{
  "name": "regex_alternation_is_leftmost_first",
  "description": "Both engines resolve alternation leftmost-first, so the earlier branch wins even when a later one would match more. Pinned rather than trusted: this is the kind of semantic two independent implementations can differ on silently, and mask depends on which branch won.",
  "rules": [
    {
      "match": [],
      "actions": [
        {
          "action": "mask",
          "field": "message",
          "pattern": "conn(ect|ected)",
          "replacement": "X"
        }
      ]
    }
  ],
  "inputs": [
    {
      "timestamp_unix_nano": 1000,
      "host": "h1",
      "service": "s1",
      "severity": "SEVERITY_INFO",
      "message": "client connected ok",
      "attributes": {}
    }
  ],
  "expect": [
    {
      "timestamp_unix_nano": 1000,
      "host": "h1",
      "service": "s1",
      "severity": "SEVERITY_INFO",
      "message": "client Xed ok",
      "attributes": {}
    }
  ]
}