5050}
5151
5252
53-
5453class CortexXQLFieldValueRender (BaseFieldValueRender ):
5554 details : PlatformDetails = cortex_xql_query_details
5655 str_value_manager = cortex_xql_str_value_manager
@@ -72,7 +71,8 @@ def _wrap_str_value(value: str) -> str:
7271 def equal_modifier (self , field : str , value : DEFAULT_VALUE_TYPE ) -> str :
7372 if isinstance (value , list ):
7473 values = ", " .join (
75- f"{ self ._pre_process_value (field , v , value_type = ValueType .value , wrap_str = True )} " for v in value
74+ f"{ self ._pre_process_value (field , str (v ) if isinstance (v , int ) else v , ValueType .value , True )} "
75+ for v in value
7676 )
7777 return f"{ field } in ({ values } )"
7878
@@ -123,7 +123,11 @@ def startswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
123123 def regex_modifier (self , field : str , value : DEFAULT_VALUE_TYPE ) -> str :
124124 if isinstance (value , list ):
125125 return f"({ self .or_token .join (self .regex_modifier (field = field , value = v ) for v in value )} )"
126- return f"{ field } ~= { self ._pre_process_value (field ,value , value_type = ValueType .regex_value , wrap_str = True )} "
126+ value = self ._pre_process_value (field , value , value_type = ValueType .regex_value , wrap_str = True )
127+ if value .endswith ('\\ \\ "' ):
128+ value = value [:- 1 ] + "]" + value [- 1 :]
129+ value = value [:- 4 ] + "[" + value [- 4 :]
130+ return f"{ field } ~= { value } "
127131
128132 def not_regex_modifier (self , field : str , value : DEFAULT_VALUE_TYPE ) -> str :
129133 if isinstance (value , list ):
0 commit comments