tellaro-query-language 0.2.0__py3-none-any.whl → 0.2.2__py3-none-any.whl

tql/core_components/stats_operations.py

@@ -175,6 +175,16 @@ class StatsOperations:
                     suggestions.append(f"Use aliases to distinguish: {key} as alias1, {key} as alias2")
                 agg_fields.append(key)
 
+        # Normalize group_by to extract just field names for compatibility
+        normalized_group_by = []
+        for field in group_by:
+            if isinstance(field, str):
+                normalized_group_by.append(field)
+            elif isinstance(field, dict) and "field" in field:
+                normalized_group_by.append(field["field"])
+            else:
+                normalized_group_by.append(str(field))
+
         # Build analysis result
         result = {
             "valid": True,
@@ -182,7 +192,7 @@ class StatsOperations:
             "query": query,
             "ast": ast,
             "aggregations": aggregations,
-            "group_by": group_by,
+            "group_by": normalized_group_by,
             "warnings": warnings,
             "suggestions": suggestions,
         }

tql/evaluator.py

@@ -96,6 +96,18 @@ class TQLEvaluator:
                 return self.special_evaluator.evaluate_geo_expr(node, record, field_mappings)
             elif node_type == "nslookup_expr":
                 return self.special_evaluator.evaluate_nslookup_expr(node, record, field_mappings)
+            elif node_type == "query_with_stats":
+                # For query_with_stats, only evaluate the filter part
+                # The stats part is handled separately
+                filter_node = node.get("filter")
+                if filter_node:
+                    return self._evaluate_node(filter_node, record, field_mappings)
+                else:
+                    return True  # No filter means match all
+            elif node_type == "stats_expr":
+                # Pure stats queries match all records
+                # The aggregations are handled separately
+                return True
 
         # Unknown node type
         return False
@@ -115,7 +127,8 @@ class TQLEvaluator:
         """
         field_name = node["field"]
         operator = node["operator"]
-        expected_value = node["value"]
+        # For exists/not_exists operators, value is None
+        expected_value = node.get("value") if operator not in ["exists", "not_exists"] else None
         field_mutators = node.get("field_mutators", [])
         value_mutators = node.get("value_mutators", [])
         type_hint = node.get("type_hint")
@@ -128,7 +141,15 @@ class TQLEvaluator:
 
         # Apply field mutators if any
         if field_mutators and field_value is not self._MISSING_FIELD:
-            field_value = apply_mutators(field_value, field_mutators, field_name, record)
+            try:
+                field_value = apply_mutators(field_value, field_mutators, field_name, record)
+            except (ValueError, TypeError):
+                # If mutators fail, treat as missing field for exists/not_exists checks
+                if operator in ["exists", "not_exists"]:
+                    field_value = self._MISSING_FIELD
+                else:
+                    # For other operators, the comparison will fail naturally
+                    return False
 
         # Apply value mutators if any
         if value_mutators:
@@ -212,9 +233,19 @@ class TQLEvaluator:
                 else:
                     # Field exists - evaluate normally
                     return not self._evaluate_node(operand, record, field_mappings)
+            elif self._is_logical_operation(operand):
+                # For logical operations (AND/OR), always evaluate normally
+                # They can handle missing fields correctly
+                return not self._evaluate_node(operand, record, field_mappings)
             elif self._operand_has_missing_fields(operand, record, field_mappings):
                 # For operations on missing fields (except exists/null checks), NOT returns True
                 # This matches OpenSearch behavior where must_not includes docs with missing fields
+                # However, for collection operators, we should evaluate normally since they handle missing fields
+                operand_type = operand.get("type")
+                operand_operator = operand.get("operator", "")
+                if operand_type == "comparison" and operand_operator in ["any", "all", "none"]:
+                    # Collection operators handle missing fields in their own evaluation
+                    return not self._evaluate_node(operand, record, field_mappings)
                 return True
             else:
                 # Standard NOT operation
@@ -352,6 +383,12 @@ class TQLEvaluator:
                 return value is None or (isinstance(value, str) and value.lower() == "null")
         return False
 
+    def _is_logical_operation(self, node: Any) -> bool:
+        """Check if a node is a logical operation (AND/OR)."""
+        if isinstance(node, dict) and node.get("type") == "logical_op":
+            return node.get("operator") in ["and", "or"]
+        return False
+
     def _apply_collection_mutators(
         self, field_value: Any, mutators: List[Dict[str, Any]], field_name: str, record: Dict[str, Any]
     ) -> Any:

tql/evaluator_components/special_expressions.py

@@ -162,8 +162,8 @@ class SpecialExpressionEvaluator:
                 temp_record["as"] = geo_data["as"]
             return self._evaluate_node(conditions, temp_record, {})
         else:
-            # No conditions, just checking if geo lookup succeeded
-            return bool(geo_data and "geo" in geo_data)
+            # No conditions, enrichment-only - always return True
+            return True
 
     def evaluate_nslookup_expr(  # noqa: C901
         self, node: Dict[str, Any], record: Dict[str, Any], field_mappings: Dict[str, str]
@@ -283,8 +283,27 @@ class SpecialExpressionEvaluator:
             if field_mutators:
                 field_value = apply_mutators(field_value, field_mutators, field_name, record)
 
-            # Apply nslookup
-            dns_data = apply_mutators(field_value, [nslookup_mutator], field_name, record)
+            # Apply nslookup (this enriches the record)
+            apply_mutators(field_value, [nslookup_mutator], field_name, record)
+
+            # Now get the DNS data from where it was stored
+            if "." in field_name:
+                # Nested field like destination.ip
+                parent_path = field_name.rsplit(".", 1)[0]
+                parent = record
+                for part in parent_path.split("."):
+                    if isinstance(parent, dict) and part in parent:
+                        parent = parent[part]
+                    else:
+                        parent = None
+                        break
+                if parent and isinstance(parent, dict) and "domain" in parent:
+                    dns_data = parent["domain"]
+                else:
+                    dns_data = None
+            else:
+                # Top-level field
+                dns_data = record.get("enrichment", {}).get("domain")
 
         # Now evaluate the conditions against the DNS data
         if conditions:
@@ -292,5 +311,5 @@ class SpecialExpressionEvaluator:
             temp_record = dns_data if dns_data else {}
             return self._evaluate_node(conditions, temp_record, {})
         else:
-            # No conditions, just checking if nslookup succeeded
-            return bool(dns_data)
+            # No conditions, enrichment-only - always return True
+            return True

tql/evaluator_components/value_comparison.py

@@ -32,6 +32,10 @@ class ValueComparator:
                 return False
             elif operator in ["not_exists"]:
                 return True  # Field doesn't exist, so "not exists" is true
+            elif operator == "is_not":
+                # For "is not null", missing fields should return False (to match OpenSearch behavior)
+                # OpenSearch "is not null" translates to "exists", which only matches if field is present
+                return False  # Missing fields return False for all "is not" comparisons
             # For negated string operators, missing fields should return True
             # (e.g., if field doesn't exist, it doesn't contain/start with/end with the value)
             elif operator in ["not_contains", "not_startswith", "not_endswith", "not_regexp"]:
@@ -66,36 +70,60 @@ class ValueComparator:
 
         try:
             if operator in ["eq", "="]:
+                # Handle array fields - check if ANY element equals expected value
+                if isinstance(field_value, (list, tuple)):
+                    return expected_value in field_value
                 return field_value == expected_value
             elif operator in ["ne", "!="]:
+                # Handle array fields - check if expected value is NOT in array
+                if isinstance(field_value, (list, tuple)):
+                    return expected_value not in field_value
                 return field_value != expected_value
             elif operator in ["gt", ">"]:
+                # Handle array fields - check if ANY element is greater than expected value
+                if isinstance(field_value, (list, tuple)):
+                    return any(self._convert_numeric(elem) > expected_value for elem in field_value)
                 return field_value > expected_value
             elif operator in ["gte", ">="]:
+                # Handle array fields - check if ANY element is greater than or equal to expected value
+                if isinstance(field_value, (list, tuple)):
+                    return any(self._convert_numeric(elem) >= expected_value for elem in field_value)
                 return field_value >= expected_value
             elif operator in ["lt", "<"]:
+                # Handle array fields - check if ANY element is less than expected value
+                if isinstance(field_value, (list, tuple)):
+                    return any(self._convert_numeric(elem) < expected_value for elem in field_value)
                 return field_value < expected_value
             elif operator in ["lte", "<="]:
+                # Handle array fields - check if ANY element is less than or equal to expected value
+                if isinstance(field_value, (list, tuple)):
+                    return any(self._convert_numeric(elem) <= expected_value for elem in field_value)
                 return field_value <= expected_value
             elif operator == "contains":
                 # Unwrap single-element lists for string operators
                 if isinstance(expected_value, list) and len(expected_value) == 1:
                     expected_value = expected_value[0]
-                # Handle list fields by checking if expected value is in the list
+                # Handle list fields by checking if ANY element contains the expected value
                 if isinstance(field_value, list):
-                    # For lists, check if expected value is in the list
-                    return expected_value in field_value
+                    # For arrays, check if ANY element contains the expected value
+                    return any(str(expected_value) in str(elem) for elem in field_value)
                 else:
                     return str(expected_value) in str(field_value)
             elif operator == "startswith":
                 # Unwrap single-element lists for string operators
                 if isinstance(expected_value, list) and len(expected_value) == 1:
                     expected_value = expected_value[0]
+                # Handle array fields - check if ANY element starts with expected value
+                if isinstance(field_value, (list, tuple)):
+                    return any(str(elem).startswith(str(expected_value)) for elem in field_value)
                 return str(field_value).startswith(str(expected_value))
             elif operator == "endswith":
                 # Unwrap single-element lists for string operators
                 if isinstance(expected_value, list) and len(expected_value) == 1:
                     expected_value = expected_value[0]
+                # Handle array fields - check if ANY element ends with expected value
+                if isinstance(field_value, (list, tuple)):
+                    return any(str(elem).endswith(str(expected_value)) for elem in field_value)
                 return str(field_value).endswith(str(expected_value))
             elif operator == "in":
                 if isinstance(expected_value, list):