Merge pull request #202 from spq/query_regex_then

Fix referencing query data conditions before they are added

internal/index/search_data.go

@@ -127,6 +127,7 @@ func (dcc *dataConditionsContainer) add(cc *query.DataCondition, subQuery string
 	if affectsSubquery {
 		return errors.New("SubQueries not yet fully supported")
 	}
+	dcc.conditions = append(dcc.conditions, cc)
 regexElements:
 	for eIdx, e := range cc.Elements {
 		for rIdx := range dcc.regexes {
@@ -140,7 +141,7 @@ regexElements:
 				continue
 			}
 			r.occurence = append(r.occurence, occ{
-				condition: len(dcc.conditions),
+				condition: len(dcc.conditions) - 1,
 				element:   eIdx,
 			})
 			continue regexElements
@@ -164,12 +165,11 @@ regexElements:
 		}
 		dcc.regexes = append(dcc.regexes, regex{
 			occurence: []occ{{
-				condition: len(dcc.conditions),
+				condition: len(dcc.conditions) - 1,
 				element:   eIdx,
 			}},
 		})
 	}
-	dcc.conditions = append(dcc.conditions, cc)
 	return nil
 }
 

internal/index/search_test.go

@@ -319,6 +319,15 @@ func TestSearchStreams(t *testing.T) {
 			"@sub:id:0,1 @sub:cdata:\"(?P<var>needle[0-9])\" cdata:@sub:var@ id:2",
 			[]uint64{2},
 		},
+		{
+			"test sequence of data connected using then",
+			[]streamInfo{
+				makeStream("192.168.0.100:123", "192.168.0.1:80", t1.Add(time.Hour*1), []string{"needle1", "needle2", "needle3"}),
+				makeStream("192.168.0.100:234", "192.168.0.1:80", t1.Add(time.Hour*2), []string{"needle2", "needle3", "needle1"}),
+			},
+			"cdata:needle1 then sdata:needle2",
+			[]uint64{0},
+		},
 		{
 			"test protocol:tcp query",
 			[]streamInfo{