@@ -246,6 +246,11 @@ func TestToLogsQLSuccess(t *testing.T) {
246246 sql : "SELECT * FROM logs WHERE message LIKE '_foo'" ,
247247 expected : "message:~\" ^.foo$\" " ,
248248 },
249+ {
250+ name : "like suffix paths with dots" ,
251+ sql : "SELECT * FROM logs WHERE RequestPath LIKE '%/favicon.ico' OR RequestPath LIKE '%index.html'" ,
252+ expected : "(RequestPath:\" */favicon.ico\" OR RequestPath:\" *index.html\" )" ,
253+ },
249254 {
250255 name : "compare fields equality" ,
251256 sql : "SELECT * FROM logs WHERE user_id = customer_id" ,
@@ -352,6 +357,11 @@ END AS severity FROM logs`,
352357 sql : "SELECT CASE level WHEN 'error' THEN 'critical' WHEN 'warn' THEN 'warning' ELSE 'info' END AS sev FROM logs" ,
353358 expected : "* | format \" info\" as sev | format if (level:warn) \" warning\" as sev | format if (level:error) \" critical\" as sev | fields sev" ,
354359 },
360+ {
361+ name : "case expression with like wildcard" ,
362+ sql : "SELECT ResponseStatus, CASE WHEN RequestPath LIKE ('%/foo') THEN 'foo' ELSE 'unknown' END AS MyType FROM logs" ,
363+ expected : "* | format \" unknown\" as MyType | format if (RequestPath:\" */foo\" ) \" foo\" as MyType | fields ResponseStatus, MyType" ,
364+ },
355365 {
356366 name : "json value simple path with alias" ,
357367 sql : "SELECT JSON_VALUE(payload, '$.ip') AS ip FROM logs" ,
0 commit comments