Add json[field] filter accessor for JSON log lines (ticket 016)

Extends the FilterBar query language with a json[field] <op> value
comparison, parsed by filter_parser.pest/rs alongside metric[param],
and evaluated in engine.rs by parsing each line as JSON at query time
(lines that aren't valid JSON, or lack the field, simply don't match).
Also wired into alerts.rs since json[field], like regex/sequence/
timestamp, only needs the line's own text.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o
This commit is contained in:
Hugh Kaznowski
2026-09-05 19:34:21 +01:00
co-authored by Claude Sonnet 5
parent e6e5bc8f50
commit a198eae1fd
5 changed files with 175 additions and 16 deletions
-11
View File
@@ -1,11 +0,0 @@
# Support filtering/querying by JSON field in the filter bar
Follow-up to the JSON log ingestion design decision (repowise decision fdb47034ad954e3ea0b898fdc2750c32).
Extend the filter query language with a JSON field accessor (e.g. `json[field] <op> value`), comparable to the existing `metric[param] <op> value` comparison, so JSON fields can be filtered without first declaring a metric/param for them.
## Acceptance criteria
- `filter_parser.pest` gains a `json[field]` (or similar) accessor usable anywhere `metric[param]` is today, for comparisons.
- The engine evaluates `json[field]` against a line's parsed JSON (when it parses as an object), consistent with how declared params/metrics are evaluated today.
- Lines that aren't valid JSON simply don't match any `json[field]` comparison (no error).
- Existing filter syntax (metric/param comparisons, regex(), sequence, timestamp, and/or) is unaffected.