Cleanup log filter code, and add supports for LT and GT filters. (#11768

)

* Cleanup of the wipe field filters

* Removes remants of m_does_conjunction

* Adds LT/GT filter logic for integer fields

* Cleanup the actual wipe functionality

* Eliminate the malloc and string copy for uppercase

* Fix milestones type and filter copy ctor

* Adds an example log format and filter for slowlog

* Fix issue with strstrcase string lengths

configs/logging.yaml.default

@@ -11,6 +11,13 @@
 
 
 logging:
+# This is an example filter for the slow log, you can tweak and tune this as you like for
+# your slowlog debugging. Use this with the slowlog format below, for a slowlog file.
+  filters:
+    - name: slowlog
+      action: accept
+      condition: '%<{TS_MILESTONE_SM_FINISH-TS_MILESTONE_SM_START}msdms GTE 100'
+
   formats:
     # WebTrends Enhanced Log Format.
     #
@@ -42,6 +49,9 @@ logging:
     - name: "extended2"
       format: '%<chi> - %<caun> [%<cqtn>] "%<cqhm> %<pqu> %<cqpv>" %<pssc> %<pscl> %<sssc> %<sscl> %<cqcl> %<pqcl> %<cqhl> %<pshl> %<pqhl> %<sshl> %<tts> %<phr> %<cfsc> %<pfsc> %<crc>'
 
+    - name: "slowlog"
+      format: '[%<cruuid>] client_ip: %<chi>:%<chp> protocol: %<cqpv> url: %<cquc> status: %<pssc> X-ID: %<{X-Id}cqh> bytes=%<pscl> client state: %<cfsc> server state: %<sssc> tls_handshake: %<{TS_MILESTONE_TLS_HANDSHAKE_END-TS_MILESTONE_TLS_HANDSHAKE_START}msdms> ua_begin: %<{TS_MILESTONE_UA_BEGIN-TS_MILESTONE_SM_START}msdms> ua_first_read: %<{TS_MILESTONE_UA_FIRST_READ-TS_MILESTONE_SM_START}msdms> ua_read_header_done: %<{TS_MILESTONE_UA_READ_HEADER_DONE-TS_MILESTONE_SM_START}msdms> cache_open_read_begin: %<{TS_MILESTONE_CACHE_OPEN_READ_BEGIN-TS_MILESTONE_SM_START}msdms> cache_open_read_end: %<{TS_MILESTONE_CACHE_OPEN_READ_END-TS_MILESTONE_SM_START}msdms> cache_open_write_begin: %<{TS_MILESTONE_CACHE_OPEN_WRITE_BEGIN-TS_MILESTONE_SM_START}msdms> cache_open_write_end: %<{TS_MILESTONE_CACHE_OPEN_WRITE_END-TS_MILESTONE_SM_START}msdms> dns_lookup_begin: %<{TS_MILESTONE_DNS_LOOKUP_BEGIN-TS_MILESTONE_SM_START}msdms> dns_lookup_end: %<{TS_MILESTONE_DNS_LOOKUP_END-TS_MILESTONE_SM_START}msdms> server_connect: %<{TS_MILESTONE_SERVER_CONNECT-TS_MILESTONE_SM_START}msdms> server_connect_end: %<{TS_MILESTONE_SERVER_CONNECT_END-TS_MILESTONE_SM_START}msdms> server_first_read: %<{TS_MILESTONE_SERVER_FIRST_READ-TS_MILESTONE_SM_START}msdms> server_read_header_done: %<{TS_MILESTONE_SERVER_READ_HEADER_DONE-TS_MILESTONE_SM_START}msdms> server_close: %<{TS_MILESTONE_SERVER_CLOSE-TS_MILESTONE_SM_START}msdms> ua_write: %<{TS_MILESTONE_UA_BEGIN_WRITE-TS_MILESTONE_SM_START}msdms> ua_close: %<{TS_MILESTONE_UA_CLOSE-TS_MILESTONE_SM_START}msdms> sm_finish: %<{TS_MILESTONE_SM_FINISH-TS_MILESTONE_SM_START}msdms> plugin_active: %<{TS_MILESTONE_PLUGIN_ACTIVE-TS_MILESTONE_SM_START}msdms> plugin_total: %<{TS_MILESTONE_PLUGIN_TOTAL-TS_MILESTONE_SM_START}msdms>'
+
   logs:
     - filename: squid
       format: squid

doc/admin-guide/files/logging.yaml.en.rst

@@ -210,6 +210,22 @@ be any one of the following:
     True if the value of ``field`` contains ``value`` (i.e. ``value`` is a
     substring of the contents of ``field``). Case-insensitive.
 
+``LT``
+    True if the value of ``field`` is less than the value of ``value``.
+    Only valid for integer fields.
+
+``LTE``
+    True if the value of ``field`` is less than or equal to the value of
+    ``value``. Only valid for integer fields.
+
+``GT``
+    True if the value of ``field`` is greater than the value of ``value``.
+    Only valid for integer fields.
+
+``GTE``
+    True if the value of ``field`` is less than or equal to the value of
+    ``value``. Only valid for integer fields.
+
 Filter Values
 ~~~~~~~~~~~~~