Bug

Currently, the EvaluateTimestampFilter class does not properly handle matching against pure wildcards.

E.g. if "ts" is the authoritative timestamp then ts: * will crash because EvaluateTimestampFilter attempts to convert * to an integer.

The code has the following comment before it static casts the literal to Integral:

// this is safe after type narrowing because all DateType literals are either
// Integral or a derived class of Integral

The issue is that after type narrowing the literal is either Integral OR it is a pure wildcard stored as a string literal.

We should be able to fix this issue by adding a special case to the evaluation logic to check whether the literal predicate is a pure wildcard before attempting to convert it to an integer.

CLP version

v0.4.0

Environment

ubuntu jammy docker container

Reproduction steps

• Compress a log like {"ts": "123"} with --timestamp-key ts
• Execute the search query 'ts: *'