From 365ba273554e3731634614d18ef106e15068dd76 Mon Sep 17 00:00:00 2001 From: Alexander Marshalov Date: Tue, 2 Dec 2025 18:59:16 +0100 Subject: [PATCH] fixed quotation bug for filters --- lib/logsql/select.go | 2 +- lib/logsql/select_test.go | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/lib/logsql/select.go b/lib/logsql/select.go index 7e1677a..a7e86c5 100644 --- a/lib/logsql/select.go +++ b/lib/logsql/select.go @@ -3458,7 +3458,7 @@ func formatWildcard(val string) string { func needsQuoteForPattern(val string) bool { for _, r := range val { - if r != '*' && r != '_' && r != '-' && r != ':' && r != '/' && r != '.' && (r < '0' || r > '9') && (r < 'A' || r > 'Z') && (r < 'a' || r > 'z') { + if r != '*' && r != '_' && r != '-' && r != ':' && (r < '0' || r > '9') && (r < 'A' || r > 'Z') && (r < 'a' || r > 'z') { return true } } diff --git a/lib/logsql/select_test.go b/lib/logsql/select_test.go index 8a79257..043eb44 100644 --- a/lib/logsql/select_test.go +++ b/lib/logsql/select_test.go @@ -246,6 +246,11 @@ func TestToLogsQLSuccess(t *testing.T) { sql: "SELECT * FROM logs WHERE message LIKE '_foo'", expected: "message:~\"^.foo$\"", }, + { + name: "like suffix paths with dots", + sql: "SELECT * FROM logs WHERE RequestPath LIKE '%/favicon.ico' OR RequestPath LIKE '%index.html'", + expected: "(RequestPath:\"*/favicon.ico\" OR RequestPath:\"*index.html\")", + }, { name: "compare fields equality", sql: "SELECT * FROM logs WHERE user_id = customer_id", @@ -342,6 +347,11 @@ END AS severity FROM logs`, sql: "SELECT CASE level WHEN 'error' THEN 'critical' WHEN 'warn' THEN 'warning' ELSE 'info' END AS sev FROM logs", expected: "* | format \"info\" as sev | format if (level:warn) \"warning\" as sev | format if (level:error) \"critical\" as sev | fields sev", }, + { + name: "case expression with like wildcard", + sql: "SELECT ResponseStatus, CASE WHEN RequestPath LIKE ('%/foo') THEN 'foo' ELSE 'unknown' END AS MyType FROM logs", + expected: "* | format \"unknown\" as MyType | format if (RequestPath:\"*/foo\") \"foo\" as MyType | fields ResponseStatus, MyType", + }, { name: "json value simple path with alias", sql: "SELECT JSON_VALUE(payload, '$.ip') AS ip FROM logs",