vrl 0.32.0

Vector Remap Language
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

LPAREN = _{ "(" }
RPAREN = _{ ")" }
LT = { "<" }
LT_EQ = { "<=" }
GT = { ">" }
GT_EQ = { ">=" }
LSQRBRACKET = { "[" }
LBRACKET = { "{" }
RSQRBRACKET = { "]" }
RBRACKET = { "}" }
COLON = _{ ":" }
STAR = { "*" }
QUESTIONMARK = { "?" }
DQUOTE = _{ "\"" }
AND = { "AND" | "&&" }
OR = { "OR" | "||" }
NOT = { "NOT" | "-" }
PLUS = { "+" }
ESC_CHAR = @{ "\\" ~ ANY }
INVALID_TERM_STARTS = _{ (WHITESPACE | "UNICODE3000" | DQUOTE | LPAREN | RPAREN | LSQRBRACKET | RSQRBRACKET | LBRACKET | RBRACKET | PLUS | "-" | "!" | COLON | "~" | "^" | QUESTIONMARK | STAR | "\\" | GT | "=" | LT) }

TERM_START_CHAR = _{ ESC_CHAR | !INVALID_TERM_STARTS ~ ANY }
TERM_END_CHAR = _{ WHITESPACE | RPAREN | RSQRBRACKET | RBRACKET | EOI }
TERM_CHAR = _{ TERM_START_CHAR | "-" | "+" | "=" }
TERM_START_CHAR_GLOB = _{ TERM_START_CHAR | STAR | QUESTIONMARK }
TERM_CHAR_GLOB = _{ TERM_CHAR | STAR | QUESTIONMARK }

TERM = @{ !(AND | OR | NOT) ~ TERM_START_CHAR ~ TERM_CHAR* }
TERM_PREFIX = @{ TERM_START_CHAR ~ TERM_CHAR* ~ STAR ~ &TERM_END_CHAR}
TERM_GLOB = @{ TERM_START_CHAR_GLOB ~ TERM_CHAR_GLOB* ~ &TERM_END_CHAR}
PHRASE = @{ DQUOTE ~ (ESC_CHAR | !DQUOTE ~ ANY )* ~ DQUOTE }

WHITESPACE = _{ " " | "\r" | "\n" | "\t" }

NUM_VALUE = _{("-"|"\\-")? ~ ASCII_DIGIT+ ~ ("." ~ ASCII_DIGIT+)?}
NUMERIC_TERM = ${ NUM_VALUE ~ ("E" ~ NUM_VALUE)?}


queryroot = { query ~ EOI }

query = { (multiterm | (modifiers? ~ clause)) ~ (multiterm | (conjunction? ~ modifiers? ~ clause))* }
    multitermlookahead = @{ TERM ~ !(COLON | STAR | WHITESPACE+ ~ (AND | OR)) }
    multiterm = { (&multitermlookahead ~ TERM)+ }
    modifiers = { PLUS | NOT }
    conjunction = { AND | OR }
    clause = { matchall | (field? ~ value) | (field? ~ LPAREN ~ query ~ RPAREN) }
        matchall = @{ STAR ~ COLON ~ STAR }
        field = ${ TERM ~ COLON }
        value = ${ STAR ~ &TERM_END_CHAR | PHRASE | TERM_PREFIX | comparison | range | TERM ~ &TERM_END_CHAR | TERM_GLOB }
            comparison = { operator ~ (NUMERIC_TERM | TERM) }
                operator = { GT_EQ | LT_EQ | GT | LT }
            range = !{ (LSQRBRACKET | LBRACKET) ~ RANGE_VALUE ~ "TO" ~ RANGE_VALUE ~ (RSQRBRACKET | RBRACKET) }
                RANGE_VALUE = @{ (!(WHITESPACE | RSQRBRACKET | RBRACKET) ~ ANY)+ }