Conditionals and other event routing improvements

Description

It is clear that 'type' and 'tags' routing decisions alone are not really sufficient. With an adequate routing system, the 'grep' filter would go away and simply become the 'drop' filter.

After some discussion with myself, Nick Ethier and Richard Pijnenburg, we decided on ruby-style syntax for conditions (if/elsif/else)

Outputs and filters will support branches in this way.

Any plugins outside a conditionals will receive all events.

The 'conditionals' syntax aims to be similar to common programming languages with infix operators:

Operators:

  • comparison: ==, !=, <=, >=, <, >, =, !, in

  • boolean: and, or, xor

Operands:

  • [some][field][selector] - select a field the same way %{[some][field]) would

  • "some string"

  • numbers: 1, 1.4

  • method calls: rate, something([some][field][selector])

Open questions:

  • Support math operators?

  • How can we provide a way for users to provide their own functions?

Environment

None

Status

Assignee

Jordan Sissel

Reporter

Jordan Sissel

Labels

None

Fix versions

Priority

Configure