plan_filter

pg_plan_filter : filter statements by their execution plans.

Overview

Packages

Source

pig build pkg pg_plan_filter;		# build rpm/deb

Install

Make sure PGDG and PIGSTY repo available:

pig repo add pgsql -u   # add both repo and update cache

Install this extension with pig:

pig install pg_plan_filter;		# install via package name, for the active PG version
pig install plan_filter;		# install by extension name, for the current active PG version

pig install plan_filter -v 18;   # install for PG 18
pig install plan_filter -v 17;   # install for PG 17
pig install plan_filter -v 16;   # install for PG 16
pig install plan_filter -v 15;   # install for PG 15
pig install plan_filter -v 14;   # install for PG 14

Config this extension to shared_preload_libraries:

shared_preload_libraries = 'plan_filter';

This extension does not need CREATE EXTENSION DDL command

Usage

Sources:

• README.md
• Makefile
• License

plan_filter is the loadable library in pg_plan_filter 1.0.0. It rejects statements or transactions whose estimated plan cost exceeds configured limits. It supports PostgreSQL 14–18 and has no SQL extension to create.

Core Workflow

shared_preload_libraries = 'plan_filter'
plan_filter.statement_cost_limit = 100000.0
plan_filter.transaction_cost_limit = 500000.0
plan_filter.filter_select_only = false

SELECT current_setting('plan_filter.module_loaded', true) IS NOT NULL AS active;

Operational Boundaries

Append the library to the existing preload list and restart; LOAD is also supported for development and testing. Both cost limits default to zero, disabling enforcement. plan_filter.statement_cost_limit caps a single plan and can also reject expensive plain EXPLAIN. plan_filter.transaction_cost_limit charges every execution, including repeated prepared statements; rolling back to a savepoint does not refund the budget. Plain EXPLAIN does not consume the transaction budget, while plan-bearing utility commands do.

plan_filter.filter_select_only applies both limits only to SELECT when true; SELECT can still have side effects. plan_filter.module_loaded is a read-only presence signal. The limit settings require superuser or explicitly granted parameter-setting privileges. Rejection uses SQLSTATE 54001. Cost is an estimate rather than elapsed time, and ordinary roles can lower planner cost settings to evade the threshold. Use this as cooperative protection against accidental load, not as the sole security boundary against hostile sessions.