[ZBXNEXT-2212] Make global regular expressions insertable into other regular expressions Created: 2014 Mar 18  Updated: 2014 Mar 20

Status: Open
Project: ZABBIX FEATURE REQUESTS
Component/s: Server (S)
Affects Version/s: None
Fix Version/s: None

Type: New Feature Request Priority: Minor
Reporter: Robin Roevens Assignee: Unassigned
Resolution: Unresolved Votes: 1
Labels: globalregexps, regexps
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified


 Description   

It would be a great feature to be able to use global defined regular expressions (Administration -> General -> Regular Expressions) inside any local regular expressions so that it becomes possible to locally extend the global regular expression. The global regular expression will act as some kind of include file.

For example:
I have a global regular expression with all windows services to exclude from LLD:
@Windows Services Blacklist:
1 » ^spupdsvc$ [Result is FALSE]
2 » ^TBS$ [Result is FALSE]
3 » ^Sysmonlog$ [Result is FALSE]
...

Which is now used as filter in a templated Windows Services LLD-item :
Filter macro:

{#SVCNAME} regexp: @Windows Services Blacklist

However sometimes it is necessary to exclude certain services on host-level, hence defining a filter as such:
Filter macro: {#SVCNAME}

regexp: @Windows Services Blacklist|^service1$|^service2$
would be very handy

Here the @Windows Services Blacklist-keyword could be replaced by "^spupdsvc$|^TBS$|^Sysmonlog$" creating the local regexp: "^spupdsvc$|^TBS$|^Sysmonlog$|^service1$|^service2$" to be evaluated
or by generating an internal temporary "global expresion" where the added part is added as a sub-expression:
1 » ^spupdsvc$ [Result is FALSE]
2 » ^TBS$ [Result is FALSE]
3 » ^Sysmonlog$ [Result is FALSE]
4 » ^service1$|^service2$ [Result is FALSE]

(see also this forum discussion: https://www.zabbix.com/forum/showthread.php?t=44002 )

This kind of feature could also be an answer to ZBXNEXT-481 making it possible to construct a regexp of global regexps:
for example: log[mylogfile.txt,@NOT_OUR_IPS|@NOT_TEST_DNS|@AAA_BBB_CCC]

This feature would make the regexp engine and LLD filtering a lot more powerful and flexible.



 Comments   
Comment by Oleksii Zagorskyi [ 2014 Mar 19 ]

You said:

Here the @Windows Services Blacklist-keyword could be replaced by "^spupdsvc$|^TBS$|^Sysmonlog$"

but that's not truth because you used [Result is FALSE] mode in global regexp.
So this is a "boolean negation" and this is a single way to perform negation in zabbix as Posix ERE (server side) doesn't support negation.

About LLD filtering - you probably don't know about ZBXNEXT-581

Comment by Robin Roevens [ 2014 Mar 19 ]

You're right about the negation and the only way to perform negation in zabbix without the use of negative lookbehinds and lookaheads forming very complex regexes, not sure if supported by Posix ERE. I completely overlooked the fact that the filter field expects a TRUE to have a value accepted not to have it filtered out. Result is TRUE in my example would make my example valid (but not doing what it was intended for).

I indeed did not know about ZBXNEXT-581, which looks promising to solving my initial problem if it will be possible to adapt a templated LLD Filter on host-level as this is not clear to me by the added documentation for this feature.

Additionally an ability to use some kind of zabbix-specific regexps syntax allowing one to simulate the current global expressions behaviour in a local regexps could also be very handy for use in trigger expressions.
For example: !

{<regexp>}

to get this boolean negation only available in global regexps
so !{^spupdsvc$}|!{^TBS$}|!{^Sysmonlog$} would represent
1 » ^spupdsvc$ [Result is FALSE]
2 » ^TBS$ [Result is FALSE]
3 » ^Sysmonlog$ [Result is FALSE]

or !{^spupdsvc$}|{^TBS$}
1 » ^spupdsvc$ [Result is FALSE]
2 » ^TBS$ [Result is TRUE]

This, in combination with the ability to combine global regexps with local ones would correct my previous erroneous example like this:
Filter macro:

{#SVCNAME}

regexp: @Windows Services Blacklist|!{^service1$}|!{^service2$}

Then of course also usable in item or trigger expressions where ZBXNEXT-581 won't be of any help..

Comment by Oleksii Zagorskyi [ 2014 Mar 19 ]

Thanks for the nice discussion! Your idea is interesting and probably is fresh.
Take into account please ZBX-3924

Comment by Robin Roevens [ 2014 Mar 20 ]

Using PCRE, as suggested engine in ZBX-3924 for regexps both on front-end en back-end, would make it possible to negate using negative lookahead:
My previous global regexp:
1 » ^spupdsvc$ [Result is FALSE]
2 » ^TBS$ [Result is FALSE]
3 » ^Sysmonlog$ [Result is FALSE]
could be noted in PCRE as
^(?!(?:spupdsvc)$).*$|^(?!(?:TBS)$).*$|^(?!(?:Sysmonlog)$).*$
or
^(?!(?:spupdsvc|TBS|Sysmonlog)$).*$
(I think.. I'm not really a regex-wiz )

Not really easy to read or construct (in my opinion), but possible, so using PCRE on both front-end and back-end as suggested in ZBX-3924 would make a zabbix-specific syntax for boolean negation unneeded.

So going back to my example combined regexp
@Windows Services Blacklist|^(?!(?:service1|service2)$).*$
could internally be converted to this PCRE regex:
^(?!(?:spupdsvc)$).*$|^(?!(?:TBS)$).*$|^(?!(?:Sysmonlog)$).*$|^(?!(?:service1|service2)$).*$

Generated at Thu Apr 25 13:45:43 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.