pySigma-backend-loki

pySigma-backend-loki copied to clipboard

As identified in #151, our backend does not currently support the case-insensitive modifiers i, ignorecase. We can support those in LogQL, by safely converting the string into a regular expression (if necessary/applicable), and appending it with (?i), in a similar way to the method currently used when case-sensitive is false.

On further investigation, it seems the |i modifier only becomes relevant if used in combination with the |re modifier, which does work, and therefore our implementation is correct.

Whilst the modifier is working, is seems that the modifier is not achieving its intended goal and therefore this is a valid bug!