Add json[field] filter accessor for JSON log lines (ticket 016)
Extends the FilterBar query language with a json[field] <op> value comparison, parsed by filter_parser.pest/rs alongside metric[param], and evaluated in engine.rs by parsing each line as JSON at query time (lines that aren't valid JSON, or lack the field, simply don't match). Also wired into alerts.rs since json[field], like regex/sequence/ timestamp, only needs the line's own text. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o
This commit is contained in:
co-authored by
Claude Sonnet 5
parent
e6e5bc8f50
commit
a198eae1fd
@@ -1,11 +0,0 @@
|
||||
# Support filtering/querying by JSON field in the filter bar
|
||||
|
||||
Follow-up to the JSON log ingestion design decision (repowise decision fdb47034ad954e3ea0b898fdc2750c32).
|
||||
|
||||
Extend the filter query language with a JSON field accessor (e.g. `json[field] <op> value`), comparable to the existing `metric[param] <op> value` comparison, so JSON fields can be filtered without first declaring a metric/param for them.
|
||||
|
||||
## Acceptance criteria
|
||||
- `filter_parser.pest` gains a `json[field]` (or similar) accessor usable anywhere `metric[param]` is today, for comparisons.
|
||||
- The engine evaluates `json[field]` against a line's parsed JSON (when it parses as an object), consistent with how declared params/metrics are evaluated today.
|
||||
- Lines that aren't valid JSON simply don't match any `json[field]` comparison (no error).
|
||||
- Existing filter syntax (metric/param comparisons, regex(), sequence, timestamp, and/or) is unaffected.
|
||||
Reference in New Issue
Block a user