feat: add logQlExpressionUsesFiltersFirst validator

Signed-off-by: Martin Chodur <m.chodur@seznam.cz>

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added: :tada: **Support for validation of Loki rules!** Now you can validate Loki rules as well. First two validators are:
    - `expressionIsValidLogQL` to check if the expression is a valid LogQL query
    - `logQlExpressionUsesRangeAggregation` to check if the LogQL expression uses range aggregation
+   - `logQlExpressionUsesFiltersFirst` t ocheck if the LogQL expression uses filters first in the query since it is more efficient
 - Added: support for alert field `keep_firing_for`
 - Added: support for the `query_offset` field in the rule group
 - Added: new validator `expressionIsValidPromQL` to check if the expression is a valid PromQL query

examples/loki/rules.yaml

@@ -4,3 +4,11 @@ groups:
   - name: group1
     remote_write:
       - url: http://localhost:1234
+    rules:
+      - alert: HighRequestLatency
+        expr: 'sum(rate({job="myjob"} |= "error" | logfmt [5m])) > 0.1'
+        for: 10m
+        labels:
+          severity: page
+        annotations:
+          summary: High error rate in logs

examples/loki/validation.yaml

@@ -4,3 +4,4 @@ validationRules:
     validations:
       - type: expressionIsValidLogQL
       - type: logQlExpressionUsesRangeAggregation
+      - type: logQlExpressionUsesFiltersFirst

pkg/validator/config.go

@@ -35,6 +35,7 @@ var registeredUniversalRuleValidators = map[string]validatorCreator{
 
 	"expressionIsValidLogQL":              newExpressionIsValidLogQL,
 	"logQlExpressionUsesRangeAggregation": newLogQLExpressionUsesRangeAggregation,
+	"logQlExpressionUsesFiltersFirst":     newlogQlExpressionUsesFiltersFirst,
 
 	"hasSourceTenantsForMetrics": newHasSourceTenantsForMetrics,
 }

pkg/validator/logql_expression.go

@@ -53,3 +53,45 @@ func (h logQLExpressionUsesRangeAggregation) Validate(_ unmarshaler.RuleGroup, r
 	}
 	return []error{fmt.Errorf("expression %s does not use any of the range aggregation which is required in rules, see https://grafana.com/docs/loki/latest/query/metric_queries/#log-range-aggregations", rule.Expr)}
 }
+
+func newlogQlExpressionUsesFiltersFirst(_ yaml.Node) (Validator, error) {
+	return &logQlExpressionUsesFiltersFirst{}, nil
+}
+
+type logQlExpressionUsesFiltersFirst struct{}
+
+func (h logQlExpressionUsesFiltersFirst) String() string {
+	return "LogQL expression should use a line filter expressions as first in the pipeline to optimize the query efficiency, see https://grafana.com/docs/loki/latest/query/log_queries/#line-filter-expression"
+}
+
+func (h logQlExpressionUsesFiltersFirst) Validate(_ unmarshaler.RuleGroup, rule rulefmt.Rule, _ *prometheus.Client) []error {
+	expr, err := syntax.ParseExpr(rule.Expr)
+	if err != nil {
+		return []error{fmt.Errorf("expression %s is not a valid LogQL query: %w", rule.Expr, err)}
+	}
+
+	filterAfterNonFilter := false
+	expr.Walk(func(e syntax.Expr) {
+		if _, ok := e.(*syntax.PipelineExpr); ok {
+			nonFilterEncountered := false
+			e.Walk(func(e syntax.Expr) {
+				switch e.(type) {
+				case *syntax.PipelineExpr:
+					return
+				case *syntax.MatchersExpr:
+					return
+				case *syntax.LineFilterExpr:
+					if nonFilterEncountered {
+						filterAfterNonFilter = true
+					}
+					return
+				}
+				nonFilterEncountered = true
+			})
+		}
+	})
+	if !filterAfterNonFilter {
+		return []error{}
+	}
+	return []error{fmt.Errorf("LogQL expression should use a line filter expressions as first in the pipeline to optimize the query efficiency: %s", rule.Expr)}
+}

pkg/validator/validator_test.go

@@ -261,6 +261,11 @@ var testCases = []struct {
 	// logQlExpressionUsesRangeAggregation
 	{name: "logQlExpressionUsesRangeAggregation_OK", validator: logQLExpressionUsesRangeAggregation{}, rule: rulefmt.Rule{Expr: `sum(rate({job="foo"} |= "foo"[1m]))`}, expectedErrors: 0},
 	{name: "logQlExpressionUsesRangeAggregation_Invalid", validator: logQLExpressionUsesRangeAggregation{}, rule: rulefmt.Rule{Expr: `{job="foo"} |= "foo"`}, expectedErrors: 1},
+
+	// logQlExpressionUsesFiltersFirst
+	{name: "logQlExpressionUsesFiltersFirst_OK", validator: logQlExpressionUsesFiltersFirst{}, rule: rulefmt.Rule{Expr: `{job="foo"} |= "foo" | logfmt`}, expectedErrors: 0},
+	{name: "logQlExpressionUsesFiltersFirst_Invalid", validator: logQlExpressionUsesFiltersFirst{}, rule: rulefmt.Rule{Expr: `{job="foo"} | logfmt |= "foo"`}, expectedErrors: 1},
+	{name: "logQlExpressionUsesFiltersFirst_Invalid", validator: logQlExpressionUsesFiltersFirst{}, rule: rulefmt.Rule{Expr: `{job="foo"} |= "foo" | logfmt |= "bar"`}, expectedErrors: 1},
 }
 
 func Test(t *testing.T) {