Graylog2 / Graylog2/graylog2-server
Extend rule language to allow extracting constants from when blocks
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
The rule syntax currently does not allow specifying any constants for use in its `when` block.
Consider the following example:
```
rule "Between 0 and 6 o'clock"
when
to_date($message.timestamp).hourOfDay >= 0 &&
to_date($message.timestamp).hourOfDay <= 6
end
```
`to_date($message.timestamp).hourOfDay` would typically be evaluated twice (optimizer enhancements might solve that in certain cases but that is non-obvious), makes the rule much less readable and maintainable.
Adding a new block that allows precomputing values for use in the rule would clean this up a lot:
```
rule "Between 0 and 6 o'clock"
with
hour: int = to_date($message.timestamp).hourOfDay
when
hour >= 0 && hour <= 6
end
```
The introduced constants would be visible in both the `when` and the `then` blocks.
This feature needs additional specs for what happens with errors, duplicate names etc.
Contributor guide
Assessment
This issue has not been assessed yet.