Skip to content

Support select_keys in regex categorization and tagging rules #604

@TimeToBuildBob

Description

@TimeToBuildBob

Problem

The Python query engine already supports restricting regex classification to specific event fields via select_keys (aw-core/aw_transform/classify.py).

aw-server-rust does not. The query parser currently reads regex and ignore_case, but ignores select_keys, and the matcher checks all string-valued fields on the event.

That means a rule intended to mean "match only app" or "match only title" silently becomes "match any string field" on the Rust stack.

Current Code Paths

  • aw-query/src/datatype.rs parses regex rules from query JSON, but only handles regex + ignore_case
  • aw-transform/src/classify.rs matches regex rules against every string value in event.data

Requested Behavior

  • Parse optional select_keys: string[] from regex rules
  • When select_keys is present, only test those event fields
  • When select_keys is absent, preserve the current all-string-fields behavior
  • Apply the same semantics to both categorization and tagging

Why This Matters

aw-webui can expose field selection in category rules, but that UI would be misleading until the Rust backend has parity with Python behavior.

Related threads:

Test Coverage

Please add tests for:

  • valid select_keys
  • invalid select_keys types
  • missing keys / non-string values
  • legacy rules without select_keys

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions