/// <inheritdoc/>
public void Visit(CardinalityAggregation cardinalityAggregation)
{
Ensure.IsNotNull(cardinalityAggregation, nameof(cardinalityAggregation));
EnsureClause.StringIsNotNullOrEmpty(cardinalityAggregation.FieldName, cardinalityAggregation.FieldName, ExceptionMessage);
cardinalityAggregation.KustoQL = $"{KustoQLOperators.DCount}({cardinalityAggregation.FieldName})";
}
/// <inheritdoc/>
public void Visit(AvgAggregation avgAggregation)
{
Ensure.IsNotNull(avgAggregation, nameof(avgAggregation));
EnsureClause.StringIsNotNullOrEmpty(avgAggregation.FieldName, avgAggregation.FieldName, ExceptionMessage);
avgAggregation.KustoQL = $"{KustoQLOperators.Avg}({avgAggregation.FieldName})";
}
/// <inheritdoc/>
public void Visit(ExistsClause existsClause)
{
Ensure.IsNotNull(existsClause, nameof(existsClause));
EnsureClause.StringIsNotNullOrEmpty(existsClause.FieldName, nameof(existsClause.FieldName));
existsClause.KustoQL = $"{KustoQLOperators.IsNotNull}({existsClause.FieldName})";
}
/// <inheritdoc/>
public void Visit(Query query)
{
Ensure.IsNotNull(query, nameof(query));
EnsureClause.IsNotNull(query.Bool, nameof(query.Bool));
query.Bool.Accept(this);
query.KustoQL = !string.IsNullOrEmpty(query.Bool.KustoQL) ? $"{KustoQLOperators.Where} {query.Bool.KustoQL}" : string.Empty;
}
/// <inheritdoc/>
public void Visit(MatchPhraseClause matchPhraseClause)
{
Ensure.IsNotNull(matchPhraseClause, nameof(matchPhraseClause));
// Must have a field name
EnsureClause.StringIsNotNullOrEmpty(matchPhraseClause.FieldName, nameof(matchPhraseClause.FieldName));
matchPhraseClause.KustoQL = $"{matchPhraseClause.FieldName} {KustoQLOperators.Equal} \"{matchPhraseClause.Phrase}\"";
}
/// <inheritdoc/>
public void Visit(DateHistogramAggregation dateHistogramAggregation)
{
Ensure.IsNotNull(dateHistogramAggregation, nameof(dateHistogramAggregation));
EnsureClause.StringIsNotNullOrEmpty(dateHistogramAggregation.Metric, nameof(dateHistogramAggregation.Metric));
EnsureClause.StringIsNotNullOrEmpty(dateHistogramAggregation.FieldName, nameof(dateHistogramAggregation.FieldName));
dateHistogramAggregation.KustoQL =
$"{dateHistogramAggregation.Metric} by {dateHistogramAggregation.FieldName} = ";
if (!string.IsNullOrEmpty(dateHistogramAggregation.Interval))
{
var period = dateHistogramAggregation.Interval[^ 1];
public void Visit(RangeClause rangeClause)
{
Ensure.IsNotNull(rangeClause, nameof(rangeClause));
EnsureClause.StringIsNotNullOrEmpty(rangeClause.FieldName, nameof(rangeClause.FieldName));
EnsureClause.IsNotNull(rangeClause.GTEValue, nameof(rangeClause.GTEValue));
// format used by Kibana 6
if (rangeClause.Format == "epoch_millis")
{
// default time filter through a rangeClause query uses epoch times with GTE+LTE
EnsureClause.IsNotNull(rangeClause.LTEValue, nameof(rangeClause.LTEValue));
rangeClause.KustoQL = $"{rangeClause.FieldName} >= unixtime_milliseconds_todatetime({rangeClause.GTEValue}) {KustoQLOperators.And} {rangeClause.FieldName} <= unixtime_milliseconds_todatetime({rangeClause.LTEValue})";
}
// format used by Kibana 7
else if (rangeClause.Format == "strict_date_optional_time")
{
// default time filter through a rangeClause query uses epoch times with GTE+LTE
EnsureClause.IsNotNull(rangeClause.LTEValue, nameof(rangeClause.LTEValue));
var gte = DateTime.Parse(rangeClause.GTEValue).ToUniversalTime().ToString("o");
var lte = DateTime.Parse(rangeClause.LTEValue).ToUniversalTime().ToString("o");
rangeClause.KustoQL = $"{rangeClause.FieldName} >= {KustoQLOperators.ToDateTime}(\"{gte}\") {KustoQLOperators.And} {rangeClause.FieldName} <= {KustoQLOperators.ToDateTime}(\"{lte}\")";
}
else
{
// general "is between" filter on numeric fields uses a rangeClause query with GTE+LT (not LTE like above)
EnsureClause.IsNotNull(rangeClause.LTValue, nameof(rangeClause.LTValue));
var t = ClauseFieldTypeProcessor.GetType(schemaRetriever, rangeClause.FieldName).Result;
switch (t)
{
case ClauseFieldType.Numeric:
rangeClause.KustoQL = $"{rangeClause.FieldName} >= {rangeClause.GTEValue} and {rangeClause.FieldName} < {rangeClause.LTValue}";
break;
case ClauseFieldType.Date:
rangeClause.KustoQL = $"{rangeClause.FieldName} >= {KustoQLOperators.ToDateTime}(\"{rangeClause.GTEValue}\") {KustoQLOperators.And} {rangeClause.FieldName} < {KustoQLOperators.ToDateTime}(\"{rangeClause.LTValue}\")";
break;
case ClauseFieldType.Text:
throw new NotSupportedException("Text Range is not supported.");
case ClauseFieldType.Unknown:
throw new Exception($"Field name {rangeClause.FieldName} has an unknown type.");
}
}
}
/// <inheritdoc/>
public void Visit(MatchPhraseClause matchPhraseClause)
{
Ensure.IsNotNull(matchPhraseClause, nameof(matchPhraseClause));
// Must have a field name
EnsureClause.StringIsNotNullOrEmpty(matchPhraseClause.FieldName, nameof(matchPhraseClause.FieldName));
if (matchPhraseClause.Phrase != null)
{
matchPhraseClause.KustoQL = $"{matchPhraseClause.FieldName} {KustoQLOperators.Equal} \"{matchPhraseClause.Phrase.EscapeSlashes()}\"";
return;
}
matchPhraseClause.KustoQL = $"{matchPhraseClause.FieldName} {KustoQLOperators.Equal} \"\"";
}
/// <inheritdoc/>
public void Visit(SortClause sortClause)
{
Ensure.IsNotNull(sortClause, nameof(sortClause));
Ensure.IsNotNull(sortClause, nameof(sortClause));
EnsureClause.StringIsNotNullOrEmpty(sortClause.FieldName, nameof(sortClause.FieldName));
if (sortClause.FieldName.StartsWith('_'))
{
// fields that start with "_" are internal to elastic and we want to disregard them
sortClause.KustoQL = string.Empty;
}
else
{
EnsureClause.StringIsNotNullOrEmpty(sortClause.Order, nameof(sortClause.Order));
sortClause.KustoQL = $"{sortClause.FieldName} {sortClause.Order}";
}
}
/// <inheritdoc/>
public void Visit(RangeClause rangeClause)
{
Ensure.IsNotNull(rangeClause, nameof(rangeClause));
EnsureClause.StringIsNotNullOrEmpty(rangeClause.FieldName, nameof(rangeClause.FieldName));
EnsureClause.IsNotNull(rangeClause.GTEValue, nameof(rangeClause.GTEValue));
if (rangeClause.Format == "epoch_millis")
{
// default time filter through a rangeClause query uses epoch times with GTE+LTE
EnsureClause.IsNotNull(rangeClause.LTEValue, nameof(rangeClause.LTEValue));
rangeClause.KustoQL = $"{rangeClause.FieldName} >= fromUnixTimeMilli({rangeClause.GTEValue}) {KustoQLOperators.And} {rangeClause.FieldName} <= fromUnixTimeMilli({rangeClause.LTEValue})";
}
else
{
// general "is between" filter on numeric fields uses a rangeClause query with GTE+LT (not LTE like above)
EnsureClause.IsNotNull(rangeClause.LTValue, nameof(rangeClause.LTValue));
rangeClause.KustoQL = $"{rangeClause.FieldName} >= {rangeClause.GTEValue} and {rangeClause.FieldName} < {rangeClause.LTValue}";
}
}
public void Visit(RangeClause rangeClause)
{
Ensure.IsNotNull(rangeClause, nameof(rangeClause));
EnsureClause.StringIsNotNullOrEmpty(rangeClause.FieldName, nameof(rangeClause.FieldName));
EnsureClause.IsNotNull(rangeClause.GTEValue, nameof(rangeClause.GTEValue));
if (rangeClause.Format == "epoch_millis")
{
// default time filter through a rangeClause query uses epoch times with GTE+LTE
EnsureClause.IsNotNull(rangeClause.LTEValue, nameof(rangeClause.LTEValue));
rangeClause.KustoQL = $"{rangeClause.FieldName} >= fromUnixTimeMilli({rangeClause.GTEValue}) {KustoQLOperators.And} {rangeClause.FieldName} <= fromUnixTimeMilli({rangeClause.LTEValue})";
}
else
{
// general "is between" filter on numeric fields uses a rangeClause query with GTE+LT (not LTE like above)
EnsureClause.IsNotNull(rangeClause.LTValue, nameof(rangeClause.LTValue));
var t = ClauseFieldTypeProcessor.GetType(schemaRetriever, rangeClause.FieldName).Result;
switch (t)
{
case ClauseFieldType.Numeric:
rangeClause.KustoQL = $"{rangeClause.FieldName} >= {rangeClause.GTEValue} and {rangeClause.FieldName} < {rangeClause.LTValue}";
break;
case ClauseFieldType.Date:
rangeClause.KustoQL = $"{rangeClause.FieldName} >= todatetime('{rangeClause.GTEValue}') and {rangeClause.FieldName} < todatetime('{rangeClause.LTValue}')";
break;
case ClauseFieldType.Text:
throw new NotSupportedException("Text Range is not supported.");
case ClauseFieldType.Unknown:
throw new Exception($"Field name {rangeClause.FieldName} has an unknown type.");
}
}
}
