elastic / elastic/detection-rules

Review EQL schema generation logic to minimize duplication

Open
#2,370 0 comments 0 reactions 0 assignees View on GitHub
backlog schema
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

## Issues

https://github.com/elastic/detection-rules/pull/2257#discussion_r998641937

## Summary

Within detection-rules, more schema validation requires more instantiations of `eql.Schema`. There may be a way to make the subclass more generic which can replace all existing implementations.

```python
class EndgameSchema(eql.Schema):
"""Endgame schema for query validation."""

type_mapping = {
```

If we can collapse the logic, then we also will no longer have to check types:

```python

def text_fields(self, eql_schema: Union[ecs.KqlSchema2Eql, endgame.EndgameSchema]) -> List[str]:
"""Return a list of fields of type text."""
from kql.parser import elasticsearch_type_family
schema = eql_schema.kql_schema if isinstance(eql_schema, ecs.KqlSchema2Eql) else eql_schema.endgame_schema

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.