[attributesprocessor] Support filter by severity

[atoulme]

Description:
Adds a severity text matcher for the attributesprocessor.

Link to tracking Issue:
No issue.

Testing:
Unit tests

Documentation:
README and configuration

[pmm-sumo]

I think the change looks good overall. I think before merging it would be good taking the item raised by @djaglowski, i.e. if we want to have separate filter for log severity number and if that's the case then how the configuration keys should be named for them.

As a digression, I think that while having ability to filter records when attributes processor is concerned is helpful, it would be even more useful to have similiar capabilities exposed in filterprocessor as well

[atoulme]

@pmm-sumo would you be awesome and file an issue for the digression? That sounds like a good move.

Agree on your comments folks, will make the filter's name more clear.

The problem with severity number fwiw is that you'd be well tempted to use a >, <, >= or <= to filter by, and that seemed like something just a bit more complex.

[djaglowski]

As a digression, I think that while having ability to filter records when attributes processor is concerned is helpful, it would be even more useful to have similiar capabilities exposed in filterprocessor as well

+1, This processor is is filtering on several non-attributes at this point.

[codeboten]

The change looks good to me. @djaglowski @pmm-sumo please review and approve if your comments have been addressed.

[pmm-sumo]

@pmm-sumo would you be awesome and file an issue for the digression? That sounds like a good move.

Sure thing: #9235

The problem with severity number fwiw is that you'd be well tempted to use a >, <, >= or <= to filter by, and that seemed like something just a bit more complex.

I think that filtering by severity text is already pretty useful, don't want to block this PR due to lack of filtering by number but I wanted to hear from @djaglowski on his take on that :)

[djaglowski]

Sorry for the delay. LGTM

[TylerHelmuth]

Tangentially related, when should new capabilities be added to the attribute processor vs the transform processor?

[pmm-sumo]

Tangentially related, when should new capabilities be added to the attribute processor vs the transform processor?

That's a good question. In my opinion it's OK to add small features here that users want and then port those to transform processor after it's considered ready to be used

There is a PR that adds some log processing capabilities. This makes it already quite useful IMO