tellaro-query-language 0.2.10__tar.gz → 0.2.12__tar.gz

{tellaro_query_language-0.2.10 → tellaro_query_language-0.2.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tellaro-query-language
-Version: 0.2.10
+Version: 0.2.12
 Summary: A flexible, human-friendly query language for searching and filtering structured data
 License: Proprietary
 License-File: LICENSE

{tellaro_query_language-0.2.10 → tellaro_query_language-0.2.12}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "tellaro-query-language"
-version = "0.2.10"
+version = "0.2.12"
 description = "A flexible, human-friendly query language for searching and filtering structured data"
 authors = ["Justin Henderson <justin@tellaro.io>"]
 license = "Proprietary"

{tellaro_query_language-0.2.10 → tellaro_query_language-0.2.12}/src/tql/post_processor.py

@@ -701,19 +701,24 @@ class QueryPostProcessor:
             # Check if this is an enrichment mutator first
             from .mutators import ENRICHMENT_MUTATORS
 
-            # Check if we have geo/geoip_lookup enrichment mutator
+            # Check if we have geo/geoip_lookup or nslookup enrichment mutator
             is_geo_enrichment = False
+            is_nslookup_enrichment = False
             for mutator in requirement.mutators:
                 mutator_name = mutator.get("name", "").lower()
                 if mutator_name in ["geo", "geoip_lookup"]:
                     is_geo_enrichment = True
-                    break
+                elif mutator_name == "nslookup":
+                    is_nslookup_enrichment = True
+
+            # Skip field transformation for enrichment mutators (they add data, not transform)
+            is_any_enrichment = is_geo_enrichment or is_nslookup_enrichment
 
-            if should_transform_output and not is_geo_enrichment:
+            if should_transform_output and not is_any_enrichment:
                 # Update the result with the mutated value
                 # Use the original field name for the output
                 self._set_field_value(result, requirement.field_name, mutated_value)
-            elif not is_geo_enrichment:
+            elif not is_any_enrichment:
                 # For type-changing mutators with filtering operations, store in temp field
                 temp_field_name = self._get_mutated_field_name(requirement.field_name)
                 self._set_field_value(result, temp_field_name, mutated_value)
@@ -750,6 +755,10 @@ class QueryPostProcessor:
                         if "as" in mutated_value:
                             result["enrichment"]["as"] = mutated_value["as"]
 
+            # Handle nslookup enrichment - the mutator already adds domain/dns via append_to_result
+            # We just need to ensure the original field value is preserved (don't overwrite)
+            # The nslookup mutator's apply() method handles enrichment storage via append_to_result()
+
             return enrichment_mutator_found
 
         except Exception: