in geneve/kql/eql2kql.py [0:0]
def _walk_comparison(self, tree): # type: (eql.ast.Comparison) -> KqlNode
left = tree.left
op = tree.comparator
right = tree.right
# move the literal to the right
if isinstance(left, eql.ast.Literal):
left, right = right, left
op = self.flipped[op]
if isinstance(left, Field) and isinstance(right, Value):
if op == eql.ast.Comparison.EQ:
return FieldComparison(left, right)
elif op == eql.ast.Comparison.NE:
return NotExpr(FieldComparison(left, right))
else:
return FieldRange(left, op, right)
raise eql.errors.EqlCompileError("Unable to convert {}".format(tree))