kyma_kql/lib.rs
1//! KQL parser — phase E.1.
2//!
3//! Translates a KQL subset to SQL that DataFusion executes. The MVP covers
4//! the most common ADX patterns:
5//!
6//! ```kql
7//! nginx_logs
8//! | where timestamp > ago(1h) and status >= 500
9//! | project timestamp, path, status
10//! | sort by timestamp desc
11//! | take 10
12//! ```
13//!
14//! ```kql
15//! nginx_logs
16//! | where body contains "OutOfMemory"
17//! | summarize count(), avg(latency_ms) by bin(timestamp, 5m), status
18//! ```
19//!
20//! # What's supported
21//!
22//! - Operators: `where`, `project`, `project-away`, `extend`, `summarize ...
23//! by ...`, `take`, `limit`, `sort by`, `order by`, `top N by`, `count`,
24//! `distinct`.
25//! - Expressions: literals (int, float, string, bool, duration, datetime),
26//! column refs, arithmetic `+ - * / %`, comparison `== != < > <= >=`,
27//! logical `and or not`, string `contains`/`startswith`/`endswith`/`has`.
28//! - Functions: `now()`, `ago(d)`, `bin(col, d)`, `startofhour/day(col)`,
29//! `strcat(a,b)`, `tolower(s)`, `toupper(s)`, aggregates `count()`,
30//! `sum(x)`, `avg(x)`, `min(x)`, `max(x)`, `dcount(x)`.
31//! - Duration literals: `30s`, `5m`, `2h`, `7d`.
32//! - Datetime literals: `datetime(2026-04-19T10:00:00Z)`.
33//!
34//! # What's deferred
35//!
36//! `join`, `make-series`, `mv-expand`, regex, `parse_json`, lookup tables,
37//! scalar-valued subqueries, materialized views.
38//!
39//! # Not building an AST
40//!
41//! The MVP lowers KQL directly to SQL as it parses, via a `QueryState`
42//! accumulator. This is enough for KQL→SQL→DataFusion correctness; richer
43//! semantics (e.g., `make-series` auto-fill) need a proper IR and land
44//! with the unified-plan work in Phase E.2.
45
46#![forbid(unsafe_code)]
47
48mod lexer;
49mod parser;
50mod state;
51
52pub use parser::{kql_to_sql, ParseError};