elastic/logstash

Extend 'in' operator to check for array subset.

Open

#6,853 opened on Mar 29, 2017

View on GitHub
 (8 comments) (0 reactions) (0 assignees)Ruby (3,496 forks)batch import
discussenhancementhelp wanted

Repository metrics

Stars
 (14,197 stars)
PR merge metrics
 (Avg merge 4d 15h) (51 merged PRs in 30d)

Description

Currently, the in operator does the following for a in b example:

  • if b is a string, it checks if a is a substring of b
  • if b is a list, it checks if a is an element of b

I propose that we extend the in operator to have the following additional behavior:

  • if b is a list, and a is a list, then a in b should check if a is a subset of the elements in b

Examples:

  • ["a", "b"] in ["a", "b", "c"] == true
  • ["a", "d"] in ["a", "b", "c"] == false

The same goes for field references. Let's suppose the [tags] field is ["web", "frontend", "newyork", "staging"], then the following:

  • ["web", "frontend"] in [tags] == true
  • ["db", "newyork"] in [tags] == false

General idea is to have in act as a subset check if both operands are list values (array literals, fieldreferences that have array values, etc)

Contributor guide

Research direction
Investigate the current implementation of the 'in' operator in Logstash (likely in the Ruby core library for event processing). Search for where the operator is defined and how it handles different operand types. Extend the logic to support array subset check when both operands are arrays. Ensure backward compatibility and add tests.
Tech stack
ruby
Domain
data
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
RubyLogstash codebase knowledge
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65