tellaro-query-language 0.1.7__py3-none-any.whl → 0.1.9__py3-none-any.whl

{tellaro_query_language-0.1.7.dist-info → tellaro_query_language-0.1.9.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: tellaro-query-language
-Version: 0.1.7
+Version: 0.1.9
 Summary: A flexible, human-friendly query language for searching and filtering structured data
 Home-page: https://github.com/tellaro/tellaro-query-language
 License: MIT

{tellaro_query_language-0.1.7.dist-info → tellaro_query_language-0.1.9.dist-info}/RECORD

@@ -4,14 +4,14 @@ tql/cache/__init__.py,sha256=GIzIEMZUZEYJj72sAhuVLEG-OJEKUG2srUWNM3Ix-T8,213
 tql/cache/base.py,sha256=0b-8uyh3JltayGmXQI45snTqsM5sQu9u0KcNvZIRa-I,687
 tql/cache/memory.py,sha256=ibcmQSAxNvqCy6DksbU7gLu6UArYp1u3fW-oLubxtV0,2056
 tql/cache/redis.py,sha256=ZU_IsVDvpSYpNvPfnZ4iulJDODpEGx3c4dkXLzPzPVc,2309
-tql/core.py,sha256=zAkTStN_3logY9ARABDZNsQJfXV5rITiiTKoX5bo274,40859
+tql/core.py,sha256=zIihZijiwqejG78EIRikTtaDvzMgcy2cwBCL3-HwZy8,40797
 tql/core_components/README.md,sha256=Rm7w4UHdQ0vPBEFybE5b62IOvSA5Nzq2GRvtBHOapmc,3068
 tql/core_components/__init__.py,sha256=v8BBybPlqV7dkVY9mw1mblvqyAFJZ7Pf_bEc-jAL7FI,643
 tql/core_components/file_operations.py,sha256=Jr0kkxz_OP2KHOAsIr7KMtYe_lbu8LuBUySt2LQbjJw,3925
-tql/core_components/opensearch_operations.py,sha256=X9xtVnrC37O-9eSTbdilvi_cjvm0jXHZIPdldM0yM7g,38028
+tql/core_components/opensearch_operations.py,sha256=HIiSosL2uek88H6aPkX_QDnlgV8bT1fbotG652Z2vdE,37900
 tql/core_components/stats_operations.py,sha256=zAfDhVOFFPMrRIMw6Qtjxbobbdi7ao_HuHBCcVc3BGY,7579
 tql/core_components/validation_operations.py,sha256=_VPXh0HABBjsXF99jFT7B6-5QAPsADOCy6poinGrxeE,22454
-tql/evaluator.py,sha256=YdgS1vuxUEPAHhUsZey-Y4NydeS8CTYOy_O8R5_K8cE,15421
+tql/evaluator.py,sha256=kjqf2rkjdfPhrX2gyNtiBpdnBpob3LFkTuvplLtc-Ww,15542
 tql/evaluator_components/README.md,sha256=c59yf2au34yPhrru7JWgGop_ORteB6w5vfMhsac8j3k,3882
 tql/evaluator_components/__init__.py,sha256=DourRUSYXWPnCghBFj7W0YfMeymT3X8YTDCwnLIyP1c,535
 tql/evaluator_components/field_access.py,sha256=BuXvL9jlv4H77neT70Vh7_qokmzs-d4EbSDA2FB1IT0,6435
@@ -33,11 +33,11 @@ tql/opensearch.py,sha256=J7LhfVJfaXEWtyZqVDqNZaeIbIcUYJr2cQtfKzdyIhM,3362
 tql/opensearch_components/README.md,sha256=gt-qLmmach8Kh7-QwLZmoAxxIL79XIG1EDqJum8PMZE,3756
 tql/opensearch_components/__init__.py,sha256=_zIZY8Fns7mkEcY6w2p9FNRBXtEmmPFFJEcFRfrVyXA,514
 tql/opensearch_components/field_mapping.py,sha256=N4r7VkzNeXjIhNDt2cfnd1LbkvaS_9O298PIDAcR_Hw,17569
-tql/opensearch_components/lucene_converter.py,sha256=ZbupWZ2smGhWfE9cSIrNo7MZVY35l2t86HYM-bd7nKw,12436
-tql/opensearch_components/query_converter.py,sha256=9Nkhehb8X7jIQcyRaHCa5WCKWtovdRGKuSdDsBulrG0,36722
+tql/opensearch_components/lucene_converter.py,sha256=ke1cMCeGVf5UorjwhN3y9x-GO-AHJ7FmbuTPSNMxYJo,12570
+tql/opensearch_components/query_converter.py,sha256=QodPaRJf5fI_DpMzRGINFIdpmcZZ_3Umlw1h33zsrZE,36858
 tql/opensearch_mappings.py,sha256=zJCCdMrxK7mswrkxd5LiOhunQ9GIJNZdhktVoGXgVgk,11529
-tql/opensearch_stats.py,sha256=03mjvnUJpNtCDpU-E1ZkugDJMIKC-F76Hekd4gppPxU,17812
-tql/parser.py,sha256=dnjgc-sDVihe-VIVPT_SRULeng4OWaLtkbM23dluT6M,75532
+tql/opensearch_stats.py,sha256=h-hA2EZ-sc4S1zxr7jaInmonfrgTXoGBbb9sOYurdFE,17823
+tql/parser.py,sha256=MnY1Gxm8vl2Uw2tU2CyFB26uE3TSeUx6i7APtlwh7Fk,75727
 tql/parser_components/README.md,sha256=lvQX72ckq2zyotGs8QIHHCIFqaA7bOHwkP44wU8Zoiw,2322
 tql/parser_components/__init__.py,sha256=zBwHBMPJyHSBbaOojf6qTrJYjJg5A6tPUE8nHFdRiQs,521
 tql/parser_components/ast_builder.py,sha256=-pbcYhZNoRm0AnjmJRAAlXLCAwHfauchTpX_6KO0plE,6793
@@ -46,11 +46,11 @@ tql/parser_components/field_extractor.py,sha256=TumeuUo2c5gPYVbTPsmU43C3TJFC8chA
 tql/parser_components/grammar.py,sha256=lSvjABvEBaH29-ad-_UGD4WmofdNwC_pO2OKQJ_It-U,19309
 tql/post_processor.py,sha256=-vA2wgbuLij2FVnj5I9HDHtw5bKj9Cu3EE9mtoeSWk8,28859
 tql/scripts.py,sha256=VOr5vCjIvKlW36kwvJx7JGFIRM16IJZlbJcWlBexBtk,3728
-tql/stats_evaluator.py,sha256=GtmygLdPPMhAMR5bN1h69cQsNBYqg-jQl6bN5rwEx6Q,15692
+tql/stats_evaluator.py,sha256=lOEbICFuP0krZZqEjREz37xlpm35_P6eRgkHVgJLNI4,15703
 tql/stats_transformer.py,sha256=MT-4rDWZSySgn4Fuq9H0c-mvwFYLM6FqWpPv2rHX-rE,7588
 tql/validators.py,sha256=e9MlX-zQ_O3M8YP8vXyMjKU8iiJMTh6mMK0iv0_4gTY,3771
-tellaro_query_language-0.1.7.dist-info/LICENSE,sha256=zRhQ85LnW55fWgAjQctckwQ67DX5Jmt64lq343ThZFU,1063
-tellaro_query_language-0.1.7.dist-info/METADATA,sha256=IDzVPrFm_GQJTRZRX4iLNw45Nqszf3TqBW6ZW6UUKBo,15109
-tellaro_query_language-0.1.7.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
-tellaro_query_language-0.1.7.dist-info/entry_points.txt,sha256=H43APfGBMsZkKsUCnFTaqprQPW-Kce2yz2qsBL3dZrw,164
-tellaro_query_language-0.1.7.dist-info/RECORD,,
+tellaro_query_language-0.1.9.dist-info/LICENSE,sha256=zRhQ85LnW55fWgAjQctckwQ67DX5Jmt64lq343ThZFU,1063
+tellaro_query_language-0.1.9.dist-info/METADATA,sha256=fChSevkv4sS0e0XQcq4oDH5kP0FZZj7zRHJs84duh_c,15109
+tellaro_query_language-0.1.9.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
+tellaro_query_language-0.1.9.dist-info/entry_points.txt,sha256=H43APfGBMsZkKsUCnFTaqprQPW-Kce2yz2qsBL3dZrw,164
+tellaro_query_language-0.1.9.dist-info/RECORD,,

tql/core.py

@@ -167,7 +167,7 @@ class TQL:
             return f"NOT {operand}"
         return str(ast)
 
-    def query(
+    def query(  # noqa: C901
         self, data: Union[List[Dict], str], query: str, size: int = 10, save_enrichment: bool = False
     ) -> Dict[str, Any]:  # noqa: C901
         """Execute a TQL query against data and return results in execute_opensearch format.
@@ -470,8 +470,7 @@ class TQL:
             size: Number of results to return (default: 500)
             from_: Starting offset for pagination (default: 0)
             timestamp_field: Field name for timestamp filtering (default: "@timestamp")
-            time_range: Optional time range dict with 'gte' and/or 'lte' keys.
-                       If None, defaults to 'gte': 'now-15m', 'lte': 'now'
+            time_range: Optional time range dict with 'gte' and/or 'lte' keys
             scan_all: If True, use scroll API to retrieve all matching documents
             scroll_size: Size per scroll when scan_all=True (default: 1000)
             scroll_timeout: Scroll timeout when scan_all=True (default: "5m")

tql/core_components/opensearch_operations.py

@@ -311,10 +311,6 @@ class OpenSearchOperations:
         search_body = opensearch_query.copy()
 
         # Handle time range filtering
-        if time_range is None:
-            # Default time range: last 15 minutes
-            time_range = {"gte": "now-15m", "lte": "now"}
-
         # Add time range filter to the query
         if time_range:
             base_query = search_body.get("query", {})
@@ -492,7 +488,7 @@ class OpenSearchOperations:
                         }
                     else:
                         # Multiple aggregations
-                        results = {}
+                        agg_results = {}
                         for i, agg in enumerate(aggregations):
                             func = agg.get("function", "")
                             field = agg.get("field", "*")
@@ -522,11 +518,11 @@ class OpenSearchOperations:
                                 value = agg_result
 
                             key = agg.get("alias") or f"{func}_{field}"
-                            results[key] = value
+                            agg_results[key] = value
 
                         stats_results = {
                             "type": "stats",
-                            "results": results,
+                            "results": agg_results,
                         }
                 else:
                     stats_results = {"type": "stats", "operation": "unknown", "field": "*", "values": 0, "group_by": []}

tql/evaluator.py

@@ -81,7 +81,10 @@ class TQLEvaluator:
         if isinstance(node, dict):
             node_type = node.get("type")
 
-            if node_type == "comparison":
+            if node_type == "match_all":
+                # Empty query matches all records
+                return True
+            elif node_type == "comparison":
                 return self._evaluate_comparison(node, record, field_mappings)
             elif node_type == "logical_op":
                 return self._evaluate_logical_op(node, record, field_mappings)

tql/opensearch_components/lucene_converter.py

@@ -31,7 +31,10 @@ class LuceneConverter:
         if isinstance(node, dict):
             node_type = node.get("type")
 
-            if node_type == "comparison":
+            if node_type == "match_all":
+                # Empty query matches all documents in Lucene
+                return "*:*"
+            elif node_type == "comparison":
                 return self._convert_comparison_to_lucene(node)
             elif node_type == "logical_op":
                 return self._convert_logical_op_to_lucene(node)

tql/opensearch_components/query_converter.py

@@ -27,7 +27,10 @@ class QueryConverter:
         if isinstance(node, dict):
             node_type = node.get("type")
 
-            if node_type == "comparison":
+            if node_type == "match_all":
+                # Empty query matches all documents
+                return {"match_all": {}}
+            elif node_type == "comparison":
                 return self._convert_comparison(node)
             elif node_type == "logical_op":
                 return self._convert_logical_op(node)

tql/opensearch_stats.py

@@ -404,7 +404,7 @@ class OpenSearchStatsTranslator:
 
     def _extract_aggregation_value(  # noqa: C901
         self, agg_result: Dict[str, Any], function: str
-    ) -> Union[int, float, Dict[str, Any], None]:
+    ) -> Union[int, float, Dict[str, Any], List[Any], None]:
         """Extract value from OpenSearch aggregation result.
 
         Args:

tql/parser.py

@@ -43,6 +43,11 @@ class TQLParser:
         Raises:
             TQLParseError: If the query has invalid syntax
         """
+        # Handle empty or whitespace-only queries
+        if not query or not query.strip():
+            # Return a special AST that matches all records
+            return {"type": "match_all"}
+
         try:
             # Parse the query
             parsed_result = self.grammar.tql_expr.parseString(query, parseAll=True)

tql/stats_evaluator.py

@@ -198,7 +198,7 @@ class TQLStatsEvaluator:
 
     def _calculate_aggregation(  # noqa: C901
         self, records: List[Dict[str, Any]], agg_spec: Dict[str, Any]
-    ) -> Union[int, float, Dict[str, Any], None]:
+    ) -> Union[int, float, Dict[str, Any], List[Any], None]:
         """Calculate a single aggregation value.
 
         Args: