Merge branch 'prod' into gis-7683

nazargesyk · nazargesyk · commit 0d189f65940e · 2024-04-30T11:44:12.000+03:00
diff --git a/uncoder-core/app/translator/core/tokenizer.py b/uncoder-core/app/translator/core/tokenizer.py
@@ -31,6 +31,8 @@
 from app.translator.core.mapping import SourceMapping
 from app.translator.core.models.field import Field, FieldValue, Keyword
 from app.translator.core.models.functions.base import Function
+from app.translator.core.models.functions.eval import EvalArg
+from app.translator.core.models.functions.rename import RenameArg
 from app.translator.core.models.functions.sort import SortArg
 from app.translator.core.models.identifier import Identifier
 from app.translator.core.str_value_manager import StrValue, StrValueManager
@@ -323,6 +325,11 @@ def get_field_tokens_from_func_args(
                 result.extend(self.get_field_tokens_from_func_args(args=arg.by_clauses))
             elif isinstance(arg, SortArg):
                 result.append(arg.field)
+            elif isinstance(arg, RenameArg):
+                result.append(arg.field_)
+            elif isinstance(arg, EvalArg):
+                result.append(arg.field_)
+                result.extend(self.get_field_tokens_from_func_args(args=arg.expression))
         return result
 
     @staticmethod
diff --git a/uncoder-core/app/translator/platforms/base/spl/const.py b/uncoder-core/app/translator/platforms/base/spl/const.py
@@ -0,0 +1,7 @@
+FIELD_PATTERN = r"(?P<___group_name___>[a-zA-Z0-9.\-_{}]+)"
+DOUBLE_QUOTES_VALUE_PATTERN = r'"(?P<___group_name___>(?:[:a-zA-Z*0-9=+%#\-_/,;`?~‘○×\'.<>$&^@!\]\[(){}\s]|\\\"|\\)*)"'  # noqa: RUF001
+SINGLE_QUOTES_VALUE_PATTERN = r"'(?P<___group_name___>(?:[:a-zA-Z*0-9=+%#\-_/,;`?~‘○×\".<>$&^@!\]\[(){}\s]|\\\'|\\)*)'"  # noqa: RUF001
+NO_QUOTES_VALUES_PATTERN = (
+    r"(?P<___group_name___>(?:[:a-zA-Z*0-9+%#\-_/,.$&^@!]|\\\s|\\=|\\!=|\\<|\\<=|\\>|\\>=|\\\\)+)"
+)
+NUM_VALUE_PATTERN = r"(?P<___group_name___>\d+(?:\.\d+)?)"
diff --git a/uncoder-core/app/translator/platforms/base/spl/tokenizer.py b/uncoder-core/app/translator/platforms/base/spl/tokenizer.py
@@ -25,6 +25,11 @@
 from app.translator.core.models.field import FieldValue, Keyword
 from app.translator.core.models.identifier import Identifier
 from app.translator.core.tokenizer import QueryTokenizer
+from app.translator.platforms.base.spl.const import DOUBLE_QUOTES_VALUE_PATTERN as D_Q_V_PATTERN
+from app.translator.platforms.base.spl.const import FIELD_PATTERN
+from app.translator.platforms.base.spl.const import NO_QUOTES_VALUES_PATTERN as NO_Q_V_PATTERN
+from app.translator.platforms.base.spl.const import NUM_VALUE_PATTERN as N_V_PATTERN
+from app.translator.platforms.base.spl.const import SINGLE_QUOTES_VALUE_PATTERN as S_Q_V_PATTERN
 from app.translator.platforms.base.spl.escape_manager import spl_escape_manager
 from app.translator.tools.utils import get_match_group
 
@@ -40,13 +45,11 @@ class SplTokenizer(QueryTokenizer, ANDLogicOperatorMixin):
     }
     multi_value_operators_map: ClassVar[dict[str, str]] = {"in": OperatorType.EQ}
 
-    field_pattern = r"(?P<field_name>[a-zA-Z0-9\.\-_\{\}]+)"
-    num_value_pattern = rf"(?P<{ValueType.number_value}>\d+(?:\.\d+)*)(?=$|\s|\))"
-    double_quotes_value_pattern = rf'"(?P<{ValueType.double_quotes_value}>(?:[:a-zA-Z\*0-9=+%#\-_/,;`\?~‘○×\'\.<>$&^@!\]\[\(\)\{{\}}\s]|\\\"|\\)*)"\s*'  # noqa: E501, RUF001
-    single_quotes_value_pattern = (
-        rf"'(?P<{ValueType.single_quotes_value}>(?:[:a-zA-Z\*0-9=+%#\-_/,;\"\.<>$&^@!\(\)\{{\}}\s]|\\\'|\\)*)'\s*"
-    )
-    no_quotes_value_pattern = rf"(?P<{ValueType.no_quotes_value}>(?:[:a-zA-Z\*0-9+%#\-_/,\.$&^@!]|\\\s|\\=|\\!=|\\<|\\<=|\\>|\\>=|\\\\)+)(?=$|\s|\))"  # noqa: E501
+    field_pattern = FIELD_PATTERN.replace("___group_name___", "field_name")
+    num_value_pattern = rf"{N_V_PATTERN.replace('___group_name___', ValueType.number_value)}(?=$|\s|\))"
+    double_quotes_value_pattern = rf"{D_Q_V_PATTERN.replace('___group_name___', ValueType.double_quotes_value)}\s*"
+    single_quotes_value_pattern = rf"{S_Q_V_PATTERN.replace('___group_name___', ValueType.single_quotes_value)}\s*"
+    no_quotes_value_pattern = rf"{NO_Q_V_PATTERN.replace('___group_name___', ValueType.no_quotes_value)}(?=$|\s|\))"
     _value_pattern = (
         rf"{num_value_pattern}|{no_quotes_value_pattern}|{double_quotes_value_pattern}|{single_quotes_value_pattern}"
     )
diff --git a/uncoder-core/app/translator/platforms/crowdstrike/renders/crowdstrike.py b/uncoder-core/app/translator/platforms/crowdstrike/renders/crowdstrike.py
@@ -41,4 +41,4 @@ class CrowdStrikeQueryRender(SplQueryRender):
 
     def __init__(self):
         super().__init__()
-        self.platform_functions.manager.init_search_func_render(self)
+        self.platform_functions.manager.post_init_configure(self)
diff --git a/uncoder-core/app/translator/platforms/logscale/renders/logscale.py b/uncoder-core/app/translator/platforms/logscale/renders/logscale.py
@@ -106,7 +106,7 @@ class LogScaleQueryRender(PlatformQueryRender):
 
     def __init__(self):
         super().__init__()
-        self.platform_functions.manager.init_search_func_render(self)
+        self.platform_functions.manager.post_init_configure(self)
 
     def wrap_with_comment(self, value: str) -> str:
         return f"/* {value} */"
diff --git a/uncoder-core/app/translator/platforms/microsoft/renders/microsoft_sentinel.py b/uncoder-core/app/translator/platforms/microsoft/renders/microsoft_sentinel.py
@@ -136,7 +136,7 @@ class MicrosoftSentinelQueryRender(PlatformQueryRender):
 
     def __init__(self):
         super().__init__()
-        self.platform_functions.manager.init_search_func_render(self)
+        self.platform_functions.manager.post_init_configure(self)
 
     def generate_prefix(self, log_source_signature: LogSourceSignature) -> str:
         return str(log_source_signature)
diff --git a/uncoder-core/app/translator/platforms/opensearch/renders/opensearch_rule.py b/uncoder-core/app/translator/platforms/opensearch/renders/opensearch_rule.py
@@ -50,7 +50,10 @@ class OpenSearchRuleRender(OpenSearchQueryRender):
 
     field_value_map = OpenSearchRuleFieldValue(or_token=or_token)
     query_pattern = "{prefix} {query} {functions}"
-    fields: dict = {}
+
+    def __init__(self):
+        super().__init__()
+        self.fields = {}
 
     def finalize_query(
         self,
diff --git a/uncoder-core/app/translator/platforms/splunk/renders/splunk.py b/uncoder-core/app/translator/platforms/splunk/renders/splunk.py
@@ -40,4 +40,4 @@ class SplunkQueryRender(SplQueryRender):
 
     def __init__(self):
         super().__init__()
-        self.platform_functions.manager.init_search_func_render(self)
+        self.platform_functions.manager.post_init_configure(self)
