From 9801ee1d458640eaf0abbc34507ac86f3ced681d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rajmund=20Hru=C5=A1ka?= <rajmund.hruska@cesnet.cz>
Date: Tue, 13 May 2025 14:06:13 +0200
Subject: [PATCH] Add README.rst

---
 README.rst | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 README.rst

diff --git a/README.rst b/README.rst
new file mode 100644
index 0000000..5f50188
--- /dev/null
+++ b/README.rst
@@ -0,0 +1,29 @@
+Welcome to ransack
+==================
+
+**ransack** is a modern, extensible language for manipulation with structured data.
+
+Structured data --- like `JSON <https://json.org>`_, `YAML <https://yaml.org/>`_, `TOML <https://toml.io/>`_ and domain-specific formats such as `IDEA <https://idea.cesnet.cz>`_ --- form the backbone of many modern applications. These formats appear in configuration files, security logs, telemetry systems, and beyond.
+
+**ransack** was designed to meet the increasing need for a robust and expressive language to query, filter, and inspect structured data. Whether used in Python code, as part of a log analysis tool, or as a compiler frontend for other systems, **ransack** provides a flexible foundation.
+
+Why ransack?
+------------
+
+ransack is a new implementation and improvement over existing libraries like *Pynspect*, which was widely used in security monitoring systems like `NEMEA <https://nemea.liberouter.org/>`_ and `Mentat <https://mentat.cesnet.cz>`_. Compared to older tools, ransack:
+
+- supports **user-defined variables**
+- enables **multi-argument functions**
+- is **extensible** and **modular**
+- supports **multiple backends** (e.g., Python evaluation, SQL translation)
+- offers a clean internal architecture for future enhancements
+
+Key features
+------------
+
+- a simple and expressive syntax for filters and conditions
+- support for context-aware variables and data scoping
+- predefined functions
+- support for IPv4/IPv6, datetimes, string and list manipulation
+- safe and maintainable implementation using `Lark <https://lark-parser.readthedocs.io/en/stable/>`_ for parsing
+
-- 
GitLab