Skip to content

Commit 197894a

Browse files
rw-accessrw-access
authored
EQL: Remove parser handling for functions (#54028)
* EQL: Remove parser handling for functions * EQL: Comment out array functions in queries-unsupported.eql
1 parent fe24848 commit 197894a

File tree

5 files changed

+44
-97
lines changed

5 files changed

+44
-97
lines changed

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlParser.java‎

Lines changed: 1 addition & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ public class EqlParser {
4343
public LogicalPlan createStatement(String eql) {
4444
return createStatement(eql, new ParserParams());
4545
}
46-
46+
4747
public LogicalPlan createStatement(String eql, ParserParams params) {
4848
if (log.isDebugEnabled()) {
4949
log.debug("Parsing as statement: {}", eql);
@@ -133,51 +133,6 @@ private class PostProcessor extends EqlBaseBaseListener {
133133
this.ruleNames = ruleNames;
134134
}
135135

136-
137-
@Override
138-
public void exitFunctionExpression(EqlBaseParser.FunctionExpressionContext context) {
139-
Token token = context.name;
140-
String functionName = token.getText();
141-
142-
switch (functionName) {
143-
case "add":
144-
case "between":
145-
case "cidrMatch":
146-
case "concat":
147-
case "divide":
148-
case "endsWith":
149-
case "indexOf":
150-
case "length":
151-
case "match":
152-
case "modulo":
153-
case "multiply":
154-
case "number":
155-
case "startsWith":
156-
case "string":
157-
case "stringContains":
158-
case "substring":
159-
case "subtract":
160-
case "wildcard":
161-
break;
162-
163-
case "arrayContains":
164-
case "arrayCount":
165-
case "arraySearch":
166-
throw new ParsingException(
167-
"Unsupported function [" + functionName + "]",
168-
null,
169-
token.getLine(),
170-
token.getCharPositionInLine());
171-
172-
default:
173-
throw new ParsingException(
174-
"Unknown function [" + functionName + "]",
175-
null,
176-
token.getLine(),
177-
token.getCharPositionInLine());
178-
}
179-
}
180-
181136
@Override
182137
public void exitJoin(EqlBaseParser.JoinContext context) {
183138
Token token = context.JOIN().getSymbol();

‎x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/analysis/VerifierTests.java‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -113,20 +113,20 @@ public void testJoinUnsupported() {
113113

114114
// Some functions fail with "Unsupported" message at the parse stage
115115
public void testArrayFunctionsUnsupported() {
116-
assertEquals("1:16: Unsupported function [arrayContains]",
117-
errorParsing("registry where arrayContains(bytes_written_string_list, 'En')"));
118-
assertEquals("1:16: Unsupported function [arraySearch]",
119-
errorParsing("registry where arraySearch(bytes_written_string_list, a, a == 'en-us')"));
120-
assertEquals("1:16: Unsupported function [arrayCount]",
121-
errorParsing("registry where arrayCount(bytes_written_string_list, s, s == '*-us') == 1"));
116+
assertEquals("1:16: Unknown function [arrayContains]",
117+
error("registry where arrayContains(bytes_written_string_list, 'En')"));
118+
assertEquals("1:16: Unknown function [arraySearch]",
119+
error("registry where arraySearch(bytes_written_string_list, bytes_written_string, true)"));
120+
assertEquals("1:16: Unknown function [arrayCount]",
121+
error("registry where arrayCount(bytes_written_string_list, bytes_written_string, true) == 1"));
122122
}
123123

124124
// Some functions fail with "Unknown" message at the parse stage
125125
public void testFunctionParsingUnknown() {
126126
assertEquals("1:15: Unknown function [matchLite]",
127-
errorParsing("process where matchLite(?'.*?net1\\s+localgroup\\s+.*?', command_line)"));
127+
error("process where matchLite(?'.*?net1\\s+localgroup\\s+.*?', command_line)"));
128128
assertEquals("1:15: Unknown function [safe]",
129-
errorParsing("network where safe(divide(process_name, process_name))"));
129+
error("network where safe(process_name)"));
130130
}
131131

132132
// Test the known EQL functions that are not supported

‎x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/planner/QueryFolderOkTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ public void test() {
9494
PhysicalPlan p = plan(query);
9595
assertEquals(EsQueryExec.class, p.getClass());
9696
EsQueryExec eqe = (EsQueryExec) p;
97-
assertEquals(23, eqe.output().size());
97+
assertEquals(25, eqe.output().size());
9898
assertEquals(KEYWORD, eqe.output().get(0).dataType());
9999

100100
final String query = eqe.queryContainer().toString().replaceAll("\\s+", "");

‎x-pack/plugin/eql/src/test/resources/mapping-default.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
{
22
"properties" : {
3+
"bytes_written_string" : {
4+
"type" : "keyword"
5+
},
6+
"bytes_written_string_list" : {
7+
"type" : "keyword"
8+
},
39
"command_line" : {
410
"type" : "keyword"
511
},

‎x-pack/plugin/eql/src/test/resources/queries-unsupported.eql‎

Lines changed: 28 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -626,58 +626,44 @@ any where process_name == "svchost.exe"
626626
;
627627

628628

629-
// array functions
630-
registry where arrayContains(bytes_written_string_list, 'En-uS');
631-
registry where arrayContains(bytes_written_string_list, 'En');
629+
// Array functions
630+
// * parser will recognize as valid, but functions will fail to resolve in verifier
632631

633632

634-
network where mysterious_field
635-
and arraySearch(mysterious_field.subarray, s, true)
636-
;
633+
// registry where arrayContains(bytes_written_string_list, 'En-uS');
634+
// registry where arrayContains(bytes_written_string_list, 'En');
637635

638-
registry where arraySearch(bytes_written_string_list, a, a == 'en-us');
636+
// network where mysterious_field
637+
// and arraySearch(mysterious_field.subarray, s, true);
639638

640-
registry where arraySearch(bytes_written_string_list, a, endsWith(a, '-us'));
639+
// registry where arraySearch(bytes_written_string_list, a, a == 'en-us');
640+
// registry where arraySearch(bytes_written_string_list, a, endsWith(a, '-us'));
641+
// network where mysterious_field and arraySearch(mysterious_field.subarray, s, false);
642+
// network where mysterious_field and arraySearch(mysterious_field.subarray, s, s.a == 's0-*');
643+
// network where mysterious_field and arraySearch(mysterious_field.subarray, s, s.a != 's0-*');
641644

645+
// network where mysterious_field
646+
// and arraySearch(mysterious_field.subarray, sub1,
647+
// arraySearch(sub1.c, nested, nested.x.y == '*'))
648+
// ;
642649

643-
network where mysterious_field and arraySearch(mysterious_field.subarray, s, false)
644-
;
650+
// network where mysterious_field
651+
// and arraySearch(mysterious_field.subarray, sub1,
652+
// sub1.a == 's0-a' and arraySearch(sub1.c, nested, nested.z == 's0-c1-x-z'))
653+
// ;
645654

646-
network where mysterious_field and arraySearch(mysterious_field.subarray, s, s.a == 's0-*')
647-
;
655+
// network where mysterious_field
656+
// and arraySearch(mysterious_field.subarray, sub1,
657+
// sub1.a == 's0-a' and arraySearch(sub1.c, nested, nested.z == sub1.cross_match));
648658

649-
network where mysterious_field and arraySearch(mysterious_field.subarray, s, s.a != 's0-*')
650-
;
659+
// network where mysterious_field
660+
// and arraySearch(mysterious_field.subarray, sub1,
661+
// arraySearch(sub1.c, nested, nested.x.y == mysterious_field.outer_cross_match));
651662

652-
network where mysterious_field
653-
and arraySearch(mysterious_field.subarray, sub1,
654-
arraySearch(sub1.c, nested, nested.x.y == '*'))
655-
;
656-
657-
network where mysterious_field
658-
and arraySearch(mysterious_field.subarray, sub1,
659-
sub1.a == 's0-a' and arraySearch(sub1.c, nested, nested.z == 's0-c1-x-z'))
660-
;
661-
662-
network where mysterious_field
663-
and arraySearch(mysterious_field.subarray, sub1,
664-
sub1.a == 's0-a' and arraySearch(sub1.c, nested, nested.z == sub1.cross_match))
665-
;
663+
// registry where arrayCount(bytes_written_string_list, s, s == '*-us') == 1;
664+
// registry where arrayCount(bytes_written_string_list, s, s == '*en*') == 2;
665+
// registry where arrayContains(bytes_written_string_list, "missing", "en-US");
666666

667-
network where mysterious_field
668-
and arraySearch(mysterious_field.subarray, sub1,
669-
arraySearch(sub1.c, nested, nested.x.y == mysterious_field.outer_cross_match))
670-
;
671-
672-
673-
registry where arrayCount(bytes_written_string_list, s, s == '*-us') == 1
674-
;
675-
676-
registry where arrayCount(bytes_written_string_list, s, s == '*en*') == 2
677-
;
678-
679-
registry where arrayContains(bytes_written_string_list, "missing", "en-US")
680-
;
681667

682668
// array fields
683669

0 commit comments

Comments
 (0)