Feature: Flexible antispammer settings

[vadimalekseev]

Antispammer is the essence of the file.d that makes a decision on the need to parse the input log. It can be useful when any application writes logs at speed faster than File.d can read it.

Let's support flexible antispammer settings. Currently, all events pass through it and we cannot make exceptions . We must begin to separate important logs from the rest and give API to manage this behavior.

The new config will look like this:

pipelines:
  k8s:
    settings:
      antispam_threshold: 1000
      antispam_except:
        - condition: 'prefix'
          value: '{"error":true'
          case_insensitive: true

        - condition: 'contains'
          value: '"error":true'

        - condition: 'suffix'
          value: '"error":true}'
          case_insensitive: false

[vadimalekseev]

After discussion with colleagues, they came up with a temporary solution before introducing their own language:

pipelines:
  k8s:
    settings:
      antispam_threshold: 1000
      antispam_except:
        - cond: 'and'
          value:
            - func: 'prefix'
              value: ['{"error":"debug"']
              case_insensitive: true
              invert: true
            - func: 'contains'
              value: ['{"service":"alerts-agent"']
              case_insensitive: false
        - cond: 'and'
          value:
            - func: 'prefix'
              value: ['{"error":"debug"']
              case_insensitive: true
              invert: true

Related with #325