logging: remote filtering expressions

[Brian Warner]

It would be great if tools like 'flogtool tail' could subscribe to less than the full event stream. The most generalized approach I can think of is to pass a filtering expression to the far end, but Python is not E, and this is not safe. However, we could define a simple stack-based language, and compile the filtering expression into the opcodes of this language, and then evaluate the filtering program for each event.

It might not be feasible to actually compile the python expression into that language, but it might be simple enough for users to write the opcodes directly.

I'm thinking things like:

• compare(GT, e.level, 20)
• AND(top two items on the stack)
• OR
• NOT
• SWAP

things like that. A basic "A and B and C" test would be:

• compare(A)
• compare(B)
• compare(C)
• AND
• AND