](/maintainers/debugrammer)

---

Top Contributors

[![cafe24-jspark03](https://avatars.githubusercontent.com/u/141196901?v=4)](https://github.com/cafe24-jspark03 "cafe24-jspark03 (13 commits)")[![debugrammer](https://avatars.githubusercontent.com/u/8610686?v=4)](https://github.com/debugrammer "debugrammer (6 commits)")

---

Tags

buildergrayloggraylog-apigraylog-query-buildergraylog-rest-apigraylog-search-queryphpphp7querybuildergraylogsearchquery

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/debugrammer-php-graylog-query-builder/health.svg)

```
[![Health](https://phpackages.com/badges/debugrammer-php-graylog-query-builder/health.svg)](https://phpackages.com/packages/debugrammer-php-graylog-query-builder)
```

###  Alternatives

[twilio/sdk

A PHP wrapper for Twilio's API

1.6k92.9M272](/packages/twilio-sdk)[facebook/php-business-sdk

PHP SDK for Facebook Business

90821.9M34](/packages/facebook-php-business-sdk)[meilisearch/meilisearch-php

PHP wrapper for the Meilisearch API

74513.7M114](/packages/meilisearch-meilisearch-php)[google/gax

Google API Core for PHP

265103.1M454](/packages/google-gax)[google/common-protos

Google API Common Protos for PHP

173103.7M50](/packages/google-common-protos)[hubspot/api-client

Hubspot API client

23914.2M16](/packages/hubspot-api-client)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)