// the find
runreveal/pql
Pipelined Query Language
A Go library that compiles a KQL-inspired pipe syntax into SQL, targeting ClickHouse but aiming to stay database-agnostic. Built by RunReveal for SIEM/detection-engineering use cases where security analysts are more comfortable with `| where EventType == 'x'` than `SELECT * FROM ... WHERE`. The pipe model maps cleanly to the mental model of filtering and shaping log data step by step.
The passthrough design for unknown functions is a smart tradeoff — you get the KQL-style pipe syntax without having to reimplement every aggregate function the underlying engine provides. The golden-file test suite covering 40+ cases plus fuzz tests on the lexer and parser is serious engineering for a library this small. The generated SQL wraps each pipe stage in a CTE, which makes the query plan readable and debuggable. Zero runtime dependencies beyond the Go stdlib.
Last commit was January 2025 and activity has tapered off sharply — the operator coverage is frozen at the basics (no `mv-expand`, no `parse`, no `bag_unpack`, no datetime functions beyond `now()`). The `let` statement only handles scalar expressions, which means you can't assign a subquery or a tabular expression to a variable, which is a significant gap for real KQL users. 'Database agnostic' is aspirational: the CTE wrapping and quoting strategy hasn't been validated against anything except ClickHouse, and subtle dialect differences (e.g., DuckDB vs Postgres identifier quoting) will bite you. 704 stars but only 28 forks suggests adoption is more 'interesting idea' than 'production dependency' for most people.