diff --git a/x-pack/plugin/eql/qa/common/src/main/resources/additional_test_queries.toml b/x-pack/plugin/eql/qa/common/src/main/resources/additional_test_queries.toml index 703ae49817b4e..676e2809d8e29 100644 --- a/x-pack/plugin/eql/qa/common/src/main/resources/additional_test_queries.toml +++ b/x-pack/plugin/eql/qa/common/src/main/resources/additional_test_queries.toml @@ -326,3 +326,32 @@ query = ''' file where wildcard(file_name, "winini?.exe", "lsass.e?e") and opcode == 2 ''' expected_event_ids = [65, 86] + +[[queries]] +name = "insensitiveInSingleArg" +query = 'process where string(serial_event_id) in~ ("1")' +expected_event_ids = [1] + +[[queries]] +name = "insensitiveInSingleArgPatternVerbatimMatch" +query = 'process where string(serial_event_id) in~ ("1*")' +expected_event_ids = [] + +[[queries]] +name = "insensitiveInSingleArgPatternQuestionMarkVerbatimMatch" +query = 'process where string(serial_event_id) in~ ("1?")' +expected_event_ids = [] + +[[queries]] +name = "insensitiveInMultipleArgs" +query = ''' +file where file_name in~ ("wininit.exe", "lsass.exe") and opcode == 2 +''' +expected_event_ids = [65, 86] + +[[queries]] +name = "insensitiveMultipleArgsWildcardPatternVerbatimMatch" +query = ''' +file where file_name in~ ("winini*.exe", "lsass.e?e") and opcode == 2 +''' +expected_event_ids = [] diff --git a/x-pack/plugin/eql/src/main/antlr/EqlBase.g4 b/x-pack/plugin/eql/src/main/antlr/EqlBase.g4 index ba41ba1aab39c..717eddb74a070 100644 --- a/x-pack/plugin/eql/src/main/antlr/EqlBase.g4 +++ b/x-pack/plugin/eql/src/main/antlr/EqlBase.g4 @@ -99,7 +99,7 @@ operatorExpression // https://github.com/antlr/antlr4/issues/780 // https://github.com/antlr/antlr4/issues/781 predicate - : NOT? kind=IN LP expression (COMMA expression)* RP + : NOT? kind=(IN | IN_INSENSITIVE) LP expression (COMMA expression)* RP | kind=SEQ constant | kind=SEQ LP constant (COMMA constant)* RP ; @@ -162,6 +162,7 @@ ANY: 'any'; BY: 'by'; FALSE: 'false'; IN: 'in'; +IN_INSENSITIVE : 'in~'; JOIN: 'join'; MAXSPAN: 'maxspan'; NOT: 'not'; diff --git a/x-pack/plugin/eql/src/main/antlr/EqlBase.tokens b/x-pack/plugin/eql/src/main/antlr/EqlBase.tokens index 236d512cbd52d..340235c4d3380 100644 --- a/x-pack/plugin/eql/src/main/antlr/EqlBase.tokens +++ b/x-pack/plugin/eql/src/main/antlr/EqlBase.tokens @@ -3,79 +3,81 @@ ANY=2 BY=3 FALSE=4 IN=5 -JOIN=6 -MAXSPAN=7 -NOT=8 -NULL=9 -OF=10 -OR=11 -SEQUENCE=12 -TRUE=13 -UNTIL=14 -WHERE=15 -WITH=16 -SEQ=17 -ASGN=18 -EQ=19 -NEQ=20 -LT=21 -LTE=22 -GT=23 -GTE=24 -PLUS=25 -MINUS=26 -ASTERISK=27 -SLASH=28 -PERCENT=29 -DOT=30 -COMMA=31 -LB=32 -RB=33 -LP=34 -RP=35 -PIPE=36 -STRING=37 -INTEGER_VALUE=38 -DECIMAL_VALUE=39 -IDENTIFIER=40 -QUOTED_IDENTIFIER=41 -TILDE_IDENTIFIER=42 -LINE_COMMENT=43 -BRACKETED_COMMENT=44 -WS=45 +IN_INSENSITIVE=6 +JOIN=7 +MAXSPAN=8 +NOT=9 +NULL=10 +OF=11 +OR=12 +SEQUENCE=13 +TRUE=14 +UNTIL=15 +WHERE=16 +WITH=17 +SEQ=18 +ASGN=19 +EQ=20 +NEQ=21 +LT=22 +LTE=23 +GT=24 +GTE=25 +PLUS=26 +MINUS=27 +ASTERISK=28 +SLASH=29 +PERCENT=30 +DOT=31 +COMMA=32 +LB=33 +RB=34 +LP=35 +RP=36 +PIPE=37 +STRING=38 +INTEGER_VALUE=39 +DECIMAL_VALUE=40 +IDENTIFIER=41 +QUOTED_IDENTIFIER=42 +TILDE_IDENTIFIER=43 +LINE_COMMENT=44 +BRACKETED_COMMENT=45 +WS=46 'and'=1 'any'=2 'by'=3 'false'=4 'in'=5 -'join'=6 -'maxspan'=7 -'not'=8 -'null'=9 -'of'=10 -'or'=11 -'sequence'=12 -'true'=13 -'until'=14 -'where'=15 -'with'=16 -':'=17 -'='=18 -'=='=19 -'!='=20 -'<'=21 -'<='=22 -'>'=23 -'>='=24 -'+'=25 -'-'=26 -'*'=27 -'/'=28 -'%'=29 -'.'=30 -','=31 -'['=32 -']'=33 -'('=34 -')'=35 -'|'=36 +'in~'=6 +'join'=7 +'maxspan'=8 +'not'=9 +'null'=10 +'of'=11 +'or'=12 +'sequence'=13 +'true'=14 +'until'=15 +'where'=16 +'with'=17 +':'=18 +'='=19 +'=='=20 +'!='=21 +'<'=22 +'<='=23 +'>'=24 +'>='=25 +'+'=26 +'-'=27 +'*'=28 +'/'=29 +'%'=30 +'.'=31 +','=32 +'['=33 +']'=34 +'('=35 +')'=36 +'|'=37 diff --git a/x-pack/plugin/eql/src/main/antlr/EqlBaseLexer.tokens b/x-pack/plugin/eql/src/main/antlr/EqlBaseLexer.tokens index 236d512cbd52d..340235c4d3380 100644 --- a/x-pack/plugin/eql/src/main/antlr/EqlBaseLexer.tokens +++ b/x-pack/plugin/eql/src/main/antlr/EqlBaseLexer.tokens @@ -3,79 +3,81 @@ ANY=2 BY=3 FALSE=4 IN=5 -JOIN=6 -MAXSPAN=7 -NOT=8 -NULL=9 -OF=10 -OR=11 -SEQUENCE=12 -TRUE=13 -UNTIL=14 -WHERE=15 -WITH=16 -SEQ=17 -ASGN=18 -EQ=19 -NEQ=20 -LT=21 -LTE=22 -GT=23 -GTE=24 -PLUS=25 -MINUS=26 -ASTERISK=27 -SLASH=28 -PERCENT=29 -DOT=30 -COMMA=31 -LB=32 -RB=33 -LP=34 -RP=35 -PIPE=36 -STRING=37 -INTEGER_VALUE=38 -DECIMAL_VALUE=39 -IDENTIFIER=40 -QUOTED_IDENTIFIER=41 -TILDE_IDENTIFIER=42 -LINE_COMMENT=43 -BRACKETED_COMMENT=44 -WS=45 +IN_INSENSITIVE=6 +JOIN=7 +MAXSPAN=8 +NOT=9 +NULL=10 +OF=11 +OR=12 +SEQUENCE=13 +TRUE=14 +UNTIL=15 +WHERE=16 +WITH=17 +SEQ=18 +ASGN=19 +EQ=20 +NEQ=21 +LT=22 +LTE=23 +GT=24 +GTE=25 +PLUS=26 +MINUS=27 +ASTERISK=28 +SLASH=29 +PERCENT=30 +DOT=31 +COMMA=32 +LB=33 +RB=34 +LP=35 +RP=36 +PIPE=37 +STRING=38 +INTEGER_VALUE=39 +DECIMAL_VALUE=40 +IDENTIFIER=41 +QUOTED_IDENTIFIER=42 +TILDE_IDENTIFIER=43 +LINE_COMMENT=44 +BRACKETED_COMMENT=45 +WS=46 'and'=1 'any'=2 'by'=3 'false'=4 'in'=5 -'join'=6 -'maxspan'=7 -'not'=8 -'null'=9 -'of'=10 -'or'=11 -'sequence'=12 -'true'=13 -'until'=14 -'where'=15 -'with'=16 -':'=17 -'='=18 -'=='=19 -'!='=20 -'<'=21 -'<='=22 -'>'=23 -'>='=24 -'+'=25 -'-'=26 -'*'=27 -'/'=28 -'%'=29 -'.'=30 -','=31 -'['=32 -']'=33 -'('=34 -')'=35 -'|'=36 +'in~'=6 +'join'=7 +'maxspan'=8 +'not'=9 +'null'=10 +'of'=11 +'or'=12 +'sequence'=13 +'true'=14 +'until'=15 +'where'=16 +'with'=17 +':'=18 +'='=19 +'=='=20 +'!='=21 +'<'=22 +'<='=23 +'>'=24 +'>='=25 +'+'=26 +'-'=27 +'*'=28 +'/'=29 +'%'=30 +'.'=31 +','=32 +'['=33 +']'=34 +'('=35 +')'=36 +'|'=37 diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveEquals.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveEquals.java index 2d233bf5e2241..e2724b5d6451b 100644 --- a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveEquals.java +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveEquals.java @@ -8,7 +8,6 @@ import org.elasticsearch.xpack.ql.expression.Expression; import org.elasticsearch.xpack.ql.expression.predicate.Negatable; -import org.elasticsearch.xpack.ql.expression.predicate.operator.comparison.BinaryComparisonProcessor.BinaryComparisonOperation; import org.elasticsearch.xpack.ql.tree.NodeInfo; import org.elasticsearch.xpack.ql.tree.Source; @@ -16,10 +15,6 @@ public class InsensitiveEquals extends InsensitiveBinaryComparison implements Negatable { - public InsensitiveEquals(Source source, Expression left, Expression right) { - this(source, left, right, null); - } - public InsensitiveEquals(Source source, Expression left, Expression right, ZoneId zoneId) { super(source, left, right, InsensitiveBinaryComparisonProcessor.InsensitiveBinaryComparisonOperation.SEQ, zoneId); } @@ -46,6 +41,6 @@ public InsensitiveBinaryComparison negate() { @Override protected String regularOperatorSymbol() { - return BinaryComparisonOperation.EQ.symbol(); + return "in"; } } diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveNotEquals.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveNotEquals.java index 192e2a91be41a..c6eb1ebd656de 100644 --- a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveNotEquals.java +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveNotEquals.java @@ -8,14 +8,11 @@ import org.elasticsearch.xpack.ql.expression.Expression; import org.elasticsearch.xpack.ql.expression.predicate.Negatable; -import org.elasticsearch.xpack.ql.expression.predicate.operator.comparison.BinaryComparisonProcessor.BinaryComparisonOperation; import org.elasticsearch.xpack.ql.tree.NodeInfo; import org.elasticsearch.xpack.ql.tree.Source; import java.time.ZoneId; -; - public class InsensitiveNotEquals extends InsensitiveBinaryComparison implements Negatable { public InsensitiveNotEquals(Source source, Expression left, Expression right, ZoneId zoneId) { @@ -44,7 +41,7 @@ public InsensitiveBinaryComparison negate() { @Override protected String regularOperatorSymbol() { - return BinaryComparisonOperation.NEQ.symbol(); + return "not in"; } } diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveWildcardEquals.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveWildcardEquals.java new file mode 100644 index 0000000000000..6b91919c15ebd --- /dev/null +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveWildcardEquals.java @@ -0,0 +1,50 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +package org.elasticsearch.xpack.eql.expression.predicate.operator.comparison; + +import org.elasticsearch.xpack.ql.expression.Expression; +import org.elasticsearch.xpack.ql.expression.predicate.operator.comparison.BinaryComparisonProcessor; +import org.elasticsearch.xpack.ql.tree.NodeInfo; +import org.elasticsearch.xpack.ql.tree.Source; + +import java.time.ZoneId; + +/** + * Variant of insensitive equality that understands wildcard patterns (*, !). + * Should be replaced by the optimizer in case of the wildcard pattern, otherwise behaves just like its parent. + */ +public class InsensitiveWildcardEquals extends InsensitiveEquals { + + public InsensitiveWildcardEquals(Source source, Expression left, Expression right, ZoneId zoneId) { + super(source, left, right, zoneId); + } + + @Override + protected NodeInfo info() { + return NodeInfo.create(this, InsensitiveWildcardEquals::new, left(), right(), zoneId()); + } + + @Override + protected InsensitiveWildcardEquals replaceChildren(Expression newLeft, Expression newRight) { + return new InsensitiveWildcardEquals(source(), newLeft, newRight, zoneId()); + } + + @Override + public InsensitiveWildcardEquals swapLeftAndRight() { + return new InsensitiveWildcardEquals(source(), right(), left(), zoneId()); + } + + @Override + public InsensitiveBinaryComparison negate() { + return new InsensitiveWildcardNotEquals(source(), left(), right(), zoneId()); + } + + @Override + protected String regularOperatorSymbol() { + return BinaryComparisonProcessor.BinaryComparisonOperation.EQ.symbol(); + } +} diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveWildcardNotEquals.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveWildcardNotEquals.java new file mode 100644 index 0000000000000..1113fd79fa980 --- /dev/null +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/predicate/operator/comparison/InsensitiveWildcardNotEquals.java @@ -0,0 +1,48 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +package org.elasticsearch.xpack.eql.expression.predicate.operator.comparison; + +import org.elasticsearch.xpack.ql.expression.Expression; +import org.elasticsearch.xpack.ql.expression.predicate.operator.comparison.BinaryComparisonProcessor; +import org.elasticsearch.xpack.ql.tree.NodeInfo; +import org.elasticsearch.xpack.ql.tree.Source; + +import java.time.ZoneId; + +public class InsensitiveWildcardNotEquals extends InsensitiveNotEquals { + + public InsensitiveWildcardNotEquals(Source source, + Expression left, + Expression right, ZoneId zoneId) { + super(source, left, right, zoneId); + } + + @Override + protected NodeInfo info() { + return NodeInfo.create(this, InsensitiveWildcardNotEquals::new, left(), right(), zoneId()); + } + + @Override + protected InsensitiveWildcardNotEquals replaceChildren(Expression newLeft, Expression newRight) { + return new InsensitiveWildcardNotEquals(source(), newLeft, newRight, zoneId()); + } + + @Override + public InsensitiveWildcardNotEquals swapLeftAndRight() { + return new InsensitiveWildcardNotEquals(source(), right(), left(), zoneId()); + } + + @Override + public InsensitiveBinaryComparison negate() { + return new InsensitiveWildcardEquals(source(), left(), right(), zoneId()); + } + + @Override + protected String regularOperatorSymbol() { + return BinaryComparisonProcessor.BinaryComparisonOperation.NEQ.symbol(); + } +} diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/optimizer/Optimizer.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/optimizer/Optimizer.java index b3fac87bec993..da14cc2404cce 100644 --- a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/optimizer/Optimizer.java +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/optimizer/Optimizer.java @@ -8,7 +8,8 @@ import org.elasticsearch.xpack.eql.EqlIllegalArgumentException; import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveBinaryComparison; -import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveNotEquals; +import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveWildcardEquals; +import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveWildcardNotEquals; import org.elasticsearch.xpack.eql.plan.logical.Join; import org.elasticsearch.xpack.eql.plan.logical.KeyedFilter; import org.elasticsearch.xpack.eql.plan.logical.LimitWithOffset; @@ -114,26 +115,27 @@ private static class ReplaceWildcards extends OptimizerRule { @Override protected LogicalPlan rule(Filter filter) { return filter.transformExpressionsUp(InsensitiveBinaryComparison.class, cmp -> { - // expr : "wildcard*phrase?" || expr !: "wildcard*phrase?" Expression result = cmp; - Expression target = null; - String wildString = null; + if (cmp instanceof InsensitiveWildcardEquals || cmp instanceof InsensitiveWildcardNotEquals) { + // expr : "wildcard*phrase?" || expr !: "wildcard*phrase?" + Expression target = null; + String wildString = null; + + // check only the right side + if (isWildcard(cmp.right())) { + wildString = (String) cmp.right().fold(); + target = cmp.left(); + } - // check only the right side - if (isWildcard(cmp.right())) { - wildString = (String) cmp.right().fold(); - target = cmp.left(); - } + if (target != null) { + Expression like = new Like(cmp.source(), target, StringUtils.toLikePattern(wildString), true); + if (cmp instanceof InsensitiveWildcardNotEquals) { + like = new Not(cmp.source(), like); + } - if (target != null) { - Expression like = new Like(cmp.source(), target, StringUtils.toLikePattern(wildString), true); - if (cmp instanceof InsensitiveNotEquals) { - like = new Not(cmp.source(), like); + result = like; } - - result = like; } - return result; }); } diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseLexer.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseLexer.java index cb688d432e559..af2d85518db21 100644 --- a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseLexer.java +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseLexer.java @@ -17,39 +17,41 @@ class EqlBaseLexer extends Lexer { protected static final PredictionContextCache _sharedContextCache = new PredictionContextCache(); public static final int - AND=1, ANY=2, BY=3, FALSE=4, IN=5, JOIN=6, MAXSPAN=7, NOT=8, NULL=9, OF=10, - OR=11, SEQUENCE=12, TRUE=13, UNTIL=14, WHERE=15, WITH=16, SEQ=17, ASGN=18, - EQ=19, NEQ=20, LT=21, LTE=22, GT=23, GTE=24, PLUS=25, MINUS=26, ASTERISK=27, - SLASH=28, PERCENT=29, DOT=30, COMMA=31, LB=32, RB=33, LP=34, RP=35, PIPE=36, - STRING=37, INTEGER_VALUE=38, DECIMAL_VALUE=39, IDENTIFIER=40, QUOTED_IDENTIFIER=41, - TILDE_IDENTIFIER=42, LINE_COMMENT=43, BRACKETED_COMMENT=44, WS=45; + AND=1, ANY=2, BY=3, FALSE=4, IN=5, IN_INSENSITIVE=6, JOIN=7, MAXSPAN=8, + NOT=9, NULL=10, OF=11, OR=12, SEQUENCE=13, TRUE=14, UNTIL=15, WHERE=16, + WITH=17, SEQ=18, ASGN=19, EQ=20, NEQ=21, LT=22, LTE=23, GT=24, GTE=25, + PLUS=26, MINUS=27, ASTERISK=28, SLASH=29, PERCENT=30, DOT=31, COMMA=32, + LB=33, RB=34, LP=35, RP=36, PIPE=37, STRING=38, INTEGER_VALUE=39, DECIMAL_VALUE=40, + IDENTIFIER=41, QUOTED_IDENTIFIER=42, TILDE_IDENTIFIER=43, LINE_COMMENT=44, + BRACKETED_COMMENT=45, WS=46; public static String[] modeNames = { "DEFAULT_MODE" }; public static final String[] ruleNames = { - "AND", "ANY", "BY", "FALSE", "IN", "JOIN", "MAXSPAN", "NOT", "NULL", "OF", - "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", "SEQ", "ASGN", "EQ", - "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", "ASTERISK", "SLASH", - "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", "PIPE", "STRING", "INTEGER_VALUE", - "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", "TILDE_IDENTIFIER", - "EXPONENT", "DIGIT", "LETTER", "LINE_COMMENT", "BRACKETED_COMMENT", "WS" + "AND", "ANY", "BY", "FALSE", "IN", "IN_INSENSITIVE", "JOIN", "MAXSPAN", + "NOT", "NULL", "OF", "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", + "SEQ", "ASGN", "EQ", "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", + "ASTERISK", "SLASH", "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", + "PIPE", "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", + "TILDE_IDENTIFIER", "EXPONENT", "DIGIT", "LETTER", "LINE_COMMENT", "BRACKETED_COMMENT", + "WS" }; private static final String[] _LITERAL_NAMES = { - null, "'and'", "'any'", "'by'", "'false'", "'in'", "'join'", "'maxspan'", - "'not'", "'null'", "'of'", "'or'", "'sequence'", "'true'", "'until'", - "'where'", "'with'", "':'", "'='", "'=='", "'!='", "'<'", "'<='", "'>'", - "'>='", "'+'", "'-'", "'*'", "'/'", "'%'", "'.'", "','", "'['", "']'", - "'('", "')'", "'|'" + null, "'and'", "'any'", "'by'", "'false'", "'in'", "'in~'", "'join'", + "'maxspan'", "'not'", "'null'", "'of'", "'or'", "'sequence'", "'true'", + "'until'", "'where'", "'with'", "':'", "'='", "'=='", "'!='", "'<'", "'<='", + "'>'", "'>='", "'+'", "'-'", "'*'", "'/'", "'%'", "'.'", "','", "'['", + "']'", "'('", "')'", "'|'" }; private static final String[] _SYMBOLIC_NAMES = { - null, "AND", "ANY", "BY", "FALSE", "IN", "JOIN", "MAXSPAN", "NOT", "NULL", - "OF", "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", "SEQ", "ASGN", - "EQ", "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", "ASTERISK", "SLASH", - "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", "PIPE", "STRING", "INTEGER_VALUE", - "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", "TILDE_IDENTIFIER", - "LINE_COMMENT", "BRACKETED_COMMENT", "WS" + null, "AND", "ANY", "BY", "FALSE", "IN", "IN_INSENSITIVE", "JOIN", "MAXSPAN", + "NOT", "NULL", "OF", "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", + "SEQ", "ASGN", "EQ", "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", + "ASTERISK", "SLASH", "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", + "PIPE", "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", + "TILDE_IDENTIFIER", "LINE_COMMENT", "BRACKETED_COMMENT", "WS" }; public static final Vocabulary VOCABULARY = new VocabularyImpl(_LITERAL_NAMES, _SYMBOLIC_NAMES); @@ -106,156 +108,160 @@ public EqlBaseLexer(CharStream input) { public ATN getATN() { return _ATN; } public static final String _serializedATN = - "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\2/\u01a7\b\1\4\2\t"+ - "\2\4\3\t\3\4\4\t\4\4\5\t\5\4\6\t\6\4\7\t\7\4\b\t\b\4\t\t\t\4\n\t\n\4\13"+ - "\t\13\4\f\t\f\4\r\t\r\4\16\t\16\4\17\t\17\4\20\t\20\4\21\t\21\4\22\t\22"+ - "\4\23\t\23\4\24\t\24\4\25\t\25\4\26\t\26\4\27\t\27\4\30\t\30\4\31\t\31"+ - "\4\32\t\32\4\33\t\33\4\34\t\34\4\35\t\35\4\36\t\36\4\37\t\37\4 \t \4!"+ - "\t!\4\"\t\"\4#\t#\4$\t$\4%\t%\4&\t&\4\'\t\'\4(\t(\4)\t)\4*\t*\4+\t+\4"+ - ",\t,\4-\t-\4.\t.\4/\t/\4\60\t\60\4\61\t\61\3\2\3\2\3\2\3\2\3\3\3\3\3\3"+ - "\3\3\3\4\3\4\3\4\3\5\3\5\3\5\3\5\3\5\3\5\3\6\3\6\3\6\3\7\3\7\3\7\3\7\3"+ - "\7\3\b\3\b\3\b\3\b\3\b\3\b\3\b\3\b\3\t\3\t\3\t\3\t\3\n\3\n\3\n\3\n\3\n"+ - "\3\13\3\13\3\13\3\f\3\f\3\f\3\r\3\r\3\r\3\r\3\r\3\r\3\r\3\r\3\r\3\16\3"+ - "\16\3\16\3\16\3\16\3\17\3\17\3\17\3\17\3\17\3\17\3\20\3\20\3\20\3\20\3"+ - "\20\3\20\3\21\3\21\3\21\3\21\3\21\3\22\3\22\3\23\3\23\3\24\3\24\3\24\3"+ - "\25\3\25\3\25\3\26\3\26\3\27\3\27\3\27\3\30\3\30\3\31\3\31\3\31\3\32\3"+ - "\32\3\33\3\33\3\34\3\34\3\35\3\35\3\36\3\36\3\37\3\37\3 \3 \3!\3!\3\""+ - "\3\"\3#\3#\3$\3$\3%\3%\3&\3&\3&\3&\7&\u00e3\n&\f&\16&\u00e6\13&\3&\3&"+ - "\3&\3&\3&\7&\u00ed\n&\f&\16&\u00f0\13&\3&\3&\3&\3&\3&\3&\3&\7&\u00f9\n"+ - "&\f&\16&\u00fc\13&\3&\3&\3&\3&\3&\3&\3&\7&\u0105\n&\f&\16&\u0108\13&\3"+ - "&\3&\3&\3&\3&\3&\7&\u0110\n&\f&\16&\u0113\13&\3&\3&\3&\3&\3&\5&\u011a"+ - "\n&\3&\5&\u011d\n&\5&\u011f\n&\3\'\6\'\u0122\n\'\r\'\16\'\u0123\3(\6("+ - "\u0127\n(\r(\16(\u0128\3(\3(\7(\u012d\n(\f(\16(\u0130\13(\3(\3(\6(\u0134"+ - "\n(\r(\16(\u0135\3(\6(\u0139\n(\r(\16(\u013a\3(\3(\7(\u013f\n(\f(\16("+ - "\u0142\13(\5(\u0144\n(\3(\3(\3(\3(\6(\u014a\n(\r(\16(\u014b\3(\3(\5(\u0150"+ - "\n(\3)\3)\5)\u0154\n)\3)\3)\3)\7)\u0159\n)\f)\16)\u015c\13)\3*\3*\3*\3"+ - "*\7*\u0162\n*\f*\16*\u0165\13*\3*\3*\3+\3+\3+\3+\7+\u016d\n+\f+\16+\u0170"+ - "\13+\3+\3+\3,\3,\5,\u0176\n,\3,\6,\u0179\n,\r,\16,\u017a\3-\3-\3.\3.\3"+ - "/\3/\3/\3/\7/\u0185\n/\f/\16/\u0188\13/\3/\5/\u018b\n/\3/\5/\u018e\n/"+ - "\3/\3/\3\60\3\60\3\60\3\60\3\60\7\60\u0197\n\60\f\60\16\60\u019a\13\60"+ - "\3\60\3\60\3\60\3\60\3\60\3\61\6\61\u01a2\n\61\r\61\16\61\u01a3\3\61\3"+ - "\61\4\u0111\u0198\2\62\3\3\5\4\7\5\t\6\13\7\r\b\17\t\21\n\23\13\25\f\27"+ - "\r\31\16\33\17\35\20\37\21!\22#\23%\24\'\25)\26+\27-\30/\31\61\32\63\33"+ - "\65\34\67\359\36;\37= ?!A\"C#E$G%I&K\'M(O)Q*S+U,W\2Y\2[\2]-_.a/\3\2\17"+ + "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\2\60\u01ad\b\1\4\2"+ + "\t\2\4\3\t\3\4\4\t\4\4\5\t\5\4\6\t\6\4\7\t\7\4\b\t\b\4\t\t\t\4\n\t\n\4"+ + "\13\t\13\4\f\t\f\4\r\t\r\4\16\t\16\4\17\t\17\4\20\t\20\4\21\t\21\4\22"+ + "\t\22\4\23\t\23\4\24\t\24\4\25\t\25\4\26\t\26\4\27\t\27\4\30\t\30\4\31"+ + "\t\31\4\32\t\32\4\33\t\33\4\34\t\34\4\35\t\35\4\36\t\36\4\37\t\37\4 \t"+ + " \4!\t!\4\"\t\"\4#\t#\4$\t$\4%\t%\4&\t&\4\'\t\'\4(\t(\4)\t)\4*\t*\4+\t"+ + "+\4,\t,\4-\t-\4.\t.\4/\t/\4\60\t\60\4\61\t\61\4\62\t\62\3\2\3\2\3\2\3"+ + "\2\3\3\3\3\3\3\3\3\3\4\3\4\3\4\3\5\3\5\3\5\3\5\3\5\3\5\3\6\3\6\3\6\3\7"+ + "\3\7\3\7\3\7\3\b\3\b\3\b\3\b\3\b\3\t\3\t\3\t\3\t\3\t\3\t\3\t\3\t\3\n\3"+ + "\n\3\n\3\n\3\13\3\13\3\13\3\13\3\13\3\f\3\f\3\f\3\r\3\r\3\r\3\16\3\16"+ + "\3\16\3\16\3\16\3\16\3\16\3\16\3\16\3\17\3\17\3\17\3\17\3\17\3\20\3\20"+ + "\3\20\3\20\3\20\3\20\3\21\3\21\3\21\3\21\3\21\3\21\3\22\3\22\3\22\3\22"+ + "\3\22\3\23\3\23\3\24\3\24\3\25\3\25\3\25\3\26\3\26\3\26\3\27\3\27\3\30"+ + "\3\30\3\30\3\31\3\31\3\32\3\32\3\32\3\33\3\33\3\34\3\34\3\35\3\35\3\36"+ + "\3\36\3\37\3\37\3 \3 \3!\3!\3\"\3\"\3#\3#\3$\3$\3%\3%\3&\3&\3\'\3\'\3"+ + "\'\3\'\7\'\u00e9\n\'\f\'\16\'\u00ec\13\'\3\'\3\'\3\'\3\'\3\'\7\'\u00f3"+ + "\n\'\f\'\16\'\u00f6\13\'\3\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u00ff\n\'\f\'"+ + "\16\'\u0102\13\'\3\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u010b\n\'\f\'\16\'\u010e"+ + "\13\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u0116\n\'\f\'\16\'\u0119\13\'\3\'\3"+ + "\'\3\'\3\'\3\'\5\'\u0120\n\'\3\'\5\'\u0123\n\'\5\'\u0125\n\'\3(\6(\u0128"+ + "\n(\r(\16(\u0129\3)\6)\u012d\n)\r)\16)\u012e\3)\3)\7)\u0133\n)\f)\16)"+ + "\u0136\13)\3)\3)\6)\u013a\n)\r)\16)\u013b\3)\6)\u013f\n)\r)\16)\u0140"+ + "\3)\3)\7)\u0145\n)\f)\16)\u0148\13)\5)\u014a\n)\3)\3)\3)\3)\6)\u0150\n"+ + ")\r)\16)\u0151\3)\3)\5)\u0156\n)\3*\3*\5*\u015a\n*\3*\3*\3*\7*\u015f\n"+ + "*\f*\16*\u0162\13*\3+\3+\3+\3+\7+\u0168\n+\f+\16+\u016b\13+\3+\3+\3,\3"+ + ",\3,\3,\7,\u0173\n,\f,\16,\u0176\13,\3,\3,\3-\3-\5-\u017c\n-\3-\6-\u017f"+ + "\n-\r-\16-\u0180\3.\3.\3/\3/\3\60\3\60\3\60\3\60\7\60\u018b\n\60\f\60"+ + "\16\60\u018e\13\60\3\60\5\60\u0191\n\60\3\60\5\60\u0194\n\60\3\60\3\60"+ + "\3\61\3\61\3\61\3\61\3\61\7\61\u019d\n\61\f\61\16\61\u01a0\13\61\3\61"+ + "\3\61\3\61\3\61\3\61\3\62\6\62\u01a8\n\62\r\62\16\62\u01a9\3\62\3\62\4"+ + "\u0117\u019e\2\63\3\3\5\4\7\5\t\6\13\7\r\b\17\t\21\n\23\13\25\f\27\r\31"+ + "\16\33\17\35\20\37\21!\22#\23%\24\'\25)\26+\27-\30/\31\61\32\63\33\65"+ + "\34\67\359\36;\37= ?!A\"C#E$G%I&K\'M(O)Q*S+U,W-Y\2[\2]\2_.a/c\60\3\2\17"+ "\n\2$$))^^ddhhppttvv\6\2\f\f\17\17))^^\6\2\f\f\17\17$$^^\5\2\f\f\17\17"+ "$$\5\2\f\f\17\17))\4\2\f\f\17\17\4\2BBaa\3\2bb\4\2GGgg\4\2--//\3\2\62"+ - ";\4\2C\\c|\5\2\13\f\17\17\"\"\u01ce\2\3\3\2\2\2\2\5\3\2\2\2\2\7\3\2\2"+ + ";\4\2C\\c|\5\2\13\f\17\17\"\"\u01d4\2\3\3\2\2\2\2\5\3\2\2\2\2\7\3\2\2"+ "\2\2\t\3\2\2\2\2\13\3\2\2\2\2\r\3\2\2\2\2\17\3\2\2\2\2\21\3\2\2\2\2\23"+ "\3\2\2\2\2\25\3\2\2\2\2\27\3\2\2\2\2\31\3\2\2\2\2\33\3\2\2\2\2\35\3\2"+ "\2\2\2\37\3\2\2\2\2!\3\2\2\2\2#\3\2\2\2\2%\3\2\2\2\2\'\3\2\2\2\2)\3\2"+ "\2\2\2+\3\2\2\2\2-\3\2\2\2\2/\3\2\2\2\2\61\3\2\2\2\2\63\3\2\2\2\2\65\3"+ "\2\2\2\2\67\3\2\2\2\29\3\2\2\2\2;\3\2\2\2\2=\3\2\2\2\2?\3\2\2\2\2A\3\2"+ "\2\2\2C\3\2\2\2\2E\3\2\2\2\2G\3\2\2\2\2I\3\2\2\2\2K\3\2\2\2\2M\3\2\2\2"+ - "\2O\3\2\2\2\2Q\3\2\2\2\2S\3\2\2\2\2U\3\2\2\2\2]\3\2\2\2\2_\3\2\2\2\2a"+ - "\3\2\2\2\3c\3\2\2\2\5g\3\2\2\2\7k\3\2\2\2\tn\3\2\2\2\13t\3\2\2\2\rw\3"+ - "\2\2\2\17|\3\2\2\2\21\u0084\3\2\2\2\23\u0088\3\2\2\2\25\u008d\3\2\2\2"+ - "\27\u0090\3\2\2\2\31\u0093\3\2\2\2\33\u009c\3\2\2\2\35\u00a1\3\2\2\2\37"+ - "\u00a7\3\2\2\2!\u00ad\3\2\2\2#\u00b2\3\2\2\2%\u00b4\3\2\2\2\'\u00b6\3"+ - "\2\2\2)\u00b9\3\2\2\2+\u00bc\3\2\2\2-\u00be\3\2\2\2/\u00c1\3\2\2\2\61"+ - "\u00c3\3\2\2\2\63\u00c6\3\2\2\2\65\u00c8\3\2\2\2\67\u00ca\3\2\2\29\u00cc"+ - "\3\2\2\2;\u00ce\3\2\2\2=\u00d0\3\2\2\2?\u00d2\3\2\2\2A\u00d4\3\2\2\2C"+ - "\u00d6\3\2\2\2E\u00d8\3\2\2\2G\u00da\3\2\2\2I\u00dc\3\2\2\2K\u011e\3\2"+ - "\2\2M\u0121\3\2\2\2O\u014f\3\2\2\2Q\u0153\3\2\2\2S\u015d\3\2\2\2U\u0168"+ - "\3\2\2\2W\u0173\3\2\2\2Y\u017c\3\2\2\2[\u017e\3\2\2\2]\u0180\3\2\2\2_"+ - "\u0191\3\2\2\2a\u01a1\3\2\2\2cd\7c\2\2de\7p\2\2ef\7f\2\2f\4\3\2\2\2gh"+ - "\7c\2\2hi\7p\2\2ij\7{\2\2j\6\3\2\2\2kl\7d\2\2lm\7{\2\2m\b\3\2\2\2no\7"+ - "h\2\2op\7c\2\2pq\7n\2\2qr\7u\2\2rs\7g\2\2s\n\3\2\2\2tu\7k\2\2uv\7p\2\2"+ - "v\f\3\2\2\2wx\7l\2\2xy\7q\2\2yz\7k\2\2z{\7p\2\2{\16\3\2\2\2|}\7o\2\2}"+ - "~\7c\2\2~\177\7z\2\2\177\u0080\7u\2\2\u0080\u0081\7r\2\2\u0081\u0082\7"+ - "c\2\2\u0082\u0083\7p\2\2\u0083\20\3\2\2\2\u0084\u0085\7p\2\2\u0085\u0086"+ - "\7q\2\2\u0086\u0087\7v\2\2\u0087\22\3\2\2\2\u0088\u0089\7p\2\2\u0089\u008a"+ - "\7w\2\2\u008a\u008b\7n\2\2\u008b\u008c\7n\2\2\u008c\24\3\2\2\2\u008d\u008e"+ - "\7q\2\2\u008e\u008f\7h\2\2\u008f\26\3\2\2\2\u0090\u0091\7q\2\2\u0091\u0092"+ - "\7t\2\2\u0092\30\3\2\2\2\u0093\u0094\7u\2\2\u0094\u0095\7g\2\2\u0095\u0096"+ - "\7s\2\2\u0096\u0097\7w\2\2\u0097\u0098\7g\2\2\u0098\u0099\7p\2\2\u0099"+ - "\u009a\7e\2\2\u009a\u009b\7g\2\2\u009b\32\3\2\2\2\u009c\u009d\7v\2\2\u009d"+ - "\u009e\7t\2\2\u009e\u009f\7w\2\2\u009f\u00a0\7g\2\2\u00a0\34\3\2\2\2\u00a1"+ - "\u00a2\7w\2\2\u00a2\u00a3\7p\2\2\u00a3\u00a4\7v\2\2\u00a4\u00a5\7k\2\2"+ - "\u00a5\u00a6\7n\2\2\u00a6\36\3\2\2\2\u00a7\u00a8\7y\2\2\u00a8\u00a9\7"+ - "j\2\2\u00a9\u00aa\7g\2\2\u00aa\u00ab\7t\2\2\u00ab\u00ac\7g\2\2\u00ac "+ - "\3\2\2\2\u00ad\u00ae\7y\2\2\u00ae\u00af\7k\2\2\u00af\u00b0\7v\2\2\u00b0"+ - "\u00b1\7j\2\2\u00b1\"\3\2\2\2\u00b2\u00b3\7<\2\2\u00b3$\3\2\2\2\u00b4"+ - "\u00b5\7?\2\2\u00b5&\3\2\2\2\u00b6\u00b7\7?\2\2\u00b7\u00b8\7?\2\2\u00b8"+ - "(\3\2\2\2\u00b9\u00ba\7#\2\2\u00ba\u00bb\7?\2\2\u00bb*\3\2\2\2\u00bc\u00bd"+ - "\7>\2\2\u00bd,\3\2\2\2\u00be\u00bf\7>\2\2\u00bf\u00c0\7?\2\2\u00c0.\3"+ - "\2\2\2\u00c1\u00c2\7@\2\2\u00c2\60\3\2\2\2\u00c3\u00c4\7@\2\2\u00c4\u00c5"+ - "\7?\2\2\u00c5\62\3\2\2\2\u00c6\u00c7\7-\2\2\u00c7\64\3\2\2\2\u00c8\u00c9"+ - "\7/\2\2\u00c9\66\3\2\2\2\u00ca\u00cb\7,\2\2\u00cb8\3\2\2\2\u00cc\u00cd"+ - "\7\61\2\2\u00cd:\3\2\2\2\u00ce\u00cf\7\'\2\2\u00cf<\3\2\2\2\u00d0\u00d1"+ - "\7\60\2\2\u00d1>\3\2\2\2\u00d2\u00d3\7.\2\2\u00d3@\3\2\2\2\u00d4\u00d5"+ - "\7]\2\2\u00d5B\3\2\2\2\u00d6\u00d7\7_\2\2\u00d7D\3\2\2\2\u00d8\u00d9\7"+ - "*\2\2\u00d9F\3\2\2\2\u00da\u00db\7+\2\2\u00dbH\3\2\2\2\u00dc\u00dd\7~"+ - "\2\2\u00ddJ\3\2\2\2\u00de\u00e4\7)\2\2\u00df\u00e0\7^\2\2\u00e0\u00e3"+ - "\t\2\2\2\u00e1\u00e3\n\3\2\2\u00e2\u00df\3\2\2\2\u00e2\u00e1\3\2\2\2\u00e3"+ - "\u00e6\3\2\2\2\u00e4\u00e2\3\2\2\2\u00e4\u00e5\3\2\2\2\u00e5\u00e7\3\2"+ - "\2\2\u00e6\u00e4\3\2\2\2\u00e7\u011f\7)\2\2\u00e8\u00ee\7$\2\2\u00e9\u00ea"+ - "\7^\2\2\u00ea\u00ed\t\2\2\2\u00eb\u00ed\n\4\2\2\u00ec\u00e9\3\2\2\2\u00ec"+ - "\u00eb\3\2\2\2\u00ed\u00f0\3\2\2\2\u00ee\u00ec\3\2\2\2\u00ee\u00ef\3\2"+ - "\2\2\u00ef\u00f1\3\2\2\2\u00f0\u00ee\3\2\2\2\u00f1\u011f\7$\2\2\u00f2"+ - "\u00f3\7A\2\2\u00f3\u00f4\7$\2\2\u00f4\u00fa\3\2\2\2\u00f5\u00f6\7^\2"+ - "\2\u00f6\u00f9\7$\2\2\u00f7\u00f9\n\5\2\2\u00f8\u00f5\3\2\2\2\u00f8\u00f7"+ - "\3\2\2\2\u00f9\u00fc\3\2\2\2\u00fa\u00f8\3\2\2\2\u00fa\u00fb\3\2\2\2\u00fb"+ - "\u00fd\3\2\2\2\u00fc\u00fa\3\2\2\2\u00fd\u011f\7$\2\2\u00fe\u00ff\7A\2"+ - "\2\u00ff\u0100\7)\2\2\u0100\u0106\3\2\2\2\u0101\u0102\7^\2\2\u0102\u0105"+ - "\7)\2\2\u0103\u0105\n\6\2\2\u0104\u0101\3\2\2\2\u0104\u0103\3\2\2\2\u0105"+ - "\u0108\3\2\2\2\u0106\u0104\3\2\2\2\u0106\u0107\3\2\2\2\u0107\u0109\3\2"+ - "\2\2\u0108\u0106\3\2\2\2\u0109\u011f\7)\2\2\u010a\u010b\7$\2\2\u010b\u010c"+ - "\7$\2\2\u010c\u010d\7$\2\2\u010d\u0111\3\2\2\2\u010e\u0110\n\7\2\2\u010f"+ - "\u010e\3\2\2\2\u0110\u0113\3\2\2\2\u0111\u0112\3\2\2\2\u0111\u010f\3\2"+ - "\2\2\u0112\u0114\3\2\2\2\u0113\u0111\3\2\2\2\u0114\u0115\7$\2\2\u0115"+ - "\u0116\7$\2\2\u0116\u0117\7$\2\2\u0117\u0119\3\2\2\2\u0118\u011a\7$\2"+ - "\2\u0119\u0118\3\2\2\2\u0119\u011a\3\2\2\2\u011a\u011c\3\2\2\2\u011b\u011d"+ - "\7$\2\2\u011c\u011b\3\2\2\2\u011c\u011d\3\2\2\2\u011d\u011f\3\2\2\2\u011e"+ - "\u00de\3\2\2\2\u011e\u00e8\3\2\2\2\u011e\u00f2\3\2\2\2\u011e\u00fe\3\2"+ - "\2\2\u011e\u010a\3\2\2\2\u011fL\3\2\2\2\u0120\u0122\5Y-\2\u0121\u0120"+ - "\3\2\2\2\u0122\u0123\3\2\2\2\u0123\u0121\3\2\2\2\u0123\u0124\3\2\2\2\u0124"+ - "N\3\2\2\2\u0125\u0127\5Y-\2\u0126\u0125\3\2\2\2\u0127\u0128\3\2\2\2\u0128"+ - "\u0126\3\2\2\2\u0128\u0129\3\2\2\2\u0129\u012a\3\2\2\2\u012a\u012e\5="+ - "\37\2\u012b\u012d\5Y-\2\u012c\u012b\3\2\2\2\u012d\u0130\3\2\2\2\u012e"+ - "\u012c\3\2\2\2\u012e\u012f\3\2\2\2\u012f\u0150\3\2\2\2\u0130\u012e\3\2"+ - "\2\2\u0131\u0133\5=\37\2\u0132\u0134\5Y-\2\u0133\u0132\3\2\2\2\u0134\u0135"+ - "\3\2\2\2\u0135\u0133\3\2\2\2\u0135\u0136\3\2\2\2\u0136\u0150\3\2\2\2\u0137"+ - "\u0139\5Y-\2\u0138\u0137\3\2\2\2\u0139\u013a\3\2\2\2\u013a\u0138\3\2\2"+ - "\2\u013a\u013b\3\2\2\2\u013b\u0143\3\2\2\2\u013c\u0140\5=\37\2\u013d\u013f"+ - "\5Y-\2\u013e\u013d\3\2\2\2\u013f\u0142\3\2\2\2\u0140\u013e\3\2\2\2\u0140"+ - "\u0141\3\2\2\2\u0141\u0144\3\2\2\2\u0142\u0140\3\2\2\2\u0143\u013c\3\2"+ - "\2\2\u0143\u0144\3\2\2\2\u0144\u0145\3\2\2\2\u0145\u0146\5W,\2\u0146\u0150"+ - "\3\2\2\2\u0147\u0149\5=\37\2\u0148\u014a\5Y-\2\u0149\u0148\3\2\2\2\u014a"+ - "\u014b\3\2\2\2\u014b\u0149\3\2\2\2\u014b\u014c\3\2\2\2\u014c\u014d\3\2"+ - "\2\2\u014d\u014e\5W,\2\u014e\u0150\3\2\2\2\u014f\u0126\3\2\2\2\u014f\u0131"+ - "\3\2\2\2\u014f\u0138\3\2\2\2\u014f\u0147\3\2\2\2\u0150P\3\2\2\2\u0151"+ - "\u0154\5[.\2\u0152\u0154\t\b\2\2\u0153\u0151\3\2\2\2\u0153\u0152\3\2\2"+ - "\2\u0154\u015a\3\2\2\2\u0155\u0159\5[.\2\u0156\u0159\5Y-\2\u0157\u0159"+ - "\7a\2\2\u0158\u0155\3\2\2\2\u0158\u0156\3\2\2\2\u0158\u0157\3\2\2\2\u0159"+ - "\u015c\3\2\2\2\u015a\u0158\3\2\2\2\u015a\u015b\3\2\2\2\u015bR\3\2\2\2"+ - "\u015c\u015a\3\2\2\2\u015d\u0163\7b\2\2\u015e\u0162\n\t\2\2\u015f\u0160"+ - "\7b\2\2\u0160\u0162\7b\2\2\u0161\u015e\3\2\2\2\u0161\u015f\3\2\2\2\u0162"+ - "\u0165\3\2\2\2\u0163\u0161\3\2\2\2\u0163\u0164\3\2\2\2\u0164\u0166\3\2"+ - "\2\2\u0165\u0163\3\2\2\2\u0166\u0167\7b\2\2\u0167T\3\2\2\2\u0168\u016e"+ - "\5[.\2\u0169\u016d\5[.\2\u016a\u016d\5Y-\2\u016b\u016d\7a\2\2\u016c\u0169"+ - "\3\2\2\2\u016c\u016a\3\2\2\2\u016c\u016b\3\2\2\2\u016d\u0170\3\2\2\2\u016e"+ - "\u016c\3\2\2\2\u016e\u016f\3\2\2\2\u016f\u0171\3\2\2\2\u0170\u016e\3\2"+ - "\2\2\u0171\u0172\7\u0080\2\2\u0172V\3\2\2\2\u0173\u0175\t\n\2\2\u0174"+ - "\u0176\t\13\2\2\u0175\u0174\3\2\2\2\u0175\u0176\3\2\2\2\u0176\u0178\3"+ - "\2\2\2\u0177\u0179\5Y-\2\u0178\u0177\3\2\2\2\u0179\u017a\3\2\2\2\u017a"+ - "\u0178\3\2\2\2\u017a\u017b\3\2\2\2\u017bX\3\2\2\2\u017c\u017d\t\f\2\2"+ - "\u017dZ\3\2\2\2\u017e\u017f\t\r\2\2\u017f\\\3\2\2\2\u0180\u0181\7\61\2"+ - "\2\u0181\u0182\7\61\2\2\u0182\u0186\3\2\2\2\u0183\u0185\n\7\2\2\u0184"+ - "\u0183\3\2\2\2\u0185\u0188\3\2\2\2\u0186\u0184\3\2\2\2\u0186\u0187\3\2"+ - "\2\2\u0187\u018a\3\2\2\2\u0188\u0186\3\2\2\2\u0189\u018b\7\17\2\2\u018a"+ - "\u0189\3\2\2\2\u018a\u018b\3\2\2\2\u018b\u018d\3\2\2\2\u018c\u018e\7\f"+ - "\2\2\u018d\u018c\3\2\2\2\u018d\u018e\3\2\2\2\u018e\u018f\3\2\2\2\u018f"+ - "\u0190\b/\2\2\u0190^\3\2\2\2\u0191\u0192\7\61\2\2\u0192\u0193\7,\2\2\u0193"+ - "\u0198\3\2\2\2\u0194\u0197\5_\60\2\u0195\u0197\13\2\2\2\u0196\u0194\3"+ - "\2\2\2\u0196\u0195\3\2\2\2\u0197\u019a\3\2\2\2\u0198\u0199\3\2\2\2\u0198"+ - "\u0196\3\2\2\2\u0199\u019b\3\2\2\2\u019a\u0198\3\2\2\2\u019b\u019c\7,"+ - "\2\2\u019c\u019d\7\61\2\2\u019d\u019e\3\2\2\2\u019e\u019f\b\60\2\2\u019f"+ - "`\3\2\2\2\u01a0\u01a2\t\16\2\2\u01a1\u01a0\3\2\2\2\u01a2\u01a3\3\2\2\2"+ - "\u01a3\u01a1\3\2\2\2\u01a3\u01a4\3\2\2\2\u01a4\u01a5\3\2\2\2\u01a5\u01a6"+ - "\b\61\2\2\u01a6b\3\2\2\2\'\2\u00e2\u00e4\u00ec\u00ee\u00f8\u00fa\u0104"+ - "\u0106\u0111\u0119\u011c\u011e\u0123\u0128\u012e\u0135\u013a\u0140\u0143"+ - "\u014b\u014f\u0153\u0158\u015a\u0161\u0163\u016c\u016e\u0175\u017a\u0186"+ - "\u018a\u018d\u0196\u0198\u01a3\3\2\3\2"; + "\2O\3\2\2\2\2Q\3\2\2\2\2S\3\2\2\2\2U\3\2\2\2\2W\3\2\2\2\2_\3\2\2\2\2a"+ + "\3\2\2\2\2c\3\2\2\2\3e\3\2\2\2\5i\3\2\2\2\7m\3\2\2\2\tp\3\2\2\2\13v\3"+ + "\2\2\2\ry\3\2\2\2\17}\3\2\2\2\21\u0082\3\2\2\2\23\u008a\3\2\2\2\25\u008e"+ + "\3\2\2\2\27\u0093\3\2\2\2\31\u0096\3\2\2\2\33\u0099\3\2\2\2\35\u00a2\3"+ + "\2\2\2\37\u00a7\3\2\2\2!\u00ad\3\2\2\2#\u00b3\3\2\2\2%\u00b8\3\2\2\2\'"+ + "\u00ba\3\2\2\2)\u00bc\3\2\2\2+\u00bf\3\2\2\2-\u00c2\3\2\2\2/\u00c4\3\2"+ + "\2\2\61\u00c7\3\2\2\2\63\u00c9\3\2\2\2\65\u00cc\3\2\2\2\67\u00ce\3\2\2"+ + "\29\u00d0\3\2\2\2;\u00d2\3\2\2\2=\u00d4\3\2\2\2?\u00d6\3\2\2\2A\u00d8"+ + "\3\2\2\2C\u00da\3\2\2\2E\u00dc\3\2\2\2G\u00de\3\2\2\2I\u00e0\3\2\2\2K"+ + "\u00e2\3\2\2\2M\u0124\3\2\2\2O\u0127\3\2\2\2Q\u0155\3\2\2\2S\u0159\3\2"+ + "\2\2U\u0163\3\2\2\2W\u016e\3\2\2\2Y\u0179\3\2\2\2[\u0182\3\2\2\2]\u0184"+ + "\3\2\2\2_\u0186\3\2\2\2a\u0197\3\2\2\2c\u01a7\3\2\2\2ef\7c\2\2fg\7p\2"+ + "\2gh\7f\2\2h\4\3\2\2\2ij\7c\2\2jk\7p\2\2kl\7{\2\2l\6\3\2\2\2mn\7d\2\2"+ + "no\7{\2\2o\b\3\2\2\2pq\7h\2\2qr\7c\2\2rs\7n\2\2st\7u\2\2tu\7g\2\2u\n\3"+ + "\2\2\2vw\7k\2\2wx\7p\2\2x\f\3\2\2\2yz\7k\2\2z{\7p\2\2{|\7\u0080\2\2|\16"+ + "\3\2\2\2}~\7l\2\2~\177\7q\2\2\177\u0080\7k\2\2\u0080\u0081\7p\2\2\u0081"+ + "\20\3\2\2\2\u0082\u0083\7o\2\2\u0083\u0084\7c\2\2\u0084\u0085\7z\2\2\u0085"+ + "\u0086\7u\2\2\u0086\u0087\7r\2\2\u0087\u0088\7c\2\2\u0088\u0089\7p\2\2"+ + "\u0089\22\3\2\2\2\u008a\u008b\7p\2\2\u008b\u008c\7q\2\2\u008c\u008d\7"+ + "v\2\2\u008d\24\3\2\2\2\u008e\u008f\7p\2\2\u008f\u0090\7w\2\2\u0090\u0091"+ + "\7n\2\2\u0091\u0092\7n\2\2\u0092\26\3\2\2\2\u0093\u0094\7q\2\2\u0094\u0095"+ + "\7h\2\2\u0095\30\3\2\2\2\u0096\u0097\7q\2\2\u0097\u0098\7t\2\2\u0098\32"+ + "\3\2\2\2\u0099\u009a\7u\2\2\u009a\u009b\7g\2\2\u009b\u009c\7s\2\2\u009c"+ + "\u009d\7w\2\2\u009d\u009e\7g\2\2\u009e\u009f\7p\2\2\u009f\u00a0\7e\2\2"+ + "\u00a0\u00a1\7g\2\2\u00a1\34\3\2\2\2\u00a2\u00a3\7v\2\2\u00a3\u00a4\7"+ + "t\2\2\u00a4\u00a5\7w\2\2\u00a5\u00a6\7g\2\2\u00a6\36\3\2\2\2\u00a7\u00a8"+ + "\7w\2\2\u00a8\u00a9\7p\2\2\u00a9\u00aa\7v\2\2\u00aa\u00ab\7k\2\2\u00ab"+ + "\u00ac\7n\2\2\u00ac \3\2\2\2\u00ad\u00ae\7y\2\2\u00ae\u00af\7j\2\2\u00af"+ + "\u00b0\7g\2\2\u00b0\u00b1\7t\2\2\u00b1\u00b2\7g\2\2\u00b2\"\3\2\2\2\u00b3"+ + "\u00b4\7y\2\2\u00b4\u00b5\7k\2\2\u00b5\u00b6\7v\2\2\u00b6\u00b7\7j\2\2"+ + "\u00b7$\3\2\2\2\u00b8\u00b9\7<\2\2\u00b9&\3\2\2\2\u00ba\u00bb\7?\2\2\u00bb"+ + "(\3\2\2\2\u00bc\u00bd\7?\2\2\u00bd\u00be\7?\2\2\u00be*\3\2\2\2\u00bf\u00c0"+ + "\7#\2\2\u00c0\u00c1\7?\2\2\u00c1,\3\2\2\2\u00c2\u00c3\7>\2\2\u00c3.\3"+ + "\2\2\2\u00c4\u00c5\7>\2\2\u00c5\u00c6\7?\2\2\u00c6\60\3\2\2\2\u00c7\u00c8"+ + "\7@\2\2\u00c8\62\3\2\2\2\u00c9\u00ca\7@\2\2\u00ca\u00cb\7?\2\2\u00cb\64"+ + "\3\2\2\2\u00cc\u00cd\7-\2\2\u00cd\66\3\2\2\2\u00ce\u00cf\7/\2\2\u00cf"+ + "8\3\2\2\2\u00d0\u00d1\7,\2\2\u00d1:\3\2\2\2\u00d2\u00d3\7\61\2\2\u00d3"+ + "<\3\2\2\2\u00d4\u00d5\7\'\2\2\u00d5>\3\2\2\2\u00d6\u00d7\7\60\2\2\u00d7"+ + "@\3\2\2\2\u00d8\u00d9\7.\2\2\u00d9B\3\2\2\2\u00da\u00db\7]\2\2\u00dbD"+ + "\3\2\2\2\u00dc\u00dd\7_\2\2\u00ddF\3\2\2\2\u00de\u00df\7*\2\2\u00dfH\3"+ + "\2\2\2\u00e0\u00e1\7+\2\2\u00e1J\3\2\2\2\u00e2\u00e3\7~\2\2\u00e3L\3\2"+ + "\2\2\u00e4\u00ea\7)\2\2\u00e5\u00e6\7^\2\2\u00e6\u00e9\t\2\2\2\u00e7\u00e9"+ + "\n\3\2\2\u00e8\u00e5\3\2\2\2\u00e8\u00e7\3\2\2\2\u00e9\u00ec\3\2\2\2\u00ea"+ + "\u00e8\3\2\2\2\u00ea\u00eb\3\2\2\2\u00eb\u00ed\3\2\2\2\u00ec\u00ea\3\2"+ + "\2\2\u00ed\u0125\7)\2\2\u00ee\u00f4\7$\2\2\u00ef\u00f0\7^\2\2\u00f0\u00f3"+ + "\t\2\2\2\u00f1\u00f3\n\4\2\2\u00f2\u00ef\3\2\2\2\u00f2\u00f1\3\2\2\2\u00f3"+ + "\u00f6\3\2\2\2\u00f4\u00f2\3\2\2\2\u00f4\u00f5\3\2\2\2\u00f5\u00f7\3\2"+ + "\2\2\u00f6\u00f4\3\2\2\2\u00f7\u0125\7$\2\2\u00f8\u00f9\7A\2\2\u00f9\u00fa"+ + "\7$\2\2\u00fa\u0100\3\2\2\2\u00fb\u00fc\7^\2\2\u00fc\u00ff\7$\2\2\u00fd"+ + "\u00ff\n\5\2\2\u00fe\u00fb\3\2\2\2\u00fe\u00fd\3\2\2\2\u00ff\u0102\3\2"+ + "\2\2\u0100\u00fe\3\2\2\2\u0100\u0101\3\2\2\2\u0101\u0103\3\2\2\2\u0102"+ + "\u0100\3\2\2\2\u0103\u0125\7$\2\2\u0104\u0105\7A\2\2\u0105\u0106\7)\2"+ + "\2\u0106\u010c\3\2\2\2\u0107\u0108\7^\2\2\u0108\u010b\7)\2\2\u0109\u010b"+ + "\n\6\2\2\u010a\u0107\3\2\2\2\u010a\u0109\3\2\2\2\u010b\u010e\3\2\2\2\u010c"+ + "\u010a\3\2\2\2\u010c\u010d\3\2\2\2\u010d\u010f\3\2\2\2\u010e\u010c\3\2"+ + "\2\2\u010f\u0125\7)\2\2\u0110\u0111\7$\2\2\u0111\u0112\7$\2\2\u0112\u0113"+ + "\7$\2\2\u0113\u0117\3\2\2\2\u0114\u0116\n\7\2\2\u0115\u0114\3\2\2\2\u0116"+ + "\u0119\3\2\2\2\u0117\u0118\3\2\2\2\u0117\u0115\3\2\2\2\u0118\u011a\3\2"+ + "\2\2\u0119\u0117\3\2\2\2\u011a\u011b\7$\2\2\u011b\u011c\7$\2\2\u011c\u011d"+ + "\7$\2\2\u011d\u011f\3\2\2\2\u011e\u0120\7$\2\2\u011f\u011e\3\2\2\2\u011f"+ + "\u0120\3\2\2\2\u0120\u0122\3\2\2\2\u0121\u0123\7$\2\2\u0122\u0121\3\2"+ + "\2\2\u0122\u0123\3\2\2\2\u0123\u0125\3\2\2\2\u0124\u00e4\3\2\2\2\u0124"+ + "\u00ee\3\2\2\2\u0124\u00f8\3\2\2\2\u0124\u0104\3\2\2\2\u0124\u0110\3\2"+ + "\2\2\u0125N\3\2\2\2\u0126\u0128\5[.\2\u0127\u0126\3\2\2\2\u0128\u0129"+ + "\3\2\2\2\u0129\u0127\3\2\2\2\u0129\u012a\3\2\2\2\u012aP\3\2\2\2\u012b"+ + "\u012d\5[.\2\u012c\u012b\3\2\2\2\u012d\u012e\3\2\2\2\u012e\u012c\3\2\2"+ + "\2\u012e\u012f\3\2\2\2\u012f\u0130\3\2\2\2\u0130\u0134\5? \2\u0131\u0133"+ + "\5[.\2\u0132\u0131\3\2\2\2\u0133\u0136\3\2\2\2\u0134\u0132\3\2\2\2\u0134"+ + "\u0135\3\2\2\2\u0135\u0156\3\2\2\2\u0136\u0134\3\2\2\2\u0137\u0139\5?"+ + " \2\u0138\u013a\5[.\2\u0139\u0138\3\2\2\2\u013a\u013b\3\2\2\2\u013b\u0139"+ + "\3\2\2\2\u013b\u013c\3\2\2\2\u013c\u0156\3\2\2\2\u013d\u013f\5[.\2\u013e"+ + "\u013d\3\2\2\2\u013f\u0140\3\2\2\2\u0140\u013e\3\2\2\2\u0140\u0141\3\2"+ + "\2\2\u0141\u0149\3\2\2\2\u0142\u0146\5? \2\u0143\u0145\5[.\2\u0144\u0143"+ + "\3\2\2\2\u0145\u0148\3\2\2\2\u0146\u0144\3\2\2\2\u0146\u0147\3\2\2\2\u0147"+ + "\u014a\3\2\2\2\u0148\u0146\3\2\2\2\u0149\u0142\3\2\2\2\u0149\u014a\3\2"+ + "\2\2\u014a\u014b\3\2\2\2\u014b\u014c\5Y-\2\u014c\u0156\3\2\2\2\u014d\u014f"+ + "\5? \2\u014e\u0150\5[.\2\u014f\u014e\3\2\2\2\u0150\u0151\3\2\2\2\u0151"+ + "\u014f\3\2\2\2\u0151\u0152\3\2\2\2\u0152\u0153\3\2\2\2\u0153\u0154\5Y"+ + "-\2\u0154\u0156\3\2\2\2\u0155\u012c\3\2\2\2\u0155\u0137\3\2\2\2\u0155"+ + "\u013e\3\2\2\2\u0155\u014d\3\2\2\2\u0156R\3\2\2\2\u0157\u015a\5]/\2\u0158"+ + "\u015a\t\b\2\2\u0159\u0157\3\2\2\2\u0159\u0158\3\2\2\2\u015a\u0160\3\2"+ + "\2\2\u015b\u015f\5]/\2\u015c\u015f\5[.\2\u015d\u015f\7a\2\2\u015e\u015b"+ + "\3\2\2\2\u015e\u015c\3\2\2\2\u015e\u015d\3\2\2\2\u015f\u0162\3\2\2\2\u0160"+ + "\u015e\3\2\2\2\u0160\u0161\3\2\2\2\u0161T\3\2\2\2\u0162\u0160\3\2\2\2"+ + "\u0163\u0169\7b\2\2\u0164\u0168\n\t\2\2\u0165\u0166\7b\2\2\u0166\u0168"+ + "\7b\2\2\u0167\u0164\3\2\2\2\u0167\u0165\3\2\2\2\u0168\u016b\3\2\2\2\u0169"+ + "\u0167\3\2\2\2\u0169\u016a\3\2\2\2\u016a\u016c\3\2\2\2\u016b\u0169\3\2"+ + "\2\2\u016c\u016d\7b\2\2\u016dV\3\2\2\2\u016e\u0174\5]/\2\u016f\u0173\5"+ + "]/\2\u0170\u0173\5[.\2\u0171\u0173\7a\2\2\u0172\u016f\3\2\2\2\u0172\u0170"+ + "\3\2\2\2\u0172\u0171\3\2\2\2\u0173\u0176\3\2\2\2\u0174\u0172\3\2\2\2\u0174"+ + "\u0175\3\2\2\2\u0175\u0177\3\2\2\2\u0176\u0174\3\2\2\2\u0177\u0178\7\u0080"+ + "\2\2\u0178X\3\2\2\2\u0179\u017b\t\n\2\2\u017a\u017c\t\13\2\2\u017b\u017a"+ + "\3\2\2\2\u017b\u017c\3\2\2\2\u017c\u017e\3\2\2\2\u017d\u017f\5[.\2\u017e"+ + "\u017d\3\2\2\2\u017f\u0180\3\2\2\2\u0180\u017e\3\2\2\2\u0180\u0181\3\2"+ + "\2\2\u0181Z\3\2\2\2\u0182\u0183\t\f\2\2\u0183\\\3\2\2\2\u0184\u0185\t"+ + "\r\2\2\u0185^\3\2\2\2\u0186\u0187\7\61\2\2\u0187\u0188\7\61\2\2\u0188"+ + "\u018c\3\2\2\2\u0189\u018b\n\7\2\2\u018a\u0189\3\2\2\2\u018b\u018e\3\2"+ + "\2\2\u018c\u018a\3\2\2\2\u018c\u018d\3\2\2\2\u018d\u0190\3\2\2\2\u018e"+ + "\u018c\3\2\2\2\u018f\u0191\7\17\2\2\u0190\u018f\3\2\2\2\u0190\u0191\3"+ + "\2\2\2\u0191\u0193\3\2\2\2\u0192\u0194\7\f\2\2\u0193\u0192\3\2\2\2\u0193"+ + "\u0194\3\2\2\2\u0194\u0195\3\2\2\2\u0195\u0196\b\60\2\2\u0196`\3\2\2\2"+ + "\u0197\u0198\7\61\2\2\u0198\u0199\7,\2\2\u0199\u019e\3\2\2\2\u019a\u019d"+ + "\5a\61\2\u019b\u019d\13\2\2\2\u019c\u019a\3\2\2\2\u019c\u019b\3\2\2\2"+ + "\u019d\u01a0\3\2\2\2\u019e\u019f\3\2\2\2\u019e\u019c\3\2\2\2\u019f\u01a1"+ + "\3\2\2\2\u01a0\u019e\3\2\2\2\u01a1\u01a2\7,\2\2\u01a2\u01a3\7\61\2\2\u01a3"+ + "\u01a4\3\2\2\2\u01a4\u01a5\b\61\2\2\u01a5b\3\2\2\2\u01a6\u01a8\t\16\2"+ + "\2\u01a7\u01a6\3\2\2\2\u01a8\u01a9\3\2\2\2\u01a9\u01a7\3\2\2\2\u01a9\u01aa"+ + "\3\2\2\2\u01aa\u01ab\3\2\2\2\u01ab\u01ac\b\62\2\2\u01acd\3\2\2\2\'\2\u00e8"+ + "\u00ea\u00f2\u00f4\u00fe\u0100\u010a\u010c\u0117\u011f\u0122\u0124\u0129"+ + "\u012e\u0134\u013b\u0140\u0146\u0149\u0151\u0155\u0159\u015e\u0160\u0167"+ + "\u0169\u0172\u0174\u017b\u0180\u018c\u0190\u0193\u019c\u019e\u01a9\3\2"+ + "\3\2"; public static final ATN _ATN = new ATNDeserializer().deserialize(_serializedATN.toCharArray()); static { diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseParser.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseParser.java index b7fa53a5a0295..51565028843d2 100644 --- a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseParser.java +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseParser.java @@ -17,12 +17,13 @@ class EqlBaseParser extends Parser { protected static final PredictionContextCache _sharedContextCache = new PredictionContextCache(); public static final int - AND=1, ANY=2, BY=3, FALSE=4, IN=5, JOIN=6, MAXSPAN=7, NOT=8, NULL=9, OF=10, - OR=11, SEQUENCE=12, TRUE=13, UNTIL=14, WHERE=15, WITH=16, SEQ=17, ASGN=18, - EQ=19, NEQ=20, LT=21, LTE=22, GT=23, GTE=24, PLUS=25, MINUS=26, ASTERISK=27, - SLASH=28, PERCENT=29, DOT=30, COMMA=31, LB=32, RB=33, LP=34, RP=35, PIPE=36, - STRING=37, INTEGER_VALUE=38, DECIMAL_VALUE=39, IDENTIFIER=40, QUOTED_IDENTIFIER=41, - TILDE_IDENTIFIER=42, LINE_COMMENT=43, BRACKETED_COMMENT=44, WS=45; + AND=1, ANY=2, BY=3, FALSE=4, IN=5, IN_INSENSITIVE=6, JOIN=7, MAXSPAN=8, + NOT=9, NULL=10, OF=11, OR=12, SEQUENCE=13, TRUE=14, UNTIL=15, WHERE=16, + WITH=17, SEQ=18, ASGN=19, EQ=20, NEQ=21, LT=22, LTE=23, GT=24, GTE=25, + PLUS=26, MINUS=27, ASTERISK=28, SLASH=29, PERCENT=30, DOT=31, COMMA=32, + LB=33, RB=34, LP=35, RP=36, PIPE=37, STRING=38, INTEGER_VALUE=39, DECIMAL_VALUE=40, + IDENTIFIER=41, QUOTED_IDENTIFIER=42, TILDE_IDENTIFIER=43, LINE_COMMENT=44, + BRACKETED_COMMENT=45, WS=46; public static final int RULE_singleStatement = 0, RULE_singleExpression = 1, RULE_statement = 2, RULE_query = 3, RULE_sequenceParams = 4, RULE_sequence = 5, RULE_join = 6, @@ -43,19 +44,19 @@ class EqlBaseParser extends Parser { }; private static final String[] _LITERAL_NAMES = { - null, "'and'", "'any'", "'by'", "'false'", "'in'", "'join'", "'maxspan'", - "'not'", "'null'", "'of'", "'or'", "'sequence'", "'true'", "'until'", - "'where'", "'with'", "':'", "'='", "'=='", "'!='", "'<'", "'<='", "'>'", - "'>='", "'+'", "'-'", "'*'", "'/'", "'%'", "'.'", "','", "'['", "']'", - "'('", "')'", "'|'" + null, "'and'", "'any'", "'by'", "'false'", "'in'", "'in~'", "'join'", + "'maxspan'", "'not'", "'null'", "'of'", "'or'", "'sequence'", "'true'", + "'until'", "'where'", "'with'", "':'", "'='", "'=='", "'!='", "'<'", "'<='", + "'>'", "'>='", "'+'", "'-'", "'*'", "'/'", "'%'", "'.'", "','", "'['", + "']'", "'('", "')'", "'|'" }; private static final String[] _SYMBOLIC_NAMES = { - null, "AND", "ANY", "BY", "FALSE", "IN", "JOIN", "MAXSPAN", "NOT", "NULL", - "OF", "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", "SEQ", "ASGN", - "EQ", "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", "ASTERISK", "SLASH", - "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", "PIPE", "STRING", "INTEGER_VALUE", - "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", "TILDE_IDENTIFIER", - "LINE_COMMENT", "BRACKETED_COMMENT", "WS" + null, "AND", "ANY", "BY", "FALSE", "IN", "IN_INSENSITIVE", "JOIN", "MAXSPAN", + "NOT", "NULL", "OF", "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", + "SEQ", "ASGN", "EQ", "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", + "ASTERISK", "SLASH", "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", + "PIPE", "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", + "TILDE_IDENTIFIER", "LINE_COMMENT", "BRACKETED_COMMENT", "WS" }; public static final Vocabulary VOCABULARY = new VocabularyImpl(_LITERAL_NAMES, _SYMBOLIC_NAMES); @@ -1628,6 +1629,7 @@ public ExpressionContext expression(int i) { } public TerminalNode RP() { return getToken(EqlBaseParser.RP, 0); } public TerminalNode IN() { return getToken(EqlBaseParser.IN, 0); } + public TerminalNode IN_INSENSITIVE() { return getToken(EqlBaseParser.IN_INSENSITIVE, 0); } public TerminalNode NOT() { return getToken(EqlBaseParser.NOT, 0); } public List COMMA() { return getTokens(EqlBaseParser.COMMA); } public TerminalNode COMMA(int i) { @@ -1680,7 +1682,13 @@ public final PredicateContext predicate() throws RecognitionException { } setState(214); - ((PredicateContext)_localctx).kind = match(IN); + ((PredicateContext)_localctx).kind = _input.LT(1); + _la = _input.LA(1); + if ( !(_la==IN || _la==IN_INSENSITIVE) ) { + ((PredicateContext)_localctx).kind = (Token)_errHandler.recoverInline(this); + } else { + consume(); + } setState(215); match(LP); setState(216); @@ -2701,9 +2709,9 @@ private boolean operatorExpression_sempred(OperatorExpressionContext _localctx, } public static final String _serializedATN = - "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\3/\u0135\4\2\t\2\4"+ - "\3\t\3\4\4\t\4\4\5\t\5\4\6\t\6\4\7\t\7\4\b\t\b\4\t\t\t\4\n\t\n\4\13\t"+ - "\13\4\f\t\f\4\r\t\r\4\16\t\16\4\17\t\17\4\20\t\20\4\21\t\21\4\22\t\22"+ + "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\3\60\u0135\4\2\t\2"+ + "\4\3\t\3\4\4\t\4\4\5\t\5\4\6\t\6\4\7\t\7\4\b\t\b\4\t\t\t\4\n\t\n\4\13"+ + "\t\13\4\f\t\f\4\r\t\r\4\16\t\16\4\17\t\17\4\20\t\20\4\21\t\21\4\22\t\22"+ "\4\23\t\23\4\24\t\24\4\25\t\25\4\26\t\26\4\27\t\27\4\30\t\30\4\31\t\31"+ "\4\32\t\32\4\33\t\33\4\34\t\34\4\35\t\35\4\36\t\36\4\37\t\37\4 \t \3\2"+ "\3\2\3\2\3\3\3\3\3\3\3\4\3\4\7\4I\n\4\f\4\16\4L\13\4\3\5\3\5\3\5\5\5Q"+ @@ -2726,43 +2734,43 @@ private boolean operatorExpression_sempred(OperatorExpressionContext _localctx, "\3\33\6\33\u011d\n\33\r\33\16\33\u011e\3\33\7\33\u0122\n\33\f\33\16\33"+ "\u0125\13\33\3\34\3\34\3\35\3\35\5\35\u012b\n\35\3\36\3\36\5\36\u012f"+ "\n\36\3\37\3\37\3 \3 \3 \2\4 $!\2\4\6\b\n\f\16\20\22\24\26\30\32\34\36"+ - " \"$&(*,.\60\62\64\668:<>\2\t\3\2\33\34\3\2\35\37\4\2**,,\3\2\25\32\4"+ - "\2\6\6\17\17\3\2*+\4\2\'\'**\u0142\2@\3\2\2\2\4C\3\2\2\2\6F\3\2\2\2\b"+ - "P\3\2\2\2\nR\3\2\2\2\fW\3\2\2\2\16l\3\2\2\2\20z\3\2\2\2\22\u0086\3\2\2"+ - "\2\24\u008f\3\2\2\2\26\u0093\3\2\2\2\30\u0097\3\2\2\2\32\u009b\3\2\2\2"+ - "\34\u009f\3\2\2\2\36\u00a4\3\2\2\2 \u00ad\3\2\2\2\"\u00bf\3\2\2\2$\u00c8"+ + " \"$&(*,.\60\62\64\668:<>\2\n\3\2\34\35\3\2\36 \3\2\7\b\4\2++--\3\2\26"+ + "\33\4\2\6\6\20\20\3\2+,\4\2((++\u0142\2@\3\2\2\2\4C\3\2\2\2\6F\3\2\2\2"+ + "\bP\3\2\2\2\nR\3\2\2\2\fW\3\2\2\2\16l\3\2\2\2\20z\3\2\2\2\22\u0086\3\2"+ + "\2\2\24\u008f\3\2\2\2\26\u0093\3\2\2\2\30\u0097\3\2\2\2\32\u009b\3\2\2"+ + "\2\34\u009f\3\2\2\2\36\u00a4\3\2\2\2 \u00ad\3\2\2\2\"\u00bf\3\2\2\2$\u00c8"+ "\3\2\2\2&\u00f2\3\2\2\2(\u00fb\3\2\2\2*\u00fd\3\2\2\2,\u010b\3\2\2\2."+ "\u0111\3\2\2\2\60\u0113\3\2\2\2\62\u0115\3\2\2\2\64\u0117\3\2\2\2\66\u0126"+ "\3\2\2\28\u0128\3\2\2\2:\u012e\3\2\2\2<\u0130\3\2\2\2>\u0132\3\2\2\2@"+ "A\5\6\4\2AB\7\2\2\3B\3\3\2\2\2CD\5\36\20\2DE\7\2\2\3E\5\3\2\2\2FJ\5\b"+ "\5\2GI\5\20\t\2HG\3\2\2\2IL\3\2\2\2JH\3\2\2\2JK\3\2\2\2K\7\3\2\2\2LJ\3"+ "\2\2\2MQ\5\f\7\2NQ\5\16\b\2OQ\5\32\16\2PM\3\2\2\2PN\3\2\2\2PO\3\2\2\2"+ - "Q\t\3\2\2\2RS\7\22\2\2ST\7\t\2\2TU\7\24\2\2UV\58\35\2V\13\3\2\2\2W`\7"+ - "\16\2\2XZ\5\22\n\2Y[\5\n\6\2ZY\3\2\2\2Z[\3\2\2\2[a\3\2\2\2\\^\5\n\6\2"+ + "Q\t\3\2\2\2RS\7\23\2\2ST\7\n\2\2TU\7\25\2\2UV\58\35\2V\13\3\2\2\2W`\7"+ + "\17\2\2XZ\5\22\n\2Y[\5\n\6\2ZY\3\2\2\2Z[\3\2\2\2[a\3\2\2\2\\^\5\n\6\2"+ "]_\5\22\n\2^]\3\2\2\2^_\3\2\2\2_a\3\2\2\2`X\3\2\2\2`\\\3\2\2\2`a\3\2\2"+ "\2ab\3\2\2\2bd\5\26\f\2ce\5\26\f\2dc\3\2\2\2ef\3\2\2\2fd\3\2\2\2fg\3\2"+ - "\2\2gj\3\2\2\2hi\7\20\2\2ik\5\26\f\2jh\3\2\2\2jk\3\2\2\2k\r\3\2\2\2ln"+ - "\7\b\2\2mo\5\22\n\2nm\3\2\2\2no\3\2\2\2op\3\2\2\2pr\5\24\13\2qs\5\24\13"+ - "\2rq\3\2\2\2st\3\2\2\2tr\3\2\2\2tu\3\2\2\2ux\3\2\2\2vw\7\20\2\2wy\5\24"+ - "\13\2xv\3\2\2\2xy\3\2\2\2y\17\3\2\2\2z{\7&\2\2{\u0084\7*\2\2|\u0081\5"+ - " \21\2}~\7!\2\2~\u0080\5 \21\2\177}\3\2\2\2\u0080\u0083\3\2\2\2\u0081"+ + "\2\2gj\3\2\2\2hi\7\21\2\2ik\5\26\f\2jh\3\2\2\2jk\3\2\2\2k\r\3\2\2\2ln"+ + "\7\t\2\2mo\5\22\n\2nm\3\2\2\2no\3\2\2\2op\3\2\2\2pr\5\24\13\2qs\5\24\13"+ + "\2rq\3\2\2\2st\3\2\2\2tr\3\2\2\2tu\3\2\2\2ux\3\2\2\2vw\7\21\2\2wy\5\24"+ + "\13\2xv\3\2\2\2xy\3\2\2\2y\17\3\2\2\2z{\7\'\2\2{\u0084\7+\2\2|\u0081\5"+ + " \21\2}~\7\"\2\2~\u0080\5 \21\2\177}\3\2\2\2\u0080\u0083\3\2\2\2\u0081"+ "\177\3\2\2\2\u0081\u0082\3\2\2\2\u0082\u0085\3\2\2\2\u0083\u0081\3\2\2"+ "\2\u0084|\3\2\2\2\u0084\u0085\3\2\2\2\u0085\21\3\2\2\2\u0086\u0087\7\5"+ - "\2\2\u0087\u008c\5\36\20\2\u0088\u0089\7!\2\2\u0089\u008b\5\36\20\2\u008a"+ + "\2\2\u0087\u008c\5\36\20\2\u0088\u0089\7\"\2\2\u0089\u008b\5\36\20\2\u008a"+ "\u0088\3\2\2\2\u008b\u008e\3\2\2\2\u008c\u008a\3\2\2\2\u008c\u008d\3\2"+ "\2\2\u008d\23\3\2\2\2\u008e\u008c\3\2\2\2\u008f\u0091\5\30\r\2\u0090\u0092"+ "\5\22\n\2\u0091\u0090\3\2\2\2\u0091\u0092\3\2\2\2\u0092\25\3\2\2\2\u0093"+ "\u0095\5\30\r\2\u0094\u0096\5\22\n\2\u0095\u0094\3\2\2\2\u0095\u0096\3"+ - "\2\2\2\u0096\27\3\2\2\2\u0097\u0098\7\"\2\2\u0098\u0099\5\34\17\2\u0099"+ - "\u009a\7#\2\2\u009a\31\3\2\2\2\u009b\u009c\5\34\17\2\u009c\33\3\2\2\2"+ + "\2\2\2\u0096\27\3\2\2\2\u0097\u0098\7#\2\2\u0098\u0099\5\34\17\2\u0099"+ + "\u009a\7$\2\2\u009a\31\3\2\2\2\u009b\u009c\5\34\17\2\u009c\33\3\2\2\2"+ "\u009d\u00a0\7\4\2\2\u009e\u00a0\5> \2\u009f\u009d\3\2\2\2\u009f\u009e"+ - "\3\2\2\2\u00a0\u00a1\3\2\2\2\u00a1\u00a2\7\21\2\2\u00a2\u00a3\5\36\20"+ + "\3\2\2\2\u00a0\u00a1\3\2\2\2\u00a1\u00a2\7\22\2\2\u00a2\u00a3\5\36\20"+ "\2\u00a3\35\3\2\2\2\u00a4\u00a5\5 \21\2\u00a5\37\3\2\2\2\u00a6\u00a7\b"+ - "\21\1\2\u00a7\u00a8\7\n\2\2\u00a8\u00ae\5 \21\7\u00a9\u00aa\7*\2\2\u00aa"+ - "\u00ab\7\f\2\2\u00ab\u00ae\5\30\r\2\u00ac\u00ae\5\"\22\2\u00ad\u00a6\3"+ + "\21\1\2\u00a7\u00a8\7\13\2\2\u00a8\u00ae\5 \21\7\u00a9\u00aa\7+\2\2\u00aa"+ + "\u00ab\7\r\2\2\u00ab\u00ae\5\30\r\2\u00ac\u00ae\5\"\22\2\u00ad\u00a6\3"+ "\2\2\2\u00ad\u00a9\3\2\2\2\u00ad\u00ac\3\2\2\2\u00ae\u00b7\3\2\2\2\u00af"+ "\u00b0\f\4\2\2\u00b0\u00b1\7\3\2\2\u00b1\u00b6\5 \21\5\u00b2\u00b3\f\3"+ - "\2\2\u00b3\u00b4\7\r\2\2\u00b4\u00b6\5 \21\4\u00b5\u00af\3\2\2\2\u00b5"+ + "\2\2\u00b3\u00b4\7\16\2\2\u00b4\u00b6\5 \21\4\u00b5\u00af\3\2\2\2\u00b5"+ "\u00b2\3\2\2\2\u00b6\u00b9\3\2\2\2\u00b7\u00b5\3\2\2\2\u00b7\u00b8\3\2"+ "\2\2\u00b8!\3\2\2\2\u00b9\u00b7\3\2\2\2\u00ba\u00c0\5$\23\2\u00bb\u00bc"+ "\5$\23\2\u00bc\u00bd\5\60\31\2\u00bd\u00be\5$\23\2\u00be\u00c0\3\2\2\2"+ @@ -2773,39 +2781,39 @@ private boolean operatorExpression_sempred(OperatorExpressionContext _localctx, "\u00cb\f\4\2\2\u00cb\u00cc\t\3\2\2\u00cc\u00d1\5$\23\5\u00cd\u00ce\f\3"+ "\2\2\u00ce\u00cf\t\2\2\2\u00cf\u00d1\5$\23\4\u00d0\u00ca\3\2\2\2\u00d0"+ "\u00cd\3\2\2\2\u00d1\u00d4\3\2\2\2\u00d2\u00d0\3\2\2\2\u00d2\u00d3\3\2"+ - "\2\2\u00d3%\3\2\2\2\u00d4\u00d2\3\2\2\2\u00d5\u00d7\7\n\2\2\u00d6\u00d5"+ - "\3\2\2\2\u00d6\u00d7\3\2\2\2\u00d7\u00d8\3\2\2\2\u00d8\u00d9\7\7\2\2\u00d9"+ - "\u00da\7$\2\2\u00da\u00df\5\36\20\2\u00db\u00dc\7!\2\2\u00dc\u00de\5\36"+ - "\20\2\u00dd\u00db\3\2\2\2\u00de\u00e1\3\2\2\2\u00df\u00dd\3\2\2\2\u00df"+ - "\u00e0\3\2\2\2\u00e0\u00e2\3\2\2\2\u00e1\u00df\3\2\2\2\u00e2\u00e3\7%"+ - "\2\2\u00e3\u00f3\3\2\2\2\u00e4\u00e5\7\23\2\2\u00e5\u00f3\5.\30\2\u00e6"+ - "\u00e7\7\23\2\2\u00e7\u00e8\7$\2\2\u00e8\u00ed\5.\30\2\u00e9\u00ea\7!"+ + "\2\2\u00d3%\3\2\2\2\u00d4\u00d2\3\2\2\2\u00d5\u00d7\7\13\2\2\u00d6\u00d5"+ + "\3\2\2\2\u00d6\u00d7\3\2\2\2\u00d7\u00d8\3\2\2\2\u00d8\u00d9\t\4\2\2\u00d9"+ + "\u00da\7%\2\2\u00da\u00df\5\36\20\2\u00db\u00dc\7\"\2\2\u00dc\u00de\5"+ + "\36\20\2\u00dd\u00db\3\2\2\2\u00de\u00e1\3\2\2\2\u00df\u00dd\3\2\2\2\u00df"+ + "\u00e0\3\2\2\2\u00e0\u00e2\3\2\2\2\u00e1\u00df\3\2\2\2\u00e2\u00e3\7&"+ + "\2\2\u00e3\u00f3\3\2\2\2\u00e4\u00e5\7\24\2\2\u00e5\u00f3\5.\30\2\u00e6"+ + "\u00e7\7\24\2\2\u00e7\u00e8\7%\2\2\u00e8\u00ed\5.\30\2\u00e9\u00ea\7\""+ "\2\2\u00ea\u00ec\5.\30\2\u00eb\u00e9\3\2\2\2\u00ec\u00ef\3\2\2\2\u00ed"+ "\u00eb\3\2\2\2\u00ed\u00ee\3\2\2\2\u00ee\u00f0\3\2\2\2\u00ef\u00ed\3\2"+ - "\2\2\u00f0\u00f1\7%\2\2\u00f1\u00f3\3\2\2\2\u00f2\u00d6\3\2\2\2\u00f2"+ + "\2\2\u00f0\u00f1\7&\2\2\u00f1\u00f3\3\2\2\2\u00f2\u00d6\3\2\2\2\u00f2"+ "\u00e4\3\2\2\2\u00f2\u00e6\3\2\2\2\u00f3\'\3\2\2\2\u00f4\u00fc\5.\30\2"+ - "\u00f5\u00fc\5*\26\2\u00f6\u00fc\5\64\33\2\u00f7\u00f8\7$\2\2\u00f8\u00f9"+ - "\5\36\20\2\u00f9\u00fa\7%\2\2\u00fa\u00fc\3\2\2\2\u00fb\u00f4\3\2\2\2"+ + "\u00f5\u00fc\5*\26\2\u00f6\u00fc\5\64\33\2\u00f7\u00f8\7%\2\2\u00f8\u00f9"+ + "\5\36\20\2\u00f9\u00fa\7&\2\2\u00fa\u00fc\3\2\2\2\u00fb\u00f4\3\2\2\2"+ "\u00fb\u00f5\3\2\2\2\u00fb\u00f6\3\2\2\2\u00fb\u00f7\3\2\2\2\u00fc)\3"+ - "\2\2\2\u00fd\u00fe\5,\27\2\u00fe\u0107\7$\2\2\u00ff\u0104\5\36\20\2\u0100"+ - "\u0101\7!\2\2\u0101\u0103\5\36\20\2\u0102\u0100\3\2\2\2\u0103\u0106\3"+ + "\2\2\2\u00fd\u00fe\5,\27\2\u00fe\u0107\7%\2\2\u00ff\u0104\5\36\20\2\u0100"+ + "\u0101\7\"\2\2\u0101\u0103\5\36\20\2\u0102\u0100\3\2\2\2\u0103\u0106\3"+ "\2\2\2\u0104\u0102\3\2\2\2\u0104\u0105\3\2\2\2\u0105\u0108\3\2\2\2\u0106"+ "\u0104\3\2\2\2\u0107\u00ff\3\2\2\2\u0107\u0108\3\2\2\2\u0108\u0109\3\2"+ - "\2\2\u0109\u010a\7%\2\2\u010a+\3\2\2\2\u010b\u010c\t\4\2\2\u010c-\3\2"+ - "\2\2\u010d\u0112\7\13\2\2\u010e\u0112\5:\36\2\u010f\u0112\5\62\32\2\u0110"+ + "\2\2\u0109\u010a\7&\2\2\u010a+\3\2\2\2\u010b\u010c\t\5\2\2\u010c-\3\2"+ + "\2\2\u010d\u0112\7\f\2\2\u010e\u0112\5:\36\2\u010f\u0112\5\62\32\2\u0110"+ "\u0112\5<\37\2\u0111\u010d\3\2\2\2\u0111\u010e\3\2\2\2\u0111\u010f\3\2"+ - "\2\2\u0111\u0110\3\2\2\2\u0112/\3\2\2\2\u0113\u0114\t\5\2\2\u0114\61\3"+ - "\2\2\2\u0115\u0116\t\6\2\2\u0116\63\3\2\2\2\u0117\u0123\5\66\34\2\u0118"+ - "\u0119\7 \2\2\u0119\u0122\5\66\34\2\u011a\u011c\7\"\2\2\u011b\u011d\7"+ - "(\2\2\u011c\u011b\3\2\2\2\u011d\u011e\3\2\2\2\u011e\u011c\3\2\2\2\u011e"+ - "\u011f\3\2\2\2\u011f\u0120\3\2\2\2\u0120\u0122\7#\2\2\u0121\u0118\3\2"+ + "\2\2\u0111\u0110\3\2\2\2\u0112/\3\2\2\2\u0113\u0114\t\6\2\2\u0114\61\3"+ + "\2\2\2\u0115\u0116\t\7\2\2\u0116\63\3\2\2\2\u0117\u0123\5\66\34\2\u0118"+ + "\u0119\7!\2\2\u0119\u0122\5\66\34\2\u011a\u011c\7#\2\2\u011b\u011d\7)"+ + "\2\2\u011c\u011b\3\2\2\2\u011d\u011e\3\2\2\2\u011e\u011c\3\2\2\2\u011e"+ + "\u011f\3\2\2\2\u011f\u0120\3\2\2\2\u0120\u0122\7$\2\2\u0121\u0118\3\2"+ "\2\2\u0121\u011a\3\2\2\2\u0122\u0125\3\2\2\2\u0123\u0121\3\2\2\2\u0123"+ - "\u0124\3\2\2\2\u0124\65\3\2\2\2\u0125\u0123\3\2\2\2\u0126\u0127\t\7\2"+ - "\2\u0127\67\3\2\2\2\u0128\u012a\5:\36\2\u0129\u012b\7*\2\2\u012a\u0129"+ - "\3\2\2\2\u012a\u012b\3\2\2\2\u012b9\3\2\2\2\u012c\u012f\7)\2\2\u012d\u012f"+ - "\7(\2\2\u012e\u012c\3\2\2\2\u012e\u012d\3\2\2\2\u012f;\3\2\2\2\u0130\u0131"+ - "\7\'\2\2\u0131=\3\2\2\2\u0132\u0133\t\b\2\2\u0133?\3\2\2\2\'JPZ^`fjnt"+ - "x\u0081\u0084\u008c\u0091\u0095\u009f\u00ad\u00b5\u00b7\u00bf\u00c4\u00c8"+ + "\u0124\3\2\2\2\u0124\65\3\2\2\2\u0125\u0123\3\2\2\2\u0126\u0127\t\b\2"+ + "\2\u0127\67\3\2\2\2\u0128\u012a\5:\36\2\u0129\u012b\7+\2\2\u012a\u0129"+ + "\3\2\2\2\u012a\u012b\3\2\2\2\u012b9\3\2\2\2\u012c\u012f\7*\2\2\u012d\u012f"+ + "\7)\2\2\u012e\u012c\3\2\2\2\u012e\u012d\3\2\2\2\u012f;\3\2\2\2\u0130\u0131"+ + "\7(\2\2\u0131=\3\2\2\2\u0132\u0133\t\t\2\2\u0133?\3\2\2\2\'JPZ^`fjntx"+ + "\u0081\u0084\u008c\u0091\u0095\u009f\u00ad\u00b5\u00b7\u00bf\u00c4\u00c8"+ "\u00d0\u00d2\u00d6\u00df\u00ed\u00f2\u00fb\u0104\u0107\u0111\u011e\u0121"+ "\u0123\u012a\u012e"; public static final ATN _ATN = diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/ExpressionBuilder.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/ExpressionBuilder.java index 4dd4595b6c2a4..082756af7b7c0 100644 --- a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/ExpressionBuilder.java +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/ExpressionBuilder.java @@ -11,6 +11,7 @@ import org.antlr.v4.runtime.tree.TerminalNode; import org.elasticsearch.xpack.eql.expression.function.EqlFunctionResolution; import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveEquals; +import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveWildcardEquals; import org.elasticsearch.xpack.eql.parser.EqlBaseParser.ArithmeticUnaryContext; import org.elasticsearch.xpack.eql.parser.EqlBaseParser.ComparisonContext; import org.elasticsearch.xpack.eql.parser.EqlBaseParser.DereferenceContext; @@ -167,8 +168,13 @@ public Expression visitOperatorExpressionDefault(EqlBaseParser.OperatorExpressio switch (predicate.kind.getType()) { case EqlBaseParser.SEQ: return Predicates.combineOr(expressions(predicate.constant()).stream() + .map(c -> new InsensitiveWildcardEquals(source, expr, c, zoneId)) + .collect(toList())); + case EqlBaseParser.IN_INSENSITIVE: + Expression insensitiveIn = Predicates.combineOr(expressions(predicate.expression()).stream() .map(c -> new InsensitiveEquals(source, expr, c, zoneId)) .collect(toList())); + return predicate.NOT() != null ? new Not(source, insensitiveIn) : insensitiveIn; case EqlBaseParser.IN: List container = expressions(predicate.expression()); Expression checkInSet = new In(source, expr, container, zoneId); diff --git a/x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/EqlTestUtils.java b/x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/EqlTestUtils.java index d3326360915f4..7b92bb42882b2 100644 --- a/x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/EqlTestUtils.java +++ b/x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/EqlTestUtils.java @@ -14,6 +14,8 @@ import org.elasticsearch.xpack.eql.action.EqlSearchTask; import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveEquals; import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveNotEquals; +import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveWildcardEquals; +import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveWildcardNotEquals; import org.elasticsearch.xpack.eql.session.EqlConfiguration; import org.elasticsearch.xpack.ql.expression.Expression; @@ -33,7 +35,7 @@ private EqlTestUtils() { } public static final EqlConfiguration TEST_CFG = new EqlConfiguration(new String[] {"none"}, - org.elasticsearch.xpack.ql.util.DateUtils.UTC, "nobody", "cluster", null, TimeValue.timeValueSeconds(30), null, + org.elasticsearch.xpack.ql.util.DateUtils.UTC, "nobody", "cluster", null, TimeValue.timeValueSeconds(30), null, 123, "", new TaskId("test", 123), null); public static EqlConfiguration randomConfiguration() { @@ -56,11 +58,11 @@ public static EqlSearchTask randomTask() { } public static InsensitiveEquals seq(Expression left, Expression right) { - return new InsensitiveEquals(EMPTY, left, right, randomZone()); + return new InsensitiveWildcardEquals(EMPTY, left, right, randomZone()); } public static InsensitiveNotEquals sneq(Expression left, Expression right) { - return new InsensitiveNotEquals(EMPTY, left, right, randomZone()); + return new InsensitiveWildcardNotEquals(EMPTY, left, right, randomZone()); } public static IndicesOptions randomIndicesOptions() { diff --git a/x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/parser/ExpressionTests.java b/x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/parser/ExpressionTests.java index e6226f37bf8c3..3a90c6a0490fd 100644 --- a/x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/parser/ExpressionTests.java +++ b/x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/parser/ExpressionTests.java @@ -395,7 +395,7 @@ public void testChainedComparisonsDisallowed() { } ParsingException e = expectThrows(ParsingException.class, () -> expr(sb.toString())); assertEquals("line 1:" + (6 + firstComparator.length()) + ": mismatched input '" + secondComparator + - "' expecting {, 'and', 'in', 'not', 'or', ':', '+', '-', '*', '/', '%', '.', '['}", - e.getMessage()); + "' expecting {, 'and', 'in', 'in~', 'not', 'or', ':', '+', '-', '*', '/', '%', '.', '['}", + e.getMessage()); } } diff --git a/x-pack/plugin/eql/src/test/resources/queryfolder_tests.txt b/x-pack/plugin/eql/src/test/resources/queryfolder_tests.txt index 068756122ec4e..acd611c3849f6 100644 --- a/x-pack/plugin/eql/src/test/resources/queryfolder_tests.txt +++ b/x-pack/plugin/eql/src/test/resources/queryfolder_tests.txt @@ -110,6 +110,29 @@ process where process_path : "*\\red_ttp\\wininit.*" and opcode in (0,1,2,3) {"terms":{"opcode":[0,1,2,3],"boost":1.0}} ; +inFilterInsensitive +process where process_name in~ ("test") +; +"term":{"process_name":{"value":"test","case_insensitive":true,"boost":1.0} +; + +inFilterInsensitiveList +process where process_name in~ ("test", "best") +; +{"bool":{"should":[{"term" +"term":{"process_name":{"value":"test","case_insensitive":true,"boost":1.0} +"term":{"process_name":{"value":"best","case_insensitive":true,"boost":1.0} +; + +inFilterInsensitiveVerbatimMatch +process where process_name in~ ("test*", "best") +; +{"bool":{"should":[{"term" +"term":{"process_name":{"value":"test*","case_insensitive":true,"boost":1.0} +"term":{"process_name":{"value":"best","case_insensitive":true,"boost":1.0} +; + + functionEqualsTrue process where cidrMatch(source_address, "10.0.0.0/8") == true ; diff --git a/x-pack/plugin/sql/src/main/java/org/elasticsearch/xpack/sql/parser/SqlBaseLexer.java b/x-pack/plugin/sql/src/main/java/org/elasticsearch/xpack/sql/parser/SqlBaseLexer.java index 99b4cfed4c511..03cadeaaa2426 100644 --- a/x-pack/plugin/sql/src/main/java/org/elasticsearch/xpack/sql/parser/SqlBaseLexer.java +++ b/x-pack/plugin/sql/src/main/java/org/elasticsearch/xpack/sql/parser/SqlBaseLexer.java @@ -1,15 +1,13 @@ // ANTLR GENERATED CODE: DO NOT EDIT package org.elasticsearch.xpack.sql.parser; -import org.antlr.v4.runtime.CharStream; import org.antlr.v4.runtime.Lexer; -import org.antlr.v4.runtime.RuntimeMetaData; -import org.antlr.v4.runtime.Vocabulary; -import org.antlr.v4.runtime.VocabularyImpl; -import org.antlr.v4.runtime.atn.ATN; -import org.antlr.v4.runtime.atn.ATNDeserializer; -import org.antlr.v4.runtime.atn.LexerATNSimulator; -import org.antlr.v4.runtime.atn.PredictionContextCache; +import org.antlr.v4.runtime.CharStream; +import org.antlr.v4.runtime.Token; +import org.antlr.v4.runtime.TokenStream; +import org.antlr.v4.runtime.*; +import org.antlr.v4.runtime.atn.*; import org.antlr.v4.runtime.dfa.DFA; +import org.antlr.v4.runtime.misc.*; @SuppressWarnings({"all", "warnings", "unchecked", "unused", "cast"}) class SqlBaseLexer extends Lexer {