Add regex pattern support for breakout filters

Implemented regex pattern matching in breakout filters with two modes:
- r/pattern/ (lowercase): Returns separate metrics for each matching value
- R/pattern/ (uppercase): Returns single aggregated metric for all matches

Features:
- Custom delimiter support: use any character after r/R as delimiter
  (e.g., r/pattern/, r|pattern|, r#pattern#)
- Consistent syntax with literal values (r vs R parallels , vs +)
- OpenSearch regexp query integration for efficient pattern matching

Examples:
- --breakout hostname=r/^worker-.*/ (separate metrics per worker)
- --breakout hostname=R/^client-.*/ (aggregated metric for all clients)
- --breakout dev=r|/dev/sd.*| (custom delimiter for patterns with /)

Implementation:
- Modified getBreakoutAggregation() to exclude fields with R/pattern/
- Updated getMetricGroupsFromBreakouts() to detect and apply regexp filters
- Added comprehensive documentation with examples and use cases

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: atheurer

queries/cdmq/README.md

@@ -406,6 +406,50 @@ This feature is particularly useful when:
 
 **Note**: Each comma-separated value in a breakout filter (e.g., `csid=1,2`) will produce separate metrics in the output, not an aggregated metric. Future enhancements may support aggregation using a different syntax (e.g., `csid=1+2`).
 
+#### Using Regular Expressions in Breakouts
+
+In addition to specifying exact values or lists of values, you can use regular expressions to match multiple values dynamically. This is particularly useful when you want to match values that follow a pattern without knowing all possible values in advance.
+
+**Syntax**: Use `r/pattern/` for separate metrics (one per match) or `R/pattern/` for aggregated metrics (all matches combined).
+
+- **Lowercase `r`**: Each value matching the pattern gets its own metric (similar to `hostname=a,b,c`)
+- **Uppercase `R`**: All values matching the pattern are aggregated into a single metric (similar to future `hostname=a+b+c`)
+
+**Examples:**
+
+```bash
+# Get separate metrics for all worker nodes matching the pattern
+node ./get-metric-data.js --period <UUID> --source mpstat --type Busy-CPU --breakout hostname=r/^worker-.*/
+
+# Get a single aggregated metric for all client nodes
+node ./get-metric-data.js --period <UUID> --source sar-net --type L2-Gbps --breakout hostname=R/^client-.*/
+
+# Mix regex with other filters
+node ./get-metric-data.js --period <UUID> --source mpstat --type Busy-CPU --breakout hostname=r/worker-[0-9]+/,cstype=physical
+
+# Use different delimiter if pattern contains slashes
+node ./get-metric-data.js --period <UUID> --source iostat --type kB-sec --breakout dev=r|/dev/sd.*|
+```
+
+**Custom Delimiter**: The character immediately after `r` or `R` is used as the delimiter. While `/` is conventional, you can use any character (like `|`, `#`, `@`, `~`) if your pattern contains forward slashes.
+
+**Regular Expression Syntax**: The patterns use OpenSearch regex syntax, which is similar to standard regex but with some differences. Common patterns include:
+- `.*` - Match any characters (zero or more)
+- `.+` - Match any characters (one or more)
+- `^` - Match start of string
+- `$` - Match end of string
+- `[0-9]` - Match any digit
+- `[a-z]` - Match any lowercase letter
+- `(a|b)` - Match 'a' or 'b'
+
+**Use Cases:**
+- Match all nodes of a certain type: `hostname=r/^worker-.*/`
+- Match numbered resources: `cpu=r/[0-9]+/`
+- Match specific patterns: `device=r/^eth[0-9]/`
+- Exclude certain patterns: Use regex negative lookahead if needed
+
+**Performance Note**: Regex patterns are evaluated by OpenSearch and may be slower than exact value matches for very large datasets. Use them when the flexibility is needed.
+
 So far all of the metrics have been represented as a single value for a specific time period.  When `--period` is used, the script finds the begin and end times for this period, which in most cases, has a duration equal to the measurement time in the benchmark itself (around 90 seconds in these examples).  One can also specify `--run`, `--begin`,  and `--end` instead of `--period`, should they need to focus on a different period of time.  However, for benchmark metrics (such as uperf), it is important to limit the begin and end to within the actual measurement period for that sample.  Conversely, tool metrics can use a begin and end spanning any time period within the run, as the tool collection tends to run continuously for any particular run.   Whatever time period is used, one can also use `--resolution` to divide this time period into multiple data-samples, in order to generate things like line graphs:
 
     # node ./get-metric-data.js --period 4F1014D6-AD33-11EC-94E3-ADE96E3275F7 --source sar-net --type L2-Gbps --breakout csid=1,cstype=worker,type=physical,direction=tx,dev --filter gt:0.01 --resolution 10

queries/cdmq/cdm.js

@@ -2425,21 +2425,37 @@ getBreakoutAggregation = function (source, type, breakout) {
     breakout.forEach((field) => {
       //if (/([^\=]+)\=([^\=]+)/.exec(field)) {
       var matches = regExp.exec(field);
+      var shouldAggregate = true; // default: include in aggregation
+
       if (matches) {
         //field = $1;
-        field = matches[1];
+        var fieldName = matches[1];
+        var value = matches[2];
+
+        // Check if this is an aggregated regex pattern (R/pattern/)
+        // If uppercase R, we should NOT add this field to the aggregation
+        // (all matches will be combined into a single metric)
+        if (/^R./.test(value)) {
+          shouldAggregate = false;
+        }
+
+        field = fieldName;
+      }
+
+      // Only add to aggregation if shouldAggregate is true
+      if (shouldAggregate) {
+        agg_str +=
+          ',"aggs": { "metric_desc.names.' +
+          field +
+          '": { "terms": ' +
+          '{ "show_term_doc_count_error": true, "size": ' +
+          bigQuerySize +
+          ',' +
+          '"field": "metric_desc.names.' +
+          field +
+          '" }';
+        field_count++;
       }
-      agg_str +=
-        ',"aggs": { "metric_desc.names.' +
-        field +
-        '": { "terms": ' +
-        '{ "show_term_doc_count_error": true, "size": ' +
-        bigQuerySize +
-        ',' +
-        '"field": "metric_desc.names.' +
-        field +
-        '" }';
-      field_count++;
     });
     while (field_count > 0) {
       agg_str += '}}';
@@ -2610,23 +2626,46 @@ getMetricGroupsFromBreakouts = async function (instance, sets, yearDotMonth) {
     }
     // If the breakout contains a match requirement (something like "host=myhost"), then we must add a term filter for it.
     // Multiple values can be specified with commas: "host=a,b,c" which will match any of those values.
-    // Eventually it would be nice to have something other than a match, like a regex: host=/^client/.
+    // Regex patterns can be specified with r/pattern/ (separate metrics) or R/pattern/ (aggregated metric).
     var regExp = /([^\=]+)\=([^\=]+)/;
     set.breakout.forEach((field) => {
       var matches = regExp.exec(field);
       if (matches) {
         field = matches[1];
         value = matches[2];
-        // Check if the value contains multiple comma-separated values
-        var values = value.split(',');
-        if (values.length > 1) {
-          // Multiple values: use "terms" query (note the plural)
+
+        // Check if it's a regex pattern: r/pattern/ or R/pattern/
+        // Group 1: r or R (lowercase = separate metrics, uppercase = aggregated)
+        // Group 2: delimiter character (usually /, but can be any char)
+        // Group 3: the actual regex pattern
+        // \2: backreference to ensure matching closing delimiter
+        var regexMatch = /^([rR])(.)(.+)\2$/.exec(value);
+
+        if (regexMatch) {
+          // It's a regex pattern
+          var isAggregated = regexMatch[1] === 'R';
+          var delimiter = regexMatch[2];
+          var pattern = regexMatch[3];
+
+          // Add regexp filter to OpenSearch query
+          // Both r/pattern/ and R/pattern/ use the same filter,
+          // the difference is in the aggregation (handled in getBreakoutAggregation)
           q.query.bool.filter.push(
-            JSON.parse('{"terms": {"metric_desc.names.' + field + '": ' + JSON.stringify(values) + '}}')
+            JSON.parse('{"regexp": {"metric_desc.names.' + field + '": ' + JSON.stringify(pattern) + '}}')
           );
         } else {
-          // Single value: use "term" query (singular)
-          q.query.bool.filter.push(JSON.parse('{"term": {"metric_desc.names.' + field + '": "' + value + '"}}'));
+          // Not a regex pattern, handle as literal value(s)
+          // Check if the value contains multiple comma-separated values
+          var values = value.split(',');
+          if (values.length > 1) {
+            // Multiple values: use "terms" query (note the plural)
+            q.query.bool.filter.push(
+              JSON.parse('{"terms": {"metric_desc.names.' + field + '": ' + JSON.stringify(values) + '}}')
+            );
+          } else {
+            // Single value: use "term" query (singular)
+            q.query.bool.filter.push(JSON.parse('{"term": {"metric_desc.names.' + field + '": "' + value + '"}}'));
+          }
         }
       }
     });