1616limitations under the License.
1717-----------------------------------------------------------------
1818"""
19- from typing import Optional ,Union
19+ from typing import ClassVar , Optional ,Union
2020
2121from app .translator .const import DEFAULT_VALUE_TYPE
2222from app .translator .core .custom_types .values import ValueType
@@ -136,12 +136,12 @@ class CortexXQLQueryRender(PlatformQueryRender):
136136details :PlatformDetails = cortex_xql_query_details
137137mappings :CortexXQLMappings = cortex_xql_mappings
138138is_strict_mapping = True
139- raw_log_field_pattern_map = {
140- ' regex' '| alter {field} = regextract(to_json_string(action_evtlog_data_fields)->{field}{{}}, "\\ "(.*)\\ "")' ,
141- ' object' '| alter {field_name} = json_extract_scalar({field_object} , "$.{field_path}")' ,
142- ' list' '| alter {field_name} = arraystring(json_extract_array({field_object} , "$.{field_path}")," ")'
139+ raw_log_field_pattern_map : ClassVar [ dict [ str , str ]] = {
140+ " regex" '| alter {field} = regextract(to_json_string(action_evtlog_data_fields)->{field}{{}}, "\\ "(.*)\\ "")' ,
141+ " object" '| alter {field_name} = json_extract_scalar({field_object} , "$.{field_path}")' ,
142+ " list" '| alter {field_name} = arraystring(json_extract_array({field_object} , "$.{field_path}")," ")' ,
143143 }
144- platform_functions :CortexXQLFunctions = cortex_xql_functions
144+ platform_functions :CortexXQLFunctions = None
145145
146146or_token = "or"
147147and_token = "and"
@@ -152,9 +152,9 @@ class CortexXQLQueryRender(PlatformQueryRender):
152152comment_symbol = "//"
153153is_single_line_comment = False
154154
155- def __init__ (self ):
156- super (). __init__ ()
157- self .platform_functions .manager . post_init_configure ( self )
155+ def init_platform_functions (self )-> None :
156+ self . platform_functions = cortex_xql_functions
157+ self .platform_functions .platform_query_render = self
158158
159159def process_raw_log_field (self ,field :str ,field_type :str )-> Optional [str ]:
160160raw_log_field_pattern = self .raw_log_field_pattern_map .get (field_type )