Skip to content

EQL: implement number function #54471

@rw-access

Description

@rw-access

Part of #51556
https://eql.readthedocs.io/en/latest/query-guide/functions.html#number
number(input: str, [base: int]) -> int|float

Function behavior

Validation requirements:

  • Accepts isString()
  • Return null if input is null
  • Autodetect the base if none provided
    • input startswith "0x": 16
    • otherwise: 10
  • Tries to parse as integer. If that succeeds, it's returned as an integer
  • If non-integer, then try to parse as a float. If that doesn't succeed, raise an EQL illegal argument exception. or is it better to raise the original exception?

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions