Graylog2 / Graylog2/graylog2-server

some boolean expression evalution issues in pipeline rule

Open
#4,692 0 comments 0 reactions 0 assignees View on GitHub
to-verify
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

boolean expression doesn't correctly work in the pipeline when clause.

1. doesn't support some boolean expression with one binary operator and one unitary operator.
2. doesn't support some boolean expression with more than 2 binary operators.
3. function with bool return value can not be correctly evaluated in boolean expression.

## Expected Behavior

1. boolean expression with one binary operator and one unitary operator should be supported.
2. boolean expression with more than 2 binary operators should be supported.
3. function with bool return value can be correctly evaluated in boolean expression.

## Current Behavior

1. doesn't support some boolean expression with one binary operator and one unitary operator.
2. doesn't support some boolean expression with more than 2 binary operators.
3. function with bool return value can not be correctly evaluated in boolean expression.

## Possible Solution

## Steps to Reproduce (for bugs)

1. create a pipeline rule, input the following rule, you will got a error indication at the boolean expression line of when clause:

rule "boolean expression issue 1"
when
NOT regex(".*$","string").matches && regex("^.*$","string").matches
then
end

2. create a pipeline rule, input the following rule, you will got a error indication at the boolean expression line of when clause:

rule "boolean expression issue 2"
when
regex("^.*$","string").matches && regex("^.*$","string").matches && regex("^.*$","string").matches
then
end

3. create a pipeline as following pipeline, you will not get the new field "x_new_field" in result message:

stage 0 match either
rule "boolean expression issue 3-1";

rule "boolean expression issue 3-1"
when
regex("^.*$","string").matches
then
set_field("x_new_field",true);
end

while you using the following pipeline, you will get the new field "x_new_field" in result message:

stage 0 match either
rule "boolean expression issue 3-2";

rule "boolean expression issue 3-2"
when
regex("^.*$","string").matches == true
then
set_field("x_new_field",true);
end

or you create the following pipeline, you will get a collison between result value(being true) of x_has_field field and pass the when condition of second rule testing:

stage 0 match either
rule "always true";
rule "boolean expression issue 3-3";

rule "always true"
when
true
then
set_field("x_exist","something");
end

rule "boolean expression issue 3-3"
when
has_field("x_exist") == false
then
set_field("x_has_field",to_string(has_field("x_exist")));
end

4.

## Context

## Your Environment

* Graylog Version: 2.4.3-1
* Elasticsearch Version: 5.6.8-1
* MongoDB Version: mongodb-enterprise-3.6.3-1
* Operating System: CentOS 7.4
* Browser version: firefox-52.7.2-1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.