Skip to content

Conversation

@rw-access
Copy link
Contributor

Relates to #51556

Removed the parser handling for all functions, and letting the Verifier handle it. I commented out the array functions in queries-unsupported.eql, because they on longer raise ParsingExceptions, and only VerifierExceptions.

public void testUnsupportedQueries() throws Exception {
EqlParser parser = new EqlParser();
List<Tuple<String, Integer>> lines = readQueries("/queries-unsupported.eql");
for (Tuple<String, Integer> line : lines) {
String q = line.v1();
ParsingException pe = expectThrows(
ParsingException.class,
"Query not identified as unsupported: " + q,
() -> parser.createStatement(q));

@rw-access rw-access added the :Analytics/EQL EQL querying label Mar 23, 2020
@rw-access rw-access requested a review from costin March 23, 2020 21:21
Copy link
Member

@costin costin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@rw-access rw-access requested a review from astefan March 23, 2020 22:10
Copy link
Contributor

@astefan astefan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rw-access rw-access merged commit 197894a into elastic:master Mar 24, 2020
@rw-access rw-access deleted the eql/unsupported-functions branch March 24, 2020 20:02
rw-access added a commit that referenced this pull request Mar 24, 2020
* EQL: Remove parser handling for functions
* EQL: Comment out array functions in queries-unsupported.eql
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

:Analytics/EQL EQL querying

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants