Filter syntax enhancement 7.0.1

Enhanced log filter syntax can be applied to the Log Viewer or Event Handler to generate a consistent result.

To use the enhanced log filter syntax:

1. Before this enhancement, event handlers and Log View used a different filter syntax in the generic text filter.
   For example, filtering "attack not equal to botnet" and "logid equal to 0000000013" in Log View would use the following syntax: (-attack=*botnet* and logid=0000000013). See the example below.
   
   In order to filter the same content for event handlers, the generic text filter would use the following syntax: (attack!~botnet and logid==0000000013). See the example below.
   Some filter syntax would work well in Log View but not for event handlers. For example: Filters (filter<value, filter>value and -filter=value etc.) may work well in Log View, but not for event handlers.
2. After this enhancement, FortiAnalyzer provide a unified syntax for Log View and event handlers, meaning users can easily use the same filter syntax for both Log View and event handlers. Additionally, new filter syntax support has been added for both Log View and event handlers.
   Below is a comparison of supported syntax filters before and after this enhancement, including new filter syntax support:

   f: filter, v: value		Before Enhancement				After Enhancement
   Filter	sample	logview	logview - fabric	logbrowse	event-handler	logview	logview - fabric	logbrowse	event-handler -
   f=v	user=test	✓	✓	✓	✓	✓	✓	✓	✓
   f!=v	user!=test	✓	✓	X	✓	✓	✓	✓	✓
   not f=v	not user=test	✓	✓	X	✓	✓	✓	✓	✓
   f='', f="", f="''"	user='', user="", user="''"	✓	✓	✓	✓	✓	✓	✓	✓
   f!='', f!="", f!="''"	user!='', user!="", user!="''"	✓	✓	X	✓	✓	✓	✓	✓
   f isnull	user isnull	X	X	X	X	✓	✓	✓	✓
   f isnotnull	user isnotnull	X	X	X	X	✓	✓	✓	✓
   f like 'v%'	user like 'test%'	X	X	X	X	✓	✓	✓	✓
   f like '__v%'	user like '__st%'	X	X	X	X	✓	✓	✓	✓
   f="v*"	user="test*"	✓	✓	✓	✓	✓	✓	✓	✓
   f!="v*"	user!="test*"	✓	✓	X	✓	✓	✓	✓	✓
   flt and flt	user=test and service=http	✓	✓	✓	✓	✓	✓	✓	✓
   flt && flt	user=test && service=http	✓	✓	✓	✓	✓	✓	✓	✓
   flt or flt	user=test or service=http	✓	✓	✓	✓	✓	✓	✓	✓
   flt || flt	user=test || service=http	✓	✓	X	✓	✓	✓	✓	✓
   -f=v	-user="test"	✓	✓	✓	X	✓	✓	✓	✓
   f~v	user~"test"	✓	X	X	✓	✓	✓	✓	✓
   f!~v	user!~"test"	✓	X	X	✓	✓	✓	✓	✓
   f~"v*"	user~"test*"	✓	X	X	✓	✓	✓	✓	✓
   f!~"v*"	user!~"test*"	✓	X	X	✓	✓	✓	✓	✓
   f~"v.*"	user~"test.*"	✓	X	X	✓	✓	Does not work for String	✓	✓
   f!~"v.*"	user!~"test.*"	✓	X	X	✓	✓	Does not work for String	✓	✓
   f>n, f<n	countips>1 countips<1	✓	✓	✓	✓	✓	✓	✓	✓
   f<=n, f>=n	countips<=1 countips>=1	✓	✓	X	✓	✓	✓	✓	✓
   f<>v, f<>n	user<>"test", countips<>1	✓	✓	X	X	✓	✓	✓	✓