diff --git a/userspace/engine/filter_details_resolver.cpp b/userspace/engine/filter_details_resolver.cpp index 7130ab11..7ab1d8e3 100644 --- a/userspace/engine/filter_details_resolver.cpp +++ b/userspace/engine/filter_details_resolver.cpp @@ -25,6 +25,7 @@ void filter_details::reset() macros.clear(); operators.clear(); lists.clear(); + evtnames.clear(); } void filter_details_resolver::run(ast::expr* filter, filter_details& details) @@ -70,6 +71,16 @@ void filter_details_resolver::visitor::visit(ast::list_expr* e) } } } + if (m_expect_evtname) + { + for(const auto& item : e->values) + { + if(m_details.known_lists.find(item) == m_details.known_lists.end()) + { + m_details.evtnames.insert(item); + } + } + } } void filter_details_resolver::visitor::visit(ast::binary_check_expr* e) @@ -77,9 +88,18 @@ void filter_details_resolver::visitor::visit(ast::binary_check_expr* e) m_expect_macro = false; m_details.fields.insert(e->field); m_details.operators.insert(e->op); - m_expect_list = true; - e->value->accept(this); - m_expect_list = false; + if (e->field == "evt.type" || e->field == "evt.asynctype") + { + m_expect_evtname = true; + e->value->accept(this); + m_expect_evtname = false; + } + else + { + m_expect_list = true; + e->value->accept(this); + m_expect_list = false; + } } void filter_details_resolver::visitor::visit(ast::unary_check_expr* e) @@ -101,4 +121,8 @@ void filter_details_resolver::visitor::visit(ast::value_expr* e) m_details.macros.insert(e->value); } + if(m_expect_evtname) + { + m_details.evtnames.insert(e->value); + } } diff --git a/userspace/engine/filter_details_resolver.h b/userspace/engine/filter_details_resolver.h index bbf2534a..df0e66ec 100644 --- a/userspace/engine/filter_details_resolver.h +++ b/userspace/engine/filter_details_resolver.h @@ -33,6 +33,7 @@ struct filter_details std::unordered_set macros; std::unordered_set operators; std::unordered_set lists; + std::unordered_set evtnames; void reset(); }; @@ -76,5 +77,6 @@ private: filter_details& m_details; bool m_expect_list; bool m_expect_macro; + bool m_expect_evtname; }; };