fix(logql): correct OR filter behavior when one side is a TrueFilter
What this PR does / why we need it
This PR fixes incorrect OR behavior in LogQL line filters when one side contains an empty match. Previously, expressions such as {app="foo"} |= "notfound" or "" or regex patterns like (notfound|) incorrectly evaluated to false, even though the empty branch should act as a TrueFilter.
The fix updates newOrFilter so that the OR operation returns TrueFilter when either side is a TrueFilter, ensuring consistent and correct LogQL semantics.
Which issue(s) this PR fixes
Fixes #19523
Special notes for your reviewer
This change aligns OR filter behavior with how LogQL already treats empty string and empty regex branches individually ("" → TrueFilter). A small test was added to ensure empty-match OR behavior remains consistent going forward.
Checklist
- [x] Reviewed the
CONTRIBUTING.mdguide (required) - [ ] Documentation added
- [x] Tests updated
- [x] Title matches the required conventional commits format, see here
-
Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such,
featPRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
-
Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such,
- [ ] Changes that require user attention or interaction to upgrade are documented in
docs/sources/setup/upgrade/_index.md - [ ] If the change is deprecating or removing a configuration option, update the
deprecated-config.yamlanddeleted-config.yamlfiles respectively in thetools/deprecated-config-checkerdirectory. Example PR