airi.conf

<source>
  type forward
  port 24224
</source>

<match tiarra.miu>
  type       exec_filter
  command    bundle exec ruby store.rb
  in_format  json
  out_format msgpack
  tag        tiarra.out
  flush_interval 1s
</match>

<match tiarra.out>
  type stdout
</match>

cli.rb

#coding:utf-8
load File.expand_path(File.dirname(__FILE__))+"/common.rb"

search(ARGV[0]).each{|r|
  puts "#{r.room}:#{r.user} #{r.content_data} at:#{Time.at(r.created_at)}"
}

common.rb

#coding:utf-8
require 'fileutils'

FileUtils.cd File.expand_path(File.dirname(__FILE__))

require 'bundler'
Bundler.setup
require 'groonga'
require 'json'
require 'msgpack'
require 'time'

Dir::mkdir "groonga" unless File.exist? "groonga"
if File.exist? "groonga/db"
  Groonga::Database.open "groonga/db"
else
  Groonga::Database.create path: "groonga/db"
end

unless Groonga['Airis']
  Groonga::Schema.define do |s|
    s.create_table('Airis', type: :patricia_trie, key_type: 'ShortText'){|t|
      t.short_text 'network'
      t.short_text 'room'
      t.short_text 'user'
      t.short_text 'content_type'
      t.long_text 'content_data'
      t.int64 'created_at'
    }
    s.create_table('AirisIndex', type: :patricia_trie, key_type: "ShortText", default_tokenizer: "TokenBigram", key_normalize: true) {|t|
      t.index 'Airis.network'
      t.index 'Airis.room'
      t.index 'Airis.user'
      t.index 'Airis.content_data'
      t.index 'Airis.content_type'
    }
  end
end

$a = Groonga['Airis']

def sanitize_query query, *ex
  if ex.first
    query.gsub!(ex.first, '')  
  end
  query.gsub(/(:|<|>|\[|\]|\(|\))/, ' ')
end

def grn_parser str
  str = sanitize_query(str.dup.to_s)
  
  q = []
  m = []
  str.gsub!(/　/, ' ')
  
  str.split(' ').map{|x| 
    if x =~ /^\-/
      m << x.sub(/^\-/, '')
    elsif x == 'OR' or x == 'AND'
      q << x
    else
      t = x.dup
      case t
      when /room:/
        q << "room:@#{sanitize_query(t, /room\:/)}"
      when /user:/
        q << "user:@#{sanitize_query(t, /user\:/)}"
      when /data:/
        q << "content_data:@#{sanitize_query(t, /data\:/)}"
      else
        t = sanitize_query(t, /all\:/)
        q << "(user:@#{t} OR content_data:@#{t} OR room:@#{t})"
      end
    end
  }
  query = ''
  q.each_with_index{|x,i|
    next if x == 'OR' or x == 'AND'
    if q[i+1] == 'OR' or q[i+1] == 'AND'
      query += "#{x} #{q[i+1]} "
    elsif q[i+1] != nil
      query += "#{x} + "
    else
      if x != 'AND' and x != 'OR'
        query += x
      end
    end
  }
  return query
end

def search query
  query = grn_parser query
  $a.select(query)
end

Gemfile

source "https://rubygems.org"

gem 'fluentd'
gem 'fluent-plugin-groonga'
gem 'rroonga'
gem 'msgpack'
gem 'sinatra'

store.rb

#coding:utf-8
load File.expand_path(File.dirname(__FILE__))+"/common.rb"

while json = STDIN.gets
  begin
    log = JSON.parse json
    key = rand(256**16).to_s(16)
    $a.add key
    $a[key].network = log['network']
    $a[key].room = log['room']
    $a[key].user = log['user']
    $a[key].content_data = log['content']['data']
    $a[key].content_type = log['content']['type']
    $a[key].created_at = Time.parse(log['at']).to_i
    print log.to_msgpack
  rescue
  end
end