[improve] update

Signed-off-by: tomsun28 <tomsun28@outlook.com>

.all-contributorsrc

@@ -2397,6 +2397,15 @@
       "contributions": [
         "code"
       ]
+    },
+    {
+      "login": "KevinLLF",
+      "name": "Jay丿167",
+      "avatar_url": "https://avatars.githubusercontent.com/u/85452733?v=4",
+      "profile": "https://github.com/KevinLLF",
+      "contributions": [
+        "code"
+      ]
     }
   ],
   "contributorsPerLine": 7,

README.md

@@ -520,6 +520,7 @@ Thanks to these wonderful people, welcome to join us:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/gagaradio"><img src="https://avatars.githubusercontent.com/u/18532370?v=4?s=100" width="100px;" alt="Walter Jia"/><br /><sub><b>Walter Jia</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=gagaradio" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/boyucjz"><img src="https://avatars.githubusercontent.com/u/18730041?v=4?s=100" width="100px;" alt="boyucjz"/><br /><sub><b>boyucjz</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=boyucjz" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/Cyanty"><img src="https://avatars.githubusercontent.com/u/153884653?v=4?s=100" width="100px;" alt="Cyanty"/><br /><sub><b>Cyanty</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=Cyanty" title="Code">💻</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/KevinLLF"><img src="https://avatars.githubusercontent.com/u/85452733?v=4?s=100" width="100px;" alt="Jay丿167"/><br /><sub><b>Jay丿167</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=KevinLLF" title="Code">💻</a></td>
     </tr>
   </tbody>
 </table>

README_CN.md

@@ -519,6 +519,7 @@ Thanks these wonderful people, welcome to join us:
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/gagaradio"><img src="https://avatars.githubusercontent.com/u/18532370?v=4?s=100" width="100px;" alt="Walter Jia"/><br /><sub><b>Walter Jia</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=gagaradio" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/boyucjz"><img src="https://avatars.githubusercontent.com/u/18730041?v=4?s=100" width="100px;" alt="boyucjz"/><br /><sub><b>boyucjz</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=boyucjz" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/Cyanty"><img src="https://avatars.githubusercontent.com/u/153884653?v=4?s=100" width="100px;" alt="Cyanty"/><br /><sub><b>Cyanty</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=Cyanty" title="Code">💻</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/KevinLLF"><img src="https://avatars.githubusercontent.com/u/85452733?v=4?s=100" width="100px;" alt="Jay丿167"/><br /><sub><b>Jay丿167</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=KevinLLF" title="Code">💻</a></td>
     </tr>
   </tbody>
 </table>

hertzbeat-alerter/src/main/java/org/apache/hertzbeat/alert/expr/AlertExpressionBaseVisitor.java

@@ -0,0 +1,113 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Generated from AlertExpression.g4 by ANTLR 4.13.2
+
+package org.apache.hertzbeat.alert.expr;
+
+import org.antlr.v4.runtime.tree.AbstractParseTreeVisitor;
+
+/**
+ * This class provides an empty implementation of {@link AlertExpressionVisitor},
+ * which can be extended to create a visitor which only needs to handle a subset
+ * of the available methods.
+ *
+ * @param <T> The return type of the visit operation. Use {@link Void} for
+ * operations with no return type.
+ */
+@SuppressWarnings("CheckReturnValue")
+public class AlertExpressionBaseVisitor<T> extends AbstractParseTreeVisitor<T> implements AlertExpressionVisitor<T> {
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The default implementation returns the result of calling
+     * {@link #visitChildren} on {@code ctx}.</p>
+     */
+    @Override public T visitExpression(AlertExpressionParser.ExpressionContext ctx) { return visitChildren(ctx); }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The default implementation returns the result of calling
+     * {@link #visitChildren} on {@code ctx}.</p>
+     */
+    @Override public T visitAndExpr(AlertExpressionParser.AndExprContext ctx) { return visitChildren(ctx); }
+
+    /**
+	 * {@inheritDoc}
+	 *
+	 * <p>The default implementation returns the result of calling
+	 * {@link #visitChildren} on {@code ctx}.</p>
+	 */
+    @Override public T visitQueryExpr(AlertExpressionParser.QueryExprContext ctx) { return visitChildren(ctx); }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The default implementation returns the result of calling
+     * {@link #visitChildren} on {@code ctx}.</p>
+     */
+    @Override public T visitComparisonExpr(AlertExpressionParser.ComparisonExprContext ctx) { return visitChildren(ctx); }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The default implementation returns the result of calling
+     * {@link #visitChildren} on {@code ctx}.</p>
+     */
+    @Override public T visitUnlessExpr(AlertExpressionParser.UnlessExprContext ctx) { return visitChildren(ctx); }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The default implementation returns the result of calling
+     * {@link #visitChildren} on {@code ctx}.</p>
+     */
+    @Override public T visitLiteralExpr(AlertExpressionParser.LiteralExprContext ctx) { return visitChildren(ctx); }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The default implementation returns the result of calling
+     * {@link #visitChildren} on {@code ctx}.</p>
+     */
+    @Override public T visitParenExpr(AlertExpressionParser.ParenExprContext ctx) { return visitChildren(ctx); }
+
+    /**
+	 * {@inheritDoc}
+     *
+     * <p>The default implementation returns the result of calling
+     * {@link #visitChildren} on {@code ctx}.</p>
+     */
+    @Override public T visitOrExpr(AlertExpressionParser.OrExprContext ctx) { return visitChildren(ctx); }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The default implementation returns the result of calling
+     * {@link #visitChildren} on {@code ctx}.</p>
+     */
+    @Override public T visitIdentifier(AlertExpressionParser.IdentifierContext ctx) { return visitChildren(ctx); }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The default implementation returns the result of calling
+     * {@link #visitChildren} on {@code ctx}.</p>
+     */
+    @Override public T visitNumber(AlertExpressionParser.NumberContext ctx) { return visitChildren(ctx); }
+}

hertzbeat-alerter/src/main/java/org/apache/hertzbeat/alert/expr/AlertExpressionEvalVisitor.java

@@ -0,0 +1,305 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hertzbeat.alert.expr;
+
+import org.apache.hertzbeat.warehouse.db.QueryExecutor;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Alert expression visitor implement
+ */
+public class AlertExpressionEvalVisitor extends AlertExpressionBaseVisitor<List<Map<String, Object>>> {
+
+    private static final String THRESHOLD = "__threshold__";
+    private static final String VALUE = "__value__";
+
+    private final QueryExecutor executor;
+
+    public AlertExpressionEvalVisitor(QueryExecutor executor) {
+        this.executor = executor;
+    }
+
+    @Override
+    public List<Map<String, Object>> visitExpression(AlertExpressionParser.ExpressionContext ctx) {
+        return visit(ctx.expr());
+    }
+
+    @Override
+    public List<Map<String, Object>> visitParenExpr(AlertExpressionParser.ParenExprContext ctx) {
+        return visit(ctx.expr());
+    }
+
+    @Override
+    public List<Map<String, Object>> visitComparisonExpr(AlertExpressionParser.ComparisonExprContext ctx) {
+        List<Map<String, Object>> leftResult = visit(ctx.left);
+        List<Map<String, Object>> rightResult = visit(ctx.right);
+        if (rightResult.size() == 1 && rightResult.get(0).containsKey(THRESHOLD)) {
+            double threshold = (double) rightResult.get(0).get(THRESHOLD);
+            String operator = ctx.op.getText();
+
+            List<Map<String, Object>> result = new ArrayList<>();
+            for (Map<String, Object> item : leftResult) {
+                Object queryValues = item.get(VALUE);
+                if (queryValues == null) {
+                    // ignore the query result data is empty
+                    continue;
+                }
+                // queryValues may be a list of values, or a single value
+                Object matchValue = evaluateCondition(queryValues, operator, threshold);
+                item.put(VALUE, matchValue);
+                // if matchValue is null, mean not match the threshold
+                // if not null, mean match the threshold
+                result.add(new HashMap<>(item));
+            }
+            return result;
+        }
+        return new LinkedList<>();
+    }
+
+    @Override
+    public List<Map<String, Object>> visitAndExpr(AlertExpressionParser.AndExprContext ctx) {
+        List<Map<String, Object>> leftOperand = visit(ctx.left);
+        List<Map<String, Object>> rightOperand = visit(ctx.right);
+
+        Map<String, Object> leftMap = null;
+        boolean leftMatch = false;
+        Map<String, Object> rightMap = null;
+        boolean rightMatch = false;
+        for (Map<String, Object> item : leftOperand) {
+            if (leftMap == null) {
+                leftMap = item;
+            }
+            if (item.get(VALUE) != null) {
+                leftMap = item;
+                leftMatch = true;
+                break;
+            }
+        }
+        for (Map<String, Object> item : rightOperand) {
+            if (rightMap == null) {
+                rightMap = item;
+            }
+            if (item.get(VALUE) != null) {
+                rightMap = item;
+                rightMatch = true;
+                break;
+            }
+        }
+        if (leftMatch && rightMatch) {
+            rightMap.putAll(leftMap);
+            return new LinkedList<>(List.of(rightMap));
+        } else if (leftMap != null) {
+            leftMap.put(VALUE, null);
+            return new LinkedList<>(List.of(leftMap));
+        } else if (rightMap != null) {
+            rightMap.put(VALUE, null);
+            return new LinkedList<>(List.of(rightMap));
+        }
+        return new LinkedList<>();
+    }
+
+    @Override
+    public List<Map<String, Object>> visitOrExpr(AlertExpressionParser.OrExprContext ctx) {
+        List<Map<String, Object>> leftOperand = visit(ctx.left);
+        List<Map<String, Object>> rightOperand = visit(ctx.right);
+
+        Map<String, Object> leftMap = null;
+        boolean leftMatch = false;
+        Map<String, Object> rightMap = null;
+        boolean rightMatch = false;
+        for (Map<String, Object> item : leftOperand) {
+            if (leftMap == null) {
+                leftMap = item;
+            }
+            if (item.get(VALUE) != null) {
+                leftMap = item;
+                leftMatch = true;
+                break;
+            }
+        }
+        for (Map<String, Object> item : rightOperand) {
+            if (rightMap == null) {
+                rightMap = item;
+            }
+            if (item.get(VALUE) != null) {
+                rightMap = item;
+                rightMatch = true;
+                break;
+            }
+        }
+        if (leftMatch && rightMatch) {
+            rightMap.putAll(leftMap);
+            return new LinkedList<>(List.of(rightMap));
+        } else if (leftMatch) {
+            return new LinkedList<>(List.of(leftMap));
+        } else if (rightMatch) {
+            return new LinkedList<>(List.of(rightMap));
+        } else {
+            if (leftMap != null && rightMap != null) {
+                rightMap.putAll(leftMap);
+                return new LinkedList<>(List.of(rightMap));
+            } else if (leftMap != null) {
+                return new LinkedList<>(List.of(leftMap));
+            } else if (rightMap != null) {
+                return new LinkedList<>(List.of(rightMap));
+            }
+        }
+        return new LinkedList<>();
+    }
+
+    @Override
+    public List<Map<String, Object>> visitUnlessExpr(AlertExpressionParser.UnlessExprContext ctx) {
+        List<Map<String, Object>> leftOperand = visit(ctx.left);
+        List<Map<String, Object>> rightOperand = visit(ctx.right);
+        Map<String, Object> leftMap = null;
+        boolean leftMatch = false;
+        Map<String, Object> rightMap = null;
+        boolean rightMatch = false;
+        for (Map<String, Object> item : leftOperand) {
+            if (leftMap == null) {
+                leftMap = item;
+            }
+            if (item.get(VALUE) != null) {
+                leftMap = item;
+                leftMatch = true;
+                break;
+            }
+        }
+        for (Map<String, Object> item : rightOperand) {
+            if (rightMap == null) {
+                rightMap = item;
+            }
+            if (item.get(VALUE) != null) {
+                rightMap = item;
+                rightMatch = true;
+                break;
+            }
+        }
+        if (leftMatch && !rightMatch) {
+            return new LinkedList<>(List.of(leftMap));
+        } else {
+            if (leftMap != null) {
+                leftMap.put(VALUE, null);
+                return new LinkedList<>(List.of(leftMap));
+            } else {
+                if (rightMap != null) {
+                    rightMap.put(VALUE, null);
+                    return new LinkedList<>(List.of(rightMap));
+                }
+            }
+        }
+        return new LinkedList<>();
+    }
+
+    @Override
+    public List<Map<String, Object>> visitQueryExpr(AlertExpressionParser.QueryExprContext ctx) {
+        String query = ctx.identifier().getText();
+        return executor.execute(query);
+    }
+
+    @Override
+    public List<Map<String, Object>> visitLiteralExpr(AlertExpressionParser.LiteralExprContext ctx) {
+        double value = Double.parseDouble(ctx.number().getText());
+        List<Map<String, Object>> numAsList = new ArrayList<>();
+        Map<String, Object> valueMap = new HashMap<>();
+        valueMap.put(THRESHOLD, value);
+        numAsList.add(valueMap);
+        return numAsList;
+    }
+
+    private Object evaluateCondition(Object value, String operator, Double threshold) {
+        // value may be a list of values, or a single value
+        switch (operator) {
+            case ">":
+                // if value is list, return the max value
+                if (value instanceof List<?> values) {
+                    Double doubleValue = values.stream().map(v -> Double.valueOf(v.toString())).max(Double::compareTo).orElse(null);
+                    if (doubleValue != null) {
+                        return doubleValue > threshold ? doubleValue : null;
+                    } else {
+                        return null;
+                    }
+                } else {
+                    return Double.parseDouble(value.toString()) > threshold ? value : null;
+                }
+            case ">=":
+                if (value instanceof List<?> values) {
+                    Double doubleValue = values.stream().map(v -> Double.valueOf(v.toString())).max(Double::compareTo).orElse(null);
+                    if (doubleValue != null) {
+                        return doubleValue >= threshold ? doubleValue : null;
+                    } else {
+                        return null;
+                    }
+                } else {
+                    return Double.parseDouble(value.toString()) >= threshold ? value : null;
+                }
+            case "<":
+                if (value instanceof List<?> values) {
+                    Double doubleValue = values.stream().map(v -> Double.valueOf(v.toString())).min(Double::compareTo).orElse(null);
+                    if (doubleValue != null) {
+                        return doubleValue < threshold ? doubleValue : null;
+                    } else {
+                        return null;
+                    }
+                } else {
+                    return Double.parseDouble(value.toString()) < threshold ? value : null;
+                }
+            case "<=":
+                if (value instanceof List<?> values) {
+                    Double doubleValue = values.stream().map(v -> Double.valueOf(v.toString())).min(Double::compareTo).orElse(null);
+                    if (doubleValue != null) {
+                        return doubleValue <= threshold ? doubleValue : null;
+                    } else {
+                        return null;
+                    }
+                } else {
+                    return Double.parseDouble(value.toString()) <= threshold ? value : null;
+                }
+            case "==":
+                if (value instanceof List<?> values) {
+                    for (Object v : values) {
+                        if (v.equals(threshold)) {
+                            return v;
+                        }
+                    }
+                    return null;
+                } else {
+                    return value.equals(threshold) ? value : null;
+                }
+            case "!=":
+                if (value instanceof List<?> values) {
+                    for (Object v : values) {
+                        if (v.equals(threshold)) {
+                            return null;
+                        }
+                    }
+                    return value;
+                } else {
+                    return value.equals(threshold) ? null : value;
+                }
+            default:
+                // unsupported operator todo add more operator
+                return null;
+        }
+    }
+}

hertzbeat-alerter/src/main/java/org/apache/hertzbeat/alert/expr/AlertExpressionLexer.java

@@ -0,0 +1,193 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Generated from AlertExpression.g4 by ANTLR 4.13.2
+
+package org.apache.hertzbeat.alert.expr;
+
+import org.antlr.v4.runtime.CharStream;
+import org.antlr.v4.runtime.Lexer;
+import org.antlr.v4.runtime.RuntimeMetaData;
+import org.antlr.v4.runtime.Vocabulary;
+import org.antlr.v4.runtime.VocabularyImpl;
+import org.antlr.v4.runtime.atn.ATN;
+import org.antlr.v4.runtime.atn.ATNDeserializer;
+import org.antlr.v4.runtime.atn.LexerATNSimulator;
+import org.antlr.v4.runtime.atn.PredictionContextCache;
+import org.antlr.v4.runtime.dfa.DFA;
+
+@SuppressWarnings({"all", "warnings", "unchecked", "unused", "cast", "CheckReturnValue", "this-escape"})
+public class AlertExpressionLexer extends Lexer {
+	static { RuntimeMetaData.checkVersion("4.13.2", RuntimeMetaData.VERSION); }
+
+	protected static final DFA[] _decisionToDFA;
+	protected static final PredictionContextCache _sharedContextCache =
+		new PredictionContextCache();
+	public static final int
+		AND=1, OR=2, UNLESS=3, GT=4, GE=5, LT=6, LE=7, EQ=8, NE=9, LPAREN=10, 
+		RPAREN=11, IDENTIFIER=12, NUMBER=13, WS=14;
+	public static String[] channelNames = {
+		"DEFAULT_TOKEN_CHANNEL", "HIDDEN"
+	};
+
+	public static String[] modeNames = {
+		"DEFAULT_MODE"
+	};
+
+	private static String[] makeRuleNames() {
+		return new String[] {
+			"AND", "OR", "UNLESS", "GT", "GE", "LT", "LE", "EQ", "NE", "LPAREN", 
+			"RPAREN", "IDENTIFIER", "NUMBER", "WS"
+		};
+	}
+	public static final String[] ruleNames = makeRuleNames();
+
+	private static String[] makeLiteralNames() {
+		return new String[] {
+			null, "'and'", "'or'", "'unless'", "'>'", "'>='", "'<'", "'<='", "'=='", 
+			"'!='", "'('", "')'"
+		};
+	}
+	private static final String[] _LITERAL_NAMES = makeLiteralNames();
+	private static String[] makeSymbolicNames() {
+		return new String[] {
+			null, "AND", "OR", "UNLESS", "GT", "GE", "LT", "LE", "EQ", "NE", "LPAREN", 
+			"RPAREN", "IDENTIFIER", "NUMBER", "WS"
+		};
+	}
+	private static final String[] _SYMBOLIC_NAMES = makeSymbolicNames();
+	public static final Vocabulary VOCABULARY = new VocabularyImpl(_LITERAL_NAMES, _SYMBOLIC_NAMES);
+
+	/**
+	 * @deprecated Use {@link #VOCABULARY} instead.
+	 */
+	@Deprecated
+	public static final String[] tokenNames;
+	static {
+		tokenNames = new String[_SYMBOLIC_NAMES.length];
+		for (int i = 0; i < tokenNames.length; i++) {
+			tokenNames[i] = VOCABULARY.getLiteralName(i);
+			if (tokenNames[i] == null) {
+				tokenNames[i] = VOCABULARY.getSymbolicName(i);
+			}
+
+			if (tokenNames[i] == null) {
+				tokenNames[i] = "<INVALID>";
+			}
+		}
+	}
+
+	@Override
+	@Deprecated
+	public String[] getTokenNames() {
+		return tokenNames;
+	}
+
+	@Override
+
+	public Vocabulary getVocabulary() {
+		return VOCABULARY;
+	}
+
+
+	public AlertExpressionLexer(CharStream input) {
+		super(input);
+		_interp = new LexerATNSimulator(this,_ATN,_decisionToDFA,_sharedContextCache);
+	}
+
+	@Override
+	public String getGrammarFileName() { return "AlertExpression.g4"; }
+
+	@Override
+	public String[] getRuleNames() { return ruleNames; }
+
+	@Override
+	public String getSerializedATN() { return _serializedATN; }
+
+	@Override
+	public String[] getChannelNames() { return channelNames; }
+
+	@Override
+	public String[] getModeNames() { return modeNames; }
+
+	@Override
+	public ATN getATN() { return _ATN; }
+
+	public static final String _serializedATN =
+		"\u0004\u0000\u000eZ\u0006\uffff\uffff\u0002\u0000\u0007\u0000\u0002\u0001"+
+		"\u0007\u0001\u0002\u0002\u0007\u0002\u0002\u0003\u0007\u0003\u0002\u0004"+
+		"\u0007\u0004\u0002\u0005\u0007\u0005\u0002\u0006\u0007\u0006\u0002\u0007"+
+		"\u0007\u0007\u0002\b\u0007\b\u0002\t\u0007\t\u0002\n\u0007\n\u0002\u000b"+
+		"\u0007\u000b\u0002\f\u0007\f\u0002\r\u0007\r\u0001\u0000\u0001\u0000\u0001"+
+		"\u0000\u0001\u0000\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0002\u0001"+
+		"\u0002\u0001\u0002\u0001\u0002\u0001\u0002\u0001\u0002\u0001\u0002\u0001"+
+		"\u0003\u0001\u0003\u0001\u0004\u0001\u0004\u0001\u0004\u0001\u0005\u0001"+
+		"\u0005\u0001\u0006\u0001\u0006\u0001\u0006\u0001\u0007\u0001\u0007\u0001"+
+		"\u0007\u0001\b\u0001\b\u0001\b\u0001\t\u0001\t\u0001\n\u0001\n\u0001\u000b"+
+		"\u0001\u000b\u0005\u000bB\b\u000b\n\u000b\f\u000bE\t\u000b\u0001\f\u0004"+
+		"\fH\b\f\u000b\f\f\fI\u0001\f\u0001\f\u0004\fN\b\f\u000b\f\f\fO\u0003\f"+
+		"R\b\f\u0001\r\u0004\rU\b\r\u000b\r\f\rV\u0001\r\u0001\r\u0000\u0000\u000e"+
+		"\u0001\u0001\u0003\u0002\u0005\u0003\u0007\u0004\t\u0005\u000b\u0006\r"+
+		"\u0007\u000f\b\u0011\t\u0013\n\u0015\u000b\u0017\f\u0019\r\u001b\u000e"+
+		"\u0001\u0000\u0004\u0003\u0000AZ__az\n\u0000\"\"..09==A[]]__a{}}\u8000"+
+		"\uff5e\u8000\uff5e\u0001\u000009\u0003\u0000\t\n\r\r  ^\u0000\u0001\u0001"+
+		"\u0000\u0000\u0000\u0000\u0003\u0001\u0000\u0000\u0000\u0000\u0005\u0001"+
+		"\u0000\u0000\u0000\u0000\u0007\u0001\u0000\u0000\u0000\u0000\t\u0001\u0000"+
+		"\u0000\u0000\u0000\u000b\u0001\u0000\u0000\u0000\u0000\r\u0001\u0000\u0000"+
+		"\u0000\u0000\u000f\u0001\u0000\u0000\u0000\u0000\u0011\u0001\u0000\u0000"+
+		"\u0000\u0000\u0013\u0001\u0000\u0000\u0000\u0000\u0015\u0001\u0000\u0000"+
+		"\u0000\u0000\u0017\u0001\u0000\u0000\u0000\u0000\u0019\u0001\u0000\u0000"+
+		"\u0000\u0000\u001b\u0001\u0000\u0000\u0000\u0001\u001d\u0001\u0000\u0000"+
+		"\u0000\u0003!\u0001\u0000\u0000\u0000\u0005$\u0001\u0000\u0000\u0000\u0007"+
+		"+\u0001\u0000\u0000\u0000\t-\u0001\u0000\u0000\u0000\u000b0\u0001\u0000"+
+		"\u0000\u0000\r2\u0001\u0000\u0000\u0000\u000f5\u0001\u0000\u0000\u0000"+
+		"\u00118\u0001\u0000\u0000\u0000\u0013;\u0001\u0000\u0000\u0000\u0015="+
+		"\u0001\u0000\u0000\u0000\u0017?\u0001\u0000\u0000\u0000\u0019G\u0001\u0000"+
+		"\u0000\u0000\u001bT\u0001\u0000\u0000\u0000\u001d\u001e\u0005a\u0000\u0000"+
+		"\u001e\u001f\u0005n\u0000\u0000\u001f \u0005d\u0000\u0000 \u0002\u0001"+
+		"\u0000\u0000\u0000!\"\u0005o\u0000\u0000\"#\u0005r\u0000\u0000#\u0004"+
+		"\u0001\u0000\u0000\u0000$%\u0005u\u0000\u0000%&\u0005n\u0000\u0000&\'"+
+		"\u0005l\u0000\u0000\'(\u0005e\u0000\u0000()\u0005s\u0000\u0000)*\u0005"+
+		"s\u0000\u0000*\u0006\u0001\u0000\u0000\u0000+,\u0005>\u0000\u0000,\b\u0001"+
+		"\u0000\u0000\u0000-.\u0005>\u0000\u0000./\u0005=\u0000\u0000/\n\u0001"+
+		"\u0000\u0000\u000001\u0005<\u0000\u00001\f\u0001\u0000\u0000\u000023\u0005"+
+		"<\u0000\u000034\u0005=\u0000\u00004\u000e\u0001\u0000\u0000\u000056\u0005"+
+		"=\u0000\u000067\u0005=\u0000\u00007\u0010\u0001\u0000\u0000\u000089\u0005"+
+		"!\u0000\u00009:\u0005=\u0000\u0000:\u0012\u0001\u0000\u0000\u0000;<\u0005"+
+		"(\u0000\u0000<\u0014\u0001\u0000\u0000\u0000=>\u0005)\u0000\u0000>\u0016"+
+		"\u0001\u0000\u0000\u0000?C\u0007\u0000\u0000\u0000@B\u0007\u0001\u0000"+
+		"\u0000A@\u0001\u0000\u0000\u0000BE\u0001\u0000\u0000\u0000CA\u0001\u0000"+
+		"\u0000\u0000CD\u0001\u0000\u0000\u0000D\u0018\u0001\u0000\u0000\u0000"+
+		"EC\u0001\u0000\u0000\u0000FH\u0007\u0002\u0000\u0000GF\u0001\u0000\u0000"+
+		"\u0000HI\u0001\u0000\u0000\u0000IG\u0001\u0000\u0000\u0000IJ\u0001\u0000"+
+		"\u0000\u0000JQ\u0001\u0000\u0000\u0000KM\u0005.\u0000\u0000LN\u0007\u0002"+
+		"\u0000\u0000ML\u0001\u0000\u0000\u0000NO\u0001\u0000\u0000\u0000OM\u0001"+
+		"\u0000\u0000\u0000OP\u0001\u0000\u0000\u0000PR\u0001\u0000\u0000\u0000"+
+		"QK\u0001\u0000\u0000\u0000QR\u0001\u0000\u0000\u0000R\u001a\u0001\u0000"+
+		"\u0000\u0000SU\u0007\u0003\u0000\u0000TS\u0001\u0000\u0000\u0000UV\u0001"+
+		"\u0000\u0000\u0000VT\u0001\u0000\u0000\u0000VW\u0001\u0000\u0000\u0000"+
+		"WX\u0001\u0000\u0000\u0000XY\u0006\r\u0000\u0000Y\u001c\u0001\u0000\u0000"+
+		"\u0000\u0006\u0000CIOQV\u0001\u0006\u0000\u0000";
+	public static final ATN _ATN =
+		new ATNDeserializer().deserialize(_serializedATN.toCharArray());
+	static {
+		_decisionToDFA = new DFA[_ATN.getNumberOfDecisions()];
+		for (int i = 0; i < _ATN.getNumberOfDecisions(); i++) {
+			_decisionToDFA[i] = new DFA(_ATN.getDecisionState(i), i);
+		}
+	}
+}

hertzbeat-alerter/src/main/java/org/apache/hertzbeat/alert/expr/AlertExpressionParser.java

@@ -0,0 +1,570 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Generated from AlertExpression.g4 by ANTLR 4.13.2
+
+package org.apache.hertzbeat.alert.expr;
+
+import org.antlr.v4.runtime.FailedPredicateException;
+import org.antlr.v4.runtime.NoViableAltException;
+import org.antlr.v4.runtime.Parser;
+import org.antlr.v4.runtime.ParserRuleContext;
+import org.antlr.v4.runtime.RecognitionException;
+import org.antlr.v4.runtime.RuleContext;
+import org.antlr.v4.runtime.RuntimeMetaData;
+import org.antlr.v4.runtime.Token;
+import org.antlr.v4.runtime.TokenStream;
+import org.antlr.v4.runtime.Vocabulary;
+import org.antlr.v4.runtime.VocabularyImpl;
+import org.antlr.v4.runtime.atn.ATN;
+import org.antlr.v4.runtime.atn.ATNDeserializer;
+import org.antlr.v4.runtime.atn.ParserATNSimulator;
+import org.antlr.v4.runtime.atn.PredictionContextCache;
+import org.antlr.v4.runtime.dfa.DFA;
+import org.antlr.v4.runtime.tree.ParseTreeVisitor;
+import org.antlr.v4.runtime.tree.TerminalNode;
+
+import java.util.List;
+
+@SuppressWarnings({"all", "warnings", "unchecked", "unused", "cast", "CheckReturnValue", "this-escape"})
+public class AlertExpressionParser extends Parser {
+	static { RuntimeMetaData.checkVersion("4.13.2", RuntimeMetaData.VERSION); }
+
+	protected static final DFA[] _decisionToDFA;
+	protected static final PredictionContextCache _sharedContextCache =
+		new PredictionContextCache();
+	public static final int
+		AND=1, OR=2, UNLESS=3, GT=4, GE=5, LT=6, LE=7, EQ=8, NE=9, LPAREN=10, 
+		RPAREN=11, IDENTIFIER=12, NUMBER=13, WS=14;
+	public static final int
+		RULE_expression = 0, RULE_expr = 1, RULE_identifier = 2, RULE_number = 3;
+	private static String[] makeRuleNames() {
+		return new String[] {
+			"expression", "expr", "identifier", "number"
+		};
+	}
+	public static final String[] ruleNames = makeRuleNames();
+
+	private static String[] makeLiteralNames() {
+		return new String[] {
+			null, "'and'", "'or'", "'unless'", "'>'", "'>='", "'<'", "'<='", "'=='", 
+			"'!='", "'('", "')'"
+		};
+	}
+	private static final String[] _LITERAL_NAMES = makeLiteralNames();
+	private static String[] makeSymbolicNames() {
+		return new String[] {
+			null, "AND", "OR", "UNLESS", "GT", "GE", "LT", "LE", "EQ", "NE", "LPAREN", 
+			"RPAREN", "IDENTIFIER", "NUMBER", "WS"
+		};
+	}
+	private static final String[] _SYMBOLIC_NAMES = makeSymbolicNames();
+	public static final Vocabulary VOCABULARY = new VocabularyImpl(_LITERAL_NAMES, _SYMBOLIC_NAMES);
+
+	/**
+	 * @deprecated Use {@link #VOCABULARY} instead.
+	 */
+	@Deprecated
+	public static final String[] tokenNames;
+	static {
+		tokenNames = new String[_SYMBOLIC_NAMES.length];
+		for (int i = 0; i < tokenNames.length; i++) {
+			tokenNames[i] = VOCABULARY.getLiteralName(i);
+			if (tokenNames[i] == null) {
+				tokenNames[i] = VOCABULARY.getSymbolicName(i);
+			}
+
+			if (tokenNames[i] == null) {
+				tokenNames[i] = "<INVALID>";
+			}
+		}
+	}
+
+	@Override
+	@Deprecated
+	public String[] getTokenNames() {
+		return tokenNames;
+	}
+
+	@Override
+
+	public Vocabulary getVocabulary() {
+		return VOCABULARY;
+	}
+
+	@Override
+	public String getGrammarFileName() { return "AlertExpression.g4"; }
+
+	@Override
+	public String[] getRuleNames() { return ruleNames; }
+
+	@Override
+	public String getSerializedATN() { return _serializedATN; }
+
+	@Override
+	public ATN getATN() { return _ATN; }
+
+	public AlertExpressionParser(TokenStream input) {
+		super(input);
+		_interp = new ParserATNSimulator(this,_ATN,_decisionToDFA,_sharedContextCache);
+	}
+
+	@SuppressWarnings("CheckReturnValue")
+	public static class ExpressionContext extends ParserRuleContext {
+		public ExprContext expr() {
+			return getRuleContext(ExprContext.class,0);
+		}
+		public TerminalNode EOF() { return getToken(AlertExpressionParser.EOF, 0); }
+		public ExpressionContext(ParserRuleContext parent, int invokingState) {
+			super(parent, invokingState);
+		}
+		@Override public int getRuleIndex() { return RULE_expression; }
+		@Override
+		public <T> T accept(ParseTreeVisitor<? extends T> visitor) {
+			if ( visitor instanceof AlertExpressionVisitor ) return ((AlertExpressionVisitor<? extends T>)visitor).visitExpression(this);
+			else return visitor.visitChildren(this);
+		}
+	}
+
+	public final ExpressionContext expression() throws RecognitionException {
+		ExpressionContext _localctx = new ExpressionContext(_ctx, getState());
+		enterRule(_localctx, 0, RULE_expression);
+		try {
+			enterOuterAlt(_localctx, 1);
+			{
+			setState(8);
+			expr(0);
+			setState(9);
+			match(EOF);
+			}
+		}
+		catch (RecognitionException re) {
+			_localctx.exception = re;
+			_errHandler.reportError(this, re);
+			_errHandler.recover(this, re);
+		}
+		finally {
+			exitRule();
+		}
+		return _localctx;
+	}
+
+	@SuppressWarnings("CheckReturnValue")
+	public static class ExprContext extends ParserRuleContext {
+		public ExprContext(ParserRuleContext parent, int invokingState) {
+			super(parent, invokingState);
+		}
+		@Override public int getRuleIndex() { return RULE_expr; }
+	 
+		public ExprContext() { }
+		public void copyFrom(ExprContext ctx) {
+			super.copyFrom(ctx);
+		}
+	}
+	@SuppressWarnings("CheckReturnValue")
+	public static class AndExprContext extends ExprContext {
+		public ExprContext left;
+		public ExprContext right;
+		public TerminalNode AND() { return getToken(AlertExpressionParser.AND, 0); }
+		public List<ExprContext> expr() {
+			return getRuleContexts(ExprContext.class);
+		}
+		public ExprContext expr(int i) {
+			return getRuleContext(ExprContext.class,i);
+		}
+		public AndExprContext(ExprContext ctx) { copyFrom(ctx); }
+		@Override
+		public <T> T accept(ParseTreeVisitor<? extends T> visitor) {
+			if ( visitor instanceof AlertExpressionVisitor ) return ((AlertExpressionVisitor<? extends T>)visitor).visitAndExpr(this);
+			else return visitor.visitChildren(this);
+		}
+	}
+	@SuppressWarnings("CheckReturnValue")
+	public static class QueryExprContext extends ExprContext {
+		public IdentifierContext identifier() {
+			return getRuleContext(IdentifierContext.class,0);
+		}
+		public QueryExprContext(ExprContext ctx) { copyFrom(ctx); }
+		@Override
+		public <T> T accept(ParseTreeVisitor<? extends T> visitor) {
+			if ( visitor instanceof AlertExpressionVisitor ) return ((AlertExpressionVisitor<? extends T>)visitor).visitQueryExpr(this);
+			else return visitor.visitChildren(this);
+		}
+	}
+	@SuppressWarnings("CheckReturnValue")
+	public static class ComparisonExprContext extends ExprContext {
+		public ExprContext left;
+		public Token op;
+		public ExprContext right;
+		public List<ExprContext> expr() {
+			return getRuleContexts(ExprContext.class);
+		}
+		public ExprContext expr(int i) {
+			return getRuleContext(ExprContext.class,i);
+		}
+		public TerminalNode GE() { return getToken(AlertExpressionParser.GE, 0); }
+		public TerminalNode LE() { return getToken(AlertExpressionParser.LE, 0); }
+		public TerminalNode GT() { return getToken(AlertExpressionParser.GT, 0); }
+		public TerminalNode LT() { return getToken(AlertExpressionParser.LT, 0); }
+		public TerminalNode EQ() { return getToken(AlertExpressionParser.EQ, 0); }
+		public TerminalNode NE() { return getToken(AlertExpressionParser.NE, 0); }
+		public ComparisonExprContext(ExprContext ctx) { copyFrom(ctx); }
+		@Override
+		public <T> T accept(ParseTreeVisitor<? extends T> visitor) {
+			if ( visitor instanceof AlertExpressionVisitor ) return ((AlertExpressionVisitor<? extends T>)visitor).visitComparisonExpr(this);
+			else return visitor.visitChildren(this);
+		}
+	}
+	@SuppressWarnings("CheckReturnValue")
+	public static class UnlessExprContext extends ExprContext {
+		public ExprContext left;
+		public ExprContext right;
+		public TerminalNode UNLESS() { return getToken(AlertExpressionParser.UNLESS, 0); }
+		public List<ExprContext> expr() {
+			return getRuleContexts(ExprContext.class);
+		}
+		public ExprContext expr(int i) {
+			return getRuleContext(ExprContext.class,i);
+		}
+		public UnlessExprContext(ExprContext ctx) { copyFrom(ctx); }
+		@Override
+		public <T> T accept(ParseTreeVisitor<? extends T> visitor) {
+			if ( visitor instanceof AlertExpressionVisitor ) return ((AlertExpressionVisitor<? extends T>)visitor).visitUnlessExpr(this);
+			else return visitor.visitChildren(this);
+		}
+	}
+	@SuppressWarnings("CheckReturnValue")
+	public static class LiteralExprContext extends ExprContext {
+		public NumberContext number() {
+			return getRuleContext(NumberContext.class,0);
+		}
+		public LiteralExprContext(ExprContext ctx) { copyFrom(ctx); }
+		@Override
+		public <T> T accept(ParseTreeVisitor<? extends T> visitor) {
+			if ( visitor instanceof AlertExpressionVisitor ) return ((AlertExpressionVisitor<? extends T>)visitor).visitLiteralExpr(this);
+			else return visitor.visitChildren(this);
+		}
+	}
+	@SuppressWarnings("CheckReturnValue")
+	public static class ParenExprContext extends ExprContext {
+		public TerminalNode LPAREN() { return getToken(AlertExpressionParser.LPAREN, 0); }
+		public ExprContext expr() {
+			return getRuleContext(ExprContext.class,0);
+		}
+		public TerminalNode RPAREN() { return getToken(AlertExpressionParser.RPAREN, 0); }
+		public ParenExprContext(ExprContext ctx) { copyFrom(ctx); }
+		@Override
+		public <T> T accept(ParseTreeVisitor<? extends T> visitor) {
+			if ( visitor instanceof AlertExpressionVisitor ) return ((AlertExpressionVisitor<? extends T>)visitor).visitParenExpr(this);
+			else return visitor.visitChildren(this);
+		}
+	}
+	@SuppressWarnings("CheckReturnValue")
+	public static class OrExprContext extends ExprContext {
+		public ExprContext left;
+		public ExprContext right;
+		public TerminalNode OR() { return getToken(AlertExpressionParser.OR, 0); }
+		public List<ExprContext> expr() {
+			return getRuleContexts(ExprContext.class);
+		}
+		public ExprContext expr(int i) {
+			return getRuleContext(ExprContext.class,i);
+		}
+		public OrExprContext(ExprContext ctx) { copyFrom(ctx); }
+		@Override
+		public <T> T accept(ParseTreeVisitor<? extends T> visitor) {
+			if ( visitor instanceof AlertExpressionVisitor ) return ((AlertExpressionVisitor<? extends T>)visitor).visitOrExpr(this);
+			else return visitor.visitChildren(this);
+		}
+	}
+
+	public final ExprContext expr() throws RecognitionException {
+		return expr(0);
+	}
+
+	private ExprContext expr(int _p) throws RecognitionException {
+		ParserRuleContext _parentctx = _ctx;
+		int _parentState = getState();
+		ExprContext _localctx = new ExprContext(_ctx, _parentState);
+		ExprContext _prevctx = _localctx;
+		int _startState = 2;
+		enterRecursionRule(_localctx, 2, RULE_expr, _p);
+		int _la;
+		try {
+			int _alt;
+			enterOuterAlt(_localctx, 1);
+			{
+			setState(18);
+			_errHandler.sync(this);
+			switch (_input.LA(1)) {
+			case LPAREN:
+				{
+				_localctx = new ParenExprContext(_localctx);
+				_ctx = _localctx;
+				_prevctx = _localctx;
+
+				setState(12);
+				match(LPAREN);
+				setState(13);
+				expr(0);
+				setState(14);
+				match(RPAREN);
+				}
+				break;
+			case IDENTIFIER:
+				{
+				_localctx = new QueryExprContext(_localctx);
+				_ctx = _localctx;
+				_prevctx = _localctx;
+				setState(16);
+				identifier();
+				}
+				break;
+			case NUMBER:
+				{
+				_localctx = new LiteralExprContext(_localctx);
+				_ctx = _localctx;
+				_prevctx = _localctx;
+				setState(17);
+				number();
+				}
+				break;
+			default:
+				throw new NoViableAltException(this);
+			}
+			_ctx.stop = _input.LT(-1);
+			setState(34);
+			_errHandler.sync(this);
+			_alt = getInterpreter().adaptivePredict(_input,2,_ctx);
+			while ( _alt!=2 && _alt!=org.antlr.v4.runtime.atn.ATN.INVALID_ALT_NUMBER ) {
+				if ( _alt==1 ) {
+					if ( _parseListeners!=null ) triggerExitRuleEvent();
+					_prevctx = _localctx;
+					{
+					setState(32);
+					_errHandler.sync(this);
+					switch ( getInterpreter().adaptivePredict(_input,1,_ctx) ) {
+					case 1:
+						{
+						_localctx = new ComparisonExprContext(new ExprContext(_parentctx, _parentState));
+						((ComparisonExprContext)_localctx).left = _prevctx;
+						pushNewRecursionContext(_localctx, _startState, RULE_expr);
+						setState(20);
+						if (!(precpred(_ctx, 6))) throw new FailedPredicateException(this, "precpred(_ctx, 6)");
+						setState(21);
+						((ComparisonExprContext)_localctx).op = _input.LT(1);
+						_la = _input.LA(1);
+						if ( !((((_la) & ~0x3f) == 0 && ((1L << _la) & 1008L) != 0)) ) {
+							((ComparisonExprContext)_localctx).op = (Token)_errHandler.recoverInline(this);
+						}
+						else {
+							if ( _input.LA(1)==Token.EOF ) matchedEOF = true;
+							_errHandler.reportMatch(this);
+							consume();
+						}
+						setState(22);
+						((ComparisonExprContext)_localctx).right = expr(7);
+						}
+						break;
+					case 2:
+						{
+						_localctx = new AndExprContext(new ExprContext(_parentctx, _parentState));
+						((AndExprContext)_localctx).left = _prevctx;
+						pushNewRecursionContext(_localctx, _startState, RULE_expr);
+						setState(23);
+						if (!(precpred(_ctx, 5))) throw new FailedPredicateException(this, "precpred(_ctx, 5)");
+						setState(24);
+						match(AND);
+						setState(25);
+						((AndExprContext)_localctx).right = expr(6);
+						}
+						break;
+					case 3:
+						{
+						_localctx = new UnlessExprContext(new ExprContext(_parentctx, _parentState));
+						((UnlessExprContext)_localctx).left = _prevctx;
+						pushNewRecursionContext(_localctx, _startState, RULE_expr);
+						setState(26);
+						if (!(precpred(_ctx, 4))) throw new FailedPredicateException(this, "precpred(_ctx, 4)");
+						setState(27);
+						match(UNLESS);
+						setState(28);
+						((UnlessExprContext)_localctx).right = expr(5);
+						}
+						break;
+					case 4:
+						{
+						_localctx = new OrExprContext(new ExprContext(_parentctx, _parentState));
+						((OrExprContext)_localctx).left = _prevctx;
+						pushNewRecursionContext(_localctx, _startState, RULE_expr);
+						setState(29);
+						if (!(precpred(_ctx, 3))) throw new FailedPredicateException(this, "precpred(_ctx, 3)");
+						setState(30);
+						match(OR);
+						setState(31);
+						((OrExprContext)_localctx).right = expr(4);
+						}
+						break;
+					}
+					} 
+				}
+				setState(36);
+				_errHandler.sync(this);
+				_alt = getInterpreter().adaptivePredict(_input,2,_ctx);
+			}
+			}
+		}
+		catch (RecognitionException re) {
+			_localctx.exception = re;
+			_errHandler.reportError(this, re);
+			_errHandler.recover(this, re);
+		}
+		finally {
+			unrollRecursionContexts(_parentctx);
+		}
+		return _localctx;
+	}
+
+	@SuppressWarnings("CheckReturnValue")
+	public static class IdentifierContext extends ParserRuleContext {
+		public TerminalNode IDENTIFIER() { return getToken(AlertExpressionParser.IDENTIFIER, 0); }
+		public IdentifierContext(ParserRuleContext parent, int invokingState) {
+			super(parent, invokingState);
+		}
+		@Override public int getRuleIndex() { return RULE_identifier; }
+		@Override
+		public <T> T accept(ParseTreeVisitor<? extends T> visitor) {
+			if ( visitor instanceof AlertExpressionVisitor ) return ((AlertExpressionVisitor<? extends T>)visitor).visitIdentifier(this);
+			else return visitor.visitChildren(this);
+		}
+	}
+
+	public final IdentifierContext identifier() throws RecognitionException {
+		IdentifierContext _localctx = new IdentifierContext(_ctx, getState());
+		enterRule(_localctx, 4, RULE_identifier);
+		try {
+			enterOuterAlt(_localctx, 1);
+			{
+			setState(37);
+			match(IDENTIFIER);
+			}
+		}
+		catch (RecognitionException re) {
+			_localctx.exception = re;
+			_errHandler.reportError(this, re);
+			_errHandler.recover(this, re);
+		}
+		finally {
+			exitRule();
+		}
+		return _localctx;
+	}
+
+	@SuppressWarnings("CheckReturnValue")
+	public static class NumberContext extends ParserRuleContext {
+		public TerminalNode NUMBER() { return getToken(AlertExpressionParser.NUMBER, 0); }
+		public NumberContext(ParserRuleContext parent, int invokingState) {
+			super(parent, invokingState);
+		}
+		@Override public int getRuleIndex() { return RULE_number; }
+		@Override
+		public <T> T accept(ParseTreeVisitor<? extends T> visitor) {
+			if ( visitor instanceof AlertExpressionVisitor ) return ((AlertExpressionVisitor<? extends T>)visitor).visitNumber(this);
+			else return visitor.visitChildren(this);
+		}
+	}
+
+	public final NumberContext number() throws RecognitionException {
+		NumberContext _localctx = new NumberContext(_ctx, getState());
+		enterRule(_localctx, 6, RULE_number);
+		try {
+			enterOuterAlt(_localctx, 1);
+			{
+			setState(39);
+			match(NUMBER);
+			}
+		}
+		catch (RecognitionException re) {
+			_localctx.exception = re;
+			_errHandler.reportError(this, re);
+			_errHandler.recover(this, re);
+		}
+		finally {
+			exitRule();
+		}
+		return _localctx;
+	}
+
+	public boolean sempred(RuleContext _localctx, int ruleIndex, int predIndex) {
+		switch (ruleIndex) {
+		case 1:
+			return expr_sempred((ExprContext)_localctx, predIndex);
+		}
+		return true;
+	}
+	private boolean expr_sempred(ExprContext _localctx, int predIndex) {
+		switch (predIndex) {
+		case 0:
+			return precpred(_ctx, 6);
+		case 1:
+			return precpred(_ctx, 5);
+		case 2:
+			return precpred(_ctx, 4);
+		case 3:
+			return precpred(_ctx, 3);
+		}
+		return true;
+	}
+
+	public static final String _serializedATN =
+		"\u0004\u0001\u000e*\u0002\u0000\u0007\u0000\u0002\u0001\u0007\u0001\u0002"+
+		"\u0002\u0007\u0002\u0002\u0003\u0007\u0003\u0001\u0000\u0001\u0000\u0001"+
+		"\u0000\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001"+
+		"\u0001\u0001\u0001\u0003\u0001\u0013\b\u0001\u0001\u0001\u0001\u0001\u0001"+
+		"\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001"+
+		"\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0005\u0001!\b\u0001\n\u0001"+
+		"\f\u0001$\t\u0001\u0001\u0002\u0001\u0002\u0001\u0003\u0001\u0003\u0001"+
+		"\u0003\u0000\u0001\u0002\u0004\u0000\u0002\u0004\u0006\u0000\u0001\u0001"+
+		"\u0000\u0004\t+\u0000\b\u0001\u0000\u0000\u0000\u0002\u0012\u0001\u0000"+
+		"\u0000\u0000\u0004%\u0001\u0000\u0000\u0000\u0006\'\u0001\u0000\u0000"+
+		"\u0000\b\t\u0003\u0002\u0001\u0000\t\n\u0005\u0000\u0000\u0001\n\u0001"+
+		"\u0001\u0000\u0000\u0000\u000b\f\u0006\u0001\uffff\uffff\u0000\f\r\u0005"+
+		"\n\u0000\u0000\r\u000e\u0003\u0002\u0001\u0000\u000e\u000f\u0005\u000b"+
+		"\u0000\u0000\u000f\u0013\u0001\u0000\u0000\u0000\u0010\u0013\u0003\u0004"+
+		"\u0002\u0000\u0011\u0013\u0003\u0006\u0003\u0000\u0012\u000b\u0001\u0000"+
+		"\u0000\u0000\u0012\u0010\u0001\u0000\u0000\u0000\u0012\u0011\u0001\u0000"+
+		"\u0000\u0000\u0013\"\u0001\u0000\u0000\u0000\u0014\u0015\n\u0006\u0000"+
+		"\u0000\u0015\u0016\u0007\u0000\u0000\u0000\u0016!\u0003\u0002\u0001\u0007"+
+		"\u0017\u0018\n\u0005\u0000\u0000\u0018\u0019\u0005\u0001\u0000\u0000\u0019"+
+		"!\u0003\u0002\u0001\u0006\u001a\u001b\n\u0004\u0000\u0000\u001b\u001c"+
+		"\u0005\u0003\u0000\u0000\u001c!\u0003\u0002\u0001\u0005\u001d\u001e\n"+
+		"\u0003\u0000\u0000\u001e\u001f\u0005\u0002\u0000\u0000\u001f!\u0003\u0002"+
+		"\u0001\u0004 \u0014\u0001\u0000\u0000\u0000 \u0017\u0001\u0000\u0000\u0000"+
+		" \u001a\u0001\u0000\u0000\u0000 \u001d\u0001\u0000\u0000\u0000!$\u0001"+
+		"\u0000\u0000\u0000\" \u0001\u0000\u0000\u0000\"#\u0001\u0000\u0000\u0000"+
+		"#\u0003\u0001\u0000\u0000\u0000$\"\u0001\u0000\u0000\u0000%&\u0005\f\u0000"+
+		"\u0000&\u0005\u0001\u0000\u0000\u0000\'(\u0005\r\u0000\u0000(\u0007\u0001"+
+		"\u0000\u0000\u0000\u0003\u0012 \"";
+	public static final ATN _ATN =
+		new ATNDeserializer().deserialize(_serializedATN.toCharArray());
+	static {
+		_decisionToDFA = new DFA[_ATN.getNumberOfDecisions()];
+		for (int i = 0; i < _ATN.getNumberOfDecisions(); i++) {
+			_decisionToDFA[i] = new DFA(_ATN.getDecisionState(i), i);
+		}
+	}
+}

hertzbeat-alerter/src/main/java/org/apache/hertzbeat/alert/expr/AlertExpressionVisitor.java

@@ -0,0 +1,109 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Generated from AlertExpression.g4 by ANTLR 4.13.2
+
+package org.apache.hertzbeat.alert.expr;
+
+import org.antlr.v4.runtime.tree.ParseTreeVisitor;
+
+/**
+ * This interface defines a complete generic visitor for a parse tree produced
+ * by {@link AlertExpressionParser}.
+ *
+ * @param <T> The return type of the visit operation. Use {@link Void} for
+ * operations with no return type.
+ */
+public interface AlertExpressionVisitor<T> extends ParseTreeVisitor<T> {
+
+    /**
+     * Visit a parse tree produced by {@link AlertExpressionParser#expression}.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    T visitExpression(AlertExpressionParser.ExpressionContext ctx);
+
+    /**
+     * Visit a parse tree produced by the {@code AndExpr}
+     * labeled alternative in AlertExpressionParser#expr
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    T visitAndExpr(AlertExpressionParser.AndExprContext ctx);
+
+    /**
+     * Visit a parse tree produced by the {@code QueryExpr}
+     * labeled alternative in AlertExpressionParser#expr
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    T visitQueryExpr(AlertExpressionParser.QueryExprContext ctx);
+
+    /**
+     * Visit a parse tree produced by the {@code ComparisonExpr}
+     * labeled alternative in AlertExpressionParser#expr
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    T visitComparisonExpr(AlertExpressionParser.ComparisonExprContext ctx);
+
+    /**
+     * Visit a parse tree produced by the {@code UnlessExpr}
+     * labeled alternative in AlertExpressionParser#expr
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    T visitUnlessExpr(AlertExpressionParser.UnlessExprContext ctx);
+
+    /**
+     * Visit a parse tree produced by the {@code LiteralExpr}
+     * labeled alternative in AlertExpressionParser#expr
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    T visitLiteralExpr(AlertExpressionParser.LiteralExprContext ctx);
+
+    /**
+     * Visit a parse tree produced by the {@code ParenExpr}
+     * labeled alternative in AlertExpressionParser#expr
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    T visitParenExpr(AlertExpressionParser.ParenExprContext ctx);
+
+    /**
+     * Visit a parse tree produced by the {@code OrExpr}
+     * labeled alternative in AlertExpressionParser#expr
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    T visitOrExpr(AlertExpressionParser.OrExprContext ctx);
+
+    /**
+     * Visit a parse tree produced by {@link AlertExpressionParser#identifier}.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    T visitIdentifier(AlertExpressionParser.IdentifierContext ctx);
+
+    /**
+     * Visit a parse tree produced by {@link AlertExpressionParser#number}.
+     * @param ctx the parse tree
+     * @return the visitor result
+     */
+    T visitNumber(AlertExpressionParser.NumberContext ctx);
+}

hertzbeat-alerter/src/main/java/org/apache/hertzbeat/alert/service/impl/DataSourceServiceImpl.java

@@ -17,21 +17,26 @@
 
 package org.apache.hertzbeat.alert.service.impl;
 
-import java.util.HashMap;
-import java.util.LinkedList;
-import java.util.Stack;
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import lombok.Getter;
+import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
+import org.antlr.v4.runtime.CharStreams;
+import org.antlr.v4.runtime.CommonTokenStream;
+import org.antlr.v4.runtime.tree.ParseTree;
+import org.apache.hertzbeat.alert.expr.AlertExpressionEvalVisitor;
+import org.apache.hertzbeat.alert.expr.AlertExpressionLexer;
+import org.apache.hertzbeat.alert.expr.AlertExpressionParser;
 import org.apache.hertzbeat.alert.service.DataSourceService;
 import org.apache.hertzbeat.warehouse.db.QueryExecutor;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
 
 import java.util.List;
 import java.util.Map;
-import java.util.ArrayList;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import org.springframework.util.StringUtils;
+import java.util.concurrent.TimeUnit;
 
 /**
  * datasource service
@@ -39,14 +44,25 @@ import org.springframework.util.StringUtils;
 @Service
 @Slf4j
 public class DataSourceServiceImpl implements DataSourceService {
-    
+
+    @Setter
     @Autowired(required = false)
     private List<QueryExecutor> executors;
-    
-    private static final Pattern EXPR_TOKEN = Pattern.compile("\\(|\\)|[a-zA-Z_][a-zA-Z0-9_=～{}\\[\\]\".]*|\\d+(\\.\\d+)?|>=|<=|==|!=|>|<|and|or|unless");
-    private static final String THRESHOLD = "__threshold__";
-    private static final String VALUE = "__value__";
-    
+
+    @Getter
+    private final Cache<String, ParseTree> expressionCache = Caffeine.newBuilder()
+            .maximumSize(256)
+            .expireAfterAccess(1, TimeUnit.HOURS)
+            .recordStats()
+            .build();
+
+    @Getter
+    private final Cache<String, CommonTokenStream> tokenStreamCache = Caffeine.newBuilder()
+            .maximumSize(512)
+            .expireAfterWrite(30, TimeUnit.MINUTES)
+            .recordStats()
+            .build();
+
     @Override
     public List<Map<String, Object>> calculate(String datasource, String expr) {
         if (!StringUtils.hasText(expr)) {
@@ -56,6 +72,7 @@ public class DataSourceServiceImpl implements DataSourceService {
             throw new IllegalArgumentException("No query executor found");
         }
         QueryExecutor executor = executors.stream().filter(e -> e.support(datasource)).findFirst().orElse(null);
+
         if (executor == null) {
             throw new IllegalArgumentException("Unsupported datasource: " + datasource);
         }
@@ -70,278 +87,18 @@ public class DataSourceServiceImpl implements DataSourceService {
     }
 
     private List<Map<String, Object>> evaluate(String expr, QueryExecutor executor) {
-        Stack<List<Map<String, Object>>> values = new Stack<>();
-        Stack<String> operators = new Stack<>();
-        Matcher matcher = EXPR_TOKEN.matcher(expr);
-        List<String> tokens = new ArrayList<>();
-        while (matcher.find()) {
-            tokens.add(matcher.group());
-        }
-        for (String token : tokens) {
-            if (token.equals("(")) {
-                operators.push(token);
-            } else if (token.equals(")")) {
-                while (!operators.isEmpty() && !operators.peek().equals("(")) {
-                    applyOperator(values, operators.pop());
-                }
-                // remove the left parenthesis
-                operators.pop();
-            } else if (token.matches(">=|<=|==|!=|>|<")) {
-                operators.push(token);
-            } else if (token.equals("and") || token.equals("or") || token.equals("unless")) {
-                while (!operators.isEmpty() && precedence(operators.peek()) >= precedence(token)) {
-                    applyOperator(values, operators.pop());
-                }
-                operators.push(token);
-            } else if (token.matches("\\d+(\\.\\d+)?")) { 
-                double value = Double.parseDouble(token);
-                List<Map<String, Object>> numAsList = new ArrayList<>();
-                numAsList.add(Map.of(THRESHOLD, value));
-                values.push(numAsList);
-            } else if (token.matches("[a-zA-Z_][a-zA-Z0-9_=～{}\\[\\]\".]*")) {
-                List<Map<String, Object>> results = executor.execute(token);
-                values.push(results);
-            }
-        }
-        while (!operators.isEmpty()) {
-            applyOperator(values, operators.pop());
-        }
-        return values.isEmpty() ? new LinkedList<>() : values.pop();
+        ParseTree tree = expressionCache.get(expr, e -> {
+            CommonTokenStream tokens = tokenStreamCache.get(e, this::createTokenStream);
+            AlertExpressionParser parser = new AlertExpressionParser(tokens);
+            return parser.expr();
+        });
+        AlertExpressionEvalVisitor visitor = new AlertExpressionEvalVisitor(executor);
+        return visitor.visit(tree);
+
     }
 
-    private int precedence(String op) {
-        return switch (op) {
-            case "or" -> 1;
-            case "unless" -> 2;
-            case "and" -> 3;
-            case ">", "<", ">=", "<=", "==", "!=" -> 4;
-            default -> 0;
-        };
+    private CommonTokenStream createTokenStream(String expr) {
+        AlertExpressionLexer lexer = new AlertExpressionLexer(CharStreams.fromString(expr));
+        return new CommonTokenStream(lexer);
     }
-
-    private void applyOperator(Stack<List<Map<String, Object>>> values, String op) {
-        if (values.size() < 2) {
-            return;
-        };
-        List<Map<String, Object>> rightOperand = values.pop();
-        List<Map<String, Object>> leftOperand = values.pop();
-        if (rightOperand.size() == 1 && rightOperand.get(0).containsKey(THRESHOLD)) {
-            double threshold = (double) rightOperand.get(0).get(THRESHOLD);
-            List<Map<String, Object>> result = new ArrayList<>();
-            for (Map<String, Object> item : leftOperand) {
-                Object queryValues = item.get(VALUE);
-                if (queryValues == null) {
-                    // ignore the query result data is empty
-                    continue;
-                }
-                // queryValues may be a list of values, or a single value
-                Object matchValue = evaluateCondition(queryValues, op, threshold);
-                item.put(VALUE, matchValue);
-                // if matchValue is null, mean not match the threshold
-                // if not null, mean match the threshold
-                result.add(new HashMap<>(item));
-            }
-            if (!result.isEmpty()) {
-                values.push(result);    
-            }
-            return;
-        }
-        Map<String, Object> leftMap = null;
-        boolean leftMatch = false;
-        Map<String, Object> rightMap = null;
-        boolean rightMatch = false;
-        switch (op) {
-            case "and" -> {
-                for (Map<String, Object> item : leftOperand) {
-                    if (leftMap == null) {
-                        leftMap = item;
-                    }
-                    if (item.get(VALUE) != null) {
-                        leftMap = item;
-                        leftMatch = true;
-                        break;
-                    }
-                }
-                for (Map<String, Object> item : rightOperand) {
-                    if (rightMap == null) {
-                        rightMap = item;
-                    }
-                    if (item.get(VALUE) != null) {
-                        rightMap = item;
-                        rightMatch = true;
-                        break;
-                    }
-                }
-                if (leftMatch && rightMatch) {
-                    rightMap.putAll(leftMap);
-                    values.push(new LinkedList<>(List.of(rightMap)));
-                } else if (leftMap != null) {
-                    leftMap.put(VALUE, null);
-                    values.push(new LinkedList<>(List.of(leftMap)));
-                } else if (rightMap != null) {
-                    rightMap.put(VALUE, null);
-                    values.push(new LinkedList<>(List.of(rightMap)));
-                } 
-            }
-            case "or" -> {
-                for (Map<String, Object> item : leftOperand) {
-                    if (leftMap == null) {
-                        leftMap = item;
-                    }
-                    if (item.get(VALUE) != null) {
-                        leftMap = item;
-                        leftMatch = true;
-                        break;
-                    }
-                }
-                for (Map<String, Object> item : rightOperand) {
-                    if (rightMap == null) {
-                        rightMap = item;
-                    }
-                    if (item.get(VALUE) != null) {
-                        rightMap = item;
-                        rightMatch = true;
-                        break;
-                    }
-                }
-                if (leftMatch && rightMatch) {
-                    rightMap.putAll(leftMap);
-                    values.push(new LinkedList<>(List.of(rightMap)));
-                } else if (leftMatch) {
-                    values.push(new LinkedList<>(List.of(leftMap)));
-                } else if (rightMatch) {
-                    values.push(new LinkedList<>(List.of(rightMap)));
-                } else {
-                    if (leftMap != null && rightMap != null) {
-                        rightMap.putAll(leftMap);
-                        values.push(new LinkedList<>(List.of(rightMap)));
-                    } else if (leftMap != null) {
-                        values.push(new LinkedList<>(List.of(leftMap)));
-                    } else if (rightMap != null){
-                        values.push(new LinkedList<>(List.of(rightMap)));
-                    }
-                }
-            }
-            case "unless" -> {
-                for (Map<String, Object> item : leftOperand) {
-                    if (leftMap == null) {
-                        leftMap = item;
-                    }
-                    if (item.get(VALUE) != null) {
-                        leftMap = item;
-                        leftMatch = true;
-                        break;
-                    }
-                }
-                for (Map<String, Object> item : rightOperand) {
-                    if (rightMap == null) {
-                        rightMap = item;
-                    }
-                    if (item.get(VALUE) != null) {
-                        rightMap = item;
-                        rightMatch = true;
-                        break;
-                    }
-                }
-                if (leftMatch && !rightMatch) {
-                    values.push(new LinkedList<>(List.of(leftMap)));
-                } else {
-                    if (leftMap != null) {
-                        leftMap.put(VALUE, null);
-                        values.push(new LinkedList<>(List.of(leftMap)));
-                    } else {
-                        if (rightMap != null) {
-                            rightMap.put(VALUE, null);
-                            values.push(new LinkedList<>(List.of(rightMap)));
-                        } 
-                    }
-                }
-            }
-            default -> throw new IllegalArgumentException("Unsupported operator: " + op);
-        }
-    }
-    
-    private Object evaluateCondition(Object value, String operator, Double threshold) {
-        // value may be a list of values, or a single value
-        switch (operator) {
-            case ">":
-                // if value is list, return the max value
-                if (value instanceof List<?> values) {
-                    Double doubleValue = values.stream().map(v -> Double.valueOf(v.toString()))
-                            .max(Double::compareTo).orElse(null);
-                    if (doubleValue != null) {
-                        return doubleValue > threshold ? doubleValue : null;
-                    } else {
-                        return null;
-                    }
-                } else {
-                    return Double.parseDouble(value.toString()) > threshold ? value : null;
-                }
-            case ">=":
-                if (value instanceof List<?> values) {
-                    Double doubleValue = values.stream().map(v -> Double.valueOf(v.toString()))
-                            .max(Double::compareTo).orElse(null);
-                    if (doubleValue != null) {
-                        return doubleValue >= threshold ? doubleValue : null;
-                    } else {
-                        return null;
-                    }
-                } else {
-                    return Double.parseDouble(value.toString()) >= threshold ? value : null;
-                }
-            case "<":
-                if (value instanceof List<?> values) {
-                    Double doubleValue = values.stream().map(v -> Double.valueOf(v.toString()))
-                            .min(Double::compareTo).orElse(null);
-                    if (doubleValue != null) {
-                        return doubleValue < threshold ? doubleValue : null;
-                    } else {
-                        return null;
-                    }
-                } else {
-                    return Double.parseDouble(value.toString()) < threshold ? value : null;
-                }
-            case "<=":
-                if (value instanceof List<?> values) {
-                    Double doubleValue = values.stream().map(v -> Double.valueOf(v.toString()))
-                            .min(Double::compareTo).orElse(null);
-                    if (doubleValue != null) {
-                        return doubleValue <= threshold ? doubleValue : null;
-                    } else {
-                        return null;
-                    }
-                } else {
-                    return Double.parseDouble(value.toString()) <= threshold ? value : null;
-                }
-            case "==":
-                if (value instanceof List<?> values) {
-                    for (Object v : values) {
-                        if (v.equals(threshold)) {
-                            return v;
-                        }
-                    }
-                    return null;
-                } else {
-                    return value.equals(threshold) ? value : null;
-                }
-            case "!=":
-                if (value instanceof List<?> values) {
-                    for (Object v : values) {
-                        if (v.equals(threshold)) {
-                            return null;
-                        }
-                    }
-                    return value;
-                } else {
-                    return value.equals(threshold) ? null : value;
-                }
-            default:
-                // unsupported operator todo add more operator
-                return null;
-        }
-    }
-
-    public void setExecutors(List<QueryExecutor> mockExecutor) {
-        this.executors = mockExecutor;
-    }
-} 
+}

hertzbeat-alerter/src/main/resources/expr/AlertExpression.g4

@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+grammar AlertExpression;
+
+expression
+    : expr EOF
+    ;
+
+expr
+    : '(' expr ')'                       # ParenExpr
+    | left=expr op=('>='|'<='|'>'|'<'|'=='|'!=') right=expr  # ComparisonExpr
+    | left=expr 'and' right=expr         # AndExpr
+    | left=expr 'unless' right=expr      # UnlessExpr
+    | left=expr 'or' right=expr          # OrExpr
+    | identifier                         # QueryExpr
+    | number                             # LiteralExpr
+    ;
+
+// Lexer rules
+AND     : 'and' ;
+OR      : 'or' ;
+UNLESS  : 'unless' ;
+GT      : '>' ;
+GE      : '>=' ;
+LT      : '<' ;
+LE      : '<=' ;
+EQ      : '==' ;
+NE      : '!=' ;
+LPAREN  : '(' ;
+RPAREN  : ')' ;
+
+identifier
+    : IDENTIFIER
+    ;
+
+number
+    : NUMBER
+    ;
+
+IDENTIFIER : [a-zA-Z_] [a-zA-Z0-9_=～{}[\]".]*;
+NUMBER     : [0-9]+ ('.' [0-9]+)? ;
+WS         : [ \t\r\n]+ -> skip ;

hertzbeat-alerter/src/test/java/org/apache/hertzbeat/alert/expr/AlertExpressionEvalVisitorTest.java

@@ -0,0 +1,181 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hertzbeat.alert.expr;
+
+import org.antlr.v4.runtime.CharStreams;
+import org.antlr.v4.runtime.CommonTokenStream;
+import org.apache.hertzbeat.warehouse.db.QueryExecutor;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.mockito.Mockito.when;
+
+/**
+ * test case for {@link AlertExpressionEvalVisitor}
+ */
+class AlertExpressionEvalVisitorTest {
+
+    private QueryExecutor mockExecutor;
+    private AlertExpressionEvalVisitor visitor;
+
+    @BeforeEach
+    void setUp() {
+        mockExecutor = Mockito.mock(QueryExecutor.class);
+        visitor = new AlertExpressionEvalVisitor(mockExecutor);
+    }
+
+    @Test
+    void testGreaterThan() {
+        when(mockExecutor.execute("cpu")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 80.0))));
+        List<Map<String, Object>> result = evaluate("cpu > 70");
+        assertEquals(1, result.size());
+        assertEquals(80.0, result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testGreaterThanWithInteger() {
+        when(mockExecutor.execute("cpu")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 80))));
+        List<Map<String, Object>> result = evaluate("cpu > 70");
+        assertEquals(1, result.size());
+        assertEquals(80, result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testLessThan() {
+        when(mockExecutor.execute("memory")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 65.0))));
+        List<Map<String, Object>> result = evaluate("memory < 70");
+        assertEquals(1, result.size());
+        assertEquals(65.0, result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testEqualWithTolerance() {
+        when(mockExecutor.execute("disk")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 99.999))));
+        List<Map<String, Object>> result = evaluate("disk == 100");
+        assertEquals(1, result.size());
+        assertNull(result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testNotEqual() {
+        when(mockExecutor.execute("network")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 50.0))));
+        List<Map<String, Object>> result = evaluate("network != 60");
+        assertEquals(1, result.size());
+        assertEquals(50.0, result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testExactlyEqual() {
+        when(mockExecutor.execute("threshold")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 100.0))));
+        List<Map<String, Object>> result = evaluate("threshold == 100");
+        assertEquals(1, result.size());
+        assertEquals(100.0, result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testMaxValueBoundary() {
+        when(mockExecutor.execute("max_val")).thenReturn(List.of(new HashMap<>(Map.of("__value__", Double.MAX_VALUE))));
+        List<Map<String, Object>> result = evaluate("max_val > 100");
+        assertEquals(1, result.size());
+        assertEquals(Double.MAX_VALUE, result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testMinValueBoundary() {
+        when(mockExecutor.execute("min_val")).thenReturn(List.of(new HashMap<>(Map.of("__value__", Double.MIN_VALUE))));
+        List<Map<String, Object>> result = evaluate("min_val > 0");
+        assertEquals(1, result.size());
+        assertEquals(Double.MIN_VALUE, result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testEmptyMetricName() {
+        when(mockExecutor.execute("")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 50.0))));
+        List<Map<String, Object>> result = evaluate(" > 40");
+        assertEquals(1, result.size());
+        assertNull(result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testListValueWithMax() {
+        when(mockExecutor.execute("multi_val")).thenReturn(List.of(new HashMap<>(Map.of("__value__", List.of(10.0, 20.0, 30.0)))));
+        List<Map<String, Object>> result = evaluate("multi_val > 25");
+        assertEquals(1, result.size());
+        assertEquals(30.0, result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testListValueWithMin() {
+        when(mockExecutor.execute("multi_val")).thenReturn(List.of(new HashMap<>(Map.of("__value__", List.of(10.0, 20.0, 30.0)))));
+        List<Map<String, Object>> result = evaluate("multi_val < 15");
+        assertEquals(1, result.size());
+        assertEquals(10.0, result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testEmptyListValue() {
+        when(mockExecutor.execute("empty_list")).thenReturn(List.of(new HashMap<>(Map.of("__value__", List.of()))));
+        List<Map<String, Object>> result = evaluate("empty_list > 50");
+        assertEquals(1, result.size());
+        assertNull(result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testNestedParentheses() {
+        when(mockExecutor.execute("a")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 10.0))));
+        when(mockExecutor.execute("b")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 20.0))));
+        when(mockExecutor.execute("c")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 30.0))));
+        List<Map<String, Object>> result = evaluate("(a > 5) and (b > 15 or c < 25)");
+        assertEquals(1, result.size());
+        assertEquals(10.0, result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testMultipleUnlessConditions() {
+        when(mockExecutor.execute("metric1")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 40.0))));
+        when(mockExecutor.execute("metric2")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 50.0))));
+        when(mockExecutor.execute("metric3")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 60.0))));
+        List<Map<String, Object>> result = evaluate("metric1 > 30 unless metric2 > 45 unless metric3 < 70");
+        assertEquals(1, result.size());
+        assertNull(result.get(0).get("__value__"));
+    }
+
+    @Test
+    void testComplexExpressionWithMixedOperators() {
+        when(mockExecutor.execute("cpu_temp")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 75.0))));
+        when(mockExecutor.execute("gpu_temp")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 85.0))));
+        when(mockExecutor.execute("fan_speed")).thenReturn(List.of(new HashMap<>(Map.of("__value__", 2000.0))));
+
+        List<Map<String, Object>> result = evaluate("(cpu_temp > 70 and gpu_temp < 90) or fan_speed > 1500");
+        assertEquals(1, result.size());
+        assertEquals(75.0, result.get(0).get("__value__"));
+    }
+
+    private List<Map<String, Object>> evaluate(String expression) {
+        AlertExpressionLexer lexer = new AlertExpressionLexer(CharStreams.fromString(expression));
+        AlertExpressionParser parser = new AlertExpressionParser(new CommonTokenStream(lexer));
+        return visitor.visit(parser.expression());
+    }
+}

hertzbeat-alerter/src/test/java/org/apache/hertzbeat/alert/service/DataSourceServiceTest.java

@@ -15,31 +15,16 @@
  * limitations under the License.
  */
 
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
 package org.apache.hertzbeat.alert.service;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import java.util.HashMap;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import org.antlr.v4.runtime.CommonTokenStream;
+import org.antlr.v4.runtime.tree.ParseTree;
 import org.apache.hertzbeat.alert.service.impl.DataSourceServiceImpl;
 import org.apache.hertzbeat.warehouse.db.QueryExecutor;
 import org.junit.jupiter.api.BeforeEach;
@@ -544,4 +529,91 @@ class DataSourceServiceTest {
         assertEquals(1, result.size());
         assertEquals(200.0, result.get(0).get("__value__"));
     }
+
+    @Test
+    void expressionCacheShouldHitForSameExpression() {
+        List<Map<String, Object>> prometheusData = List.of(
+                new HashMap<>(Map.of("__value__", 200.0, "timestamp", 1343555, "instance", "node2"))
+        );
+        QueryExecutor mockExecutor = Mockito.mock(QueryExecutor.class);
+        Mockito.when(mockExecutor.support("promql")).thenReturn(true);
+        Mockito.when(mockExecutor.execute(Mockito.anyString())).thenReturn(prometheusData);
+        dataSourceService.setExecutors(List.of(mockExecutor));
+        String expr = "node_cpu_seconds_total > 50";
+        Cache<String, ParseTree> expressionCache = dataSourceService.getExpressionCache();
+        expressionCache.invalidateAll();
+        long beforeHits = expressionCache.stats().hitCount();
+        dataSourceService.calculate("promql", expr); //first execution miss cache
+        dataSourceService.calculate("promql", expr); //second execution hits cache
+        long actualHits = expressionCache.stats().hitCount() - beforeHits;
+        assertEquals(1, actualHits, "expression cache should hit but miss");
+    }
+
+    @Test
+    void tokenCacheShouldHitForSameExpression() {
+        List<Map<String, Object>> prometheusData = List.of(
+                new HashMap<>(Map.of("__value__", 200.0, "timestamp", 1343555, "instance", "node2"))
+        );
+        QueryExecutor mockExecutor = Mockito.mock(QueryExecutor.class);
+        Mockito.when(mockExecutor.support("promql")).thenReturn(true);
+        Mockito.when(mockExecutor.execute(Mockito.anyString())).thenReturn(prometheusData);
+        dataSourceService.setExecutors(List.of(mockExecutor));
+        String expr = "node_cpu_seconds_total > 50";
+        Cache<String, ParseTree> expressionCache = dataSourceService.getExpressionCache();
+        Cache<String, CommonTokenStream> tokenStreamCache = dataSourceService.getTokenStreamCache();
+        expressionCache.invalidateAll();
+        tokenStreamCache.invalidateAll();
+        long beforeHits = tokenStreamCache.stats().hitCount();
+        dataSourceService.calculate("promql", expr);
+        expressionCache.invalidateAll();
+        dataSourceService.calculate("promql", expr);
+        long actualHits = tokenStreamCache.stats().hitCount() - beforeHits;
+        assertEquals(1, actualHits, "expression cache should hit but miss");
+    }
+
+    @Test
+    void expressCacheShouldNotHitForDifferentExpressions() {
+        List<Map<String, Object>> prometheusData = List.of(
+                new HashMap<>(Map.of("__value__", 200.0, "timestamp", 1343555, "instance", "node2"))
+        );
+        QueryExecutor mockExecutor = Mockito.mock(QueryExecutor.class);
+        Mockito.when(mockExecutor.support("promql")).thenReturn(true);
+        Mockito.when(mockExecutor.execute(Mockito.anyString())).thenReturn(prometheusData);
+        dataSourceService.setExecutors(List.of(mockExecutor));
+        dataSourceService.calculate("promql", "node_cpu_seconds_total > 50");
+        Cache<String, ParseTree> expressionCache = dataSourceService.getExpressionCache();
+        Cache<String, CommonTokenStream> tokenStreamCache = dataSourceService.getTokenStreamCache();
+        expressionCache.invalidateAll();
+        tokenStreamCache.invalidateAll();
+        String expr1 = "node_cpu_seconds_total > 30";
+        String expr2 = "node_cpu_seconds_total > 50";
+        long beforeHits = expressionCache.stats().hitCount();
+        dataSourceService.calculate("promql", expr1);
+        dataSourceService.calculate("promql", expr2);
+        long actualHits = expressionCache.stats().hitCount() - beforeHits;
+        assertEquals(0, actualHits, "expression cache should miss but hit");
+    }
+
+    @Test
+    void tokenCacheShouldNotHitForDifferentExpressions() {
+        List<Map<String, Object>> prometheusData = List.of(
+                new HashMap<>(Map.of("__value__", 200.0, "timestamp", 1343555, "instance", "node2"))
+        );
+        QueryExecutor mockExecutor = Mockito.mock(QueryExecutor.class);
+        Mockito.when(mockExecutor.support("promql")).thenReturn(true);
+        Mockito.when(mockExecutor.execute(Mockito.anyString())).thenReturn(prometheusData);
+        dataSourceService.setExecutors(List.of(mockExecutor));
+        dataSourceService.calculate("promql", "node_cpu_seconds_total > 50");
+        Cache<String, ParseTree> expressionCache = dataSourceService.getExpressionCache();
+        Cache<String, CommonTokenStream> tokenStreamCache = dataSourceService.getTokenStreamCache();
+        expressionCache.invalidateAll();
+        tokenStreamCache.invalidateAll();
+        String expr1 = "node_cpu_seconds_total > 30";
+        String expr2 = "node_cpu_seconds_total > 50";
+        long beforeHits = tokenStreamCache.stats().hitCount();
+        dataSourceService.calculate("promql", expr1);
+        dataSourceService.calculate("promql", expr2);
+        long actualHits = tokenStreamCache.stats().hitCount() - beforeHits;
+        assertEquals(0, actualHits, "expression cache should miss but hit");
+    }
 }

hertzbeat-collector/hertzbeat-collector-basic/src/main/java/org/apache/hertzbeat/collector/collect/database/JdbcCommonCollect.java

@@ -63,6 +63,25 @@ public class JdbcCommonCollect extends AbstractCollect {
 
     private static final String[] VULNERABLE_KEYWORDS = {"allowLoadLocalInfile", "allowLoadLocalInfileInPath", "useLocalInfile"};
 
+    private static final String[] BLACK_LIST = {
+            // dangerous SQL commands - may cause database structure damage or data leakage
+            "create trigger", "create alias", "runscript from", "shutdown", "drop table",
+            "drop database", "create function", "alter system", "grant all", "revoke all",
+
+            // file IO related - may cause server files to be read or written
+            "allowloadlocalinfile", "allowloadlocalinfileinpath", "uselocalinfile",
+
+            // code execution related - may result in remote code execution
+            "init=", "javaobjectserializer=", "runscript", "serverstatusdiffinterceptor",
+            "queryinterceptors=", "statementinterceptors=", "exceptioninterceptors=",
+
+            // multiple statement execution - may lead to SQL injection
+            "allowmultiqueries",
+
+            // deserialization related - may result in remote code execution
+            "autodeserialize", "detectcustomcollations",
+    };
+
     private final GlobalConnectionCache connectionCommonCache = GlobalConnectionCache.getInstance();
 
 
@@ -331,17 +350,24 @@ public class JdbcCommonCollect extends AbstractCollect {
         if (Objects.nonNull(jdbcProtocol.getUrl())
                 && !Objects.equals("", jdbcProtocol.getUrl())
                 && jdbcProtocol.getUrl().startsWith("jdbc")) {
-            // convert the URL to lowercase for case-insensitive checking
-            String url = jdbcProtocol.getUrl().toLowerCase();
-            // check whether the parameter is valid
-            if (url.contains("create trigger") || url.contains("create alias") || url.contains("runscript from")
-                    || url.contains("allowloadlocalinfile") || url.contains("allowloadlocalinfileinpath")
-                    || url.contains("uselocalinfile") || url.contains("autodeserialize") || url.contains("detectcustomcollations")
-                    || url.contains("serverstatusdiffinterceptor")) {
-                throw new IllegalArgumentException("Invalid JDBC URL: contains malicious characters.");
+            // limit url length
+            if (jdbcProtocol.getUrl().length() > 2048) {
+                throw new IllegalArgumentException("JDBC URL length exceeds maximum limit of 2048 characters");
             }
-            // when has config jdbc url, use it 
-            return jdbcProtocol.getUrl();
+            // remove special characters
+            String cleanedUrl = jdbcProtocol.getUrl().replaceAll("[\\x00-\\x1F\\x7F]", "");
+            String url = cleanedUrl.toLowerCase();
+            // backlist check
+            for (String keyword : BLACK_LIST) {
+                if (url.contains(keyword)) {
+                    throw new IllegalArgumentException("Invalid JDBC URL: contains potentially malicious parameter: " + keyword);
+                }
+            }
+            // url format check
+            if (!url.matches("^jdbc:[a-zA-Z0-9]+://[^\\s]+$")) {
+                throw new IllegalArgumentException("Invalid JDBC URL format");
+            }
+            return cleanedUrl;
         }
         return switch (jdbcProtocol.getPlatform()) {
             case "mysql", "mariadb" -> "jdbc:mysql://" + host + ":" + port

hertzbeat-mcp/README.md

@@ -0,0 +1,27 @@
+# Hertzbeat-MCP
+
+## Hertzbeat-Log-MCP
+
+Log MCP Service Based on GreptimeDB.
+
+- GreptimeDB log writing needs to be enabled.
+
+## Claude Desktop Integration (stdio)
+
+```json
+{
+    "mcpServers": {
+        "hertzbeat-mcp": {
+            "command": "java",
+            "args": [
+                "-Dspring.ai.mcp.server.stdio=true",
+                "-Dspring.main.web-application-type=none",
+                "-Dlogging.pattern.console=",
+                "-Dgreptime.url=http://${IP}:4000",
+                "-jar",
+                "${PATH}/hertzbeat-mcp-2.0-SNAPSHOT.jar"
+            ]
+        }
+    }
+}
+```

hertzbeat-mcp/pom.xml

@@ -0,0 +1,107 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one or more
+  ~ contributor license agreements.  See the NOTICE file distributed with
+  ~ this work for additional information regarding copyright ownership.
+  ~ The ASF licenses this file to You under the Apache License, Version 2.0
+  ~ (the "License"); you may not use this file except in compliance with
+  ~ the License.  You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.apache.hertzbeat</groupId>
+        <artifactId>hertzbeat</artifactId>
+        <version>2.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>hertzbeat-mcp</artifactId>
+
+    <properties>
+        <maven.compiler.source>17</maven.compiler.source>
+        <maven.compiler.target>17</maven.compiler.target>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <spring-ai.version>1.0.0-M6</spring-ai.version>
+    </properties>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-dependencies</artifactId>
+                <version>3.4.2</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.springframework.ai</groupId>
+                <artifactId>spring-ai-bom</artifactId>
+                <version>${spring-ai.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.ai</groupId>
+            <artifactId>spring-ai-mcp-server-webflux-spring-boot-starter</artifactId>
+            <version>${spring-ai.version}</version>
+        </dependency>
+        <!-- json path parser-->
+        <dependency>
+            <groupId>com.jayway.jsonpath</groupId>
+            <artifactId>json-path</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-web</artifactId>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>repackage</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>17</source>
+                    <target>17</target>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>${maven-compiler-plugin.version}</version>
+                <configuration>
+                    <release>${java.version}</release>
+                    <compilerArgs>
+                        <compilerArg>-parameters</compilerArg>
+                    </compilerArgs>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

hertzbeat-mcp/src/main/java/org/apache/hertzbeat/mcp/server/McpServerApplication.java

@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hertzbeat.mcp.server;
+
+import org.apache.hertzbeat.mcp.server.service.LogService;
+import org.springframework.ai.tool.ToolCallbackProvider;
+import org.springframework.ai.tool.method.MethodToolCallbackProvider;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Bean;
+
+/**
+ * MCP Server Application
+ */
+@SpringBootApplication
+public class McpServerApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(McpServerApplication.class, args);
+    }
+
+    @Bean
+    public ToolCallbackProvider tools(
+            LogService logService) {
+        return MethodToolCallbackProvider.builder()
+                .toolObjects(logService)
+                .build();
+    }
+}

hertzbeat-mcp/src/main/java/org/apache/hertzbeat/mcp/server/service/LogService.java

@@ -0,0 +1,196 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hertzbeat.mcp.server.service;
+
+import com.jayway.jsonpath.JsonPath;
+import com.jayway.jsonpath.ReadContext;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.ai.tool.annotation.Tool;
+import org.springframework.ai.tool.annotation.ToolParam;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Service;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.client.RestClient;
+
+import java.time.Instant;
+import java.time.LocalDateTime;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Log query service
+ */
+@Service
+@Slf4j
+public class LogService {
+
+    private static final String TIMESTAMP_COLUMN = "timestamp";
+    private static final String SEVERITY_TEXT_COLUMN = "severity_text";
+    private static final String BODY_COLUMN = "body";
+    private static final DateTimeFormatter DATE_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss");
+    
+    private final RestClient restClient;
+
+    public LogService(@Value("${greptime.url}") String greptimeUrl) {
+        this.restClient = RestClient.builder()
+                .baseUrl(greptimeUrl)
+                .defaultHeader("Accept", "application/json")
+                .defaultHeader("Content-Type", "application/x-www-form-urlencoded")
+                .build();
+    }
+
+    @Tool(description = "System log query tool that supports filtering by time, log level, and content")
+    public String getHertzbeatLog(
+            @ToolParam(description = """
+                Query system logs with support for filtering by time, log level, and content.
+                
+                Usage:
+                1. Table name: hzb_log
+                2. Common query examples:
+                   - Get latest 10 logs: SELECT * FROM hzb_log ORDER BY timestamp DESC LIMIT 10
+                   - Query ERROR level logs: SELECT * FROM hzb_log WHERE severity_number=17
+                   - Query specific time range: SELECT * FROM hzb_log WHERE timestamp > '2024-01-01 00:00:00'
+                
+                Field descriptions:
+                1. severity_number (log level):
+                   - 5: DEBUG
+                   - 9: INFO
+                   - 13: WARN
+                   - 17: ERROR
+                2. timestamp: log timestamp
+                3. body: log content
+                """) String querySql) {
+        
+        if (!isValidQuery(querySql)) {
+            return "Invalid query statement";
+        }
+
+        try {
+            String response = executeQuery(querySql);
+            return formatQueryResults(response);
+        } catch (Exception e) {
+            log.error("Failed to query logs", e);
+            return "Failed to query logs: " + e.getMessage();
+        }
+    }
+
+    private boolean isValidQuery(String sql) {
+        return sql != null && sql.toLowerCase().contains("hzb_log");
+    }
+
+    private String executeQuery(String sql) {
+        MultiValueMap<String, String> formData = new LinkedMultiValueMap<>();
+        formData.add("sql", sql);
+        log.debug("Executing SQL query: {}", sql);
+        
+        return restClient.post()
+                .uri("/v1/sql?db=public")
+                .contentType(MediaType.APPLICATION_FORM_URLENCODED)
+                .body(formData)
+                .retrieve()
+                .body(String.class);
+    }
+
+    private String formatQueryResults(String response) {
+        ReadContext ctx = JsonPath.parse(response);
+        List<Map<String, Object>> columnSchemas = ctx.read("$.output[0].records.schema.column_schemas");
+        List<List<Object>> rows = ctx.read("$.output[0].records.rows");
+        int totalRows = ctx.read("$.output[0].records.total_rows");
+
+        ColumnIndices indices = findColumnIndices(columnSchemas);
+        StringBuilder result = new StringBuilder()
+                .append("Query Results:\n\n")
+                .append("Log Time\t\t\tLog Level\tLog Content\n")
+                .append("----------------------------------------------------\n");
+
+        if (rows != null && !rows.isEmpty()) {
+            formatRows(rows, indices, result);
+            result.append("\nTotal ").append(totalRows).append(" records");
+        } else {
+            result.append("No data");
+        }
+
+        return result.toString();
+    }
+
+    private record ColumnIndices(int timestamp, int severityText, int body) {}
+
+    private ColumnIndices findColumnIndices(List<Map<String, Object>> columnSchemas) {
+        int timestampIndex = -1;
+        int severityTextIndex = -1;
+        int bodyIndex = -1;
+
+        for (int i = 0; i < columnSchemas.size(); i++) {
+            String columnName = (String) columnSchemas.get(i).get("name");
+            switch (columnName) {
+                case TIMESTAMP_COLUMN -> timestampIndex = i;
+                case SEVERITY_TEXT_COLUMN -> severityTextIndex = i;
+                case BODY_COLUMN -> bodyIndex = i;
+                default -> {
+                    // Ignore other columns
+                }
+            }
+        }
+
+        return new ColumnIndices(timestampIndex, severityTextIndex, bodyIndex);
+    }
+
+    private void formatRows(List<List<Object>> rows, ColumnIndices indices, StringBuilder result) {
+        for (List<Object> row : rows) {
+            appendTimestamp(row, indices.timestamp(), result);
+            appendSeverity(row, indices.severityText(), result);
+            appendBody(row, indices.body(), result);
+            result.append("\n");
+        }
+    }
+
+    private void appendTimestamp(List<Object> row, int index, StringBuilder result) {
+        if (index >= 0 && index < row.size()) {
+            Object value = row.get(index);
+            if (value instanceof Number) {
+                long timestamp = ((Number) value).longValue();
+                LocalDateTime dateTime = LocalDateTime.ofInstant(
+                        Instant.ofEpochMilli(timestamp / 1_000_000),
+                        ZoneId.systemDefault());
+                result.append(DATE_FORMATTER.format(dateTime)).append("\t");
+                return;
+            }
+        }
+        result.append("Unknown time\t");
+    }
+
+    private void appendSeverity(List<Object> row, int index, StringBuilder result) {
+        if (index >= 0 && index < row.size()) {
+            result.append(row.get(index)).append("\t");
+        } else {
+            result.append("Unknown\t");
+        }
+    }
+
+    private void appendBody(List<Object> row, int index, StringBuilder result) {
+        if (index >= 0 && index < row.size()) {
+            result.append(row.get(index));
+        } else {
+            result.append("No content");
+        }
+    }
+}

hertzbeat-mcp/src/main/resources/application.yml

@@ -0,0 +1,28 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+spring:
+  main:
+    banner-mode: off
+  ai:
+    mcp:
+      server:
+        name: hertzbeat-log-analysis-server
+        version: 0.1
+
+#
+#logging:
+#  file:
+#    name:

hertzbeat-warehouse/src/main/java/org/apache/hertzbeat/warehouse/db/PromqlQueryExecutor.java

@@ -98,9 +98,9 @@ public abstract class PromqlQueryExecutor implements QueryExecutor {
             }
             HttpEntity<Void> httpEntity = new HttpEntity<>(headers);
 
-            UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.fromHttpUrl(httpPromqlProperties.url);
+            UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.fromHttpUrl(httpPromqlProperties.url + QUERY_PATH);
             uriComponentsBuilder.queryParam(HTTP_QUERY_PARAM, queryString);
-            URI uri = uriComponentsBuilder.build(true).toUri();
+            URI uri = uriComponentsBuilder.build().toUri();
             ResponseEntity<PromQlQueryContent> responseEntity = restTemplate.exchange(uri,
                     HttpMethod.GET, httpEntity, PromQlQueryContent.class);
             if (responseEntity.getStatusCode().is2xxSuccessful()) {

hertzbeat-warehouse/src/main/java/org/apache/hertzbeat/warehouse/store/history/vm/VictoriaMetricsClusterDataStorage.java

@@ -254,7 +254,7 @@ public class VictoriaMetricsClusterDataStorage extends AbstractHistoryDataStorag
         }
         String timeSeriesSelector =
                 LABEL_KEY_NAME + "=\"" + labelName + "\"" + "," + LABEL_KEY_INSTANCE + "=\"" + monitorId + "\"" + ","
-                        + MONITOR_METRIC_KEY + "=\"" + metric + "\"";
+                        + (CommonConstants.PROMETHEUS.equals(app) ? "" : "," + MONITOR_METRIC_KEY + "=\"" + metric + "\"");
         Map<String, List<Value>> instanceValuesMap = new HashMap<>(8);
         try {
             HttpHeaders headers = new HttpHeaders();
@@ -349,7 +349,7 @@ public class VictoriaMetricsClusterDataStorage extends AbstractHistoryDataStorag
         }
         String timeSeriesSelector =
                 LABEL_KEY_NAME + "=\"" + labelName + "\"" + "," + LABEL_KEY_INSTANCE + "=\"" + monitorId + "\"" + ","
-                        + MONITOR_METRIC_KEY + "=\"" + metric + "\"";
+                        + (CommonConstants.PROMETHEUS.equals(app) ? "" : "," + MONITOR_METRIC_KEY + "=\"" + metric + "\"");
         Map<String, List<Value>> instanceValuesMap = new HashMap<>(8);
         try {
             HttpHeaders headers = new HttpHeaders();

hertzbeat-warehouse/src/main/java/org/apache/hertzbeat/warehouse/store/history/vm/VictoriaMetricsDataStorage.java

@@ -253,7 +253,7 @@ public class VictoriaMetricsDataStorage extends AbstractHistoryDataStorage {
         }
         String timeSeriesSelector = LABEL_KEY_NAME + "=\"" + labelName + "\""
                 + "," + LABEL_KEY_INSTANCE + "=\"" + monitorId + "\""
-                + "," + MONITOR_METRIC_KEY + "=\"" + metric + "\"";
+                + (CommonConstants.PROMETHEUS.equals(app) ? "" : "," + MONITOR_METRIC_KEY + "=\"" + metric + "\"");
         Map<String, List<Value>> instanceValuesMap = new HashMap<>(8);
         try {
             HttpHeaders headers = new HttpHeaders();
@@ -347,7 +347,7 @@ public class VictoriaMetricsDataStorage extends AbstractHistoryDataStorage {
         }
         String timeSeriesSelector = LABEL_KEY_NAME + "=\"" + labelName + "\""
                 + "," + LABEL_KEY_INSTANCE + "=\"" + monitorId + "\""
-                + "," + MONITOR_METRIC_KEY + "=\"" + metric + "\"";
+                + (CommonConstants.PROMETHEUS.equals(app) ? "" : "," + MONITOR_METRIC_KEY + "=\"" + metric + "\"");
         Map<String, List<Value>> instanceValuesMap = new HashMap<>(8);
         try {
             HttpHeaders headers = new HttpHeaders();

home/src/pages/team/index.jsx

@@ -458,6 +458,7 @@ export default function () {
                   <td align="center" valign="top" width="14.28%"><a href="https://github.com/gagaradio"><img src="https://avatars.githubusercontent.com/u/18532370?v=4?s=100" width="100px;" alt="Walter Jia"/><br /><sub><b>Walter Jia</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=gagaradio" title="Code">💻</a></td>
                   <td align="center" valign="top" width="14.28%"><a href="https://github.com/boyucjz"><img src="https://avatars.githubusercontent.com/u/18730041?v=4?s=100" width="100px;" alt="boyucjz"/><br /><sub><b>boyucjz</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=boyucjz" title="Code">💻</a></td>
                   <td align="center" valign="top" width="14.28%"><a href="https://github.com/Cyanty"><img src="https://avatars.githubusercontent.com/u/153884653?v=4?s=100" width="100px;" alt="Cyanty"/><br /><sub><b>Cyanty</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=Cyanty" title="Code">💻</a></td>
+                  <td align="center" valign="top" width="14.28%"><a href="https://github.com/KevinLLF"><img src="https://avatars.githubusercontent.com/u/85452733?v=4?s=100" width="100px;" alt="Jay丿167"/><br /><sub><b>Jay丿167</b></sub></a><br /><a href="https://github.com/apache/hertzbeat/commits?author=KevinLLF" title="Code">💻</a></td>
                 </tr>
                 </tbody>
               </table>

pom.xml

@@ -91,6 +91,7 @@
         <module>hertzbeat-log</module>
         <module>hertzbeat-e2e</module>
         <module>hertzbeat-base</module>
+        <module>hertzbeat-mcp</module>
     </modules>
 
     <properties>