Add documentation for trie module.

1 files changed, 39 insertions, 0 deletions

diff --git a/doc/markdown/modules/trie.md b/doc/markdown/modules/trie.md
index e69de29bb..997f4d0df 100644
--- a/doc/markdown/modules/trie.md
+++ b/doc/markdown/modules/trie.md
@@ -0,0 +1,39 @@
+# Trie plugin
+
+Trie plugin is designed to search multiple strings within raw messages or text parts
+doing this blazingly fast. In fact, it uses aho-corasic algorithm that performs incredibly
+good even on large texts and many input strings.
+
+This module provides a convenient interface to the search trie structure.
+
+## Configuration
+
+Here is an example of trie configuration:
+
+~~~nginx
+trie {
+	# Each subsection defines a single rule with associated symbol
+	SYMBOL1 {
+		# Define rules in the file (it is *NOT* a map)
+		file = "/some/path";
+		# Raw rules search within the whole undecoded messages
+		raw = true;
+		# If we have multiple occurrences of strings from this rule
+		# then we insert a symbol multiple times
+		multi = true;
+	}
+	SYMBOL2 {
+		patterns = [
+			"pattern1",
+			"pattern2",
+			"pattern3"
+		]
+	}
+}
+~~~
+
+Despite of the fact that aho-corasic trie is very fast, it supports merely plain
+strings. Moreover, it cannot distinguish words boundaries, for example, a string
+`test` will be found in texts `test`, `tests` or even `123testing`. Therefore, it
+might be used to search some concrete and relatively specific patterns and should
+not be used for words match.
\ No newline at end of file