lib/logstorage: and filter results in unexpected response (#6556)

fix #6554
andfilter shouldn't return orfilter field which result in bloomfilter
return false.

---------

Co-authored-by: hagen1778 <roman@victoriametrics.com>

docs/VictoriaLogs/CHANGELOG.md

@@ -27,6 +27,7 @@ according to [these docs](https://docs.victoriametrics.com/victorialogs/quicksta
 
 * BUGFIX: properly handle Logstash requests for Elasticsearch configuration when using `outputs.elasticsearch` in Logstash pipelines. Previously, the requests could be rejected with `400 Bad Request` response. Updates [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/4750).
 * BUGFIX: [vmui](https://docs.victoriametrics.com/#vmui): fix `not found index.js` error when loading vmui in VictoriaLogs. See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6764). Thanks to @yincongcyincong for the [pull request](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/6770).
+* BUGFIX: fix filtering when logical operators `AND` and `OR` are used in query expression. See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6554) for details. Thanks to @yincongcyincong for the [pull request](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/6556). 
 
 ## [v0.28.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v0.28.0-victorialogs)
 

lib/logstorage/filter_and.go

@@ -112,6 +112,10 @@ func (fa *filterAnd) getByFieldTokens() []fieldTokens {
 	return fa.byFieldTokens
 }
 
+// https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6554
+// and filter shouldn't return or filter which result in
+// bloom filter execute error interception.
+// detail see: https://github.com/VictoriaMetrics/VictoriaMetrics/pull/6556#issuecomment-2323643507
 func (fa *filterAnd) initByFieldTokens() {
 	m := make(map[string]map[string]struct{})
 	var fieldNames []string
@@ -153,11 +157,6 @@ func (fa *filterAnd) initByFieldTokens() {
 		case *filterSequence:
 			tokens := t.getTokens()
 			mergeFieldTokens(t.fieldName, tokens)
-		case *filterOr:
-			bfts := t.getByFieldTokens()
-			for _, bft := range bfts {
-				mergeFieldTokens(bft.field, bft.tokens)
-			}
 		}
 	}
 

lib/logstorage/filter_and_test.go

@@ -25,7 +25,7 @@ func TestFilterAnd(t *testing.T) {
 		},
 	}
 
-	// non-empty intersection
+	//non-empty intersection
 	fa := &filterAnd{
 		filters: []filter{
 			&filterPhrase{
@@ -114,4 +114,26 @@ func TestFilterAnd(t *testing.T) {
 		},
 	}
 	testFilterMatchForColumns(t, columns, fa, "foo", nil)
+
+	fa = &filterAnd{
+		filters: []filter{
+			&filterPrefix{
+				fieldName: "foo",
+				prefix:    "a foo",
+			},
+			&filterOr{
+				filters: []filter{
+					&filterExact{
+						fieldName: "foo",
+						value:     "a foobar",
+					},
+					&filterExact{
+						fieldName: "boo",
+						value:     "bbbbbbb",
+					},
+				},
+			},
+		},
+	}
+	testFilterMatchForColumns(t, columns, fa, "foo", []int{1})
 }