plan_filter

Overview

Maintained RPM/DEB recipes and versioned source are 1.0.0; local package matrix on 2026-10-10 has RPM 1.0.0 and DEB 0.0.1. Retain maintained DEB 1.0.0; repository publication is a separate check.

Version

Build

You can build the RPM / DEB packages for pg_plan_filter using pig build:

pig build pkg pg_plan_filter         # build RPM / DEB packages

Install

You can install pg_plan_filter directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

pig install pg_plan_filter;          # Install for current active PG version

pig ext install -y pg_plan_filter -v 18  # PG 18
pig ext install -y pg_plan_filter -v 17  # PG 17
pig ext install -y pg_plan_filter -v 16  # PG 16
pig ext install -y pg_plan_filter -v 15  # PG 15
pig ext install -y pg_plan_filter -v 14  # PG 14

dnf install -y pg_plan_filter_18       # PG 18
dnf install -y pg_plan_filter_17       # PG 17
dnf install -y pg_plan_filter_16       # PG 16
dnf install -y pg_plan_filter_15       # PG 15
dnf install -y pg_plan_filter_14       # PG 14

apt install -y postgresql-18-pg-plan-filter   # PG 18
apt install -y postgresql-17-pg-plan-filter   # PG 17
apt install -y postgresql-16-pg-plan-filter   # PG 16
apt install -y postgresql-15-pg-plan-filter   # PG 15
apt install -y postgresql-14-pg-plan-filter   # PG 14

Preload:

shared_preload_libraries = 'plan_filter';

Usage

Sources:

• README.md
• Makefile
• License

plan_filter is the loadable library in pg_plan_filter 1.0.0. It rejects statements or transactions whose estimated plan cost exceeds configured limits. It supports PostgreSQL 14–18 and has no SQL extension to create.

Core Workflow

shared_preload_libraries = 'plan_filter'
plan_filter.statement_cost_limit = 100000.0
plan_filter.transaction_cost_limit = 500000.0
plan_filter.filter_select_only = false

SELECT current_setting('plan_filter.module_loaded', true) IS NOT NULL AS active;

Operational Boundaries

Append the library to the existing preload list and restart; LOAD is also supported for development and testing. Both cost limits default to zero, disabling enforcement. plan_filter.statement_cost_limit caps a single plan and can also reject expensive plain EXPLAIN. plan_filter.transaction_cost_limit charges every execution, including repeated prepared statements; rolling back to a savepoint does not refund the budget. Plain EXPLAIN does not consume the transaction budget, while plan-bearing utility commands do.

plan_filter.filter_select_only applies both limits only to SELECT when true; SELECT can still have side effects. plan_filter.module_loaded is a read-only presence signal. The limit settings require superuser or explicitly granted parameter-setting privileges. Rejection uses SQLSTATE 54001. Cost is an estimate rather than elapsed time, and ordinary roles can lower planner cost settings to evade the threshold. Use this as cooperative protection against accidental load, not as the sole security boundary against hostile sessions.