On Mon, Feb 6, 2012 at 10:35 AM, Scott Deboy <firstname.lastname@example.org>
I wouldn't mind getting rid of the implementation behind the current expression/expressionfilter support (also used in Chainsaw). Were there improvements in that area?
The expression support has some limits which I don't love - yes, you can define regexps and use relational and logical operators and grouping, but I would love to be able to have something like an 'around' operator that would work off of either of events (ten events around a warning message), and/or a time-based version (events within +- 1 minute of a warning message).
Logback also supports "evaluators". I've thought about that but the only difference seems to be that Filters return ACCEPT, DENY or NEUTRAL while evaluators are boolean. If I did that I would expect that most of the logic in the current filters would be moved to an Evaluator and then the individual filters would extend an EvaluatorFilter.
With all that, any ideas you have like that are certainly welcome. Take a look at the documentation and the code. My hope was to make things fairly amenable to enhancements.