Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ channels { WHITESPACE, ERRORCHANNEL }

// COMMAND KEYWORDS
SEARCH: 'SEARCH';
DESCRIBE: 'DESCRIBE';
SHOW: 'SHOW';
FROM: 'FROM';
WHERE: 'WHERE';
FIELDS: 'FIELDS';
Expand All @@ -23,8 +25,16 @@ HEAD: 'HEAD';
TOP: 'TOP';
RARE: 'RARE';
PARSE: 'PARSE';
METHOD: 'METHOD';
REGEX: 'REGEX';
PUNCT: 'PUNCT';
GROK: 'GROK';
PATTERN: 'PATTERN';
PATTERNS: 'PATTERNS';
NEW_FIELD: 'NEW_FIELD';
KMEANS: 'KMEANS';
AD: 'AD';
ML: 'ML';

// COMMAND ASSIST KEYWORDS
AS: 'AS';
Expand All @@ -33,6 +43,7 @@ SOURCE: 'SOURCE';
INDEX: 'INDEX';
D: 'D';
DESC: 'DESC';
CATALOGS: 'CATALOGS';

// CLAUSE KEYWORDS
SORTBY: 'SORTBY';
Expand All @@ -59,6 +70,7 @@ SAMPLE_SIZE: 'SAMPLE_SIZE';
OUTPUT_AFTER: 'OUTPUT_AFTER';
TIME_DECAY: 'TIME_DECAY';
ANOMALY_RATE: 'ANOMALY_RATE';
CATEGORY_FIELD: 'CATEGORY_FIELD';
TIME_FIELD: 'TIME_FIELD';
TIME_ZONE: 'TIME_ZONE';
TRAINING_DATA_SIZE: 'TRAINING_DATA_SIZE';
Expand Down Expand Up @@ -101,6 +113,7 @@ DAY_SECOND: 'DAY_SECOND';
DAY_MINUTE: 'DAY_MINUTE';
DAY_HOUR: 'DAY_HOUR';
YEAR_MONTH: 'YEAR_MONTH';
CONVERT_TZ: 'CONVERT_TZ';

// DATASET TYPES
DATAMODEL: 'DATAMODEL';
Expand Down Expand Up @@ -168,6 +181,7 @@ VAR_POP: 'VAR_POP';
STDDEV_SAMP: 'STDDEV_SAMP';
STDDEV_POP: 'STDDEV_POP';
PERCENTILE: 'PERCENTILE';
TAKE: 'TAKE';
FIRST: 'FIRST';
LAST: 'LAST';
LIST: 'LIST';
Expand Down Expand Up @@ -222,21 +236,39 @@ TAN: 'TAN';

// DATE AND TIME FUNCTIONS
ADDDATE: 'ADDDATE';
CURDATE: 'CURDATE';
CURRENT_DATE: 'CURRENT_DATE';
CURRENT_TIME: 'CURRENT_TIME';
CURRENT_TIMESTAMP: 'CURRENT_TIMESTAMP';
CURTIME: 'CURTIME';
DATE: 'DATE';
DATE_ADD: 'DATE_ADD';
DATE_FORMAT: 'DATE_FORMAT';
DATE_SUB: 'DATE_SUB';
DAYNAME: 'DAYNAME';
DAYOFMONTH: 'DAYOFMONTH';
DAYOFWEEK: 'DAYOFWEEK';
DAYOFYEAR: 'DAYOFYEAR';
DAYNAME: 'DAYNAME';
FROM_DAYS: 'FROM_DAYS';
LOCALTIME: 'LOCALTIME';
LOCALTIMESTAMP: 'LOCALTIMESTAMP';
FROM_UNIXTIME: 'FROM_UNIXTIME';
MAKEDATE: 'MAKEDATE';
MAKETIME: 'MAKETIME';
MONTHNAME: 'MONTHNAME';
NOW: 'NOW';
PERIOD_ADD: 'PERIOD_ADD';
PERIOD_DIFF: 'PERIOD_DIFF';
SUBDATE: 'SUBDATE';
SYSDATE: 'SYSDATE';
TIME: 'TIME';
TIME_TO_SEC: 'TIME_TO_SEC';
TIMESTAMP: 'TIMESTAMP';
DATE_FORMAT: 'DATE_FORMAT';
TO_DAYS: 'TO_DAYS';
UTC_DATE: 'UTC_DATE';
UTC_TIME: 'UTC_TIME';
UTC_TIMESTAMP: 'UTC_TIMESTAMP';
UNIX_TIMESTAMP: 'UNIX_TIMESTAMP';

// TEXT FUNCTIONS
SUBSTR: 'SUBSTR';
Expand Down Expand Up @@ -267,11 +299,16 @@ ISNOTNULL: 'ISNOTNULL';
IFNULL: 'IFNULL';
NULLIF: 'NULLIF';
IF: 'IF';
TYPEOF: 'TYPEOF';

// RELEVANCE FUNCTIONS AND PARAMETERS
MATCH: 'MATCH';
MATCH_PHRASE: 'MATCH_PHRASE';
MATCH_PHRASE_PREFIX: 'MATCH_PHRASE_PREFIX';
MATCH_BOOL_PREFIX: 'MATCH_BOOL_PREFIX';
SIMPLE_QUERY_STRING: 'SIMPLE_QUERY_STRING';
MULTI_MATCH: 'MULTI_MATCH';
QUERY_STRING: 'QUERY_STRING';

ALLOW_LEADING_WILDCARD: 'ALLOW_LEADING_WILDCARD';
ANALYZE_WILDCARD: 'ANALYZE_WILDCARD';
Expand All @@ -282,6 +319,7 @@ CUTOFF_FREQUENCY: 'CUTOFF_FREQUENCY';
DEFAULT_FIELD: 'DEFAULT_FIELD';
DEFAULT_OPERATOR: 'DEFAULT_OPERATOR';
ENABLE_POSITION_INCREMENTS: 'ENABLE_POSITION_INCREMENTS';
ESCAPE: 'ESCAPE';
FLAGS: 'FLAGS';
FUZZY_MAX_EXPANSIONS: 'FUZZY_MAX_EXPANSIONS';
FUZZY_PREFIX_LENGTH: 'FUZZY_PREFIX_LENGTH';
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,20 +14,34 @@ root

/** statement */
pplStatement
: searchCommand (PIPE commands)*
: pplCommands (PIPE commands)*
;

/** commands */
pplCommands
: searchCommand
| describeCommand
| showCatalogsCommand
;

commands
: whereCommand | fieldsCommand | renameCommand | statsCommand | dedupCommand | sortCommand | evalCommand | headCommand
| topCommand | rareCommand | parseCommand | kmeansCommand | adCommand;
| topCommand | rareCommand | grokCommand | parseCommand | patternsCommand | kmeansCommand | adCommand | mlCommand;

searchCommand
: (SEARCH)? fromClause #searchFrom
| (SEARCH)? fromClause logicalExpression #searchFromFilter
| (SEARCH)? logicalExpression fromClause #searchFilterFrom
;

describeCommand
: DESCRIBE tableSourceClause
;

showCatalogsCommand
: SHOW CATALOGS
;

whereCommand
: WHERE logicalExpression
;
Expand Down Expand Up @@ -85,10 +99,27 @@ rareCommand
(byClause)?
;

grokCommand
: GROK (source_field=expression) (pattern=stringLiteral)
;

parseCommand
: PARSE expression pattern
: PARSE (source_field=expression) (pattern=stringLiteral)
;


patternsCommand
: PATTERNS (patternsParameter)* (source_field=expression)
;

patternsParameter
: (NEW_FIELD EQUAL new_field=stringLiteral)
| (PATTERN EQUAL pattern=stringLiteral)
;

patternsMethod
: PUNCT | REGEX
;

kmeansCommand
: KMEANS (kmeansParameter)*
;
Expand All @@ -110,17 +141,32 @@ adParameter
| (OUTPUT_AFTER EQUAL output_after=integerLiteral)
| (TIME_DECAY EQUAL time_decay=decimalLiteral)
| (ANOMALY_RATE EQUAL anomaly_rate=decimalLiteral)
| (CATEGORY_FIELD EQUAL category_field=stringLiteral)
| (TIME_FIELD EQUAL time_field=stringLiteral)
| (DATE_FORMAT EQUAL date_format=stringLiteral)
| (TIME_ZONE EQUAL time_zone=stringLiteral)
| (TRAINING_DATA_SIZE EQUAL training_data_size=integerLiteral)
| (ANOMALY_SCORE_THRESHOLD EQUAL anomaly_score_threshold=decimalLiteral)
;

mlCommand
: ML (mlArg)*
;

mlArg
: (argName=ident EQUAL argValue=literalValue)
;

/** clauses */
fromClause
: SOURCE EQUAL tableSource (COMMA tableSource)*
| INDEX EQUAL tableSource (COMMA tableSource)*
: SOURCE EQUAL tableSourceClause
| INDEX EQUAL tableSourceClause
| SOURCE EQUAL tableFunction
| INDEX EQUAL tableFunction
;

tableSourceClause
: tableSource (COMMA tableSource)*
;

renameClasue
Expand Down Expand Up @@ -164,12 +210,17 @@ statsFunction
| COUNT LT_PRTHS RT_PRTHS #countAllFunctionCall
| (DISTINCT_COUNT | DC) LT_PRTHS valueExpression RT_PRTHS #distinctCountFunctionCall
| percentileAggFunction #percentileAggFunctionCall
| takeAggFunction #takeAggFunctionCall
;

statsFunctionName
: AVG | COUNT | SUM | MIN | MAX | VAR_SAMP | VAR_POP | STDDEV_SAMP | STDDEV_POP
;

takeAggFunction
: TAKE LT_PRTHS fieldExpression (COMMA size=integerLiteral)? RT_PRTHS
;

percentileAggFunction
: PERCENTILE LESS value=integerLiteral GREATER LT_PRTHS aggField=fieldExpression RT_PRTHS
;
Expand Down Expand Up @@ -208,6 +259,11 @@ primaryExpression
| dataTypeFunctionCall
| fieldExpression
| literalValue
| constantFunction
;

constantFunction
: constantFunctionName LT_PRTHS functionArgs? RT_PRTHS
;

booleanExpression
Expand Down Expand Up @@ -238,6 +294,10 @@ tableSource
| ID_DATE_SUFFIX
;

tableFunction
: qualifiedName LT_PRTHS functionArgs RT_PRTHS
;

/** fields */
fieldList
: fieldExpression (COMMA fieldExpression)*
Expand Down Expand Up @@ -300,14 +360,15 @@ evalFunctionName
| dateAndTimeFunctionBase
| textFunctionBase
| conditionFunctionBase
| systemFunctionBase
;

functionArgs
: (functionArg (COMMA functionArg)*)?
;

functionArg
: valueExpression
: (ident EQUAL)? valueExpression
;

relevanceArg
Expand All @@ -317,8 +378,8 @@ relevanceArg
relevanceArgName
: ALLOW_LEADING_WILDCARD | ANALYZER | ANALYZE_WILDCARD | AUTO_GENERATE_SYNONYMS_PHRASE_QUERY
| BOOST | CUTOFF_FREQUENCY | DEFAULT_FIELD | DEFAULT_OPERATOR | ENABLE_POSITION_INCREMENTS
| FIELDS | FLAGS | FUZZINESS | FUZZY_MAX_EXPANSIONS | FUZZY_PREFIX_LENGTH | FUZZY_REWRITE
| FUZZY_TRANSPOSITIONS | LENIENT | LOW_FREQ_OPERATOR | MAX_DETERMINIZED_STATES
| ESCAPE | FIELDS | FLAGS | FUZZINESS | FUZZY_MAX_EXPANSIONS | FUZZY_PREFIX_LENGTH
| FUZZY_REWRITE | FUZZY_TRANSPOSITIONS | LENIENT | LOW_FREQ_OPERATOR | MAX_DETERMINIZED_STATES
| MAX_EXPANSIONS | MINIMUM_SHOULD_MATCH | OPERATOR | PHRASE_SLOP | PREFIX_LENGTH
| QUOTE_ANALYZER | QUOTE_FIELD_SUFFIX | REWRITE | SLOP | TIE_BREAKER | TIME_ZONE | TYPE
| ZERO_TERMS_QUERY
Expand Down Expand Up @@ -360,9 +421,17 @@ trigonometricFunctionName
;

dateAndTimeFunctionBase
: ADDDATE | DATE | DATE_ADD | DATE_SUB | DAY | DAYNAME | DAYOFMONTH | DAYOFWEEK | DAYOFYEAR | FROM_DAYS
| HOUR | MICROSECOND | MINUTE | MONTH | MONTHNAME | QUARTER | SECOND | SUBDATE | TIME | TIME_TO_SEC
| TIMESTAMP | TO_DAYS | YEAR | WEEK | DATE_FORMAT
: ADDDATE | CONVERT_TZ | DATE | DATE_ADD | DATE_FORMAT | DATE_SUB
| DATETIME | DAY | DAYNAME | DAYOFMONTH | DAYOFWEEK | DAYOFYEAR | FROM_DAYS | FROM_UNIXTIME
| HOUR | MAKEDATE | MAKETIME | MICROSECOND | MINUTE | MONTH | MONTHNAME | PERIOD_ADD
| PERIOD_DIFF | QUARTER | SECOND | SUBDATE | SYSDATE | TIME | TIME_TO_SEC
| TIMESTAMP | TO_DAYS | UNIX_TIMESTAMP | WEEK | YEAR
;

// Functions which value could be cached in scope of a single query
constantFunctionName
: CURRENT_DATE | CURRENT_TIME | CURRENT_TIMESTAMP | LOCALTIME | LOCALTIMESTAMP | UTC_TIMESTAMP | UTC_DATE | UTC_TIME
| CURDATE | CURTIME | NOW
;

/** condition function return boolean value */
Expand All @@ -371,6 +440,10 @@ conditionFunctionBase
| IF | ISNULL | ISNOTNULL | IFNULL | NULLIF
;

systemFunctionBase
: TYPEOF
;

textFunctionBase
: SUBSTR | SUBSTRING | TRIM | LTRIM | RTRIM | LOWER | UPPER | CONCAT | CONCAT_WS | LENGTH | STRCMP
| RIGHT | LEFT | ASCII | LOCATE | REPLACE
Expand All @@ -389,10 +462,14 @@ binaryOperator
singleFieldRelevanceFunctionName
: MATCH
| MATCH_PHRASE
| MATCH_BOOL_PREFIX
| MATCH_PHRASE_PREFIX
;

multiFieldRelevanceFunctionName
: SIMPLE_QUERY_STRING
| MULTI_MATCH
| QUERY_STRING
;

/** literals and values*/
Expand All @@ -402,6 +479,7 @@ literalValue
| integerLiteral
| decimalLiteral
| booleanLiteral
| datetimeLiteral //#datetime
;

intervalLiteral
Expand All @@ -424,8 +502,23 @@ booleanLiteral
: TRUE | FALSE
;

pattern
: stringLiteral
// Date and Time Literal, follow ANSI 92
datetimeLiteral
: dateLiteral
| timeLiteral
| timestampLiteral
;

dateLiteral
: DATE date=stringLiteral
;

timeLiteral
: TIME time=stringLiteral
;

timestampLiteral
: TIMESTAMP timestamp=stringLiteral
;

intervalUnit
Expand Down Expand Up @@ -472,4 +565,8 @@ keywordsCanBeId
| TIMESTAMP | DATE | TIME
| FIRST | LAST
| timespanUnit | SPAN
| constantFunctionName
| dateAndTimeFunctionBase
| textFunctionBase
| mathematicalFunctionBase
;
Loading