Class CIDRMatch
- All Implemented Interfaces:
NamedWriteable,Writeable,TranslationAware,TranslationAware.SingleValueTranslationAware,Resolvable,EvaluatorMapper
- a string literal;
- a field of type keyword;
- a function outputting a keyword.
The function will match if the IP parameter is within any (not all) of the ranges defined by the provided CIDR specs.
Example: `| eval cidr="10.0.0.0/8" | where cidr_match(ip_field, "127.0.0.1/30", cidr)`
-
Nested Class Summary
Nested classes/interfaces inherited from class org.elasticsearch.xpack.esql.core.expression.Expression
Expression.TypeResolutionNested classes/interfaces inherited from interface org.elasticsearch.xpack.esql.evaluator.mapper.EvaluatorMapper
EvaluatorMapper.ToEvaluatorNested classes/interfaces inherited from interface org.elasticsearch.xpack.esql.capabilities.TranslationAware
TranslationAware.FinishedTranslatable, TranslationAware.SingleValueTranslationAware, TranslationAware.TranslatableNested classes/interfaces inherited from interface org.elasticsearch.common.io.stream.Writeable
Writeable.Reader<V>, Writeable.Writer<V> -
Field Summary
FieldsFields inherited from class org.elasticsearch.xpack.esql.core.expression.function.scalar.ScalarFunction
MAX_BYTES_REF_RESULT_SIZE -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionasQuery(LucenePushdownPredicates pushdownPredicates, TranslatorHandler handler) Translates the implementing expression into a Query.dataType()booleanfoldable()protected NodeInfo<? extends Expression> info()ipField()matches()replaceChildren(List<Expression> newChildren) protected Expression.TypeResolutionReturns the field that only supports single-value semantics.toEvaluator(EvaluatorMapper.ToEvaluator toEvaluator) Convert this into anEvalOperator.ExpressionEvaluator.translatable(LucenePushdownPredicates pushdownPredicates) Can this instance be translated or not? Usually checks whether the expression arguments are actual fields that exist in Lucene.voidwriteTo(StreamOutput out) Methods inherited from class org.elasticsearch.xpack.esql.expression.function.scalar.EsqlScalarFunction
foldMethods inherited from class org.elasticsearch.xpack.esql.core.expression.function.Function
arguments, equals, functionName, hashCode, nodeString, nullableMethods inherited from class org.elasticsearch.xpack.esql.core.expression.Expression
canonical, canonicalize, childrenResolved, propertiesToString, references, resolved, semanticEquals, semanticHash, toString, typeResolvedMethods inherited from class org.elasticsearch.xpack.esql.core.tree.Node
anyMatch, children, collect, collectFirstChildren, collectLeaves, doCollectFirst, forEachDown, forEachDown, forEachProperty, forEachPropertyDown, forEachPropertyOnly, forEachPropertyUp, forEachUp, forEachUp, nodeName, nodeProperties, replaceChildrenSameSize, source, sourceLocation, sourceText, transformChildren, transformDown, transformDown, transformDown, transformNodeProps, transformPropertiesDown, transformPropertiesOnly, transformPropertiesUp, transformUp, transformUp, transformUpMethods inherited from class java.lang.Object
clone, finalize, getClass, notify, notifyAll, wait, wait, waitMethods inherited from interface org.elasticsearch.xpack.esql.evaluator.mapper.EvaluatorMapper
foldMethods inherited from interface org.elasticsearch.xpack.esql.capabilities.TranslationAware
asLuceneQuery
-
Field Details
-
ENTRY
-
-
Constructor Details
-
CIDRMatch
-
-
Method Details
-
writeTo
- Specified by:
writeToin interfaceWriteable- Throws:
IOException
-
getWriteableName
- Specified by:
getWriteableNamein interfaceNamedWriteable
-
ipField
-
matches
-
foldable
public boolean foldable()- Overrides:
foldablein classExpression
-
toEvaluator
public EvalOperator.ExpressionEvaluator.Factory toEvaluator(EvaluatorMapper.ToEvaluator toEvaluator) Description copied from interface:EvaluatorMapperConvert this into anEvalOperator.ExpressionEvaluator.Note for implementors: If you are implementing this function, you should call the passed-in lambda on your children, after doing any other manipulation (casting, etc.) necessary.
Note for Callers: If you are attempting to call this method, and you have an
Expressionand aLayout, you likely want to callEvalMapper.toEvaluator(org.elasticsearch.xpack.esql.core.expression.FoldContext, org.elasticsearch.xpack.esql.core.expression.Expression, org.elasticsearch.xpack.esql.planner.Layout)instead. On the other hand, if you already have something that looks like the parameter for this method, you should call this method with that function.Build an
EvalOperator.ExpressionEvaluator.Factoryfor the tree of expressions rooted at this node. This is only guaranteed to return a sensible evaluator if this node has a valid type. If this node is a subclass ofExpressionthen "valid type" means thatExpression.typeResolved()returns a non-error resolution. If Expression.typeResolved() returns an error then this method may throw. Or return an evaluator that produces garbage. Or return an evaluator that throws when run.- Specified by:
toEvaluatorin interfaceEvaluatorMapper
-
dataType
- Specified by:
dataTypein classExpression
-
resolveType
- Overrides:
resolveTypein classExpression
-
replaceChildren
- Specified by:
replaceChildrenin classNode<Expression>
-
info
- Specified by:
infoin classNode<Expression>
-
translatable
Description copied from interface:TranslationAwareCan this instance be translated or not? Usually checks whether the expression arguments are actual fields that exist in Lucene. SeeTranslationAware.Translatablefor precisely what can be signaled from this method.- Specified by:
translatablein interfaceTranslationAware
-
asQuery
Description copied from interface:TranslationAwareTranslates the implementing expression into a Query. If during translation a child needs to be translated first, the handler needs to be used even if the child implements this interface as well. This is to ensure that the child is wrapped in a SingleValueQuery if necessary.So use this:
Query childQuery = handler.asQuery(child);and not this:
Query childQuery = child.asQuery(handler);- Specified by:
asQueryin interfaceTranslationAware
-
singleValueField
Description copied from interface:TranslationAware.SingleValueTranslationAwareReturns the field that only supports single-value semantics.- Specified by:
singleValueFieldin interfaceTranslationAware.SingleValueTranslationAware
-