I faced exactly this problem - a large database that needs to be searched. I made some static reports and some trendy filters using django (very simple with django), just like you.
However, experienced users demanded more. I decided that there was already a DSL that they all knew - SQL . The question was how to make it safe enough.
So, I used django permissions to give authorized users permission to execute SQL queries in a new table. Then I pretended that users who did not have enough power were using these queries. I made them take extra parameters. The queries were executed using the lower level Python DB-API , which django uses under the hood for its ORM anyway.
The real trick was to open a read-only database connection, to run these queries to make sure there were no updates. I made a read-only connection by creating another user in the database with lower permissions and opening a specific connection for it.
TL; DR - SQL is the way to go!
Nick Craig-Wood
source share