loki icon indicating copy to clipboard operation
loki copied to clipboard

fix(logql): correct OR filter behavior when one side is a TrueFilter

Open Kim-Yukyung opened this issue 1 month ago • 0 comments

What this PR does / why we need it

This PR fixes incorrect OR behavior in LogQL line filters when one side contains an empty match. Previously, expressions such as {app="foo"} |= "notfound" or "" or regex patterns like (notfound|) incorrectly evaluated to false, even though the empty branch should act as a TrueFilter.

The fix updates newOrFilter so that the OR operation returns TrueFilter when either side is a TrueFilter, ensuring consistent and correct LogQL semantics.

Which issue(s) this PR fixes

Fixes #19523

Special notes for your reviewer

This change aligns OR filter behavior with how LogQL already treats empty string and empty regex branches individually ("" → TrueFilter). A small test was added to ensure empty-match OR behavior remains consistent going forward.

Checklist

  • [x] Reviewed the CONTRIBUTING.md guide (required)
  • [ ] Documentation added
  • [x] Tests updated
  • [x] Title matches the required conventional commits format, see here
    • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
  • [ ] Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
  • [ ] If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR

Kim-Yukyung avatar Dec 06 '25 08:12 Kim-Yukyung