3 Commits

Author	SHA1	Message	Date
Henri DF	79cdf31aa7	Expand in relational expressions ... For example, `a.b in [1, 2]` is expanded to `a.b = 1 or a.b = 2`. This is done over the AST, not filter text.	2016-02-13 15:23:03 -08:00
Henri DF	48685f4f2f	Don't require quoting for non-alphanum characters ... This commit removes the one remaining (known) difference with the sysdig c++ parser: relational expression right-hand sides now _only_ need to be quoted if they contain a paren or a space. So you can now do things like "fd.name contains (.log and event.dir = <" without needing to quote "*.log" or "<".	2016-02-13 15:23:03 -08:00
Henri DF	41ee6e49a5	Grammar for filters and macros	2016-02-13 15:23:03 -08:00