Sergey Polzunov
1fb60d6475
* first pass * Adding a dedicated code checking workflow * Type fixes * linting config and python version bump * Type hints * Drop incorrect config option * More fixes * Style fixes * CI adjustments * Pyproject fixes * CI & pyproject fixes * Proper version bump * Tests formatting * Resolve cirtular dependency * Test fixes * Make sure the tests are formatted correctly * Check tweaks * Bumping python version in CI images * Pin marshmallow do 3.x because 4.x is not supported * License fix * Convert path to str * Making myself a codeowner * Missing kwargs param * Adding a missing kwargs to `set_score` * Update .github/CODEOWNERS Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Dropping unnecessary raise * Dropping skipped test * Drop unnecessary var * Drop unused commented-out func * Disable typehinting for the whole func * Update linting command * Invalid type hist on the input param * Incorrect field type * Incorrect value used fix * Stricter values check * Simpler function call * Type condition fix * TOML formatter fix * Simpligy output conditions * Formatting * Use proper types instead of aliases * MITRE attack fixes * Using pathlib.Path for an argument * Use proper method to update a set from a dict * First round of `ruff` fixes * More fixes * More fixes * Hack against cyclic dependency * Ignore `PLC0415` * Remove unused markers * Cleanup * Fixing the incorrect condition * Update .github/CODEOWNERS Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Set explicit default values for optional fields * Update the guidelines * Adding None Defaults --------- Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>
88 lines
3.6 KiB
Python
88 lines
3.6 KiB
Python
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
|
# or more contributor license agreements. Licensed under the Elastic License
|
|
# 2.0; you may not use this file except in compliance with the Elastic License
|
|
# 2.0.
|
|
|
|
import unittest
|
|
|
|
import kql
|
|
from kql.ast import (
|
|
Exists,
|
|
Field,
|
|
FieldComparison,
|
|
FieldRange,
|
|
Number,
|
|
String,
|
|
)
|
|
|
|
|
|
class ParserTests(unittest.TestCase):
|
|
def validate(self, source, tree, *args, **kwargs):
|
|
kwargs.setdefault("optimize", False)
|
|
self.assertEqual(kql.parse(source, *args, **kwargs), tree)
|
|
|
|
def test_keyword(self):
|
|
schema = {
|
|
"a.text": "text",
|
|
"a.keyword": "keyword",
|
|
"b": "long",
|
|
}
|
|
|
|
self.validate("a.text:hello", FieldComparison(Field("a.text"), String("hello")), schema=schema)
|
|
self.validate("a.keyword:hello", FieldComparison(Field("a.keyword"), String("hello")), schema=schema)
|
|
|
|
self.validate('a.text:"hello"', FieldComparison(Field("a.text"), String("hello")), schema=schema)
|
|
self.validate('a.keyword:"hello"', FieldComparison(Field("a.keyword"), String("hello")), schema=schema)
|
|
|
|
self.validate("a.text:1", FieldComparison(Field("a.text"), String("1")), schema=schema)
|
|
self.validate("a.keyword:1", FieldComparison(Field("a.keyword"), String("1")), schema=schema)
|
|
|
|
self.validate('a.text:"1"', FieldComparison(Field("a.text"), String("1")), schema=schema)
|
|
self.validate('a.keyword:"1"', FieldComparison(Field("a.keyword"), String("1")), schema=schema)
|
|
|
|
def test_conversion(self):
|
|
schema = {"num": "long", "text": "text"}
|
|
|
|
self.validate("num:1", FieldComparison(Field("num"), Number(1)), schema=schema)
|
|
self.validate('num:"1"', FieldComparison(Field("num"), Number(1)), schema=schema)
|
|
|
|
self.validate("text:1", FieldComparison(Field("text"), String("1")), schema=schema)
|
|
self.validate('text:"1"', FieldComparison(Field("text"), String("1")), schema=schema)
|
|
|
|
def test_list_equals(self):
|
|
self.assertEqual(kql.parse("a:(1 or 2)", optimize=False), kql.parse("a:(2 or 1)", optimize=False))
|
|
|
|
def test_number_exists(self):
|
|
self.assertEqual(kql.parse("foo:*", schema={"foo": "long"}), FieldComparison(Field("foo"), Exists()))
|
|
|
|
def test_multiple_types_success(self):
|
|
schema = {"common.a": "keyword", "common.b": "keyword"}
|
|
self.validate('common.* : "hello"', FieldComparison(Field("common.*"), String("hello")), schema=schema)
|
|
|
|
def test_multiple_types_fail(self):
|
|
with self.assertRaises(kql.KqlParseError):
|
|
kql.parse('common.* : "hello"', schema={"common.a": "keyword", "common.b": "ip"})
|
|
|
|
def test_number_wildcard_fail(self):
|
|
with self.assertRaises(kql.KqlParseError):
|
|
kql.parse("foo:*wc", schema={"foo": "long"})
|
|
|
|
with self.assertRaises(kql.KqlParseError):
|
|
kql.parse("foo:wc*", schema={"foo": "long"})
|
|
|
|
def test_type_family_success(self):
|
|
kql.parse("abc : 1.2345", schema={"abc": "scaled_float"})
|
|
kql.parse("abc : hello", schema={"abc": "annotated-text"})
|
|
kql.parse("abc >= now-30d", schema={"abc": "date_nanos"})
|
|
|
|
def test_type_family_fail(self):
|
|
with self.assertRaises(kql.KqlParseError):
|
|
kql.parse('foo : "hello world"', schema={"foo": "scaled_float"})
|
|
|
|
def test_date(self):
|
|
schema = {"@time": "date"}
|
|
self.validate("@time <= now-10d", FieldRange(Field("@time"), "<=", String("now-10d")), schema=schema)
|
|
|
|
with self.assertRaises(kql.KqlParseError):
|
|
kql.parse("@time > 5", schema=schema)
|