Skip to content

Commit db95ca8

Browse files
costincostin
authored
EQL: Introduce case insensitive variant in~ (#68176) (#68204)
Complement to in, in~ does case-insensitive matching without any pattern matching - : should be used instead. process where name in~ ("ExPLorEr.eXe") will match name against explorer.exe regardless of case. Fix #68172
1 parent 3c6f7db commit db95ca8

File tree

16 files changed

+581
-412
lines changed

16 files changed

+581
-412
lines changed

‎x-pack/plugin/eql/qa/common/src/main/resources/additional_test_queries.toml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -326,3 +326,32 @@ query = '''
326326
file where wildcard(file_name, "winini?.exe", "lsass.e?e") and opcode == 2
327327
'''
328328
expected_event_ids = [65, 86]
329+
330+
[[queries]]
331+
name = "insensitiveInSingleArg"
332+
query = 'process where string(serial_event_id) in~ ("1")'
333+
expected_event_ids = [1]
334+
335+
[[queries]]
336+
name = "insensitiveInSingleArgPatternVerbatimMatch"
337+
query = 'process where string(serial_event_id) in~ ("1*")'
338+
expected_event_ids = []
339+
340+
[[queries]]
341+
name = "insensitiveInSingleArgPatternQuestionMarkVerbatimMatch"
342+
query = 'process where string(serial_event_id) in~ ("1?")'
343+
expected_event_ids = []
344+
345+
[[queries]]
346+
name = "insensitiveInMultipleArgs"
347+
query = '''
348+
file where file_name in~ ("wininit.exe", "lsass.exe") and opcode == 2
349+
'''
350+
expected_event_ids = [65, 86]
351+
352+
[[queries]]
353+
name = "insensitiveMultipleArgsWildcardPatternVerbatimMatch"
354+
query = '''
355+
file where file_name in~ ("winini*.exe", "lsass.e?e") and opcode == 2
356+
'''
357+
expected_event_ids = []

‎x-pack/plugin/eql/src/main/antlr/EqlBase.g4

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ operatorExpression
9999
// https://github.com/antlr/antlr4/issues/780
100100
// https://github.com/antlr/antlr4/issues/781
101101
predicate
102-
: NOT? kind=IN LP expression (COMMA expression)* RP
102+
: NOT? kind=(IN | IN_INSENSITIVE) LP expression (COMMA expression)* RP
103103
| kind=SEQ constant
104104
| kind=SEQ LP constant (COMMA constant)* RP
105105
;
@@ -162,6 +162,7 @@ ANY: 'any';
162162
BY: 'by';
163163
FALSE: 'false';
164164
IN: 'in';
165+
IN_INSENSITIVE : 'in~';
165166
JOIN: 'join';
166167
MAXSPAN: 'maxspan';
167168
NOT: 'not';

‎x-pack/plugin/eql/src/main/antlr/EqlBase.tokens

Lines changed: 73 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -3,79 +3,81 @@ ANY=2
33
BY=3
44
FALSE=4
55
IN=5
6-
JOIN=6
7-
MAXSPAN=7
8-
NOT=8
9-
NULL=9
10-
OF=10
11-
OR=11
12-
SEQUENCE=12
13-
TRUE=13
14-
UNTIL=14
15-
WHERE=15
16-
WITH=16
17-
SEQ=17
18-
ASGN=18
19-
EQ=19
20-
NEQ=20
21-
LT=21
22-
LTE=22
23-
GT=23
24-
GTE=24
25-
PLUS=25
26-
MINUS=26
27-
ASTERISK=27
28-
SLASH=28
29-
PERCENT=29
30-
DOT=30
31-
COMMA=31
32-
LB=32
33-
RB=33
34-
LP=34
35-
RP=35
36-
PIPE=36
37-
STRING=37
38-
INTEGER_VALUE=38
39-
DECIMAL_VALUE=39
40-
IDENTIFIER=40
41-
QUOTED_IDENTIFIER=41
42-
TILDE_IDENTIFIER=42
43-
LINE_COMMENT=43
44-
BRACKETED_COMMENT=44
45-
WS=45
6+
IN_INSENSITIVE=6
7+
JOIN=7
8+
MAXSPAN=8
9+
NOT=9
10+
NULL=10
11+
OF=11
12+
OR=12
13+
SEQUENCE=13
14+
TRUE=14
15+
UNTIL=15
16+
WHERE=16
17+
WITH=17
18+
SEQ=18
19+
ASGN=19
20+
EQ=20
21+
NEQ=21
22+
LT=22
23+
LTE=23
24+
GT=24
25+
GTE=25
26+
PLUS=26
27+
MINUS=27
28+
ASTERISK=28
29+
SLASH=29
30+
PERCENT=30
31+
DOT=31
32+
COMMA=32
33+
LB=33
34+
RB=34
35+
LP=35
36+
RP=36
37+
PIPE=37
38+
STRING=38
39+
INTEGER_VALUE=39
40+
DECIMAL_VALUE=40
41+
IDENTIFIER=41
42+
QUOTED_IDENTIFIER=42
43+
TILDE_IDENTIFIER=43
44+
LINE_COMMENT=44
45+
BRACKETED_COMMENT=45
46+
WS=46
4647
'and'=1
4748
'any'=2
4849
'by'=3
4950
'false'=4
5051
'in'=5
51-
'join'=6
52-
'maxspan'=7
53-
'not'=8
54-
'null'=9
55-
'of'=10
56-
'or'=11
57-
'sequence'=12
58-
'true'=13
59-
'until'=14
60-
'where'=15
61-
'with'=16
62-
':'=17
63-
'='=18
64-
'=='=19
65-
'!='=20
66-
'<'=21
67-
'<='=22
68-
'>'=23
69-
'>='=24
70-
'+'=25
71-
'-'=26
72-
'*'=27
73-
'/'=28
74-
'%'=29
75-
'.'=30
76-
','=31
77-
'['=32
78-
']'=33
79-
'('=34
80-
')'=35
81-
'|'=36
52+
'in~'=6
53+
'join'=7
54+
'maxspan'=8
55+
'not'=9
56+
'null'=10
57+
'of'=11
58+
'or'=12
59+
'sequence'=13
60+
'true'=14
61+
'until'=15
62+
'where'=16
63+
'with'=17
64+
':'=18
65+
'='=19
66+
'=='=20
67+
'!='=21
68+
'<'=22
69+
'<='=23
70+
'>'=24
71+
'>='=25
72+
'+'=26
73+
'-'=27
74+
'*'=28
75+
'/'=29
76+
'%'=30
77+
'.'=31
78+
','=32
79+
'['=33
80+
']'=34
81+
'('=35
82+
')'=36
83+
'|'=37

‎x-pack/plugin/eql/src/main/antlr/EqlBaseLexer.tokens

Lines changed: 73 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -3,79 +3,81 @@ ANY=2
33
BY=3
44
FALSE=4
55
IN=5
6-
JOIN=6
7-
MAXSPAN=7
8-
NOT=8
9-
NULL=9
10-
OF=10
11-
OR=11
12-
SEQUENCE=12
13-
TRUE=13
14-
UNTIL=14
15-
WHERE=15
16-
WITH=16
17-
SEQ=17
18-
ASGN=18
19-
EQ=19
20-
NEQ=20
21-
LT=21
22-
LTE=22
23-
GT=23
24-
GTE=24
25-
PLUS=25
26-
MINUS=26
27-
ASTERISK=27
28-
SLASH=28
29-
PERCENT=29
30-
DOT=30
31-
COMMA=31
32-
LB=32
33-
RB=33
34-
LP=34
35-
RP=35
36-
PIPE=36
37-
STRING=37
38-
INTEGER_VALUE=38
39-
DECIMAL_VALUE=39
40-
IDENTIFIER=40
41-
QUOTED_IDENTIFIER=41
42-
TILDE_IDENTIFIER=42
43-
LINE_COMMENT=43
44-
BRACKETED_COMMENT=44
45-
WS=45
6+
IN_INSENSITIVE=6
7+
JOIN=7
8+
MAXSPAN=8
9+
NOT=9
10+
NULL=10
11+
OF=11
12+
OR=12
13+
SEQUENCE=13
14+
TRUE=14
15+
UNTIL=15
16+
WHERE=16
17+
WITH=17
18+
SEQ=18
19+
ASGN=19
20+
EQ=20
21+
NEQ=21
22+
LT=22
23+
LTE=23
24+
GT=24
25+
GTE=25
26+
PLUS=26
27+
MINUS=27
28+
ASTERISK=28
29+
SLASH=29
30+
PERCENT=30
31+
DOT=31
32+
COMMA=32
33+
LB=33
34+
RB=34
35+
LP=35
36+
RP=36
37+
PIPE=37
38+
STRING=38
39+
INTEGER_VALUE=39
40+
DECIMAL_VALUE=40
41+
IDENTIFIER=41
42+
QUOTED_IDENTIFIER=42
43+
TILDE_IDENTIFIER=43
44+
LINE_COMMENT=44
45+
BRACKETED_COMMENT=45
46+
WS=46
4647
'and'=1
4748
'any'=2
4849
'by'=3
4950
'false'=4
5051
'in'=5
51-
'join'=6
52-
'maxspan'=7
53-
'not'=8
54-
'null'=9
55-
'of'=10
56-
'or'=11
57-
'sequence'=12
58-
'true'=13
59-
'until'=14
60-
'where'=15
61-
'with'=16
62-
':'=17
63-
'='=18
64-
'=='=19
65-
'!='=20
66-
'<'=21
67-
'<='=22
68-
'>'=23
69-
'>='=24
70-
'+'=25
71-
'-'=26
72-
'*'=27
73-
'/'=28
74-
'%'=29
75-
'.'=30
76-
','=31
77-
'['=32
78-
']'=33
79-
'('=34
80-
')'=35
81-
'|'=36
52+
'in~'=6
53+
'join'=7
54+
'maxspan'=8
55+
'not'=9
56+
'null'=10
57+
'of'=11
58+
'or'=12
59+
'sequence'=13
60+
'true'=14
61+
'until'=15
62+
'where'=16
63+
'with'=17
64+
':'=18
65+
'='=19
66+
'=='=20
67+
'!='=21
68+
'<'=22
69+
'<='=23
70+
'>'=24
71+
'>='=25
72+
'+'=26
73+
'-'=27
74+
'*'=28
75+
'/'=29
76+
'%'=30
77+
'.'=31
78+
','=32
79+
'['=33
80+
']'=34
81+
'('=35
82+
')'=36
83+
'|'=37

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveEquals.java

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,13 @@
88

99
import org.elasticsearch.xpack.ql.expression.Expression;
1010
import org.elasticsearch.xpack.ql.expression.predicate.Negatable;
11-
import org.elasticsearch.xpack.ql.expression.predicate.operator.comparison.BinaryComparisonProcessor.BinaryComparisonOperation;
1211
import org.elasticsearch.xpack.ql.tree.NodeInfo;
1312
import org.elasticsearch.xpack.ql.tree.Source;
1413

1514
import java.time.ZoneId;
1615

1716
public class InsensitiveEquals extends InsensitiveBinaryComparison implements Negatable<InsensitiveBinaryComparison> {
1817

19-
public InsensitiveEquals(Source source, Expression left, Expression right) {
20-
this(source, left, right, null);
21-
}
22-
2318
public InsensitiveEquals(Source source, Expression left, Expression right, ZoneId zoneId) {
2419
super(source, left, right, InsensitiveBinaryComparisonProcessor.InsensitiveBinaryComparisonOperation.SEQ, zoneId);
2520
}
@@ -46,6 +41,6 @@ public InsensitiveBinaryComparison negate() {
4641

4742
@Override
4843
protected String regularOperatorSymbol() {
49-
return BinaryComparisonOperation.EQ.symbol();
44+
return "in";
5045
}
5146
}

0 commit comments

Comments
 (0)