From f52d7383d0ff814200bbcf08d3177b0a28fff221 Mon Sep 17 00:00:00 2001 From: Oleksandr Volha Date: Thu, 20 Jun 2024 11:34:45 +0300 Subject: [PATCH 1/2] query parts join method --- uncoder-core/app/translator/core/render.py | 8 ++++++-- .../platforms/palo_alto/renders/cortex_xsiam.py | 1 + 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/uncoder-core/app/translator/core/render.py b/uncoder-core/app/translator/core/render.py index 055ce889..02caef32 100644 --- a/uncoder-core/app/translator/core/render.py +++ b/uncoder-core/app/translator/core/render.py @@ -197,6 +197,7 @@ class PlatformQueryRender(QueryRender): not_token = "not" group_token = "(%s)" + query_parts_delimiter = " " field_value_map = BaseQueryFieldValue(or_token=or_token) @@ -284,6 +285,10 @@ def wrap_query_with_meta_info(self, meta_info: MetaInfoContainer, query: str) -> def _finalize_search_query(query: str) -> str: return query + def _join_query_parts(self, prefix: str, query: str, functions: str) -> str: + parts = filter(lambda s: bool(s), map(str.strip, [prefix, self._finalize_search_query(query), functions])) + return self.query_parts_delimiter.join(parts) + def finalize_query( self, prefix: str, @@ -295,8 +300,7 @@ def finalize_query( *args, # noqa: ARG002 **kwargs, # noqa: ARG002 ) -> str: - parts = filter(lambda s: bool(s), map(str.strip, [prefix, self._finalize_search_query(query), functions])) - query = " ".join(parts) + query = self._join_query_parts(prefix, query, functions) query = self.wrap_query_with_meta_info(meta_info=meta_info, query=query) if not_supported_functions: rendered_not_supported = self.render_not_supported_functions(not_supported_functions) diff --git a/uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py b/uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py index 72a2737b..8a201fa2 100644 --- a/uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py +++ b/uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py @@ -147,6 +147,7 @@ class CortexXQLQueryRender(PlatformQueryRender): or_token = "or" and_token = "and" not_token = "not" + query_parts_delimiter = "" field_value_map = CortexXQLFieldValue(or_token=or_token) comment_symbol = "//" From ddb2bbc9b0bad17700deef376fdd6fdcdd2c5b07 Mon Sep 17 00:00:00 2001 From: Oleksandr Volha Date: Thu, 20 Jun 2024 11:46:32 +0300 Subject: [PATCH 2/2] fix --- uncoder-core/app/translator/core/render.py | 2 +- .../app/translator/platforms/palo_alto/renders/cortex_xsiam.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/uncoder-core/app/translator/core/render.py b/uncoder-core/app/translator/core/render.py index 02caef32..bf28b4f6 100644 --- a/uncoder-core/app/translator/core/render.py +++ b/uncoder-core/app/translator/core/render.py @@ -387,7 +387,7 @@ def _generate_from_tokenized_query_container(self, query_container: TokenizedQue defined_raw_log_fields = self.generate_raw_log_fields( fields=query_container.meta_info.query_fields, source_mapping=source_mapping ) - prefix += f"\n{defined_raw_log_fields}\n" + prefix += f"\n{defined_raw_log_fields}" result = self.generate_query(tokens=query_container.tokens, source_mapping=source_mapping) except StrictPlatformException as err: errors.append(err) diff --git a/uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py b/uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py index 8a201fa2..54f50916 100644 --- a/uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py +++ b/uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py @@ -147,7 +147,7 @@ class CortexXQLQueryRender(PlatformQueryRender): or_token = "or" and_token = "and" not_token = "not" - query_parts_delimiter = "" + query_parts_delimiter = "\n" field_value_map = CortexXQLFieldValue(or_token=or_token) comment_symbol = "//" pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy