3636
3737event_search_grammar = Grammar (
3838 r"""
39- search = (boolean_operator / paren_term / search_term)*
40- boolean_operator = spaces (or_operator / and_operator) spaces
41- paren_term = spaces open_paren spaces (paren_term / boolean_operator / search_term)+ spaces closed_paren spaces
42- search_term = key_val_term / quoted_raw_search / raw_search
43- key_val_term = spaces (time_filter / rel_time_filter / specific_time_filter
44- / duration_filter / boolean_filter / numeric_filter
45- / aggregate_filter / aggregate_date_filter / aggregate_rel_date_filter
46- / has_filter / is_filter / text_filter)
47- spaces
48- raw_search = (!key_val_term ~r"\ *(?!(?i)OR(?![^\s]))(?!(?i)AND(?![^\s]))([^\ ^\n ()]+)\ *" )*
49- quoted_raw_search = spaces quoted_value spaces
39+ search = (boolean_operator / paren_term / search_term)*
40+
41+ boolean_operator = spaces (or_operator / and_operator) spaces
42+ paren_term = spaces open_paren spaces (paren_term / boolean_operator / search_term)+ spaces closed_paren spaces
43+ search_term = key_val_term / free_text_quoted / free_text
44+
45+ free_text = (!key_val_term ~r"\ *(?!(?i)OR(?![^\s]))(?!(?i)AND(?![^\s]))([^\ ^\n ()]+)\ *" )*
46+ free_text_quoted = spaces quoted_value spaces
47+
48+ # All key:value filter types
49+ key_val_term = spaces key_val_filter spaces
50+ key_val_filter = time_filter
51+ / rel_time_filter
52+ / specific_time_filter
53+ / duration_filter
54+ / boolean_filter
55+ / numeric_filter
56+ / aggregate_filter
57+ / aggregate_date_filter
58+ / aggregate_rel_date_filter
59+ / has_filter
60+ / is_filter
61+ / text_filter
5062
5163# standard key:val filter
5264text_filter = negation? text_key sep ((open_bracket text_value (comma spaces text_value)* closed_bracket) / search_value)
91103explicit_tag_key = "tags" open_bracket search_key closed_bracket
92104text_key = explicit_tag_key / search_key
93105text_value = quoted_value / in_value
94-
95- # Explanation of quoted string regex
96- # " # literal quote
97- # ( # begin capture group
98- # (?: # begin uncaptured group
99- # \\\" # A \", where both the \ and " are escaped
100- # | # or
101- # [^"] # any character that's not quote
102- # ) # end uncaptured group
103- # * # repeat the uncaptured group
104- # ) # end captured group
105- # ? # allow to be empty (allow empty quotes)
106- # " # quote literal
107- quoted_value = ~r"\"((?:\\\"|[^\"])*)?\""s
106+ quoted_value = ~r"\"((?:\\\"|[^\"])*)?\""s
108107
109108# Formats
110109iso_8601_date_format = ~r"(\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}:\d{2}(\.\d{1,6})?)?(Z|([+-]\d{2}:\d{2}))?)(?=\s|\)|$)"
@@ -293,7 +292,7 @@ def key_mappings_lookup(self):
293292
294293 def flatten (self , children ):
295294 def _flatten (seq ):
296- # there is a list from search_term and one from raw_search , so flatten them.
295+ # there is a list from search_term and one from free_text , so flatten them.
297296 # Flatten each group in the list, since nodes can return multiple items
298297 for item in seq :
299298 if isinstance (item , list ):
@@ -340,14 +339,14 @@ def visit_key_val_term(self, node, children):
340339 # key_val_term is a list because of group
341340 return key_val_term [0 ]
342341
343- def visit_raw_search (self , node , children ):
342+ def visit_free_text (self , node , children ):
344343 value = node .text .strip (" " )
345344 if not value :
346345 return None
347346
348347 return SearchFilter (SearchKey ("message" ), "=" , SearchValue (value ))
349348
350- def visit_quoted_raw_search (self , node , children ):
349+ def visit_free_text_quoted (self , node , children ):
351350 value = children [1 ]
352351 if not value :
353352 return None
@@ -356,7 +355,7 @@ def visit_quoted_raw_search(self, node, children):
356355 def visit_paren_term (self , node , children ):
357356 if not self .allow_boolean :
358357 # It's possible to have a valid search that includes parens, so we can't just error out when we find a paren expression.
359- return self .visit_raw_search (node , children )
358+ return self .visit_free_text (node , children )
360359
361360 children = self .remove_space (self .remove_optional_nodes (self .flatten (children )))
362361 children = self .flatten (children [1 ])
0 commit comments