tellaro-query-language 0.2.11__py3-none-any.whl → 0.2.12__py3-none-any.whl

{tellaro_query_language-0.2.11.dist-info → tellaro_query_language-0.2.12.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tellaro-query-language
-Version: 0.2.11
+Version: 0.2.12
 Summary: A flexible, human-friendly query language for searching and filtering structured data
 License: Proprietary
 License-File: LICENSE

{tellaro_query_language-0.2.11.dist-info → tellaro_query_language-0.2.12.dist-info}/RECORD

@@ -46,14 +46,14 @@ tql/parser_components/ast_builder.py,sha256=erHoeKAMzobswoRIXB9xcsZbzQ5-2ZwaYfQg
 tql/parser_components/error_analyzer.py,sha256=qlCD9vKyW73aeKQYI33P1OjIWSJ3LPd08wuN9cis2fU,4012
 tql/parser_components/field_extractor.py,sha256=eUEkmiYWX2OexanFqhHeX8hcIkRlfIcgMB667e0HRYs,4629
 tql/parser_components/grammar.py,sha256=vEPiYOMMk-a6Xzz0y6kjRzyq4slwBG5T9YDeBg1txAk,21460
-tql/post_processor.py,sha256=5w_rP0V-t3AC7iAFLnlDxUtawcDFovbhbRsoZxt9yP4,51787
+tql/post_processor.py,sha256=lv3dLMyXCfi-_PN6WXgtdrpzu2P8Ul6n_Iy5d-v8TeQ,52383
 tql/scripts.py,sha256=DUY0H5IoGs_CNdG_oxITvLiCNVsogb2RJqUs2xXOs24,4319
 tql/stats_evaluator.py,sha256=2qnjeH5Qx14qpHDS_YJn9jRPeoPUfkeiYJabBagdfRs,36126
 tql/stats_transformer.py,sha256=MT-4rDWZSySgn4Fuq9H0c-mvwFYLM6FqWpPv2rHX-rE,7588
 tql/streaming_file_processor.py,sha256=cftWhYcvUo984P3ALf2CO3FoCQPJPe_2s2HLcXTp5UQ,12437
 tql/validators.py,sha256=e9MlX-zQ_O3M8YP8vXyMjKU8iiJMTh6mMK0iv0_4gTY,3771
-tellaro_query_language-0.2.11.dist-info/METADATA,sha256=GSY785bdmvKgMeNIDqgS99PTfBNbetFythhyVIvYbyE,21892
-tellaro_query_language-0.2.11.dist-info/WHEEL,sha256=3ny-bZhpXrU6vSQ1UPG34FoxZBp3lVcvK0LkgUz6VLk,88
-tellaro_query_language-0.2.11.dist-info/entry_points.txt,sha256=D0lbIGUYuDyfcYeqju1rWcMBFzft4sZtfIlw5uPNx5g,181
-tellaro_query_language-0.2.11.dist-info/licenses/LICENSE,sha256=eWf8lkuXlVX_8WiDpUgQvzxc1cxCeVne_e6P-pVJpwM,3038
-tellaro_query_language-0.2.11.dist-info/RECORD,,
+tellaro_query_language-0.2.12.dist-info/METADATA,sha256=RoDiW3dCxiaoBu39n0Xp9oBH3NWez8nZDjpL9gVhCNY,21892
+tellaro_query_language-0.2.12.dist-info/WHEEL,sha256=3ny-bZhpXrU6vSQ1UPG34FoxZBp3lVcvK0LkgUz6VLk,88
+tellaro_query_language-0.2.12.dist-info/entry_points.txt,sha256=D0lbIGUYuDyfcYeqju1rWcMBFzft4sZtfIlw5uPNx5g,181
+tellaro_query_language-0.2.12.dist-info/licenses/LICENSE,sha256=eWf8lkuXlVX_8WiDpUgQvzxc1cxCeVne_e6P-pVJpwM,3038
+tellaro_query_language-0.2.12.dist-info/RECORD,,

tql/post_processor.py

@@ -701,19 +701,24 @@ class QueryPostProcessor:
             # Check if this is an enrichment mutator first
             from .mutators import ENRICHMENT_MUTATORS
 
-            # Check if we have geo/geoip_lookup enrichment mutator
+            # Check if we have geo/geoip_lookup or nslookup enrichment mutator
             is_geo_enrichment = False
+            is_nslookup_enrichment = False
             for mutator in requirement.mutators:
                 mutator_name = mutator.get("name", "").lower()
                 if mutator_name in ["geo", "geoip_lookup"]:
                     is_geo_enrichment = True
-                    break
+                elif mutator_name == "nslookup":
+                    is_nslookup_enrichment = True
+
+            # Skip field transformation for enrichment mutators (they add data, not transform)
+            is_any_enrichment = is_geo_enrichment or is_nslookup_enrichment
 
-            if should_transform_output and not is_geo_enrichment:
+            if should_transform_output and not is_any_enrichment:
                 # Update the result with the mutated value
                 # Use the original field name for the output
                 self._set_field_value(result, requirement.field_name, mutated_value)
-            elif not is_geo_enrichment:
+            elif not is_any_enrichment:
                 # For type-changing mutators with filtering operations, store in temp field
                 temp_field_name = self._get_mutated_field_name(requirement.field_name)
                 self._set_field_value(result, temp_field_name, mutated_value)
@@ -750,6 +755,10 @@ class QueryPostProcessor:
                         if "as" in mutated_value:
                             result["enrichment"]["as"] = mutated_value["as"]
 
+            # Handle nslookup enrichment - the mutator already adds domain/dns via append_to_result
+            # We just need to ensure the original field value is preserved (don't overwrite)
+            # The nslookup mutator's apply() method handles enrichment storage via append_to_result()
+
             return enrichment_mutator_found
 
         except Exception: