in msticpy/data/sql_to_kql.py [0:0]
def _parse_expression(expression): # noqa: MC0001
"""Return parsed expression."""
if _is_literal(expression)[0]:
return _quote_literal(expression)
if not isinstance(expression, dict):
return expression
if AND in expression:
return "\n and ".join([_parse_expression(expr) for expr in expression[AND]])
if OR in expression:
return "\n or ".join([_parse_expression(expr) for expr in expression[OR]])
if NOT in expression:
return f" not ({_parse_expression(expression[NOT])})"
if BETWEEN in expression:
args = expression[BETWEEN]
betw_expr = f"{_parse_expression(args[1])} .. {_parse_expression(args[2])}"
return f"{args[0]} between ({betw_expr})"
if NOT_BETWEEN in expression:
args = expression[NOT_BETWEEN]
betw_expr = f"{_parse_expression(args[1])} .. {_parse_expression(args[2])}"
return f"{args[0]} not between ({betw_expr})"
if IN in expression or NOT_IN in expression:
sql_op = IN if IN in expression else NOT_IN
kql_op = IN if IN in expression else "!in"
args = expression[sql_op]
right = _quote_literal(args[1])
if isinstance(right, list):
_db_print(args[1])
arg_list = ", ".join([str(_parse_expression(l_item)) for l_item in right])
return f"{args[0]} {kql_op} ({arg_list})"
sub_query = "\n".join(_parse_query(right))
return f"{args[0]} {kql_op} ({sub_query})"
# Handle other operators
oper = list(expression.keys())[0] if expression else None
if oper in BINARY_OPS:
right = _parse_expression(expression[oper][1])
left = _parse_expression(expression[oper][0])
return f"{left} {BINARY_OPS[oper]} {right}"
if LIKE in expression:
return _process_like(expression)
# For everything else, assume it's a function
if expression:
func, operand = next(iter(expression.items()))
# set_trace()
return _map_func(func, operand)
return "EXPRESSION {expression} not resolved."