16
16
limitations under the License.
17
17
-----------------------------------------------------------------
18
18
"""
19
- from typing import Optional , Union
19
+ from typing import ClassVar , Optional , Union
20
20
21
21
from app .translator .const import DEFAULT_VALUE_TYPE
22
22
from app .translator .core .custom_types .values import ValueType
@@ -136,12 +136,12 @@ class CortexXQLQueryRender(PlatformQueryRender):
136
136
details : PlatformDetails = cortex_xql_query_details
137
137
mappings : CortexXQLMappings = cortex_xql_mappings
138
138
is_strict_mapping = True
139
- raw_log_field_pattern_map = {
140
- ' regex' : '| alter {field} = regextract(to_json_string(action_evtlog_data_fields)->{field}{{}}, "\\ "(.*)\\ "")' ,
141
- ' object' : '| alter {field_name} = json_extract_scalar({field_object} , "$.{field_path}")' ,
142
- ' list' : '| alter {field_name} = arraystring(json_extract_array({field_object} , "$.{field_path}")," ")'
139
+ raw_log_field_pattern_map : ClassVar [ dict [ str , str ]] = {
140
+ " regex" : '| alter {field} = regextract(to_json_string(action_evtlog_data_fields)->{field}{{}}, "\\ "(.*)\\ "")' ,
141
+ " object" : '| alter {field_name} = json_extract_scalar({field_object} , "$.{field_path}")' ,
142
+ " list" : '| alter {field_name} = arraystring(json_extract_array({field_object} , "$.{field_path}")," ")' ,
143
143
}
144
- platform_functions : CortexXQLFunctions = cortex_xql_functions
144
+ platform_functions : CortexXQLFunctions = None
145
145
146
146
or_token = "or"
147
147
and_token = "and"
@@ -152,9 +152,9 @@ class CortexXQLQueryRender(PlatformQueryRender):
152
152
comment_symbol = "//"
153
153
is_single_line_comment = False
154
154
155
- def __init__ (self ):
156
- super (). __init__ ()
157
- self .platform_functions .manager . post_init_configure ( self )
155
+ def init_platform_functions (self ) -> None :
156
+ self . platform_functions = cortex_xql_functions
157
+ self .platform_functions .platform_query_render = self
158
158
159
159
def process_raw_log_field (self , field : str , field_type : str ) -> Optional [str ]:
160
160
raw_log_field_pattern = self .raw_log_field_pattern_map .get (field_type )
0 commit comments