Method evalSequence

pkg/filter/filter.go:343–381

evalSequence evaluates the sequence with one, multiple or no join links. The sequence link is first consulted for the global sequence definition, and if it is not defined then the expression sequence link is used.

(
	e *event.Event,
	seqID int,
	expr *ql.SequenceExpr,
	partials map[int][]*event.Event,
	valuer ql.MapValuer,
)

// global sequence definition, and if it is not defined then
// the expression sequence link is used.
func (f *filter) evalSequence(
	e *event.Event,
	seqID int,
	expr *ql.SequenceExpr,
	partials map[int][]*event.Event,
	valuer ql.MapValuer,
) bool {
	// top-level sequence link is defined
	by := f.seq.By
	if by == nil {
		// otherwise, use the expression link
		by = expr.By
	}

	var match bool
	if seqID >= 1 && by != nil {
		linkID := makeSequenceLinkID(valuer, by)
		// traverse upstream partials for join equality
		joins := make([]bool, seqID)
	outer:
		for i := range seqID {
			for _, p := range partials[i] {
				if CompareSeqLink(linkID, p.SequenceLinks()) {
					joins[i] = true
					continue outer
				}
			}
		}
		match = joinsEqual(joins) && ql.Eval(expr.Expr, valuer, f.hasFunctions)
	} else {
		match = ql.Eval(expr.Expr, valuer, f.hasFunctions)
	}

	if match && by != nil {
		e.AddSequenceLink(makeSequenceLinkID(valuer, by))
	}

	return match
}

func (f *filter) RunSequence(e *event.Event, seqID int, partials map[int][]*event.Event, rawMatch bool) bool {
	if f.seq == nil {