@VisibleForTesting
  public List<FileStatus> pruneFiles(final SearchArgument sarg, final long timeSliceSeconds,
    final List<FileStatus> inputFiles) {
    int tsExpr = 0;
    List<PredicateLeaf> predLeaves = sarg.getLeaves();
    SearchArgument.TruthValue[] truthValues = new SearchArgument.TruthValue[predLeaves.size()];
    PredicateLeaf tsPred = null;
    for (int i = 0; i < truthValues.length; i++) {
      if (!predLeaves.get(i).getColumnName().equalsIgnoreCase("ts")) {
        truthValues[i] = SearchArgument.TruthValue.YES_NO_NULL;
      } else {
        tsPred = predLeaves.get(i);
        tsExpr++;
      }
    }
    // multiple expressions on 'ts' columns are not supported
    if (tsExpr == 0 || tsExpr > 1) {
      // no expressions on timestamp column or multi-expression
      if (tsExpr == 0) {
        LOG.warn("No filter expression on 'ts' column. Skipping file pruning..");
      } else {
        LOG.warn("Multi-filter expression ({}) on 'ts' column is not supported. Skipping file pruning..", tsExpr);
      }
      return inputFiles;
    }

    // only BETWEEN filter is supported
    if (tsPred.getOperator() == PredicateLeaf.Operator.BETWEEN) {
      List<FileStatus> selectedFiles = new ArrayList<>();
      List<Object> objects = tsPred.getLiteralList();

      Timestamp left = (Timestamp) objects.get(0);
      Timestamp right = (Timestamp) objects.get(1);
      // file pruning does not handle seconds and millis granularity.
      // so we round to nearest minute (left = floor) and (right = ceil).
      Timestamp predLowerBound = roundupToMinuteFloor(left);
      Timestamp predUpperBound = roundupToMinuteCeil(right);

      // we have left and right values from BETWEEN expression. For each file we have a start timestamp (from filename)
      // and end timestamp (start + timeslice). We compare the predicates with start and end timestamp of each file
      // and see if it falls within the range.
      for (FileStatus fileStatus : inputFiles) {
        Timestamp fileLowerBound = getTimeStampFromPath(fileStatus);
        if (fileLowerBound != null) {
          Timestamp fileUpperBound = Timestamp.from(fileLowerBound.toInstant().plusSeconds(timeSliceSeconds));
          Location predLowerLocation;
          Location predUpperLocation = null;
          predLowerLocation = compareToRange(predLowerBound, fileLowerBound, fileUpperBound);
          boolean selected = false;
          if (predLowerLocation == Location.BEFORE || predLowerLocation == Location.MIN) {
            predUpperLocation = compareToRange(predUpperBound, fileLowerBound, fileUpperBound);
            if (predUpperLocation == Location.AFTER || predUpperLocation == Location.MAX) {
              selectedFiles.add(fileStatus);
              selected = true;
            } else if (predUpperLocation == Location.BEFORE) {
              // file skipped (out of range)
            } else {
              selectedFiles.add(fileStatus);
              selected = true;
            }
          } else if (predLowerLocation == Location.AFTER) {
            // file skipped (out of range)
          } else {
            selectedFiles.add(fileStatus);
            selected = true;
          }

          LOG.info("file: {} -> [{}, {}] against predicate [{}({}), {}({})]. selected? {}",
            fileStatus.getPath(), fileLowerBound.toInstant(), fileUpperBound.toInstant(),
            predLowerBound.toInstant(), predLowerLocation, predUpperBound.toInstant(), predUpperLocation, selected);
        } else {
          LOG.warn("Timestamp cannot be extracted from filename. Incorrect file name convention? {}",
            fileStatus.getPath());
          return inputFiles;
        }
      }
      LOG.info("Total selected files: {}", selectedFiles.size());
      return selectedFiles;
    }
    LOG.warn("Unsupported expression ({}) on 'ts' column. Skipping file pruning..", tsPred.getOperator());
    return inputFiles;
  }
Syslog input format handles files written to sys.logs hive table. This input format can prune files based on
predicates in ts (timestamp) column. Following are the assumptions/supported options for the file pruning to work.
When configuring log shippers (like fluentd), the following directory layout has to be followed

WAREHOUSE_DIR/sys.db/logs/dt=DATE/ns=NAMESPACE/app=APPLICATION/YYYY-mm-DD-HH-MM_i[.log][.gz]
WAREHOUSE_DIR - is hive warehouse location for external tables
DATE - date of the log files
NAMESPACE - namespace for the applications
APPLICATION - name of the application (hiveserver2, metastore etc.)
YYYY - year
mm - month
DD - day of the month
HH - hour of the day (24 hr format)
MM - minute
i - index (log rotation)
[.log] - optional log extension
[.gz] - optional gz compression extension

When executing queries like
select count(*) from sys.logs where ts between current_timestamp() - INTERVAL '1' DAY and current_timestamp()

syslog input format can prunes the file listing based on the query filter condition.
File Pruning Assumptions/Support:
- All timestamps are in UTC (timestamp in file name, log lines and in query predicates all assume UTC)
- File names are in YYYY-mm-DD-HH-MM_i[.log][.gz] format.
- Seconds and millis in predicates gets rounded off to nearest minute (essentially ignoring them).
- Time slice used by log aggregation library should match with hive.syslog.input.format.file.time.slice config.
  If a filename is 2019-04-02-21-00_0.log.gz and timeslice is 300s then the file 2019-04-02-21-00_0.log.gz is
  expected to have log lines from timestamp 2019:04:02 21:00:00 to 2019:04:02 21:05:00 timestamp.
- Logs table should have 'ts' as timestamp column.
- Only simple BETWEEN filter predicate is supported for 'ts' column. There cannot be &gt;1 predicates on 'ts' column.
ql/src/java/org/apache/hadoop/hive/ql/log/syslog/SyslogInputFormat.java