shellstyle and contains substring patterns

[vhodges]

Hi,

I have a need to support matching on fields that contain a sub string and I've been going under the assumption that a using a shell style pattern like '*substring' on when a field has a value like 'some other preamble substring and more after the substring' was going to give me that but I am now having doubts (since this would normally be expressed with two globs)

I took a quick look at the code to see if *prefix would need to consume the rest of the field to be a valid match or not but couldn't tell with a quick one minute look. I did see in TestMakeShellStyleAutomaton that makeShellStyleAutomaton supports multiple globs.

My question: do shellstyle patterns support contains substring matching?

[timbray]

Unfortunately no. At the moment "*foo" only matches if foo is at the end of the field. It's on the agenda but not here yet.

[vhodges]

okay, no worries. I have a related need to support boolean expressions during a match anyways, so I'll do 'contains' that way for now.

Basically I will run one or more named expressions through an evaluator and add the results to the 'message' before calling MatchesForEvent eg {"expressions: {"exprName": true||false ... } } They're going to be on the expensive side but represent <4% of the matches to compare.

[timbray]

BTW if your need is urgent and you could use a library in Java rather than Go, https://github.com/aws/event-ruler has what you need.

Quamina will get it once I find the error in my automaton arithmetic that's causing simple wildcard expressions to occasionally explode to O(2**N) size.

[vhodges]

No not that urgent 😃 I have a work around that I will need to implement for other reasons.

[timbray]

No not that urgent 😃 I have a work around that I will need to implement for other reasons.

Fixed, by the way, as soon as the latest PR lands.