Extend Threshold Expression Support with SQL Functions and Boolean Evaluation Semantics

[bigcyy]

In the community, I’ve noticed that the current periodic threshold expression mechanism has introduced lexical and syntax parsers. However, the current design does not yet support SQL-style execution logic. Additionally, the existing behavior—where an alert is triggered as long as the expression result is non-empty—seems problematic. A more reasonable approach would be to require the threshold expression to return a boolean value to clearly determine whether an alert should be triggered.

Based on the above observations, I propose the following improvements:

• Introduce a __script__(...) lexical rule to support SQL-style function expressions;
• Add syntax-level support for function expressions, laying the groundwork for extending additional functions in the future;
• Improve the SQL execution logic to ensure its result can be used in threshold evaluation;
• Modify the alert trigger mechanism so that an alert is triggered only when the expression evaluates to true.

Suggestions for further improvement are welcome.

[bigcyy]

I will attempt to modify the lexer and parser to support expressions like:

• SQL execution: __script__("select * from table")
• PromQL execution: __script__("cpu{__field__='usage'}")

[tomsun28]

👍 relate pr #3406