test-regex: ability to specify config stream.filter instead of full regex

I am not really sure that I understand test-regex.

With fail2ban, I would create a log file with matches and not matches called /tmp/test.log or so.

cat /var/log/apache2/access.log | grep "Firefox/76.0" | tail -n 100 > /tmp/test.log
cat /var/log/apache2/access.log | grep -v "Firefox/76.0" | tail -n 100 >> /tmp/test.log

Then I would write a filter and run the filter on the log file.

fail2ban-regex /tmp/test.log /etc/fail2ban/filter.d/apache-ff76.conf | grep "Lines:"

If I get the config right, the output should look like this:

Lines: 200 lines, 0 ignored, 100 matched, 100 missed

reaction test-regex works differently which is fine, but I'm not entirely clear on the new workflow.

To check several lines, I get that I need to pipe and lines start with either no match: or matching ["<ip>"]: text. When piping, it gives the error no second argument: reading from stdin so I can direct stderr to /dev/null to skip that line.

Then reaction needs --config <CONFIG> <REGEX> so my command looks like this:

cat /tmp/reactiontest.log | reaction test-regex --config /etc/reaction/reaction.jsonnet '^<ip> - - \[.*\] "(GET|HEAD|POST) .+ HTTP/..." [0-9]+ [0-9]+ ".+" ".+Firefox/76\..+$' 2>/dev/null | grep -E '^.*matching' | wc -l

The output would be the number of matches. If it is 100 in this example, it would be correct. If I modified the <REGEX> on the command line, then I would copy it to the config.

What I would expect is to name the stream and filter in the config instead of pasting the <REGEX> on the command line. This would eliminate the need to copy and paste so much and reduce moments where human error could introduce a bug. Something like this:

cat /tmp/reactiontest.log | reaction test-regex --config /etc/reaction/reaction.jsonnet apache.ff76 2>/dev/null | grep -E '^.*matching' | wc -l

Or is that already possible in some way and I missed it?

BTW I am really enjoying using reaction so far in my tests and plan to migrate from fail2ban.

Edit: In expected behavior, separated stream and filter with a period and specified stream.

Edited by Michael McMahon