private async Task <bool> GetIsFieldNumeric(string fieldName)
{
Ensure.IsNotNullOrEmpty(fieldName, nameof(fieldName));
var fieldType = await ClauseFieldTypeProcessor.GetType(schemaRetriever, fieldName);
return(fieldType == ClauseFieldType.Numeric);
}
public void Visit(RangeClause rangeClause)
{
Ensure.IsNotNull(rangeClause, nameof(rangeClause));
EnsureClause.StringIsNotNullOrEmpty(rangeClause.FieldName, nameof(rangeClause.FieldName));
EnsureClause.IsNotNull(rangeClause.GTEValue, nameof(rangeClause.GTEValue));
// format used by Kibana 6
if (rangeClause.Format == "epoch_millis")
{
// default time filter through a rangeClause query uses epoch times with GTE+LTE
EnsureClause.IsNotNull(rangeClause.LTEValue, nameof(rangeClause.LTEValue));
rangeClause.KustoQL = $"{rangeClause.FieldName} >= unixtime_milliseconds_todatetime({rangeClause.GTEValue}) {KustoQLOperators.And} {rangeClause.FieldName} <= unixtime_milliseconds_todatetime({rangeClause.LTEValue})";
}
// format used by Kibana 7
else if (rangeClause.Format == "strict_date_optional_time")
{
// default time filter through a rangeClause query uses epoch times with GTE+LTE
EnsureClause.IsNotNull(rangeClause.LTEValue, nameof(rangeClause.LTEValue));
var gte = DateTime.Parse(rangeClause.GTEValue).ToUniversalTime().ToString("o");
var lte = DateTime.Parse(rangeClause.LTEValue).ToUniversalTime().ToString("o");
rangeClause.KustoQL = $"{rangeClause.FieldName} >= {KustoQLOperators.ToDateTime}(\"{gte}\") {KustoQLOperators.And} {rangeClause.FieldName} <= {KustoQLOperators.ToDateTime}(\"{lte}\")";
}
else
{
// general "is between" filter on numeric fields uses a rangeClause query with GTE+LT (not LTE like above)
EnsureClause.IsNotNull(rangeClause.LTValue, nameof(rangeClause.LTValue));
var t = ClauseFieldTypeProcessor.GetType(schemaRetriever, rangeClause.FieldName).Result;
switch (t)
{
case ClauseFieldType.Numeric:
rangeClause.KustoQL = $"{rangeClause.FieldName} >= {rangeClause.GTEValue} and {rangeClause.FieldName} < {rangeClause.LTValue}";
break;
case ClauseFieldType.Date:
rangeClause.KustoQL = $"{rangeClause.FieldName} >= {KustoQLOperators.ToDateTime}(\"{rangeClause.GTEValue}\") {KustoQLOperators.And} {rangeClause.FieldName} < {KustoQLOperators.ToDateTime}(\"{rangeClause.LTValue}\")";
break;
case ClauseFieldType.Text:
throw new NotSupportedException("Text Range is not supported.");
case ClauseFieldType.Unknown:
throw new Exception($"Field name {rangeClause.FieldName} has an unknown type.");
}
}
}
public void Visit(RangeClause rangeClause)
{
Ensure.IsNotNull(rangeClause, nameof(rangeClause));
EnsureClause.StringIsNotNullOrEmpty(rangeClause.FieldName, nameof(rangeClause.FieldName));
EnsureClause.IsNotNull(rangeClause.GTEValue, nameof(rangeClause.GTEValue));
if (rangeClause.Format == "epoch_millis")
{
// default time filter through a rangeClause query uses epoch times with GTE+LTE
EnsureClause.IsNotNull(rangeClause.LTEValue, nameof(rangeClause.LTEValue));
rangeClause.KustoQL = $"{rangeClause.FieldName} >= fromUnixTimeMilli({rangeClause.GTEValue}) {KustoQLOperators.And} {rangeClause.FieldName} <= fromUnixTimeMilli({rangeClause.LTEValue})";
}
else
{
// general "is between" filter on numeric fields uses a rangeClause query with GTE+LT (not LTE like above)
EnsureClause.IsNotNull(rangeClause.LTValue, nameof(rangeClause.LTValue));
var t = ClauseFieldTypeProcessor.GetType(schemaRetriever, rangeClause.FieldName).Result;
switch (t)
{
case ClauseFieldType.Numeric:
rangeClause.KustoQL = $"{rangeClause.FieldName} >= {rangeClause.GTEValue} and {rangeClause.FieldName} < {rangeClause.LTValue}";
break;
case ClauseFieldType.Date:
rangeClause.KustoQL = $"{rangeClause.FieldName} >= todatetime('{rangeClause.GTEValue}') and {rangeClause.FieldName} < todatetime('{rangeClause.LTValue}')";
break;
case ClauseFieldType.Text:
throw new NotSupportedException("Text Range is not supported.");
case ClauseFieldType.Unknown:
throw new Exception($"Field name {rangeClause.FieldName} has an unknown type.");
}
}
}
