lib: Try to interpret filter values as intervals when parsing integer event values

This allows event filter values to be given as "1days" or "1week". This
is only done after parsing sizes and thus sizes takes precedences. Thus
for ambiguous units like "M" sizes are used before intervals (e.g. "1M"
= "1024 * 1024" and not "1M" = "60 * 60 * 1000 * 1000").

diff --git a/src/lib/event-filter-parser.y b/src/lib/event-filter-parser.y
index dbf936b3c48089713b8ab5c546179e52899809fe..1c70f2e32b6dac5233cece0a8943a9f1eba708b3 100644 (file)
--- a/src/lib/event-filter-parser.y
+++ b/src/lib/event-filter-parser.y
@@ -114,6 +114,21 @@ static struct event_filter_node *key_value(struct event_filter_parser_state *sta
                        if (ret == 0 && bytes <= INTMAX_MAX) {
                                node->field.value.intmax = (intmax_t) bytes;
                                node->field.value_type = EVENT_FIELD_VALUE_TYPE_INTMAX;
+                               node->type = EVENT_FILTER_NODE_TYPE_EVENT_FIELD_EXACT;
+                               break;
+                       }
+
+                       /* As a second step try to parse the value as an
+                          interval. The string-parser returns values as
+                          milliseconds, but the events usually report values
+                          as microseconds, which needs to be accounted for. */
+                       unsigned int intval;
+                       ret = str_parse_get_interval_msecs(b, &intval, &error);
+                       if (ret == 0) {
+                               node->field.value.intmax = (intmax_t) intval * 1000;
+                               node->field.value_type = EVENT_FIELD_VALUE_TYPE_INTMAX;
+                               node->type = EVENT_FILTER_NODE_TYPE_EVENT_FIELD_EXACT;
+                               break;
                        }
                }