test-regex: ability to specify config stream.filter instead of full regex
I am not really sure that I understand test-regex.
With fail2ban, I would create a log file with matches and not matches called /tmp/test.log or so.
cat /var/log/apache2/access.log | grep "Firefox/76.0" | tail -n 100 > /tmp/test.log
cat /var/log/apache2/access.log | grep -v "Firefox/76.0" | tail -n 100 >> /tmp/test.log
Then I would write a filter and run the filter on the log file.
fail2ban-regex /tmp/test.log /etc/fail2ban/filter.d/apache-ff76.conf | grep "Lines:"
If I get the config right, the output should look like this:
Lines: 200 lines, 0 ignored, 100 matched, 100 missed
reaction test-regex works differently which is fine, but I'm not entirely clear on the new workflow.
To check several lines, I get that I need to pipe and lines start with either no match: or matching ["<ip>"]: text. When piping, it gives the error no second argument: reading from stdin so I can direct stderr to /dev/null to skip that line.
Then reaction needs --config <CONFIG> <REGEX> so my command looks like this:
cat /tmp/reactiontest.log | reaction test-regex --config /etc/reaction/reaction.jsonnet '^<ip> - - \[.*\] "(GET|HEAD|POST) .+ HTTP/..." [0-9]+ [0-9]+ ".+" ".+Firefox/76\..+$' 2>/dev/null | grep -E '^.*matching' | wc -l
The output would be the number of matches. If it is 100 in this example, it would be correct. If I modified the <REGEX> on the command line, then I would copy it to the config.
What I would expect is to name the stream and filter in the config instead of pasting the <REGEX> on the command line. This would eliminate the need to copy and paste so much and reduce moments where human error could introduce a bug. Something like this:
cat /tmp/reactiontest.log | reaction test-regex --config /etc/reaction/reaction.jsonnet apache.ff76 2>/dev/null | grep -E '^.*matching' | wc -l
Or is that already possible in some way and I missed it?
BTW I am really enjoying using reaction so far in my tests and plan to migrate from fail2ban.
Edit: In expected behavior, separated stream and filter with a period and specified stream.