Add the ability to add multiple :filter-expr

[maxim-lbmv]

If you have multiple filters, you can quickly switch between them. For example, I have several applications that generate logs, I can add several filters :filter-expr :log_procname = 'syslogd' to display them all, or quickly disable filters for those that are not currently interesting. Editing one filter every time you need to add or remove messages from the log is not very fast.

Using :filter-in combinations it is difficult to achieve this effect, because you need to filter a specific field, in my case the process name. That is, if I simply write :filter-in syslogd, then the output will include all messages containing syslogd, and not just those generated by the syslogd process.

[tstack]

Support for multiple :filter-exprs introduces a lot of UX issues. Can you provide some suggestions on how the whole flow would work? For example:

• How are these separate expressions combined together? Are they OR'd together or AND'd or is the user allowed to combine them arbitrarily?
• Right now, the :filter-expr command will fill the prompt the current expression. Will that be removed?
• Does each expression have a name assigned to it by the user so that they can manipulate it?
• ...

[maxim-lbmv]

I think it's better to use the already existing :filter-in and :filter-out logic. Hence the answers to the questions.

How are these separate expressions combined together? Are they OR'd together or AND'd or is the user allowed to combine them arbitrarily?

They must be combined by OR, as happens with other filters

Right now, the :filter-expr command will fill the prompt the current expression. Will that be removed?

Yes, because the command creates a new filter

Does each expression have a name assigned to it by the user so that they can manipulate it?

Names are not needed, control is from the filters panel and the commands :delete-filter, :disable-filter, :enable-filter, etc.