[Feature Request] <or> - logical or between checks

[DopeforHope]

Hello,

again, thanks for the work on the negate flag. However I noticed one use-case which isn't possible to cover with the plugin right now.

Let's assume we have the following use-case: I want to filter out all JSONs with the value foo for the keys key1 and key2. However, I'm fine if one of the keys has the value foo but not both.

Exemplary JSONs:

{ "key1": "foo", "key2": "foo" } #shall not pass
{ "key1": "foo", "key2": "test" } #shall pass
{ "key1": "test", "key2": "foo" } #shall pass

As for as I know, the nearest I can get with this plugin is the following:

<filter **>
 @type json
 @id json_filter

  <check>
    path /key1
    pattern /^(?!foo)/
  </check>
  <check>
    path /key2
    pattern /^(?!foo)/
  </check>
</filter>

However in the following, all three exemplary JSONs would be filtered out. I don't see a way to implement it with this plugin. The reason is that consecutive check are evaluated with a logical AND in between. However, the logical OR operator is non existent as far as I know.

Therefore I would propose an <or>-tag like in the FluentD grep module: https://docs.fluentd.org/filter/grep#less-than-or-greater-than-directive

With this one, one should be able to filter out the value as desired:

<filter **>
 @type json
 @id json_filter

  <or>
    <check>
      path /key1
      pattern /^(?!foo)/
    </check>
    <check>
      path /key2
      pattern /^(?!foo)/
    </check>
  </or>
</filter>

[iamazeem]

Hi @DopeforHope, :smiley:

Thank you for another feature request! :+1: Let me think about this a bit. I'll share my thoughts on this later.

Apparently, it looks like that <or> should accompany an <and> as well. :thinking: It would be quite similar to the grep plugin as far as the syntax is concerned.

If you think there are more such use-cases for JSON, please open issues for those also. Thanks and regards!