improve fields parsing performance by eliminating temp strings.

[VadimZy]

improve parser performance by statically precompiling regex

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind design

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area libsinsp

Does this PR require a change in the driver versions? NO

What this PR does / why we need it: improving falco parsing performance

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?: NO

NONE

[jasondellaluce]

Also, please sign-off your commits (https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md#developer-certificate-of-origin). Thanks Vadim!

[mstemm]

This looks like a great set of changes! While we're in here mucking with regexes, what do you (and other reviewers) think about using RE2 instead of c++ regex? I believe all of these are compatible with RE2 (e.g. don't backtrack) and from what I recall, including https://github.com/HFTrader/regex-performance, RE2 appears to be much much faster.

[jasondellaluce]

/ok-to-test

[VadimZy]

@mstemm

While we're in here mucking with regexes, what do you (and other reviewers) think about using RE2 instead of c++ regex?

I think it would be quite beneficial to have a portable REGEX in Falco/Libs

[jasondellaluce]

While we're in here mucking with regexes, what do you (and other reviewers) think about using RE2 instead of c++ regex?

I think that would be a very good contribution in our case. Regex inconsistency makes our code troublesome and harder to maintain. We'll need to open separate PRs and track the progress in an issue eventually.

[poiana]

LGTM label has been added.

Git tree hash: 3f057211ddf02873415d027b14a51d4735d9df69

[jasondellaluce]

FYI the regex portability problem has been addressed in https://github.com/falcosecurity/libs/pull/556.

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, VadimZy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• ~~OWNERS~~ [FedeDP]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment