Commit graph

12 commits

Author SHA1 Message Date
Nik Everett
45bfaab448
ESQL: ROUND_TO function (#128278)
Creates a `ROUND_TO` function that rounds it's input to one of the
provided values. Like so:
```
ROUND_TO(v, 0, 5000, 10000, 20000, 40000, 100000)

   v   | ROUND_TO
     0 | 0
   100 | 0
  6000 | 5000
 45001 | 40000
999999 | 100000
```

For some sequences of numbers you could do this with the `/` operator -
but for arbitrary sequences of numbers you needed `CASE` which is quite
slow. And hard to read!

Rewriting the example above would look like:
```
CASE (
  v <   5000,     0,
  v <  10000,  5000,
  v <  20000, 10000,
  v <  40000, 20000,
  v < 100000, 40000,
  100000
)
```

Even better, this is *fast*:
```
        (operation)  Mode  Cnt    Score   Error  Units
round_to_4_via_case  avgt    7  138.124 ± 0.738  ns/op
         round_to_4  avgt    7    0.805 ± 0.011  ns/op
         round_to_3  avgt    7    0.739 ± 0.011  ns/op
         round_to_2  avgt    7    0.651 ± 0.009  ns/op
         date_trunc  avgt    7    2.425 ± 0.018  ns/op
```

I've included a comparison to `DATE_TRUNC` above because we should be
able to rewrite `DATE_TRUNC` into `ROUND_TO` when we know the date range
of the index. This doesn't do it now, but it should be possible.
2025-05-23 10:14:30 -04:00
shmuelhanoch
db644e20c8
Added esql scalb function. (#127696)
Co-authored-by: Shmuel Hanoch <shmuel.hanoch@elastic.co>
2025-05-22 10:47:44 +03:00
Jan Kuipers
9cf2a64067
ES|QL SAMPLE aggregation function (#127629)
* ES|QL SAMPLE aggregation function

* [CI] Auto commit changes from spotless

* ThreadLocalRandom -> SplittableRandom

* Update docs/changelog/127629.yaml

* fix yaml test

* Add SampleTests

* docs + example

* polish code

* mark generated imports

* comment with algorith description

* use Randomness.get()

* close properly

* type checks

* reuse hash

* regen some files

* [CI] Auto commit changes from spotless

---------

Co-authored-by: elasticsearchmachine <infra-root+elasticsearchmachine@elastic.co>
2025-05-08 08:01:53 +02:00
Craig Taverner
f6a05c6a7c
Support depthOffset in MD docs headings for nesting functions (#126984)
While this change appears subtle at this point, I am using this in a later PR that adds a lot more spatial functions, where nesting them in related groups like this looks much better.

The main impact of this is that the On this page navigator on the right panel of the docs will show the nesting

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
2025-04-19 11:28:05 +02:00
Svilen Mihaylov
02f9af732e
Add multi_match function #121525 (#125062)
Implement multi_match function for ESQL. Its currently available on snapshot builds pending refinement of the syntax.
2025-04-15 09:38:08 -04:00
Nik Everett
55a6624746
ESQL: TO_IP can handle leading zeros (#126532)
Modifies TO_IP so it can handle leading `0`s in ipv4s. Here's how it
works now:
```
ROW ip = TO_IP("192.168.0.1") // OK!
ROW ip = TO_IP("192.168.010.1") // Fails
```

This adds
```
ROW ip = TO_IP("192.168.010.1", {"leading_zeros": "octal"})
ROW ip = TO_IP("192.168.010.1", {"leading_zeros": "decimal"})
```

We do this because there isn't a consensus on how to parse leading zeros
in ipv4s. The standard unix tools like `ping` and `ftp` interpret
leading zeros as octal. Java's built in ip parsing interprets them as
decimal. Because folks are using this for security rules we need to
support all the choices.

Closes #125460
2025-04-11 19:45:14 +02:00
Craig Taverner
98a2c711f8
Refine ESQL docs handling of applies_to (#125835)
This primarily splits the old preview:true warning from the newer applies_to approach. Since all of our current applies_to examples are actually just behaviour modifications of current functions, we do not use the official docs {applies_to} syntax. However there is code to make use of that in the case where we have an entirely new function which will appear in a new version.

Co-authored-by: Alexander Spies <alexander.spies@elastic.co>
2025-03-28 22:09:15 +01:00
Larisa Motova
10719831b5
[ES|QL] Add ToAggregateMetricDouble example (#125518)
Adds AggregateMetricDouble to the ES|QL CSV tests and examples of how to
use the ToAggregateMetricDouble function
2025-03-26 07:56:48 -10:00
Craig Taverner
8ffecb408d
Additional support for docs for ES|QL operators and version-specific differentiation (#125251)
This PR was originally focused on improving support for Kibana docs, in particular the missing operator docs, but it has expanded to cover a bunch of related things:

* Primarily the main work was to improve operators support. ESQL generated docs cover all functions and most operators for which their is a clear operator class and test class. However, some are built-in behaviour and need additional support. This PR adds more generated content for those operators.
* Various specific operators requested by Kibana: Cast & null-predicates, and in particular the addition of examples
* Two functions without examples: mv_append and to_date_nanos
* Many small visual document cleanups (spelling, grammar, capitalization, etc.)
* Initial support for `applies_to` for multi-version differentiation.

This last point requires more work, as it is not yet agreed on just how we want this to look. We'll probably need to do refinements in followup PR. Consider the version in this PR as a first step into how this could look.
2025-03-24 09:56:45 +01:00
Larisa Motova
08ae54e423
[ES|QL] ToAggregateMetricDouble function (#124595)
This commit adds a conversion function from numerics (and aggregate
metric doubles) to aggregate metric doubles.

It is most useful when you have multiple indices, where one index uses
aggregate metric double (e.g. a downsampled index) and another uses a
normal numeric type like long or double (e.g. an index prior to
downsampling).
2025-03-18 11:39:27 -10:00
Craig Taverner
d5ddb909a4
ESQL autogenerate docs v3 (#124312)
Building on the work started in https://github.com/elastic/elasticsearch/pull/123904, we now want to auto-generate most of the small subfiles from the ES|QL functions unit tests.

This work also investigates any remaining discrepancies between the original asciidoc version and the new markdown, and tries to minimize differences so the docs do not look too different.

The kibana json and markdown files are moved to a new location, and the operator docs are a little more generated than before (although still largely manual).
2025-03-13 14:16:46 +01:00
Craig Taverner
efe7379e67
Split ESQL functions/operators docs files (#123904)
* Port from asciidocalypse

* Fix links for operator lists

* Remove unused image files after moving/editing them

* Fix lists links

* Fix like/rlike links

* Fix remaining bad references to /elasticsearch/docs

* Fix logstash and beats references

* Fix logstash and beats references

* Fix image links
2025-03-04 14:59:31 +01:00