Problem
The Python query engine already supports restricting regex classification to specific event fields via select_keys (aw-core/aw_transform/classify.py).
aw-server-rust does not. The query parser currently reads regex and ignore_case, but ignores select_keys, and the matcher checks all string-valued fields on the event.
That means a rule intended to mean "match only app" or "match only title" silently becomes "match any string field" on the Rust stack.
Current Code Paths
aw-query/src/datatype.rs parses regex rules from query JSON, but only handles regex + ignore_case
aw-transform/src/classify.rs matches regex rules against every string value in event.data
Requested Behavior
- Parse optional
select_keys: string[] from regex rules
- When
select_keys is present, only test those event fields
- When
select_keys is absent, preserve the current all-string-fields behavior
- Apply the same semantics to both categorization and tagging
Why This Matters
aw-webui can expose field selection in category rules, but that UI would be misleading until the Rust backend has parity with Python behavior.
Related threads:
Test Coverage
Please add tests for:
- valid
select_keys
- invalid
select_keys types
- missing keys / non-string values
- legacy rules without
select_keys
Problem
The Python query engine already supports restricting regex classification to specific event fields via
select_keys(aw-core/aw_transform/classify.py).aw-server-rustdoes not. The query parser currently readsregexandignore_case, but ignoresselect_keys, and the matcher checks all string-valued fields on the event.That means a rule intended to mean "match only
app" or "match onlytitle" silently becomes "match any string field" on the Rust stack.Current Code Paths
aw-query/src/datatype.rsparses regex rules from query JSON, but only handlesregex+ignore_caseaw-transform/src/classify.rsmatches regex rules against every string value inevent.dataRequested Behavior
select_keys: string[]from regex rulesselect_keysis present, only test those event fieldsselect_keysis absent, preserve the current all-string-fields behaviorWhy This Matters
aw-webuican expose field selection in category rules, but that UI would be misleading until the Rust backend has parity with Python behavior.Related threads:
Test Coverage
Please add tests for:
select_keysselect_keystypesselect_keys