EQL: implement cidrMatch function #54186
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| { | ||
| "properties" : { | ||
| "command_line" : { | ||
| "type" : "keyword" | ||
| }, | ||
| "event" : { | ||
| "properties" : { | ||
| "category" : { | ||
| "type" : "keyword" | ||
| } | ||
| } | ||
| }, | ||
| "md5" : { | ||
| "type" : "keyword" | ||
| }, | ||
| "parent_process_name": { | ||
| "type" : "keyword" | ||
| }, | ||
| "parent_process_path": { | ||
| "type" : "keyword" | ||
| }, | ||
| "pid" : { | ||
| "type" : "long" | ||
| }, | ||
| "ppid" : { | ||
| "type" : "long" | ||
| }, | ||
| "process_name": { | ||
| "type" : "keyword" | ||
| }, | ||
| "process_path": { | ||
| "type" : "keyword" | ||
| }, | ||
| "subtype" : { | ||
| "type" : "keyword" | ||
| }, | ||
| "@timestamp" : { | ||
| "type" : "date" | ||
| }, | ||
| "user" : { | ||
| "type" : "keyword" | ||
| }, | ||
| "user_name" : { | ||
| "type" : "keyword" | ||
| }, | ||
| "user_domain": { | ||
| "type" : "keyword" | ||
| }, | ||
| "hostname" : { | ||
| "type" : "text", | ||
| "fields" : { | ||
| "keyword" : { | ||
| "type" : "keyword", | ||
| "ignore_above" : 256 | ||
| } | ||
| } | ||
| }, | ||
| "opcode" : { | ||
| "type" : "long" | ||
| }, | ||
| "file_name" : { | ||
| "type" : "text", | ||
| "fields" : { | ||
| "keyword" : { | ||
| "type" : "keyword", | ||
| "ignore_above" : 256 | ||
| } | ||
| } | ||
| }, | ||
| "serial_event_id" : { | ||
| "type" : "long" | ||
| }, | ||
| "source_address" : { | ||
| "type" : "ip" | ||
| }, | ||
| "exit_code" : { | ||
| "type" : "long" | ||
| } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,108 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.xpack.eql.expression.function.scalar.string; | ||
|
|
||
| import org.elasticsearch.xpack.ql.expression.Expression; | ||
| import org.elasticsearch.xpack.ql.expression.Expressions; | ||
| import org.elasticsearch.xpack.ql.expression.Expressions.ParamOrdinal; | ||
| import org.elasticsearch.xpack.ql.expression.function.scalar.ScalarFunction; | ||
| import org.elasticsearch.xpack.ql.expression.gen.script.ScriptTemplate; | ||
| import org.elasticsearch.xpack.ql.expression.predicate.logical.Or; | ||
| import org.elasticsearch.xpack.ql.expression.predicate.operator.comparison.Equals; | ||
| import org.elasticsearch.xpack.ql.tree.NodeInfo; | ||
| import org.elasticsearch.xpack.ql.tree.Source; | ||
| import org.elasticsearch.xpack.ql.type.DataType; | ||
| import org.elasticsearch.xpack.ql.type.DataTypes; | ||
| import org.elasticsearch.xpack.ql.util.CollectionUtils; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| import static java.util.Collections.singletonList; | ||
| import static org.elasticsearch.xpack.ql.expression.TypeResolutions.isIPAndExact; | ||
| import static org.elasticsearch.xpack.ql.expression.TypeResolutions.isStringAndExact; | ||
|
|
||
| /** | ||
| * EQL specific cidrMatch function | ||
|
Contributor
There was a problem hiding this comment. Personal preference, but I would like to see a useful description of the function. Not even the original EQL documentation is clear imo: https://eql.readthedocs.io/en/latest/query-guide/functions.html
Contributor
Author
There was a problem hiding this comment. Added a couple of more lines with a link to the EQL doc. |
||
| */ | ||
| public class CIDRMatch extends ScalarFunction { | ||
|
|
||
| private final Expression field; | ||
| private final List<Expression> addresses; | ||
|
|
||
| public CIDRMatch(Source source, Expression field, List<Expression> addresses) { | ||
| super(source, CollectionUtils.combine(singletonList(field), addresses)); | ||
| this.field = field; | ||
| this.addresses = addresses; | ||
| } | ||
|
|
||
| @Override | ||
| protected TypeResolution resolveType() { | ||
| if (!childrenResolved()) { | ||
| return new TypeResolution("Unresolved children"); | ||
| } | ||
|
|
||
| TypeResolution resolution = isIPAndExact(field, sourceText(), Expressions.ParamOrdinal.FIRST); | ||
| if (resolution.unresolved()) { | ||
| return resolution; | ||
| } | ||
|
|
||
| for (Expression addr: addresses) { | ||
| // Currently we have limited enum for ordinal numbers | ||
| // So just using default here for error messaging | ||
| resolution = isStringAndExact(addr, sourceText(), ParamOrdinal.DEFAULT); | ||
|
Contributor
Author
There was a problem hiding this comment. The current enum for error messages doesn't work great for variadic type of function. Open to suggestions.
Contributor
There was a problem hiding this comment. I added a method here in my wildcard PR:
Contributor
There was a problem hiding this comment. Also, should these fields also be
Contributor
Author
There was a problem hiding this comment. Cool! Will update after your PR merges.
Contributor
There was a problem hiding this comment. For how to handle functions that deal with a variable list of parameters, I suggest having a look at
Contributor
Author
There was a problem hiding this comment. Relying on the same def builder here that was merged with |
||
| if (resolution.unresolved()) { | ||
| return resolution; | ||
| } | ||
| } | ||
|
|
||
| return resolution; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean foldable() { | ||
| return super.foldable() && field.foldable() && asFunction().foldable(); | ||
rw-access marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| } | ||
|
|
||
| @Override | ||
| public Object fold() { | ||
| return asFunction().fold(); | ||
| } | ||
|
|
||
| @Override | ||
| protected NodeInfo<? extends Expression> info() { | ||
| return NodeInfo.create(this, CIDRMatch::new, field, addresses); | ||
| } | ||
|
|
||
| @Override | ||
| public ScriptTemplate asScript() { | ||
| throw new UnsupportedOperationException(); | ||
| } | ||
|
|
||
| @Override | ||
| public DataType dataType() { | ||
| return DataTypes.BOOLEAN; | ||
| } | ||
|
|
||
| @Override | ||
| public Expression replaceChildren(List<Expression> newChildren) { | ||
| if (newChildren.size() < 2) { | ||
| throw new IllegalArgumentException("expected at least [2] children but received [" + newChildren.size() + "]"); | ||
| } | ||
| return new CIDRMatch(source(), newChildren.get(0), newChildren.subList(1, newChildren.size())); | ||
| } | ||
|
|
||
| public ScalarFunction asFunction() { | ||
| ScalarFunction func = null; | ||
|
|
||
| for (Expression address: addresses) { | ||
| final Equals eq = new Equals(source(), field, address); | ||
| func = (func == null) ? eq : new Or(source(), func, eq); | ||
| } | ||
|
|
||
| return func; | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Needed mapping to IP type, this creating the index with mapping.