LogQL IP Filtering

[frisbeeman]

Overview

Implement LogQL IP address filtering for both line filters and label filters.

Parent Issue

Part of #6 (Query Service Implementation), delegated from #8 (LogQL Query Compiler).

Context

IP filtering allows matching log lines or labels against IP addresses and CIDR ranges. Currently, IP filtering returns NotImplemented error in both line filters and label filters.

Requirements

IP Filter Syntax

Line Filter:

{job="app"} | ip("192.168.0.0/16")
{job="app"} !| ip("10.0.0.0/8")

Label Filter:

{job="app"} | json | ip_address = ip("192.168.1.0/24")
{job="app"} | logfmt | client_ip != ip("127.0.0.1")

Implementation Approach

1. Create ip_match UDF in src/query/logql/datafusion/udf.rs:

   • Signature: ip_match(ip_string: String, cidr: String) -> Boolean
   • Parse IP addresses and CIDR ranges
   • Support IPv4 and IPv6

2. Update line filter handling in planner.rs:

   • Detect IP filter expressions
   • Extract IP addresses from log lines using regex
   • Apply ip_match UDF

3. Update label filter handling in planner.rs:

   • Apply ip_match UDF to label values

Dependencies

• ipnetwork crate for IP/CIDR parsing

Acceptance Criteria

• Line filter with IP range works correctly
• Label filter with IP range works correctly
• IPv4 addresses and CIDR ranges are supported
• IPv6 addresses and CIDR ranges are supported
• Negation (!=, !|) works correctly
• Invalid IP addresses are handled gracefully
• Unit tests for IP matching logic
• Integration tests with full LogQL queries

Technical References

• LogQL IP Label Filter
• Current placeholder: src/query/logql/datafusion/planner.rs
• Technical spec: src/query/logql/TECHNICAL_SPEC.md Section 7.1.7