Skip to content

Commit 3612111

Browse files
costincostin
committed
EQL: Sequence/Join parsing and model (#54227)
Add parsing and (logical) domain model for sequence and join (cherry picked from commit 9e9632d)
1 parent e9c3bfc commit 3612111

File tree

14 files changed

+907
-227
lines changed

14 files changed

+907
-227
lines changed

‎x-pack/plugin/eql/src/main/antlr/EqlBase.g4‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,13 @@ sequenceParams
3232
sequence
3333
: SEQUENCE (by=joinKeys sequenceParams? | sequenceParams by=joinKeys?)?
3434
sequenceTerm sequenceTerm+
35-
(UNTIL sequenceTerm)?
35+
(UNTIL until=sequenceTerm)?
3636
;
3737

3838
join
3939
: JOIN (by=joinKeys)?
4040
joinTerm joinTerm+
41-
(UNTIL joinTerm)?
41+
(UNTIL until=joinTerm)?
4242
;
4343

4444
pipe

‎x-pack/plugin/eql/src/main/antlr/EqlBase.tokens‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
AND=1
2+
ANY=2
3+
BY=3
4+
FALSE=4
5+
FORK=5
6+
IN=6
7+
JOIN=7
8+
MAXSPAN=8
9+
NOT=9
10+
NULL=10
11+
OF=11
12+
OR=12
13+
SEQUENCE=13
14+
TRUE=14
15+
UNTIL=15
16+
WHERE=16
17+
WITH=17
18+
EQ=18
19+
NEQ=19
20+
LT=20
21+
LTE=21
22+
GT=22
23+
GTE=23
24+
PLUS=24
25+
MINUS=25
26+
ASTERISK=26
27+
SLASH=27
28+
PERCENT=28
29+
DOT=29
30+
COMMA=30
31+
LB=31
32+
RB=32
33+
LP=33
34+
RP=34
35+
PIPE=35
36+
ESCAPED_IDENTIFIER=36
37+
STRING=37
38+
INTEGER_VALUE=38
39+
DECIMAL_VALUE=39
40+
IDENTIFIER=40
41+
LINE_COMMENT=41
42+
BRACKETED_COMMENT=42
43+
WS=43
44+
'and'=1
45+
'any'=2
46+
'by'=3
47+
'false'=4
48+
'fork'=5
49+
'in'=6
50+
'join'=7
51+
'maxspan'=8
52+
'not'=9
53+
'null'=10
54+
'of'=11
55+
'or'=12
56+
'sequence'=13
57+
'true'=14
58+
'until'=15
59+
'where'=16
60+
'with'=17
61+
'!='=19
62+
'<'=20
63+
'<='=21
64+
'>'=22
65+
'>='=23
66+
'+'=24
67+
'-'=25
68+
'*'=26
69+
'/'=27
70+
'%'=28
71+
'.'=29
72+
','=30
73+
'['=31
74+
']'=32
75+
'('=33
76+
')'=34
77+
'|'=35

‎x-pack/plugin/eql/src/main/antlr/EqlBaseLexer.tokens‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
AND=1
2+
ANY=2
3+
BY=3
4+
FALSE=4
5+
FORK=5
6+
IN=6
7+
JOIN=7
8+
MAXSPAN=8
9+
NOT=9
10+
NULL=10
11+
OF=11
12+
OR=12
13+
SEQUENCE=13
14+
TRUE=14
15+
UNTIL=15
16+
WHERE=16
17+
WITH=17
18+
EQ=18
19+
NEQ=19
20+
LT=20
21+
LTE=21
22+
GT=22
23+
GTE=23
24+
PLUS=24
25+
MINUS=25
26+
ASTERISK=26
27+
SLASH=27
28+
PERCENT=28
29+
DOT=29
30+
COMMA=30
31+
LB=31
32+
RB=32
33+
LP=33
34+
RP=34
35+
PIPE=35
36+
ESCAPED_IDENTIFIER=36
37+
STRING=37
38+
INTEGER_VALUE=38
39+
DECIMAL_VALUE=39
40+
IDENTIFIER=40
41+
LINE_COMMENT=41
42+
BRACKETED_COMMENT=42
43+
WS=43
44+
'and'=1
45+
'any'=2
46+
'by'=3
47+
'false'=4
48+
'fork'=5
49+
'in'=6
50+
'join'=7
51+
'maxspan'=8
52+
'not'=9
53+
'null'=10
54+
'of'=11
55+
'or'=12
56+
'sequence'=13
57+
'true'=14
58+
'until'=15
59+
'where'=16
60+
'with'=17
61+
'!='=19
62+
'<'=20
63+
'<='=21
64+
'>'=22
65+
'>='=23
66+
'+'=24
67+
'-'=25
68+
'*'=26
69+
'/'=27
70+
'%'=28
71+
'.'=29
72+
','=30
73+
'['=31
74+
']'=32
75+
'('=33
76+
')'=34
77+
'|'=35

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseParser.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -393,6 +393,7 @@ public final SequenceParamsContext sequenceParams() throws RecognitionException
393393

394394
public static class SequenceContext extends ParserRuleContext {
395395
public JoinKeysContext by;
396+
public SequenceTermContext until;
396397
public TerminalNode SEQUENCE() { return getToken(EqlBaseParser.SEQUENCE, 0); }
397398
public List<SequenceTermContext> sequenceTerm() {
398399
return getRuleContexts(SequenceTermContext.class);
@@ -495,7 +496,7 @@ public final SequenceContext sequence() throws RecognitionException {
495496
setState(94);
496497
match(UNTIL);
497498
setState(95);
498-
sequenceTerm();
499+
((SequenceContext)_localctx).until = sequenceTerm();
499500
}
500501
}
501502

@@ -514,6 +515,7 @@ public final SequenceContext sequence() throws RecognitionException {
514515

515516
public static class JoinContext extends ParserRuleContext {
516517
public JoinKeysContext by;
518+
public JoinTermContext until;
517519
public TerminalNode JOIN() { return getToken(EqlBaseParser.JOIN, 0); }
518520
public List<JoinTermContext> joinTerm() {
519521
return getRuleContexts(JoinTermContext.class);
@@ -585,7 +587,7 @@ public final JoinContext join() throws RecognitionException {
585587
setState(108);
586588
match(UNTIL);
587589
setState(109);
588-
joinTerm();
590+
((JoinContext)_localctx).until = joinTerm();
589591
}
590592
}
591593

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlParser.java‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -133,16 +133,6 @@ private class PostProcessor extends EqlBaseBaseListener {
133133
this.ruleNames = ruleNames;
134134
}
135135

136-
@Override
137-
public void exitJoin(EqlBaseParser.JoinContext context) {
138-
Token token = context.JOIN().getSymbol();
139-
throw new ParsingException(
140-
"Join is not supported",
141-
null,
142-
token.getLine(),
143-
token.getCharPositionInLine());
144-
}
145-
146136
@Override
147137
public void exitPipe(EqlBaseParser.PipeContext context) {
148138
Token token = context.PIPE().getSymbol();
@@ -163,16 +153,6 @@ public void exitProcessCheck(EqlBaseParser.ProcessCheckContext context) {
163153
token.getCharPositionInLine());
164154
}
165155

166-
@Override
167-
public void exitSequence(EqlBaseParser.SequenceContext context) {
168-
Token token = context.SEQUENCE().getSymbol();
169-
throw new ParsingException(
170-
"Sequence is not supported",
171-
null,
172-
token.getLine(),
173-
token.getCharPositionInLine());
174-
}
175-
176156
@Override
177157
public void exitQualifiedName(EqlBaseParser.QualifiedNameContext context) {
178158
if (context.INTEGER_VALUE().size() > 0) {

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/ExpressionBuilder.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.ComparisonContext;
1414
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.DereferenceContext;
1515
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.FunctionExpressionContext;
16+
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.JoinKeysContext;
1617
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.LogicalBinaryContext;
1718
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.LogicalNotContext;
1819
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.PredicateContext;
@@ -46,6 +47,8 @@
4647

4748
import java.util.List;
4849

50+
import static java.util.Collections.emptyList;
51+
4952

5053
public class ExpressionBuilder extends IdentifierBuilder {
5154

@@ -62,6 +65,11 @@ public Expression visitSingleExpression(EqlBaseParser.SingleExpressionContext ct
6265
return expression(ctx.expression());
6366
}
6467

68+
@Override
69+
public List<Expression> visitJoinKeys(JoinKeysContext ctx) {
70+
return ctx != null ? expressions(ctx.expression()) : emptyList();
71+
}
72+
6573
@Override
6674
public Expression visitArithmeticUnary(ArithmeticUnaryContext ctx) {
6775
Expression expr = expression(ctx.valueExpression());

0 commit comments

Comments
 (0)