Fix the Seq built-in property name filter translation

Author: nblumhardt

src/SeqCli/Cli/Commands/IngestCommand.cs

@@ -20,6 +20,7 @@
 using SeqCli.Ingestion;
 using SeqCli.Levels;
 using SeqCli.PlainText;
+using SeqCli.Syntax;
 using Serilog;
 using Serilog.Core;
 using Serilog.Events;
@@ -92,11 +93,7 @@ protected override async Task<int> Run()
             Func<LogEvent, bool>? filter = null;
             if (_filter != null)
             {
-                // Support non-Serilog level names (`@l` can't be overridden by the name resolver). At a later date,
-                // we hope to be able to use the Serilog.Expressions AST to do this reliably (at the moment, all occurrences
-                // of @l, whether referring to the property or not, will be replaced).
-                var expr = _filter.Replace("@l", "@Level").Replace("@Level", $"coalesce(@p['{SurrogateLevelProperty.PropertyName}'],@l)");
-                var eval = SerilogExpression.Compile(expr, nameResolver: new SeqBuiltInNameResolver());
+                var eval = SeqSyntax.CompileExpression(_filter);
                 filter = evt => ExpressionResult.IsTrue(eval(evt));
             }
 

…qCli/Ingestion/SeqBuiltInNameResolver.cs …/SeqCli/Syntax/SeqBuiltInNameResolver.cssrc/SeqCli/Ingestion/SeqBuiltInNameResolver.cs renamed to src/SeqCli/Syntax/SeqBuiltInNameResolver.cs src/SeqCli/Ingestion/SeqBuiltInNameResolver.cs renamed to src/SeqCli/Syntax/SeqBuiltInNameResolver.cs

@@ -15,9 +15,7 @@
 using System.Diagnostics.CodeAnalysis;
 using Serilog.Expressions;
 
-#nullable enable
-
-namespace SeqCli.Ingestion;
+namespace SeqCli.Syntax;
 
 /// <summary>
 /// Extends Serilog.Expressions with support for commonly-used Seq property names.
@@ -30,26 +28,26 @@ public override bool TryResolveBuiltInPropertyName(string alias, [NotNullWhen(tr
     {
         switch (alias)
         {
-            case "@Properties":
-                target = "@p";
+            case "Properties":
+                target = "p";
                 return true;
-            case "@Timestamp":
-                target = "@t";
+            case "Timestamp":
+                target = "t";
                 return true;
-            case "@Level":
-                target = "@l";
+            case "Level":
+                target = "l";
                 return true;
-            case "@Message":
-                target = "@m";
+            case "Message":
+                target = "m";
                 return true;
-            case "@MessageTemplate":
-                target = "@mt";
+            case "MessageTemplate":
+                target = "mt";
                 return true;
-            case "@EventType":
-                target = "@i";
+            case "EventType":
+                target = "i";
                 return true;
-            case "@Exception":
-                target = "@x";
+            case "Exception":
+                target = "x";
                 return true;
             default:
                 target = null;

src/SeqCli/Syntax/SeqSyntax.cs

@@ -0,0 +1,16 @@
+using SeqCli.Levels;
+using Serilog.Expressions;
+
+namespace SeqCli.Syntax;
+
+static class SeqSyntax
+{
+    public static CompiledExpression CompileExpression(string expression)
+    {
+        // Support non-Serilog level names (`@l` can't be overridden by the name resolver). At a later date,
+        // we'll use the Seq.Syntax package to do this reliably (at the moment, all occurrences
+        // of @l, whether referring to the property or not, will be replaced).
+        var expr = expression.Replace("@l", "@Level").Replace("@Level", $"coalesce(@p['{SurrogateLevelProperty.PropertyName}'],@l)");
+        return SerilogExpression.Compile(expr, nameResolver: new SeqBuiltInNameResolver());
+    }
+}

test/SeqCli.Tests/Syntax/SeqSyntaxTests.cs

@@ -0,0 +1,38 @@
+using System;
+using System.Linq;
+using SeqCli.Levels;
+using SeqCli.Syntax;
+using Serilog.Events;
+using Serilog.Parsing;
+using Xunit;
+
+namespace SeqCli.Tests.Syntax;
+
+public class SeqSyntaxTests
+{
+    [Fact]
+    public void MessageIsExposed()
+    {
+        var evt = new LogEvent(DateTimeOffset.Now, LogEventLevel.Information, null,
+            new MessageTemplateParser().Parse("Hello"), ArraySegment<LogEventProperty>.Empty);
+        
+        var expr = SeqSyntax.CompileExpression("@Message");
+        var result = expr(evt);
+        var scalar = Assert.IsType<ScalarValue>(result);
+        Assert.Equal("Hello", scalar.Value);
+    }
+    
+    [Fact]
+    public void SurrogateLevelIsExposed()
+    {
+        var evt = new LogEvent(DateTimeOffset.Now, LogEventLevel.Information, null, new MessageTemplate(Enumerable.Empty<MessageTemplateToken>()), new[]
+        {
+            new LogEventProperty(SurrogateLevelProperty.PropertyName, new ScalarValue("Warning"))
+        });
+        
+        var expr = SeqSyntax.CompileExpression("@Level");
+        var result = expr(evt);
+        var scalar = Assert.IsType<ScalarValue>(result);
+        Assert.Equal("Warning", scalar.Value);
+    }
+}