Implement filter in status, website and uri in CLI and Frontend

README.md

@@ -52,6 +52,7 @@ nginx-logtail/
     ├── frontend/
     │   ├── main.go
     │   ├── handler.go                 # URL param parsing, concurrent TopN+Trend, template exec
+    │   ├── filter.go                  # ParseFilterExpr / FilterExprString mini filter language
     │   ├── client.go                  # gRPC dial helper
     │   ├── sparkline.go               # TrendPoints → inline SVG polyline
     │   ├── format.go                  # fmtCount (space thousands separator)
@@ -145,11 +146,16 @@ and does not change any existing interface.
 ## Protobuf API (`proto/logtail.proto`)
 
 ```protobuf
+enum StatusOp { EQ = 0; NE = 1; GT = 2; GE = 3; LT = 4; LE = 5; }
+
 message Filter {
   optional string website          = 1;
   optional string client_prefix    = 2;
   optional string http_request_uri = 3;
   optional int32  http_response    = 4;
+  StatusOp        status_op        = 5;  // comparison operator for http_response
+  optional string website_regex    = 6;  // RE2 regex against website
+  optional string uri_regex        = 7;  // RE2 regex against http_request_uri
 }
 
 enum GroupBy { WEBSITE = 0; CLIENT_PREFIX = 1; REQUEST_URI = 2; HTTP_RESPONSE = 3; }
@@ -262,8 +268,16 @@ service LogtailService {
 
 ### handler.go
 - All filter state in the **URL query string**: `w` (window), `by` (group_by), `f_website`,
-  `f_prefix`, `f_uri`, `f_status`, `n`, `target`. No server-side session — URLs are shareable
-  and bookmarkable; multiple operators see independent views.
+  `f_prefix`, `f_uri`, `f_status`, `f_website_re`, `f_uri_re`, `n`, `target`. No server-side
+  session — URLs are shareable and bookmarkable; multiple operators see independent views.
+- **Filter expression box**: a `q=` parameter carries a mini filter language
+  (`status>=400 AND website~=gouda.* AND uri~=^/api/`). On submission the handler parses it
+  via `ParseFilterExpr` and redirects to the canonical URL with individual `f_*` params; `q=`
+  never appears in the final URL. Parse errors re-render the current page with an inline message.
+- **Status expressions**: `f_status` accepts `200`, `!=200`, `>=400`, `<500`, etc. — parsed by
+  `store.ParseStatusExpr` into `(value, StatusOp)` for the filter protobuf.
+- **Regex filters**: `f_website_re` and `f_uri_re` hold RE2 patterns; compiled once per request
+  into `store.CompiledFilter` before the query-loop iteration. Invalid regexes match nothing.
 - `TopN` and `Trend` RPCs issued **concurrently** (both with a 5 s deadline); page renders with
   whatever completes. Trend failure suppresses the sparkline without erroring the page.
 - **Drilldown**: clicking a table row adds the current dimension's filter and advances `by` through
@@ -304,7 +318,9 @@ logtail-cli stream  [flags]   live snapshot feed (runs until Ctrl-C, auto-reconn
 | `--website`  | —                | Filter: website                                          |
 | `--prefix`   | —                | Filter: client prefix                                    |
 | `--uri`      | —                | Filter: request URI                                      |
-| `--status`   | —                | Filter: HTTP status code                                 |
+| `--status`   | —                | Filter: HTTP status expression (`200`, `!=200`, `>=400`, `<500`, …) |
+| `--website-re`| —               | Filter: RE2 regex against website                        |
+| `--uri-re`   | —                | Filter: RE2 regex against request URI                    |
 
 **`topn` only**: `--n 10`, `--window 5m`, `--group-by website`
 
@@ -345,3 +361,6 @@ with a non-zero code on gRPC error.
 | CLI default: human-readable table | Operator-friendly by default; `--json` opt-in for scripting |
 | CLI multi-target fan-out | Compare a collector vs. aggregator, or two collectors, in one command |
 | CLI uses stdlib `flag`, no framework | Four subcommands don't justify a dependency |
+| Status filter as expression string (`!=200`, `>=400`) | Operator-friendly; parsed once at query boundary, encoded as `(int32, StatusOp)` in proto |
+| Regex filters compiled once per query (`CompiledFilter`) | Up to 288 × 5 000 per-entry calls — compiling per-entry would dominate query latency |
+| Filter expression box (`q=`) redirects to canonical URL | Filter state stays in individual `f_*` params; URLs remain shareable and bookmarkable |