From b83d84d65f76d093be7dbdcf8969c74298d4b5e8 Mon Sep 17 00:00:00 2001 From: Karl Fleischmann Date: Fri, 11 Nov 2022 15:42:01 +0100 Subject: [PATCH] lib: Try to interpret filter values as intervals when parsing integer event values This allows event filter values to be given as "1days" or "1week". This is only done after parsing sizes and thus sizes takes precedences. Thus for ambiguous units like "M" sizes are used before intervals (e.g. "1M" = "1024 * 1024" and not "1M" = "60 * 60 * 1000 * 1000"). --- src/lib/event-filter-parser.y | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/lib/event-filter-parser.y b/src/lib/event-filter-parser.y index dbf936b3c4..1c70f2e32b 100644 --- a/src/lib/event-filter-parser.y +++ b/src/lib/event-filter-parser.y @@ -114,6 +114,21 @@ static struct event_filter_node *key_value(struct event_filter_parser_state *sta if (ret == 0 && bytes <= INTMAX_MAX) { node->field.value.intmax = (intmax_t) bytes; node->field.value_type = EVENT_FIELD_VALUE_TYPE_INTMAX; + node->type = EVENT_FILTER_NODE_TYPE_EVENT_FIELD_EXACT; + break; + } + + /* As a second step try to parse the value as an + interval. The string-parser returns values as + milliseconds, but the events usually report values + as microseconds, which needs to be accounted for. */ + unsigned int intval; + ret = str_parse_get_interval_msecs(b, &intval, &error); + if (ret == 0) { + node->field.value.intmax = (intmax_t) intval * 1000; + node->field.value_type = EVENT_FIELD_VALUE_TYPE_INTMAX; + node->type = EVENT_FILTER_NODE_TYPE_EVENT_FIELD_EXACT; + break; } } -- 2.47.3