Skip to content

lib/logstorage: reject unquoted filter values using function names - #1711

Open
angelofallars wants to merge 6 commits into
VictoriaMetrics:masterfrom
angelofallars:logsql/reject-unquoted-filter-function-names
Open

lib/logstorage: reject unquoted filter values using function names#1711
angelofallars wants to merge 6 commits into
VictoriaMetrics:masterfrom
angelofallars:logsql/reject-unquoted-filter-function-names

Conversation

@angelofallars

@angelofallars angelofallars commented Aug 23, 2026

Copy link
Copy Markdown

Fixes #1457

Makes LogsQL reject unquoted filter values if they match a built-in filter function name like ipv6_range or field:ipv6_range.

The error message tells users to put the value or field name in quotes: the "<func_name>" must be put in quotes.

image image

These names will now be rejected when unquoted and not used as a function call:

  • eq_field
  • exact
  • i
  • ipv4_range
  • ipv6_range
  • json_array_contains_any
  • le_field
  • len_range
  • lt_field
  • pattern_match
  • pattern_match_full
  • pattern_match_prefix
  • pattern_match_suffix
  • range
  • re
  • seq
  • string_range
  • value_type

Additionally, contains_common_case and equals_common_case were already being rejected when used without quotes but their error message has been modified to match the other values for consistency.

Before After
image image

Checklist

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 2 files

Re-trigger cubic

@angelofallars
angelofallars force-pushed the logsql/reject-unquoted-filter-function-names branch from 6deab47 to 28d0464 Compare August 23, 2026 21:13
f(`''`, `""`)

// reserved functions
f("eq_field", `"eq_field"`)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These tests must be rewritten for testing how the parser parses quoted function names.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good callout, I will add unit tests to ensure quoted function names are parsed successfully

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 5c9abcd, added tests for successful parsing of quoted function names for every reserved function keyword

Comment thread docs/victorialogs/CHANGELOG.md Outdated
* BUGFIX: [cluster version](https://docs.victoriametrics.com/victorialogs/cluster/): evenly spread rerouted data across available `vlstorage` nodes. Previously, healthy nodes adjacent to unavailable nodes in the `-storageNode` list could receive much more data, resulting in uneven resource usage. See [#1548](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1548).
* BUGFIX: [data ingestion](https://docs.victoriametrics.com/victorialogs/data-ingestion/) and [querying](https://docs.victoriametrics.com/victorialogs/querying/): properly handle logs containing duplicate [stream field](https://docs.victoriametrics.com/victorialogs/keyconcepts/#stream-fields) names. Previously, [v1.52.0](https://github.com/VictoriaMetrics/VictoriaLogs/releases/tag/v1.52.0) could panic when ingesting such logs in single-node VictoriaLogs, drop them during ingestion in VictoriaLogs cluster, or panic when querying such data written by earlier releases. See [#1603](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1603) and [#1604](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1604).
* BUGFIX: [LogsQL](https://docs.victoriametrics.com/victorialogs/logsql/): fix [`week_range[Sun,Sun]` filter](https://docs.victoriametrics.com/victorialogs/logsql/#week-range-filter) when it is used inside the [`filter` pipe](https://docs.victoriametrics.com/victorialogs/logsql/#filter-pipe). Previously, it could fail to match rows on Sunday. See [#1335](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1335).
* BUGFIX: [LogsQL](https://docs.victoriametrics.com/victorialogs/logsql/): reject unquoted field names and filter values starting with built-in filter function names such as `exact`, `ipv6_range` and `range`, consistently with `in`, which already requires quoting. Previously, such names were accepted as phrase filters instead of returning an error that they must be quoted. See [#1711](https://github.com/VictoriaMetrics/VictoriaLogs/pull/1711).

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changelog entry must link to the corresponding issue, not to the pull request. The initial message in the pull request must point to the corresponding issue, so the issue is automatically back linked to the pull request.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah didn't quite catch that as I couldn't find a "changelog process" doc, will link to the issue instead

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 03b98de, links to the issue instead of the PR

@angelofallars

angelofallars commented Aug 25, 2026

Copy link
Copy Markdown
Author

@valyala thanks for the review! I will address the review comments today and re-request review when I have free time (busy with work rn 😅)

@angelofallars

Copy link
Copy Markdown
Author

@valyala I addressed the review comments. I also changed a query snippet in the public docs that became invalid from the unquoted function name changes (430d88c). Would appreciate another look at my changes if you have time!

@angelofallars
angelofallars requested a review from valyala August 25, 2026 17:49

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 3 files (changes from recent commits).

Tip: cubic used a learning from your PR history. Let your coding agent read cubic learnings directly with the cubic MCP.

Re-trigger cubic

Comment thread docs/victorialogs/logsql.md Outdated
Comment thread docs/victorialogs/logsql.md Outdated
Comment thread docs/victorialogs/logsql.md Outdated
Comment thread docs/victorialogs/CHANGELOG.md Outdated
Comment thread docs/victorialogs/CHANGELOG.md Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

logsql: reject unquoted filter values matching filter function names

2 participants