correct comments

src/datadog/grok/parse_grok.rs

@@ -1021,33 +1021,33 @@ mod tests {
     #[test]
     fn parses_with_new_lines() {
         test_full_grok(vec![
-            // multiline mode is enabled by default
+            // the DOTALL mode is enabled by default
             (
                 "%{data:field}",
                 "a\nb",
                 Ok(Value::from(btreemap! {
                     "field" => "a\nb"
                 })),
             ),
+            // (?s) enables the DOTALL mode
             (
-                "%{data:line1}\n%{data:line2}",
+                "(?s)%{data:field}",
                 "a\nb",
                 Ok(Value::from(btreemap! {
-                    "line1" => "a",
-                    "line2" => "b"
+                    "field" => "a\nb"
                 })),
             ),
-            // (?s) is not supported by the underlying regex engine(onig) - it uses (?m) instead, so we convert it silently
             (
-                "(?s)%{data:field}",
+                "%{data:line1}\n%{data:line2}",
                 "a\nb",
                 Ok(Value::from(btreemap! {
-                    "field" => "a\nb"
+                    "line1" => "a",
+                    "line2" => "b"
                 })),
             ),
-            // disable DOTALL mode with (?-s)
+            // disable the DOTALL mode with (?-s)
             ("(?s)(?-s)%{data:field}", "a\nb", Err(Error::NoMatch)),
-            // disable and then enable DOTALL mode
+            // disable and then enable the DOTALL mode
             (
                 "(?-s)%{data:field} (?s)%{data:field}",
                 "abc d\ne",

src/datadog/grok/parse_grok_rules.rs

@@ -176,12 +176,13 @@ fn parse_pattern(
 ) -> Result<GrokRule, Error> {
     parse_grok_rule(pattern, context)?;
     let mut pattern = String::new();
+    // In Oniguruma the (?m) modifier is used to enable the DOTALL mode(dot includes newlines),
+    // as opposed to the (?s) modifier in other regex flavors.
     // \A, \z - parses from the beginning to the end of string, not line(until \n)
-    pattern.push_str(r"(?m)\A"); // (?m) enables multiline mode
+    pattern.push_str(r"(?m)\A"); // (?m) enables the DOTALL mode by default
     pattern.push_str(&context.regex);
     pattern.push_str(r"\z");
 
-    // our regex engine(onig) uses (?m) mode modifier instead of (?s) to make the dot match all characters
     pattern = pattern.replace("(?s)", "(?m)").replace("(?-s)", "(?-m)");
 
     // compile pattern