fkie-cad / fkie-cad/Logprep

Add fuzzy filter logic to filter expressions

Open
#552 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
37
Forks
10
Avg merge
5d 16h
Merged PRs (30d)
8

Description

https://www.elastic.co/guide/en/elasticsearch/reference/8.12/query-dsl-query-string-query.html#query-string-fuzziness

we should implement this feature in favor of multiline regex support to address the same use cases.
multiline regex would be to expensive during prozessing logs.
this could be a simple string lookup in a json document?

Contributor guide

Open the contributing guide

Research direction

Start with the linked Elasticsearch query-string fuzziness documentation and locate the existing filter-expression handling in Logprep. Determine the intended fuzzy matching behavior and how it should replace multiline regex use, then identify suitable tests or examples for JSON log documents. Done means the behavior and performance expectations are specified and implemented without the proposed expensive multiline regex processing.

Written by the indexing model from the issue text.

Assessment

Tech stack
elasticsearch, python
Domain
search
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.