[patrickbirch]

…_log_filter (PS-11118) 8.4

modified:   docs/write-filter-definitions.md

Change Log (Pass 1)
git diff and git status were checked. The only changed file is docs/write-filter-definitions.md. The hunks are the condition grammar in Basic structure, one cross-reference at the end of Test event field values, and the new Regular expression field conditions section.
Facts added: regex instead of value; where a regex condition is accepted; member rules; string-only fields; ICU pattern rules; unanchored, case-sensitive matching; JSON and SQL escaping; missing fields and empty query text; UTF-8 matching and PS-10355; validation error text and 96-byte truncation; ICU limits 32 and 8000000 bytes; failed-match effects; audit_log_filter_regex_match_errors; the 60-second error-log warning; KILL and MAX_EXECUTION_TIME behavior; compile-once, match-per-evaluation cost; upgrade rejection of older regex+value objects; the pre-upgrade SELECT; downgrade flush and reconnect; replica upgrade order.
Beginner context added from this manual: AUDIT_ADMIN, install link, audit_log_filter_set_filter() / audit_log_filter_flush() around the sample JSON, reconnect after flush (8.4.9-9), a JSON_OBJECT() example that uses [0-9]+, and the existing print rule that a false condition replaces the field. Example filter names are log_tpcc_tables and log_digit_tables.
The general-class connection id is named general_connection_id, which is the name in Audit Log Filter definition fields. The source notes said connection_id for the general, connection, and table_access classes.
No bracketed placeholders.
Not edited in this pass: the field row in docs/filter-audit-log-filter-files.md, and the status-variable table in docs/audit-log-filter-variables.md. The new counter is documented only in the new section. There is no 8.4.13 release-notes page in this tree.