61 lines
1.6 KiB
Python
61 lines
1.6 KiB
Python
|
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||
|
|
# or more contributor license agreements. Licensed under the Elastic License;
|
||
|
|
# you may not use this file except in compliance with the Elastic License.
|
||
|
|
|
||
|
|
import eql
|
||
|
|
|
||
|
|
from . import ast
|
||
|
|
from .eql2kql import Eql2Kql
|
||
|
|
from .errors import KqlParseError, KqlCompileError
|
||
|
|
from .evaluator import FilterGenerator
|
||
|
|
from .kql2eql import KqlToEQL
|
||
|
|
from .parser import lark_parse, KqlParser
|
||
|
|
|
||
|
|
__version__ = '0.1.4'
|
||
|
|
__all__ = (
|
||
|
|
"ast",
|
||
|
|
"to_eql",
|
||
|
|
"lint",
|
||
|
|
"parse",
|
||
|
|
"from_eql",
|
||
|
|
"get_evaluator",
|
||
|
|
"KqlParseError",
|
||
|
|
"KqlCompileError",
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
def to_eql(text, optimize=True, schema=None):
|
||
|
|
lark_parsed = lark_parse(text)
|
||
|
|
|
||
|
|
converted = KqlToEQL(text, schema=schema).visit(lark_parsed)
|
||
|
|
return converted.optimize(recursive=True) if optimize else converted
|
||
|
|
|
||
|
|
|
||
|
|
def parse(text, optimize=True, schema=None):
|
||
|
|
lark_parsed = lark_parse(text)
|
||
|
|
converted = KqlParser(text, schema=schema).visit(lark_parsed)
|
||
|
|
|
||
|
|
return converted.optimize(recursive=True) if optimize else converted
|
||
|
|
|
||
|
|
|
||
|
|
def lint(text):
|
||
|
|
return parse(text, optimize=True).render()
|
||
|
|
|
||
|
|
|
||
|
|
def from_eql(tree, optimize=True):
|
||
|
|
if not isinstance(tree, eql.ast.EqlNode):
|
||
|
|
try:
|
||
|
|
tree = eql.parse_query(tree, implied_any=True)
|
||
|
|
except eql.EqlSemanticError:
|
||
|
|
tree = eql.parse_expression(tree)
|
||
|
|
|
||
|
|
converted = Eql2Kql().walk(tree)
|
||
|
|
return converted.optimize(recursive=True) if optimize else converted
|
||
|
|
|
||
|
|
|
||
|
|
def get_evaluator(tree, optimize=False):
|
||
|
|
if not isinstance(tree, ast.KqlNode):
|
||
|
|
tree = parse(tree, optimize=optimize)
|
||
|
|
|
||
|
|
return FilterGenerator().filter(tree)
|