Converts a parse tree to an intermediate AST which is a little easier to analyze and work with. This is the AST we use for optimization and which is passed to various query compilers. Turns literals into their equivalent JVM types, and eliminates some unnecessary parser structure.

Takes a string to a general AST.

Rewrites predicates with and/or/not to normal Clojure forms.

Rewrites binary expressions from infix to prefix. Takes a symbol (e.g. '=) and a 3-element seq like (1 "=" 2) and emits (= 1 2), ignoring the middle term and transforming t1 and t2.

Takes a type of match (:like or :regex), a list of three string terms: an AST resolving to a string, the literal =~ (ignored), and a pattern. Returns (:regex pattern string-ast).

For :regex matches, emits a regular expression pattern. For :like matches, emits a string pattern.

Rewrites an AST to eval-able Clojure forms.

Takes a keyword field name and emits an expression to extract that field from an ’event map, e.g. (:fieldname event).

Like prefix, but inserts a predicate check around both terms.

Takes a pattern transformer, and a list of pattern string-ast, and emits code to match the string-ast’s results with a regex match, compiling pattern with pattern-transformer.

Takes a tag and emits an expression to match that tag in an event.

Transforms an AST into a fn event which returns true if the query matches that event. Example:

(def q (fun (ast "metric > 2")))
(q {:metric 1}) => false
(q {:metric 3}) => true

Speeds up the compilation of queries by caching map of ASTs to corresponding functions.

Convert a string like “foo%” into /^foo.*$/