SUMMARY
The Syslog plugin currently relies on raw text inputs for 'sql' type rules and simple dropdowns for others. There is no visual interface to build complex, multi-condition logic without manual SQL knowledge.
WHY REFACTOR
Replacing raw SQL inputs with a visual builder improves user experience and is a prerequisite for the backend transition to JSON-based rules (Issue #284). It ensures that users can only construct valid, safe queries through a controlled interface.
PROPOSED CHANGE
Implement a client-side visual Filter Builder:
- Add a JavaScript component (
js/filter-builder.js) that allows users to add/remove rule rows.
- Provide dropdowns for allowed fields (
Host, Facility, Message, etc.) and operators.
- Serialize the visual state into a JSON string for storage in the existing
message column.
- Integrate the component into the Alert and Removal Rule edit pages.
SCOPE
- Client-side UI implementation in
js/filter-builder.js.
- Integration into
syslog_alerts.php and syslog_removal.php.
- Ensuring the UI handles both new JSON-based rules and displays a warning for legacy raw SQL rules.
SUMMARY
The Syslog plugin currently relies on raw text inputs for 'sql' type rules and simple dropdowns for others. There is no visual interface to build complex, multi-condition logic without manual SQL knowledge.
WHY REFACTOR
Replacing raw SQL inputs with a visual builder improves user experience and is a prerequisite for the backend transition to JSON-based rules (Issue #284). It ensures that users can only construct valid, safe queries through a controlled interface.
PROPOSED CHANGE
Implement a client-side visual Filter Builder:
js/filter-builder.js) that allows users to add/remove rule rows.Host,Facility,Message, etc.) and operators.messagecolumn.SCOPE
js/filter-builder.js.syslog_alerts.phpandsyslog_removal.php.