diff --git a/lib/logstorage/parser.go b/lib/logstorage/parser.go index cb87e363f..55825dae7 100644 --- a/lib/logstorage/parser.go +++ b/lib/logstorage/parser.go @@ -1090,6 +1090,9 @@ func parseFuncArgs(lex *lexer, fieldName string, callback func(args []string) (f if lex.isKeyword(",") { return nil, fmt.Errorf("unexpected ',' - missing arg in %s()", funcName) } + if lex.isKeyword("(") { + return nil, fmt.Errorf("unexpected '(' - missing arg in %s()", funcName) + } arg := getCompoundFuncArg(lex) args = append(args, arg) if lex.isKeyword(")") { diff --git a/lib/logstorage/parser_test.go b/lib/logstorage/parser_test.go index e69994e12..17f93c843 100644 --- a/lib/logstorage/parser_test.go +++ b/lib/logstorage/parser_test.go @@ -714,6 +714,7 @@ func TestParseQuerySuccess(t *testing.T) { f(`ip:in(foo and user:in(admin, moderator)|fields ip)`, `ip:in(foo user:in(admin,moderator) | fields ip)`) f(`x:in(_time:5m y:in(*|fields z) | stats by (q) count() rows|fields q)`, `x:in(_time:5m y:in(* | fields z) | stats by (q) count(*) as rows | fields q)`) f(`in(bar:in(1,2,3) | uniq (x)) | stats count() rows`, `in(bar:in(1,2,3) | uniq by (x)) | stats count(*) as rows`) + f(`in((1) | fields z) | stats count() rows`, `in(1 | fields z) | stats count(*) as rows`) // ipv4_range filter f(`ipv4_range(1.2.3.4, "5.6.7.8")`, `ipv4_range(1.2.3.4, 5.6.7.8)`)