From 385ff1b0ff95d23b5e7065ce4550625629141433 Mon Sep 17 00:00:00 2001
From: Nikolay Bryskin <nbryskin@yandex-team.ru>
Date: Tue, 11 Jun 2013 02:36:59 +0400
Subject: [PATCH 1/3] derivequery: pass search filter to query

---
 panels/derivequeries/module.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/panels/derivequeries/module.js b/panels/derivequeries/module.js
index fab94a8a17786..09f0233d47b42 100644
--- a/panels/derivequeries/module.js
+++ b/panels/derivequeries/module.js
@@ -81,7 +81,7 @@ angular.module('kibana.derivequeries', [])
       $scope.panel.loading = false;
       var data = [];
       _.each(results.facets.query.terms, function(v) {
-        data.push($scope.panel.field+':"'+v.term+'"')
+        data.push($scope.panel.field+':"'+v.term+'" AND ' + ($scope.panel.query || '*'))
       });
       $scope.send_query(data)
     });

From a03501031dbc82d90b872210abf495d845293ce1 Mon Sep 17 00:00:00 2001
From: Nikolay Bryskin <nbryskin@yandex-team.ru>
Date: Wed, 12 Jun 2013 03:30:30 +0400
Subject: [PATCH 2/3] derivequeries: added Query Mode option

---
 panels/derivequeries/editor.html | 13 +++++++++----
 panels/derivequeries/module.js   | 11 ++++++++++-
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/panels/derivequeries/editor.html b/panels/derivequeries/editor.html
index 442e55d72a88b..56922bc2efa59 100644
--- a/panels/derivequeries/editor.html
+++ b/panels/derivequeries/editor.html
@@ -1,17 +1,22 @@
 <div>
   <div class="row-fluid">    
     <div class="span12">
-      The derive queries panel takes a query and a field, then runs a terms facet against both and generates a list of terms to query on. For example, you might want to see a histogram of the top 5 requests that return a 404. <strong>You should be careful not to select a high cardinality field</strong> as Elasticsearch must load all of these values into memory.
+      The derive queries panel takes a query and a field, then runs a terms facet against both and generates a list of terms to query on. For example, you might want to see a histogram of the top 5 requests that return a 404. <strong>You should be careful not to select a high cardinality field</strong> as Elasticsearch must load all of these values into memory.<p>
+      Query Mode allows to optionally append original query to each term in the list.
     </div>
   </div>
   <div class="row-fluid">
-    <div class="span3">
+    <div class="span1">
       <label class="small">Length</label>
       <input type="number" style="width:80%" ng-model="panel.size" ng-change="set_refresh(true)">
     </div>
+    <div class="span3">
+      <label class="small">Query Mode</label>
+      <select style="width:80%" ng-change="set_refresh(true)" ng-model='panel.mode' ng-options="f for f in ['terms only','AND', 'OR']"></select>
+    </div>
     <div class="span8">
       <label class="small">Exclude Terms(s) (comma seperated)</label>
-        <input array-join type="text" style="width:90%" ng-change="set_refresh(true)" ng-model='panel.exclude'></input>
+      <input array-join type="text" style="width:90%" ng-change="set_refresh(true)" ng-model='panel.exclude'></input>
     </div>
   </div>
-</div>
\ No newline at end of file
+</div>
diff --git a/panels/derivequeries/module.js b/panels/derivequeries/module.js
index 09f0233d47b42..e62d065439d76 100644
--- a/panels/derivequeries/module.js
+++ b/panels/derivequeries/module.js
@@ -10,6 +10,7 @@
   * field :: the field to facet on
   * size :: how many queries to generate
   * fields :: a list of fields known to us
+  * query_mode :: how to create query
   
   ### Group Events
   #### Sends
@@ -33,6 +34,7 @@ angular.module('kibana.derivequeries', [])
     fields  : [],
     spyable : true,
     size    : 5,
+    mode    : 'terms only',
     exclude : []
   }
   _.defaults($scope.panel,_d);
@@ -80,8 +82,15 @@ angular.module('kibana.derivequeries', [])
     results.then(function(results) {
       $scope.panel.loading = false;
       var data = [];
+      if ($scope.panel.query === '' || $scope.panel.mode === 'terms only') {
+        var suffix = '';
+      } else if ($scope.panel.mode === 'AND') {
+        var suffix = ' AND ' + $scope.panel.query;
+      } else if ($scope.panel.mode === 'OR') {
+        var suffix = ' OR ' + $scope.panel.query;
+      }
       _.each(results.facets.query.terms, function(v) {
-        data.push($scope.panel.field+':"'+v.term+'" AND ' + ($scope.panel.query || '*'))
+        data.push($scope.panel.field+':"'+v.term+'"'+suffix)
       });
       $scope.send_query(data)
     });

From ac24a06daf9eaa0e0c3343b9ce5d35fc4f135db3 Mon Sep 17 00:00:00 2001
From: Nikolay Bryskin <nbryskin@yandex-team.ru>
Date: Wed, 12 Jun 2013 23:59:09 +0400
Subject: [PATCH 3/3] derivequeries: combine derived query with original query
 using brackets

---
 panels/derivequeries/module.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/panels/derivequeries/module.js b/panels/derivequeries/module.js
index e62d065439d76..b18bf0c60927f 100644
--- a/panels/derivequeries/module.js
+++ b/panels/derivequeries/module.js
@@ -85,9 +85,9 @@ angular.module('kibana.derivequeries', [])
       if ($scope.panel.query === '' || $scope.panel.mode === 'terms only') {
         var suffix = '';
       } else if ($scope.panel.mode === 'AND') {
-        var suffix = ' AND ' + $scope.panel.query;
+        var suffix = ' AND (' + $scope.panel.query + ')';
       } else if ($scope.panel.mode === 'OR') {
-        var suffix = ' OR ' + $scope.panel.query;
+        var suffix = ' OR (' + $scope.panel.query + ')';
       }
       _.each(results.facets.query.terms, function(v) {
         data.push($scope.panel.field+':"'+v.term+'"'+suffix)