def test_conversion(self):
schema = {"num": "long", "text": "text"}
self.validate('num:1', FieldComparison(Field("num"), Number(1)), schema=schema)
self.validate('num:"1"', FieldComparison(Field("num"), Number(1)), schema=schema)
self.validate('text:1', FieldComparison(Field("text"), String("1")), schema=schema)
self.validate('text:"1"', FieldComparison(Field("text"), String("1")), schema=schema)
def test_keyword(self):
schema = {
"a.text": "text",
"a.keyword": "keyword",
"b": "long",
}
self.validate('a.text:hello',
FieldComparison(Field("a.text"), String("hello")),
schema=schema)
self.validate('a.keyword:hello',
FieldComparison(Field("a.keyword"), String("hello")),
schema=schema)
self.validate('a.text:"hello"',
FieldComparison(Field("a.text"), String("hello")),
schema=schema)
self.validate('a.keyword:"hello"',
FieldComparison(Field("a.keyword"), String("hello")),
schema=schema)
self.validate('a.text:1',
FieldComparison(Field("a.text"), String("1")),
schema=schema)
self.validate('a.keyword:1',
FieldComparison(Field("a.keyword"), String("1")),
schema=schema)
self.validate('a.text:"1"',
FieldComparison(Field("a.text"), String("1")),
schema=schema)
self.validate('a.keyword:"1"',
FieldComparison(Field("a.keyword"), String("1")),
schema=schema)
def test_date(self):
schema = {"@time": "date"}
self.validate('@time <= now-10d', FieldRange(Field("@time"), "<=", String("now-10d")), schema=schema)
with self.assertRaises(kql.KqlParseError):
kql.parse("@time > 5", schema=schema)
def test_multiple_types_success(self):
schema = {"common.a": "keyword", "common.b": "keyword"}
self.validate("common.* : \"hello\"", FieldComparison(Field("common.*"), String("hello")), schema=schema)