Description

References

• This is one of the PR series Kv-pair IR stream: Search implementation plan. #840.

Overview

This PR implements QueryHandler::evaluate_kv_pair_log_event method to evaluate a kv-pair log event against a search query using iterative DFS on the search AST.

With this PR, QueryHandler will be fully implemented and we can proceed to integrate the search feature into Deserializer.

Checklist

• The PR satisfies the contribution guidelines.
• This is a breaking change and that has been indicated in the PR title, OR this isn't a
  breaking change.
• Necessary docs have been updated, OR no docs need to be updated.

Validation performed

• Ensure all workflows passed.
• Add new unit test cases to cover basic evaluation behaviour.

Summary by CodeRabbit

• New Features
  • Introduced comprehensive evaluation of search queries, supporting logical operators, filter expressions, and wildcard handling for log events.
  • Added detailed AST traversal and evaluation framework with improved query processing.
  • Added a new iterator-based approach for AST evaluation with explicit stack management.
• Bug Fixes
  • Improved error handling with new error codes for AST evaluation issues and invalid operations.
• Refactor
  • Simplified and consolidated query evaluation interfaces for easier use and maintenance.
  • Replaced separate node-ID-value pair evaluation with unified log event evaluation method.
  • Updated enum handling for evaluation results to support bitmask operations.
• Tests
  • Updated tests to reflect changes in query handling and input expectations.
  • Added new test cases verifying evaluation of key-value pair log events against queries.
• Chores
  • Refined utility functions for encoding and AST construction in tests.