Graylog2 / Graylog2/graylog2-server
some boolean expression evalution issues in pipeline rule
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
boolean expression doesn't correctly work in the pipeline when clause.
1. doesn't support some boolean expression with one binary operator and one unitary operator.
2. doesn't support some boolean expression with more than 2 binary operators.
3. function with bool return value can not be correctly evaluated in boolean expression.
## Expected Behavior
1. boolean expression with one binary operator and one unitary operator should be supported.
2. boolean expression with more than 2 binary operators should be supported.
3. function with bool return value can be correctly evaluated in boolean expression.
## Current Behavior
1. doesn't support some boolean expression with one binary operator and one unitary operator.
2. doesn't support some boolean expression with more than 2 binary operators.
3. function with bool return value can not be correctly evaluated in boolean expression.
## Possible Solution
## Steps to Reproduce (for bugs)
1. create a pipeline rule, input the following rule, you will got a error indication at the boolean expression line of when clause:
rule "boolean expression issue 1"
when
NOT regex(".*$","string").matches && regex("^.*$","string").matches
then
end
2. create a pipeline rule, input the following rule, you will got a error indication at the boolean expression line of when clause:
rule "boolean expression issue 2"
when
regex("^.*$","string").matches && regex("^.*$","string").matches && regex("^.*$","string").matches
then
end
3. create a pipeline as following pipeline, you will not get the new field "x_new_field" in result message:
stage 0 match either
rule "boolean expression issue 3-1";
rule "boolean expression issue 3-1"
when
regex("^.*$","string").matches
then
set_field("x_new_field",true);
end
while you using the following pipeline, you will get the new field "x_new_field" in result message:
stage 0 match either
rule "boolean expression issue 3-2";
rule "boolean expression issue 3-2"
when
regex("^.*$","string").matches == true
then
set_field("x_new_field",true);
end
or you create the following pipeline, you will get a collison between result value(being true) of x_has_field field and pass the when condition of second rule testing:
stage 0 match either
rule "always true";
rule "boolean expression issue 3-3";
rule "always true"
when
true
then
set_field("x_exist","something");
end
rule "boolean expression issue 3-3"
when
has_field("x_exist") == false
then
set_field("x_has_field",to_string(has_field("x_exist")));
end
4.
## Context
## Your Environment
* Graylog Version: 2.4.3-1
* Elasticsearch Version: 5.6.8-1
* MongoDB Version: mongodb-enterprise-3.6.3-1
* Operating System: CentOS 7.4
* Browser version: firefox-52.7.2-1
Contributor guide
Assessment
This issue has not been assessed yet.