feat: added exclude_keyvals transform

Author: ErikBjare

aw-query/src/functions.rs

@@ -67,6 +67,10 @@ pub fn fill_env(env: &mut VarEnv) {
             qfunctions::chunk_events_by_key,
         ),
     );
+    env.insert(
+        "exclude_keyvals".to_string(),
+        DataType::Function("exclude_keyvals".to_string(), qfunctions::exclude_keyvals),
+    );
     env.insert(
         "filter_keyvals".to_string(),
         DataType::Function("filter_keyvals".to_string(), qfunctions::filter_keyvals),
@@ -466,6 +470,25 @@ mod qfunctions {
         Ok(DataType::List(filtered_tagged_events))
     }
 
+    pub fn exclude_keyvals(
+        args: Vec<DataType>,
+        _env: &VarEnv,
+        _ds: &Datastore,
+    ) -> Result<DataType, QueryError> {
+        // typecheck
+        validate::args_length(&args, 3)?;
+        let events = (&args[0]).try_into()?;
+        let key: String = (&args[1]).try_into()?;
+        let vals: Vec<_> = (&args[2]).try_into()?;
+
+        let mut filtered_events = aw_transform::exclude_keyvals(events, &key, &vals);
+        let mut filtered_tagged_events = Vec::new();
+        for event in filtered_events.drain(..) {
+            filtered_tagged_events.push(DataType::Event(event));
+        }
+        Ok(DataType::List(filtered_tagged_events))
+    }
+
     pub fn filter_period_intersect(
         args: Vec<DataType>,
         _env: &VarEnv,

aw-transform/src/filter_keyvals.rs

@@ -50,6 +50,30 @@ pub fn filter_keyvals_regex(mut events: Vec<Event>, key: &str, regex: &Regex) ->
     filtered_events
 }
 
+/// Drops events matching the specified key and value(s). Opposite of filter_keyvals.
+///
+/// # Example
+/// ```ignore
+///  key: a
+///  vals: [1,2]
+///  input:  [a:1][a:2][a:3][b:4]
+///  output: [a:3][b:4]
+/// ```
+pub fn exclude_keyvals(mut events: Vec<Event>, key: &str, vals: &[Value]) -> Vec<Event> {
+    let mut filtered_events = Vec::new();
+    'events: for event in events.drain(..) {
+        if let Some(v) = event.data.get(key) {
+            for val in vals {
+                if val == v {
+                    continue 'events;
+                }
+            }
+        }
+        filtered_events.push(event);
+    }
+    filtered_events
+}
+
 #[cfg(test)]
 mod tests {
     use std::str::FromStr;
@@ -61,7 +85,7 @@ mod tests {
 
     use aw_models::Event;
 
-    use super::{filter_keyvals, filter_keyvals_regex};
+    use super::{exclude_keyvals, filter_keyvals, filter_keyvals_regex};
 
     #[test]
     fn test_filter_keyvals() {
@@ -108,4 +132,20 @@ mod tests {
         let res = filter_keyvals_regex(events.clone(), "key3", &regex_value);
         assert_eq!(0, res.len());
     }
+
+    #[test]
+    fn test_exclude_keyvals() {
+        let e1 = Event {
+            id: None,
+            timestamp: DateTime::from_str("2000-01-01T00:00:00Z").unwrap(),
+            duration: Duration::seconds(1),
+            data: json_map! {"test": json!(1)},
+        };
+        let mut e2 = e1.clone();
+        e2.data = json_map! {"test": json!(1), "test2": json!(2)};
+        let mut e3 = e1.clone();
+        e3.data = json_map! {"test": json!(2)};
+        let res = exclude_keyvals(vec![e1.clone(), e2.clone(), e3], "test", &vec![json!(2)]);
+        assert_eq!(vec![e1, e2], res);
+    }
 }

aw-transform/src/lib.rs

@@ -37,7 +37,7 @@ mod sort;
 pub use sort::{sort_by_duration, sort_by_timestamp};
 
 mod filter_keyvals;
-pub use filter_keyvals::{filter_keyvals, filter_keyvals_regex};
+pub use filter_keyvals::{exclude_keyvals, filter_keyvals, filter_keyvals_regex};
 
 mod filter_period;
 pub use filter_period::filter_period_intersect;