-
Notifications
You must be signed in to change notification settings - Fork 591
Open
Labels
backlogbugSomething isn't workingSomething isn't workingkqlrelated to the kql modulerelated to the kql modulepythonInternal python for the repositoryInternal python for the repository
Description
Describe the bug
Unquoted leading /
must be escaped in KQL, since this is used for regex syntax with lucene
This
process.args:/lockscreenurl\:http*
should become
`"\\/lockscreenurl\\:http*"`
to mimic expected DSL conversion
but instead it is converted to
`"/lockscreenurl\\:http*"`
To Reproduce
Steps to reproduce the behavior:
- search
process.args:/lockscreenurl\:http*
in kibana - this is converted to:
"\\/lockscreenurl\\:http*"
- run
kql.to_dsl("process.args:/lockscreenurl\:http*")
4 compare diffs
Metadata
Metadata
Assignees
Labels
backlogbugSomething isn't workingSomething isn't workingkqlrelated to the kql modulerelated to the kql modulepythonInternal python for the repositoryInternal python for the repository