@@ -1010,8 +1010,6 @@ public QueryTokenStream visitScalar_expression(EqlParser.Scalar_expressionContex
1010
1010
return visit (ctx .case_expression ());
1011
1011
} else if (ctx .entity_type_expression () != null ) {
1012
1012
return visit (ctx .entity_type_expression ());
1013
- } else if (ctx .cast_function () != null ) {
1014
- return (visit (ctx .cast_function ()));
1015
1013
}
1016
1014
1017
1015
return QueryTokenStream .empty ();
@@ -1363,8 +1361,8 @@ public QueryTokenStream visitStringComparison(EqlParser.StringComparisonContext
1363
1361
1364
1362
QueryRendererBuilder builder = QueryRenderer .builder ();
1365
1363
1366
- builder .appendExpression (visit (ctx .string_expression (0 )));
1367
- builder .appendExpression (visit (ctx .comparison_operator ()));
1364
+ builder .appendInline (visit (ctx .string_expression (0 )));
1365
+ builder .appendInline (visit (ctx .comparison_operator ()));
1368
1366
1369
1367
if (ctx .string_expression (1 ) != null ) {
1370
1368
builder .appendExpression (visit (ctx .string_expression (1 )));
@@ -1420,7 +1418,7 @@ public QueryTokenStream visitDatetimeComparison(EqlParser.DatetimeComparisonCont
1420
1418
QueryRendererBuilder builder = QueryRenderer .builder ();
1421
1419
1422
1420
builder .appendInline (visit (ctx .datetime_expression (0 )));
1423
- builder .append ( QueryTokens . ventilated (ctx .comparison_operator (). op ));
1421
+ builder .appendInline ( visit (ctx .comparison_operator ()));
1424
1422
1425
1423
if (ctx .datetime_expression (1 ) != null ) {
1426
1424
builder .appendExpression (visit (ctx .datetime_expression (1 )));
@@ -1453,8 +1451,8 @@ public QueryTokenStream visitArithmeticComparison(EqlParser.ArithmeticComparison
1453
1451
1454
1452
QueryRendererBuilder builder = QueryRenderer .builder ();
1455
1453
1456
- builder .appendExpression (visit (ctx .arithmetic_expression (0 )));
1457
- builder .appendExpression (visit (ctx .comparison_operator ()));
1454
+ builder .appendInline (visit (ctx .arithmetic_expression (0 )));
1455
+ builder .appendInline (visit (ctx .comparison_operator ()));
1458
1456
1459
1457
if (ctx .arithmetic_expression (1 ) != null ) {
1460
1458
builder .appendExpression (visit (ctx .arithmetic_expression (1 )));
@@ -1491,7 +1489,7 @@ public QueryTokenStream visitRegexpComparison(EqlParser.RegexpComparisonContext
1491
1489
1492
1490
@ Override
1493
1491
public QueryTokenStream visitComparison_operator (EqlParser .Comparison_operatorContext ctx ) {
1494
- return QueryTokenStream .ofToken ( ctx .op );
1492
+ return QueryTokenStream .from ( QueryTokens . ventilated ( ctx .op ) );
1495
1493
}
1496
1494
1497
1495
@ Override
@@ -2005,7 +2003,7 @@ public QueryTokenStream visitType_cast_function(EqlParser.Type_cast_functionCont
2005
2003
if (ctx .AS () != null ) {
2006
2004
builder .append (QueryTokens .expression (ctx .AS ()));
2007
2005
}
2008
- builder .appendInline (QueryTokenStream . concat (ctx .identification_variable (), this :: visit , TOKEN_SPACE ));
2006
+ builder .appendInline (visit (ctx .identification_variable ()));
2009
2007
2010
2008
if (!CollectionUtils .isEmpty (ctx .numeric_literal ())) {
2011
2009
0 commit comments