in_systemd: treat multiple filters as ANDs, not ORs

[mikekap]

The docs seems to point to these being ANDs. You can always use multiple inputs to create ORs.

[edsiper]

thanks for raising this.

I think we should not change the default behavior that it have as of now, otherwise we would break "a lot" of systems running Fluent Bit, what I propose is the following:

• new configuration keys:
  • systemd_filter: use disjunction (to avoid break production systems)
  • systemd_filter_and: use conjunction
  • systemd_filter_or: use disjunction

[mikekap]

Hmm sure - we can make this backwards compatible. My concern with your suggestion was that in theory you could use both systemd_filter_and and systemd_filter_or. Technically the C API supports that - but I didn't want to give folks an ability to make their filters indecipherable (there is some idea of precedence order - it scared me).

As an alternative I added systemd_filter_type that can be and or or. How does this version look? If you'd prefer the 3-option approach you suggested before - let me know and I'll switch to that. I might make it an exclusive set though.

[edsiper]

I liked that approach, thanks for the PR.