Improve collection filters (filter file)

[joachimmetz]

The filter file is currently used to indicate which paths should be included in extraction, however a recurring feature request is to be able to exclude paths from extraction.

Change filter file format to yaml to support additional expressions such as:

• include/exclude filter type
• data stream separator (to support data streams)
• path segment separator (to support Windows-like paths)
• path prefixes and suffixes

To do:

• [x] add basic yaml filter file support https://github.com/log2timeline/plaso/pull/2519
  • since regular expression support the \ character as an escape character it must be escaped in paths
• [x] preparation to implement exclude filter functionality https://github.com/log2timeline/plaso/pull/2520
• [x] implement exclude filter functionality
  • change find_spec Matches to not require search_depth https://github.com/log2timeline/dfvfs/pull/395
  • added exclusion of paths from collection https://github.com/log2timeline/plaso/pull/2521
• [x] update documentation
  • https://github.com/log2timeline/plaso/pull/2536
• [ ] add data stream support
  • using find spec
  • using data stream separator
• [ ] add find specification support
  • add path prefixes support
  • add path suffixes support
  • what is the expected behavior here? to only match on leaf file entries (files and empty directories)?

[joachimmetz]

Bumped to next release

[joachimmetz]

Unlikely to be implemented before Jan 25, bumping release

[Onager]

Not going to make release, removing milestone.

[joachimmetz]

Additional work moved to next milestone

[rodgermoore]

Just to let you know this is great! 🥇