Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EQL: Sequence/Join parsing and model #54227

Merged
merged 8 commits into from
Apr 6, 2020
Merged

EQL: Sequence/Join parsing and model #54227

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
9b7dfea
wip
costin Mar 22, 2020
f00e6f0
Initial model and parsing for Join
costin Mar 31, 2020
96550c1
wip
costin Apr 2, 2020
adfa27c
Done with parsing, need to improve the test suite.
costin Apr 2, 2020
6d4d394
Add more parsing tests
costin Apr 3, 2020
1d34437
Merge remote-tracking branch 'remotes/upstream/master' into eql/sequence
costin Apr 3, 2020
0fb96ca
Merge branch 'master' into eql/sequence
elasticmachine Apr 4, 2020
08bd924
Merge branch 'master' into eql/sequence
elasticmachine Apr 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions x-pack/plugin/eql/src/main/antlr/EqlBase.g4
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,13 +32,13 @@ sequenceParams
sequence
: SEQUENCE (by=joinKeys sequenceParams? | sequenceParams by=joinKeys?)?
sequenceTerm sequenceTerm+
(UNTIL sequenceTerm)?
(UNTIL until=sequenceTerm)?
;

join
: JOIN (by=joinKeys)?
joinTerm joinTerm+
(UNTIL joinTerm)?
(UNTIL until=joinTerm)?
;

pipe
Expand Down
77 changes: 77 additions & 0 deletions x-pack/plugin/eql/src/main/antlr/EqlBase.tokens
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
AND=1
ANY=2
BY=3
FALSE=4
FORK=5
IN=6
JOIN=7
MAXSPAN=8
NOT=9
NULL=10
OF=11
OR=12
SEQUENCE=13
TRUE=14
UNTIL=15
WHERE=16
WITH=17
EQ=18
NEQ=19
LT=20
LTE=21
GT=22
GTE=23
PLUS=24
MINUS=25
ASTERISK=26
SLASH=27
PERCENT=28
DOT=29
COMMA=30
LB=31
RB=32
LP=33
RP=34
PIPE=35
ESCAPED_IDENTIFIER=36
STRING=37
INTEGER_VALUE=38
DECIMAL_VALUE=39
IDENTIFIER=40
LINE_COMMENT=41
BRACKETED_COMMENT=42
WS=43
'and'=1
'any'=2
'by'=3
'false'=4
'fork'=5
'in'=6
'join'=7
'maxspan'=8
'not'=9
'null'=10
'of'=11
'or'=12
'sequence'=13
'true'=14
'until'=15
'where'=16
'with'=17
'!='=19
'<'=20
'<='=21
'>'=22
'>='=23
'+'=24
'-'=25
'*'=26
'/'=27
'%'=28
'.'=29
','=30
'['=31
']'=32
'('=33
')'=34
'|'=35
77 changes: 77 additions & 0 deletions x-pack/plugin/eql/src/main/antlr/EqlBaseLexer.tokens
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
AND=1
ANY=2
BY=3
FALSE=4
FORK=5
IN=6
JOIN=7
MAXSPAN=8
NOT=9
NULL=10
OF=11
OR=12
SEQUENCE=13
TRUE=14
UNTIL=15
WHERE=16
WITH=17
EQ=18
NEQ=19
LT=20
LTE=21
GT=22
GTE=23
PLUS=24
MINUS=25
ASTERISK=26
SLASH=27
PERCENT=28
DOT=29
COMMA=30
LB=31
RB=32
LP=33
RP=34
PIPE=35
ESCAPED_IDENTIFIER=36
STRING=37
INTEGER_VALUE=38
DECIMAL_VALUE=39
IDENTIFIER=40
LINE_COMMENT=41
BRACKETED_COMMENT=42
WS=43
'and'=1
'any'=2
'by'=3
'false'=4
'fork'=5
'in'=6
'join'=7
'maxspan'=8
'not'=9
'null'=10
'of'=11
'or'=12
'sequence'=13
'true'=14
'until'=15
'where'=16
'with'=17
'!='=19
'<'=20
'<='=21
'>'=22
'>='=23
'+'=24
'-'=25
'*'=26
'/'=27
'%'=28
'.'=29
','=30
'['=31
']'=32
'('=33
')'=34
'|'=35
6 changes: 4 additions & 2 deletions x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -393,6 +393,7 @@ public final SequenceParamsContext sequenceParams() throws RecognitionException

public static class SequenceContext extends ParserRuleContext {
public JoinKeysContext by;
public SequenceTermContext until;
public TerminalNode SEQUENCE() { return getToken(EqlBaseParser.SEQUENCE, 0); }
public List<SequenceTermContext> sequenceTerm() {
return getRuleContexts(SequenceTermContext.class);
Expand Down Expand Up @@ -495,7 +496,7 @@ public final SequenceContext sequence() throws RecognitionException {
setState(94);
match(UNTIL);
setState(95);
sequenceTerm();
((SequenceContext)_localctx).until = sequenceTerm();
}
}

Expand All @@ -514,6 +515,7 @@ public final SequenceContext sequence() throws RecognitionException {

public static class JoinContext extends ParserRuleContext {
public JoinKeysContext by;
public JoinTermContext until;
public TerminalNode JOIN() { return getToken(EqlBaseParser.JOIN, 0); }
public List<JoinTermContext> joinTerm() {
return getRuleContexts(JoinTermContext.class);
Expand Down Expand Up @@ -585,7 +587,7 @@ public final JoinContext join() throws RecognitionException {
setState(108);
match(UNTIL);
setState(109);
joinTerm();
((JoinContext)_localctx).until = joinTerm();
}
}

Expand Down
20 changes: 0 additions & 20 deletions x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,16 +133,6 @@ private class PostProcessor extends EqlBaseBaseListener {
this.ruleNames = ruleNames;
}

@Override
public void exitJoin(EqlBaseParser.JoinContext context) {
Token token = context.JOIN().getSymbol();
throw new ParsingException(
"Join is not supported",
null,
token.getLine(),
token.getCharPositionInLine());
}

@Override
public void exitPipe(EqlBaseParser.PipeContext context) {
Token token = context.PIPE().getSymbol();
Expand All @@ -163,16 +153,6 @@ public void exitProcessCheck(EqlBaseParser.ProcessCheckContext context) {
token.getCharPositionInLine());
}

@Override
public void exitSequence(EqlBaseParser.SequenceContext context) {
Token token = context.SEQUENCE().getSymbol();
throw new ParsingException(
"Sequence is not supported",
null,
token.getLine(),
token.getCharPositionInLine());
}

@Override
public void exitQualifiedName(EqlBaseParser.QualifiedNameContext context) {
if (context.INTEGER_VALUE().size() > 0) {
Expand Down
8 changes: 8 additions & 0 deletions x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/ExpressionBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.ComparisonContext;
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.DereferenceContext;
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.FunctionExpressionContext;
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.JoinKeysContext;
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.LogicalBinaryContext;
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.LogicalNotContext;
import org.elasticsearch.xpack.eql.parser.EqlBaseParser.PredicateContext;
Expand Down Expand Up @@ -46,6 +47,8 @@

import java.util.List;

import static java.util.Collections.emptyList;


public class ExpressionBuilder extends IdentifierBuilder {

Expand All @@ -62,6 +65,11 @@ public Expression visitSingleExpression(EqlBaseParser.SingleExpressionContext ct
return expression(ctx.expression());
}

@Override
public List<Expression> visitJoinKeys(JoinKeysContext ctx) {
return ctx != null ? expressions(ctx.expression()) : emptyList();
}

@Override
public Expression visitArithmeticUnary(ArithmeticUnaryContext ctx) {
Expression expr = expression(ctx.valueExpression());
Expand Down
Loading