From 975ed27a76d136fb3fa5a20bd437e1c534cc4b7a Mon Sep 17 00:00:00 2001
From: jackyin <yincong@baidu.com>
Date: Tue, 3 Sep 2024 16:17:44 +0800
Subject: [PATCH] lib/logstorage: `and` filter results in unexpected response
 (#6556)

fix #6554
andfilter shouldn't return orfilter field which result in bloomfilter
return false.

---------

Co-authored-by: hagen1778 <roman@victoriametrics.com>
---
 docs/VictoriaLogs/CHANGELOG.md    |  1 +
 lib/logstorage/filter_and.go      |  9 ++++-----
 lib/logstorage/filter_and_test.go | 24 +++++++++++++++++++++++-
 3 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/docs/VictoriaLogs/CHANGELOG.md b/docs/VictoriaLogs/CHANGELOG.md
index 8ca8dfe34..bdd02ecf2 100644
--- a/docs/VictoriaLogs/CHANGELOG.md
+++ b/docs/VictoriaLogs/CHANGELOG.md
@@ -27,6 +27,7 @@ according to [these docs](https://docs.victoriametrics.com/victorialogs/quicksta
 
 * BUGFIX: properly handle Logstash requests for Elasticsearch configuration when using `outputs.elasticsearch` in Logstash pipelines. Previously, the requests could be rejected with `400 Bad Request` response. Updates [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/4750).
 * BUGFIX: [vmui](https://docs.victoriametrics.com/#vmui): fix `not found index.js` error when loading vmui in VictoriaLogs. See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6764). Thanks to @yincongcyincong for the [pull request](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/6770).
+* BUGFIX: fix filtering when logical operators `AND` and `OR` are used in query expression. See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6554) for details. Thanks to @yincongcyincong for the [pull request](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/6556). 
 
 ## [v0.28.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v0.28.0-victorialogs)
 
diff --git a/lib/logstorage/filter_and.go b/lib/logstorage/filter_and.go
index 513d3e23b..1ad922c1f 100644
--- a/lib/logstorage/filter_and.go
+++ b/lib/logstorage/filter_and.go
@@ -112,6 +112,10 @@ func (fa *filterAnd) getByFieldTokens() []fieldTokens {
 	return fa.byFieldTokens
 }
 
+// https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6554
+// and filter shouldn't return or filter which result in
+// bloom filter execute error interception.
+// detail see: https://github.com/VictoriaMetrics/VictoriaMetrics/pull/6556#issuecomment-2323643507
 func (fa *filterAnd) initByFieldTokens() {
 	m := make(map[string]map[string]struct{})
 	var fieldNames []string
@@ -153,11 +157,6 @@ func (fa *filterAnd) initByFieldTokens() {
 		case *filterSequence:
 			tokens := t.getTokens()
 			mergeFieldTokens(t.fieldName, tokens)
-		case *filterOr:
-			bfts := t.getByFieldTokens()
-			for _, bft := range bfts {
-				mergeFieldTokens(bft.field, bft.tokens)
-			}
 		}
 	}
 
diff --git a/lib/logstorage/filter_and_test.go b/lib/logstorage/filter_and_test.go
index db448490e..080ed790b 100644
--- a/lib/logstorage/filter_and_test.go
+++ b/lib/logstorage/filter_and_test.go
@@ -25,7 +25,7 @@ func TestFilterAnd(t *testing.T) {
 		},
 	}
 
-	// non-empty intersection
+	//non-empty intersection
 	fa := &filterAnd{
 		filters: []filter{
 			&filterPhrase{
@@ -114,4 +114,26 @@ func TestFilterAnd(t *testing.T) {
 		},
 	}
 	testFilterMatchForColumns(t, columns, fa, "foo", nil)
+
+	fa = &filterAnd{
+		filters: []filter{
+			&filterPrefix{
+				fieldName: "foo",
+				prefix:    "a foo",
+			},
+			&filterOr{
+				filters: []filter{
+					&filterExact{
+						fieldName: "foo",
+						value:     "a foobar",
+					},
+					&filterExact{
+						fieldName: "boo",
+						value:     "bbbbbbb",
+					},
+				},
+			},
+		},
+	}
+	testFilterMatchForColumns(t, columns, fa, "foo", []int{1})
 }