Fix log pattern end anchoring - #1338
Conversation
|
/cc @ameukam |
|
/lgtm |
|
/hold for a second pass |
| anchored := `(?:` + expr + `)\z` | ||
| reg, err := regexp.Compile(anchored) | ||
| if err != nil { | ||
| return nil, err |
There was a problem hiding this comment.
Everything LGTM. Only one comment - I think with this change we should wrap the error:
fmt.Errorf("invalid pattern %q: %w", expr, err)
This is based on running a before/after with a string with \Q in it:
old regexp.Compile(`error\Q` + `\z`) → no err
new regexp.Compile(`(?:error\Q)` + `\z`) → missing closing ): `(?:error\Q)\z`
The error message shows our internal (?:...)\z pattern which the user did not write.
There was a problem hiding this comment.
good point, will update. thanks for checking this.
b02cca9 to
0558b3d
Compare
0558b3d to
b02cca9
Compare
`CompilePattern` previously appended `\z` directly to each configured expression. With a top-level alternative such as `oom-kill|Out of memory`, the first branch could match an older line that was still in the buffer. Wrap the expression in a non-capturing group before adding the end anchor: - **Before:** `oom-kill|Out of memory\z` - **After:** `(?:oom-kill|Out of memory)\z` This makes every branch honor the documented end-of-buffer contract, lets last-line classification inspect a single parse tree, and adds regression coverage for stale matches.
b02cca9 to
0b0ff3e
Compare
|
/unhold |
|
CC @ameukam @DigitalVeer - one more LGTM, please |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ameukam, DigitalVeer, hakman The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
CompilePatternpreviously appended\zdirectly to each configured expression. Because|has lower precedence,oom-kill|Out of memory\zanchored only the second branch. The first branch could match a retained line again after every subsequent push until that line was overwritten, repeating temporary events and log-counter results.Group the expression before adding the end anchor:
oom-kill|Out of memory\z(?:oom-kill|Out of memory)\zThis makes every branch honor the end-of-buffer contract and removes the extra parse-tree comparison. Shipped configurations are unaffected because they already group their alternatives. Custom patterns with an unparenthesized top-level
|intentionally change behavior; use(?:oom-kill|Out of memory).*when either phrase should match anywhere before the end of the newest line./cc @DigitalVeer