lib/logstorage: fix collapse_nums treating hex-letter word prefixes as numbers

docs/victorialogs/CHANGELOG.md

@@ -40,6 +40,7 @@ according to the following docs:
 * BUGFIX: [cluster version](https://docs.victoriametrics.com/victorialogs/cluster/): properly cancel queries already running on `vlstorage` when the corresponding query is canceled or times out on `vlselect`. Previously, `vlstorage` could fail to detect the disconnected `vlselect`, causing these queries to continue running and waste CPU and disk IO. See [#1672](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1672).
 * BUGFIX: [data ingestion](https://docs.victoriametrics.com/victorialogs/data-ingestion/) and [querying](https://docs.victoriametrics.com/victorialogs/querying/): properly handle logs containing duplicate [stream field](https://docs.victoriametrics.com/victorialogs/keyconcepts/#stream-fields) names. Previously, [v1.52.0](https://github.com/VictoriaMetrics/VictoriaLogs/releases/tag/v1.52.0) could panic when ingesting such logs in single-node VictoriaLogs, drop them during ingestion in VictoriaLogs cluster, or panic when querying such data written by earlier releases. See [#1603](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1603) and [#1604](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1604).
 * BUGFIX: [LogsQL](https://docs.victoriametrics.com/victorialogs/logsql/): fix [`week_range[Sun,Sun]` filter](https://docs.victoriametrics.com/victorialogs/logsql/#week-range-filter) when it is used inside the [`filter` pipe](https://docs.victoriametrics.com/victorialogs/logsql/#filter-pipe). Previously, it could fail to match rows on Sunday. See [#1335](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1335).
+* BUGFIX: [LogsQL](https://docs.victoriametrics.com/victorialogs/logsql/): fix [`collapse_nums` pipe](https://docs.victoriametrics.com/victorialogs/logsql/#collapse_nums-pipe) and [pattern match filters](https://docs.victoriametrics.com/victorialogs/logsql/#pattern-match-filter) incorrectly detecting hexadecimal numbers at the beginning of words. Previously, words such as `default` could be collapsed into `<N>ult`. Note that hexadecimal numbers immediately followed by `_`, `T`, `Z`, `s`, `m`, `h`, `u` or `n` are no longer collapsed, `deadbeef1234s` is left as is, while `dead_beef` is collapsed into `dead_<N>` instead of `<N>_<N>`. See [#1760](https://github.com/VictoriaMetrics/VictoriaLogs/issues/1760).
 * BUGFIX: [web UI](https://docs.victoriametrics.com/victorialogs/querying/#web-ui): prevent long group-by values from overflowing group headers. See [#1663](https://github.com/VictoriaMetrics/VictoriaLogs/pull/1663).
 * BUGFIX: [web UI](https://docs.victoriametrics.com/victorialogs/querying/#web-ui): render only inline Markdown links with explicit `http` or `https` destinations, such as `[text](https://example.com)`, as clickable links in log messages. Bare URLs, autolinks, reference-style links, links using other schemes, and images are rendered as plain text. See [#1470](https://github.com/VictoriaMetrics/VictoriaLogs/pull/1470).
 * BUGFIX: [web UI](https://docs.victoriametrics.com/victorialogs/querying/#web-ui): prevent manually entered time ranges from shifting after Apply when using non-UTC time zones.

lib/logstorage/pattern_matcher_test.go

@@ -177,4 +177,8 @@ func TestPatternMatcherMatch(t *testing.T) {
 	f("xx<N>", "xxxxxx123", patternMatcherOptionFull, false)
 	f("xx<N>", "xxxxxx123", patternMatcherOptionPrefix, false)
 	f("xx<N>", "xxxxxx123", patternMatcherOptionSuffix, true)
+
+	// hex chars at the beginning of the word must not be treated as a num
+	f("<N>ult", "default", patternMatcherOptionAny, false)
+	f("<N>_letter", "dead_letter", patternMatcherOptionAny, false)
 }

lib/logstorage/pipe_collapse_nums.go

@@ -180,8 +180,13 @@ func indexNumEnd(s string, offset int) int {
 }
 
 func isValidNum(s string, start, end int) bool {
-	if end < len(s) && isTokenChar(s[end]) && !isSpecialNumEnd(s[end]) {
-		return false
+	if end < len(s) && isTokenChar(s[end]) {
+		if !isSpecialNumEnd(s[end]) {
+			return false
+		}
+		if hasHexChars(s[start:end]) {
+			return false
+		}
 	}
 	return canBeTreatedAsNum(s[start:end])
 }

lib/logstorage/pipe_collapse_nums_test.go

@@ -199,6 +199,16 @@ func TestAppendCollapseNums(t *testing.T) {
 
 	// non-ascii chars must be treated as number delimiters
 	f("ЙЦ123ук", "ЙЦ<N>ук")
+
+	// See https://github.com/VictoriaMetrics/VictoriaLogs/issues/1760
+	f("default", "default")
+	f("beefsteak", "beefsteak")
+	f("abacus", "abacus")
+	f("dead_letter", "dead_letter")
+	f("deadbeef1234s", "deadbeef1234s")
+	f("dead_beef", "dead_<N>")
+	f("deadbeef1234", "<N>")
+	f("deadbeef1234 done", "<N> done")
 }
 
 func TestAppendCollapseNums_Prettified(t *testing.T) {