Skip to content

Line filter with "or" syntax not behaving consistently with empty query #19523

@telhaakhi

Description

@telhaakhi

Describe the bug

If {app="foo"} |= "" matches all log lines, and {app="foo"} |= "notfound" matches none, I expect that:

{app="foo"} |= "notfound" or "" should match all log lines.
Instead it matches no lines.

I believe this is caused by a mistake in the logic in newOrFilter:

func newOrFilter(left MatcherFilterer, right MatcherFilterer) MatcherFilterer {
if left == nil || isTrueFilter(left) {
return right
}
if right == nil || isTrueFilter(right) {
return left
}

Where if left or right is trivially true, it also requires the other side to be true, treating it as an and clause.
It should instead treat the whole or clause as trivially true.

This also affects simplified regular expression matches, so {app="foo"} |~ "(notfound|)" will match no lines, while {app="foo"} |~ "" or {app="foo"} |~ "(|)" matches all lines.

To Reproduce
Steps to reproduce the behavior:

Observe no results from
{cluster="eu-west-1"} |= "" or "notfound"

Expected behavior

  • {app="foo"} |= "notfound" or "" should match all log lines, consistent with {app="foo"} |= "" and {app="foo"} |= "" or ""
  • {app="foo"} |~ "(notfound|)" should match all log lines, consistent with {app="foo"} |~ "" and {app="foo"} |~ "(|)"

Environment:
N/A

Screenshots, Promtail config, or terminal output
N/A

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions