Fix Parser Test Runner JSON mode, Filter Simulator PQ syntax, dropdown source

- backend/routers/quality.py
 * Add GET /api/quality/parsers (lists actual files in /app/parsers)
 * Support SDL JSON auto-extract parsers ($=json{parse=json}$)
 * Apply parser rewrite blocks with correct $0/$N backref translation
 * Accept single JSON / JSON array / NDJSON in test-parser body
 * Flatten JSON inside 'message' for Field Population coverage
- backend/routers/ingest.py
 * Rewrite simulate-filter PowerQuery to valid SDL syntax
 * Correct field name: src.name -> dataSource.name
- frontend/index.html
 * Parser dropdown loads from /api/quality/parsers
 * Add 'Last 7d' lookback option
 * Render JSON-mode test results with badges + payload counter
This commit is contained in:
marc
2026-05-20 19:40:24 +02:00
parent 6e137438b1
commit 8dbd38f3bb
3 changed files with 219 additions and 20 deletions
+7 -4
View File
@@ -92,12 +92,15 @@ async def simulate_filter(rule: FilterRule):
clauses = []
if rule.source:
clauses.append(f'src.name = "{rule.source}"')
clauses.append(f"dataSource.name=='{rule.source}'")
if rule.event_type:
clauses.append(f'event.type = "{rule.event_type}"')
clauses.append(f"event.type=='{rule.event_type}'")
filter_expr = " AND ".join(clauses) if clauses else "true"
query = f"| filter {filter_expr} | count() as events"
if clauses:
filter_expr = " and ".join(clauses)
query = f"| filter {filter_expr} | group events=count()"
else:
query = "| group events=count()"
try:
result = await s1_client.run_powerquery(query, from_dt, to_dt)