in geneve/events_emitter_eql.py [0:0]
def cc_subquery_by(node: eql.ast.SubqueryBy, negate: bool, max_branches: int) -> List[Tuple[Document, List[str]]]:
if negate:
raise NotImplementedError(f"Negation of {type(node)} is not supported")
if any(not isinstance(value, eql.ast.Field) for value in node.join_values):
raise NotImplementedError(f"Unsupported join values: {node.join_values}")
if node.data:
if node.data.get("fork", False):
raise NotImplementedError(f"Unsupported fork: {node.data}")
if node.data.get("is_negated", False):
raise NotImplementedError(f"Unsupported is_negated: {node.data}")
join_fields = [field.render() for field in node.join_values]
return [[(doc, join_fields) for doc in branch] for branch in collect_constraints(node.query, negate, max_branches)]