Unwrap JSON array values in ad-hoc equality filters

When Grafana passes a stringified array like ["paperclip"] as a filter
value, detect it as JSON array and generate term queries on the
individual elements instead of a phrase query on the literal string.

Single element: attributes.tags:paperclip
Multiple elements: attributes.tags:paperclip OR attributes.tags:stapler
Empty array: no-op

Fixes #179

Author: xrl

src/modifyQuery.test.ts

@@ -1,27 +1,53 @@
 import { addAddHocFilter } from './modifyQuery';
 
 describe('addAddHocFilter', () => {
-  describe('current behavior with array values', () => {
-    it('wraps equality filter value in quotes (phrase query)', () => {
+  describe('array values', () => {
+    it('unwraps single-element array into a term query', () => {
       const result = addAddHocFilter('', {
         key: 'attributes.tags',
         operator: '=',
         value: '["paperclip"]',
       });
-      // Current behavior: generates a phrase query with the stringified array
-      expect(result).toBe('attributes.tags:"[\\"paperclip\\"]"');
+      expect(result).toBe('attributes.tags:paperclip');
     });
 
-    it('wraps negated equality filter value in quotes', () => {
+    it('unwraps multi-element array into OR of term queries', () => {
+      const result = addAddHocFilter('', {
+        key: 'attributes.tags',
+        operator: '=',
+        value: '["paperclip","stapler"]',
+      });
+      expect(result).toBe('attributes.tags:paperclip OR attributes.tags:stapler');
+    });
+
+    it('negated array produces negated term queries', () => {
       const result = addAddHocFilter('', {
         key: 'attributes.tags',
         operator: '!=',
         value: '["paperclip"]',
       });
-      expect(result).toBe('-attributes.tags:"[\\"paperclip\\"]"');
+      expect(result).toBe('-attributes.tags:paperclip');
     });
 
-    it('term operator produces unquoted query', () => {
+    it('appends array filter to existing query with AND', () => {
+      const result = addAddHocFilter('status:200', {
+        key: 'attributes.tags',
+        operator: '=',
+        value: '["paperclip"]',
+      });
+      expect(result).toBe('status:200 AND attributes.tags:paperclip');
+    });
+
+    it('passes through non-array bracket strings unchanged', () => {
+      const result = addAddHocFilter('', {
+        key: 'attributes.message',
+        operator: '=',
+        value: '[not json',
+      });
+      expect(result).toBe('attributes.message:"[not json"');
+    });
+
+    it('term operator still produces unquoted query', () => {
       const result = addAddHocFilter('', {
         key: 'attributes.tags',
         operator: 'term',
@@ -30,7 +56,7 @@ describe('addAddHocFilter', () => {
       expect(result).toBe('attributes.tags:paperclip');
     });
 
-    it('not term operator produces negated unquoted query', () => {
+    it('not term operator still produces negated unquoted query', () => {
       const result = addAddHocFilter('', {
         key: 'attributes.tags',
         operator: 'not term',
@@ -124,14 +150,13 @@ describe('addAddHocFilter', () => {
       expect(result).toBe('existing');
     });
 
-    it('handles multi-element array value with equality', () => {
-      const result = addAddHocFilter('', {
+    it('treats empty JSON array as no-op', () => {
+      const result = addAddHocFilter('existing', {
         key: 'attributes.tags',
         operator: '=',
-        value: '["paperclip","stapler"]',
+        value: '[]',
       });
-      // Current behavior: entire stringified array becomes the phrase
-      expect(result).toBe('attributes.tags:"[\\"paperclip\\",\\"stapler\\"]"');
+      expect(result).toBe('existing');
     });
   });
 });

src/modifyQuery.ts

@@ -1,6 +1,21 @@
 import { escapeFilter, escapeFilterValue, concatenate, LuceneQuery } from 'utils/lucene';
 import { AdHocVariableFilter } from '@grafana/data';
 
+function tryParseJsonArray(value: string): string[] | null {
+  if (!value.startsWith('[')) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (Array.isArray(parsed) && parsed.every((el) => typeof el === 'string')) {
+      return parsed;
+    }
+  } catch {
+    // not valid JSON
+  }
+  return null;
+}
+
 /**
  * Adds a label:"value" expression to the query.
  */
@@ -18,6 +33,17 @@ export function addAddHocFilter(query: string, filter: AdHocVariableFilter): str
 
   const equalityFilters = ['=', '!='];
   if (equalityFilters.includes(filter.operator)) {
+    const arrayElements = tryParseJsonArray(filter.value);
+    if (arrayElements !== null) {
+      if (arrayElements.length === 0) {
+        return query;
+      }
+      const modifier = filter.operator === '=' ? '' : '-';
+      const key = escapeFilter(filter.key);
+      const termFilters = arrayElements.map((el) => `${modifier}${key}:${escapeFilterValue(el)}`);
+      const combined = termFilters.join(' OR ');
+      return concatenate(query, combined, 'AND');
+    }
     return LuceneQuery.parse(query).addFilter(filter.key, filter.value, filter.operator === '=' ? '' : '-').toString();
   }
   /**