Explain the internal working of HertzBeat's ANTLR-based alert expression grammar?

Multi-expression threshold alarms need to parse complex boolean logic across PromQL- and SQL-style syntax reliably, which is fragile to do with regular expressions or hand-rolled string parsing. HertzBeat instead defines an ANTLR v4 grammar for this expression language.

ANTLR generates a parser from the grammar definition that converts a raw expression string into a structured parse tree, rather than matching substrings directly. That tree is then walked and evaluated against the actual metric or log data at alert-check time, correctly handling operator precedence, nested boolean logic (AND/OR/UNLESS), and the boolean modifier used to force an explicit true/false result for logical combinations.

The practical benefit is extensibility: adding a new operator or function to the alert expression language means extending the grammar definition, not rewriting a brittle parsing function by hand, and the generated parser rejects malformed expressions with a clear syntax error rather than silently misbehaving.