Graylog2 / Graylog2/graylog2-server

Extend rule language to allow extracting constants from when blocks

Open
#4,845 0 comments 1 reaction 0 assignees View on GitHub
feature processing triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

The rule syntax currently does not allow specifying any constants for use in its `when` block.

Consider the following example:

```
rule "Between 0 and 6 o'clock"
when
to_date($message.timestamp).hourOfDay >= 0 &&
to_date($message.timestamp).hourOfDay <= 6
end
```

`to_date($message.timestamp).hourOfDay` would typically be evaluated twice (optimizer enhancements might solve that in certain cases but that is non-obvious), makes the rule much less readable and maintainable.

Adding a new block that allows precomputing values for use in the rule would clean this up a lot:

```
rule "Between 0 and 6 o'clock"
with
hour: int = to_date($message.timestamp).hourOfDay
when
hour >= 0 && hour <= 6
end
```

The introduced constants would be visible in both the `when` and the `then` blocks.

This feature needs additional specs for what happens with errors, duplicate names etc.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.