Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EQL: Expand verification tests #52664

Merged
merged 5 commits into from
Feb 24, 2020

Conversation

aleksmaus
Copy link
Contributor

Expand verification tests
Fix some error messaging consistency in EqlParser

Related to #51873

@costin Could you take a look and let me know if this is what you were looking for that github issue.
Thanks!

Fix some error messaging consistency in EqlParser

Related to elastic#51873
@aleksmaus aleksmaus requested review from costin and imotov February 21, 2020 21:17
@aleksmaus aleksmaus added the :Analytics/EQL EQL querying label Feb 21, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-search (:Search/EQL)

@astefan astefan self-requested a review February 24, 2020 08:21
Copy link
Contributor

@astefan astefan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice addition of tests.
I left two comments about MATCH/QUERY predicates inside an error message.

Comment on lines 225 to 226
accept(idxr, "foo where integer_field == " +
"0");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Single line, please.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will update


assertEquals("1:11: Unknown column [endgame.pi], did you mean [endgame.pid]?",
error(idxr, "foo where endgame.pi == 0"));

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please, remove extra empty line.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I kind of liked the one line visual separation between successful and failure cases in here

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This empty line is at the end of the method, before the closing } bracket...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will fix

accept(idxr, "foo where multi_field.raw == 'bar'");

assertEquals("1:11: [multi_field.english == 'bar'] cannot operate on first argument field of data type [text]: " +
"No keyword/multi-field defined exact matches for [english]; define one or use MATCH/QUERY instead",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this error message is wrong, unless EQL plans to support MATCH/QUERY predicates.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aleksmaus please raise an issue and mark it as discuss to get consensus about how we deal with exact matches on analyzed fields - whether we prevent any exact comparison against them or introduce some other type of comparison (inexact matches - say ~=).

error(idxr, "foo where multi_field_ambiguous.normalized == 'bar'"));

assertEquals("1:11: [multi_field_nested.dep_name == 'bar'] cannot operate on first argument field of data type [text]: " +
"No keyword/multi-field defined exact matches for [dep_name]; define one or use MATCH/QUERY instead",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here about MATCH/QUERY predicates.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discussed with Costin, the behavior is correct, the error message can be improved in the context of EQL. Agreed on leaving the test as is and open an "issue" for error messaging improvement for this particular case. Possibly can bring up for discussion for our weekly.

Copy link
Member

@costin costin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks really good. Thanks Aleks!

@aleksmaus aleksmaus marked this pull request as ready for review February 24, 2020 13:56
Copy link
Contributor

@astefan astefan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@aleksmaus aleksmaus merged commit 8e02bc3 into elastic:master Feb 24, 2020
aleksmaus added a commit to aleksmaus/elasticsearch that referenced this pull request Feb 25, 2020
Expand verification tests
Fix some error messaging consistency in EqlParser

Related to elastic#51873
aleksmaus added a commit that referenced this pull request Feb 25, 2020
* EQL: Expand verification tests (#52664)

Expand verification tests
Fix some error messaging consistency in EqlParser

Related to #51873

* Adjust for 7.x compatibility
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
:Analytics/EQL EQL querying
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants