plunk 0.0.8 → 0.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 599c26a054ac47928ba6b476dcf62c2731b07305
-  data.tar.gz: d10dbfe0b2c3d3d26611a509b1e699bc42b8e412
+  metadata.gz: f4dfac5efa2e55552472e25e7c690597f9897f54
+  data.tar.gz: dcd5d467953d34343a7bb3a1a2f52ed9a1a40293
 SHA512:
-  metadata.gz: 1f5facdc7cedcfdb9a94d7f51a148ad72319b1ebd55ae54449c6e860f6a173149da2f5ec95697ef2a7e23bcd2af46535154bfba46030345864f07ab2c244144d
-  data.tar.gz: 0b8b372f4b1b5ca0ae46cfcb3d2214e68dcc5490432b9117bb02d84f8e2cbf564f8322b961d385eb0ea57116e1b4b3b2b542d16f105364702573c8a4a0a56ec9
+  metadata.gz: 883e88718a5af4fdd8bb7e636cf4a1621a24b6dd8b15e00d94b1bdeb5c147944daa24ba04672b3496b6adedf6576e3c9a5b89b9e82d444e1d44ffeb414c60111
+  data.tar.gz: 4c1403380786063af8680102e108650e769883568f38aa7434f75da71abb7991d567ecc5264f19f3f4721a364700f700670f258ef711d624a7115853f24d58fa

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    plunk (0.0.7)
+    plunk (0.0.8)
       activesupport
       json
       parslet

data/lib/plunk/parser.rb

@@ -1,6 +1,11 @@
 require 'parslet'
 
 class Plunk::Parser < Parslet::Parser
+
+  def parenthesized(atom)
+    lparen >> atom >> rparen
+  end
+
   # Single character rules
   rule(:lparen)     { str('(') >> space? }
   rule(:rparen)     { str(')') >> space? }
@@ -21,6 +26,8 @@ class Plunk::Parser < Parslet::Parser
   rule(:wildcard)   { match('[a-zA-Z0-9.*]').repeat(1) }
   rule(:searchop)   { match('[=]').as(:op) }
 
+  rule(:query_value) { wildcard | integer }
+
   # boolean operators search
   rule(:concatop)   { (str('OR') | str('AND')) >> space? }
   rule(:operator)   { match('[|]').as(:op) >> space? }
@@ -30,9 +37,19 @@ class Plunk::Parser < Parslet::Parser
 
   # Grammar parts
   rule(:rhs) {
-      regexp | subsearch | integer | wildcard |
-       (lparen >> (space? >> (wildcard | integer) >>
-         (space >> concatop).maybe).repeat(1) >> rparen).maybe
+    regexp | subsearch | integer | wildcard | booleanop
+  }
+
+  rule(:boolean_value) {
+    booleanparen | query_value
+  }
+
+  rule(:booleanop) {
+    boolean_value >> (space >> concatop >> boolean_value).repeat
+  }
+
+  rule(:booleanparen) {
+    lparen >> space? >> booleanop >> space? >> rparen
   }
 
   rule(:regexp) {
@@ -58,9 +75,9 @@ class Plunk::Parser < Parslet::Parser
   }
 
   rule(:nested_search) {
-    match('[^|]').repeat.as(:initial_query) >> str('|') >> space? >>
+    # match('[^|]').repeat.as(:initial_query) >> str('|') >> space? >>
+    job.as(:initial_query) >> space? >> str('|') >> space? >>
     match('[^`]').repeat.as(:extractors)
-    # job >> str('|') >> space? >>
   }
 
   rule(:paren) {

data/plunk.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name                    = "plunk"
-  s.version                 = "0.0.8"
+  s.version                 = "0.0.9"
   s.date                    = "2013-12-03"
   s.add_runtime_dependency  "json"
   s.add_runtime_dependency  "parslet"

data/spec/boolean_spec.rb

@@ -7,9 +7,9 @@ describe 'boolean searches' do
   end
 
   it 'should parse a single field / value complex boolean expression' do
-    @parsed = @parser.parse 'ids.attackers=(bar OR car)'
-    expect(@parsed[:field].to_s).to eq 'ids.attackers'
-    expect(@parsed[:value].to_s).to eq '(bar OR car)'
+    @parsed = @parser.parse 'baz=(foo OR bar AND (bar OR fez))'
+    expect(@parsed[:field].to_s).to eq 'baz'
+    expect(@parsed[:value].to_s).to eq '(foo OR bar AND (bar OR fez))'
     expect(@parsed[:op].to_s).to eq '='
   end
 

data/spec/nested_search_spec.rb

@@ -5,7 +5,7 @@ describe 'nested searches' do
     @parsed = @parser.parse 'tshark.len = ` 226 | tshark.frame.time_epoch,tshark.ip.src`'
     expect(@parsed[:field].to_s).to eq 'tshark.len'
     expect(@parsed[:op].to_s).to eq '='
-    expect(@parsed[:value][:initial_query].to_s).to eq '226 '
+    expect(@parsed[:value][:initial_query][:match].to_s).to eq '226 '
     expect(@parsed[:value][:extractors].to_s).to eq 'tshark.frame.time_epoch,tshark.ip.src'
   end
 
@@ -13,7 +13,9 @@ describe 'nested searches' do
     @parsed = @parser.parse 'tshark.len = ` cif.malicious_ips=/foo/ | tshark.frame.time_epoch,tshark.ip.src`'
     expect(@parsed[:field].to_s).to eq 'tshark.len'
     expect(@parsed[:op].to_s).to eq '='
-    expect(@parsed[:value][:initial_query].to_s).to eq 'cif.malicious_ips=/foo/ '
+    expect(@parsed[:value][:initial_query][:field].to_s).to eq 'cif.malicious_ips'
+    expect(@parsed[:value][:initial_query][:op].to_s).to eq '='
+    expect(@parsed[:value][:initial_query][:value].to_s).to eq '/foo/'
     expect(@parsed[:value][:extractors].to_s).to eq 'tshark.frame.time_epoch,tshark.ip.src'
   end
 
@@ -21,7 +23,7 @@ describe 'nested searches' do
     @parsed = @parser.parse 'tshark.len = `(foo OR bar) | tshark.frame.time_epoch,tshark.ip.src`'
     expect(@parsed[:field].to_s).to eq 'tshark.len'
     expect(@parsed[:op].to_s).to eq '='
-    expect(@parsed[:value][:initial_query].to_s).to eq '(foo OR bar) '
+    expect(@parsed[:value][:initial_query][:match].to_s).to eq '(foo OR bar) '
     expect(@parsed[:value][:extractors].to_s).to eq 'tshark.frame.time_epoch,tshark.ip.src'
   end
 
@@ -29,7 +31,9 @@ describe 'nested searches' do
     @parsed = @parser.parse 'tshark.len = `baz=(foo OR bar AND (bar OR fez)) | tshark.frame.time_epoch,tshark.ip.src`'
     expect(@parsed[:field].to_s).to eq 'tshark.len'
     expect(@parsed[:op].to_s).to eq '='
-    expect(@parsed[:value][:initial_query].to_s).to eq 'baz=(foo OR bar AND (bar OR fez)) '
+    expect(@parsed[:value][:initial_query][:field].to_s).to eq 'baz'
+    expect(@parsed[:value][:initial_query][:op].to_s).to eq '='
+    expect(@parsed[:value][:initial_query][:value].to_s).to eq '(foo OR bar AND (bar OR fez)) '
     expect(@parsed[:value][:extractors].to_s).to eq 'tshark.frame.time_epoch,tshark.ip.src'
   end
 
@@ -37,7 +41,8 @@ describe 'nested searches' do
     @parsed = @parser.parse 'tshark.len = `last 24h | tshark.frame.time_epoch,tshark.ip.src`'
     expect(@parsed[:field].to_s).to eq 'tshark.len'
     expect(@parsed[:op].to_s).to eq '='
-    expect(@parsed[:value][:initial_query].to_s).to eq 'last 24h '
+    expect(@parsed[:value][:initial_query][:timerange][:quantity].to_s).to eq '24'
+    expect(@parsed[:value][:initial_query][:timerange][:quantifier].to_s).to eq 'h'
     expect(@parsed[:value][:extractors].to_s).to eq 'tshark.frame.time_epoch,tshark.ip.src'
   end
 
@@ -45,7 +50,11 @@ describe 'nested searches' do
     @parsed = @parser.parse 'tshark.len = `last 24h foo=bar | tshark.frame.time_epoch,tshark.ip.src`'
     expect(@parsed[:field].to_s).to eq 'tshark.len'
     expect(@parsed[:op].to_s).to eq '='
-    expect(@parsed[:value][:initial_query].to_s).to eq 'last 24h foo=bar '
+    expect(@parsed[:value][:initial_query][:timerange][:quantity].to_s).to eq '24'
+    expect(@parsed[:value][:initial_query][:timerange][:quantifier].to_s).to eq 'h'
+    expect(@parsed[:value][:initial_query][:search][:field].to_s).to eq 'foo'
+    expect(@parsed[:value][:initial_query][:search][:op].to_s).to eq '='
+    expect(@parsed[:value][:initial_query][:search][:value].to_s).to eq 'bar'
     expect(@parsed[:value][:extractors].to_s).to eq 'tshark.frame.time_epoch,tshark.ip.src'
   end
 end

data/spec/shared/basic.rb

@@ -0,0 +1,5 @@
+shared_examples 'basic' do
+  describe 'string' do
+    expect(query[:match].to_s).to eq expected[:match]
+  end
+end

data/spec/shared/field_value.rb

@@ -0,0 +1,7 @@
+shared_examples 'field / value' do
+  describe 'basic' do
+    expect(query[:field].to_s).to eq expected[:field]
+    expect(query[:value].to_s).to eq expected[:value]
+    expect(query[:op].to_s).to eq expected[:op]
+  end
+end

data/spec/shared/last.rb

@@ -0,0 +1,6 @@
+shared_examples 'last' do
+  describe 'basic' do
+    expect(query[:timerange][:quantity].to_s).to eq expected[:quantity]
+    expect(query[:timerange][:quantifier].to_s).to eq expected[:quantifier]
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: plunk
 version: !ruby/object:Gem::Version
-  version: 0.0.8
+  version: 0.0.9
 platform: ruby
 authors:
 - Ram Mehta
@@ -108,6 +108,9 @@ files:
 - spec/last_spec.rb
 - spec/nested_search_spec.rb
 - spec/regexp_spec.rb
+- spec/shared/basic.rb
+- spec/shared/field_value.rb
+- spec/shared/last.rb
 - spec/spec_helper.rb
 homepage: https://github.com/elbii/plunk
 licenses: