elastic / elastic/detection-rules
Review EQL schema generation logic to minimize duplication
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 696
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 87
Description
## Issues
https://github.com/elastic/detection-rules/pull/2257#discussion_r998641937
## Summary
Within detection-rules, more schema validation requires more instantiations of `eql.Schema`. There may be a way to make the subclass more generic which can replace all existing implementations.
```python
class EndgameSchema(eql.Schema):
"""Endgame schema for query validation."""
type_mapping = {
```
If we can collapse the logic, then we also will no longer have to check types:
```python
def text_fields(self, eql_schema: Union[ecs.KqlSchema2Eql, endgame.EndgameSchema]) -> List[str]:
"""Return a list of fields of type text."""
from kql.parser import elasticsearch_type_family
schema = eql_schema.kql_schema if isinstance(eql_schema, ecs.KqlSchema2Eql) else eql_schema.endgame_schema
```
Contributor guide
Assessment
This issue has not been assessed yet.