Commit graph

41 commits

Author SHA1 Message Date
Carlos Delgado
6ee641bdfd
ESQL - Update WHERE command docs with MATCH and full text functions examples (#118987) 2024-12-19 16:44:53 +01:00
Bogdan Pintea
1fe3ed1e85
Add docs for aggs filtering (#116681)
Add documentation for aggs filtering (the WHERE in STATS command).

Fixes: #115083
2024-11-22 13:26:30 +01:00
Costin Leau
bc785f5ca1
Esql/lookup join grammar (#116515)
First PR for adding LOOKUP JOIN in ESQL.
Introduces grammar and wires the main building blocks to execute a query; follow-ups are required (see #116208 for more details).

Co-authored-by: Nik Everett <nik9000@users.noreply.github.com>
2024-11-19 17:52:24 -08:00
Kyle Thomas
ee74ce564f
[DOCS] ES|QL: Adding a tip to the WHERE documentation (#114050)
* Adding a tip to make null field behavior more apparent.

* Update docs/reference/esql/processing-commands/where.asciidoc

Co-authored-by: Andrei Stefan <astefan@users.noreply.github.com>

* Update docs/reference/esql/processing-commands/where.asciidoc

Rephrasing for clarity

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>

---------

Co-authored-by: Andrei Stefan <astefan@users.noreply.github.com>
Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
2024-10-14 13:05:12 -05:00
Liam Thompson
04678e9a15
[DOCS][ESQL] Include bucket in agg functions list (#112513) 2024-09-05 11:43:20 +02:00
Nik Everett
b5c6c2da30
ESQL: INLINESTATS (#109583)
This implements `INLINESTATS`. Most of the heavy lifting is done by
`LOOKUP`, with this change mostly adding a new abstraction to logical
plans, and interface I'm calling `Phased`. Implementing this interface
allows a logical plan node to cut the query into phases. `INLINESTATS`
implements it by asking for a "first phase" that's the same query, up to
`INLINESTATS`, but with `INLINESTATS` replaced with `STATS`. The next
phase replaces the `INLINESTATS` with a `LOOKUP` on the results of the
first phase.

So, this query:
```
FROM foo
| EVAL bar = a * b
| INLINESTATS m = MAX(bar) BY b
| WHERE m = bar
| LIMIT 1
```

gets split into
```
FROM foo
| EVAL bar = a * b
| STATS m = MAX(bar) BY b
```

followed by
```
FROM foo
| EVAL bar = a * b
| LOOKUP (results of m = MAX(bar) BY b) ON b
| WHERE m = bar
| LIMIT 1
```
2024-07-24 17:16:37 -04:00
Alexander Spies
da5392134f
ESQL: Validate unique plan attribute names (#110488)
* Enforce an invariant in our dependency checker so that logical plans never have duplicate output attribute names or ids.
* Fix ROW to not produce columns with duplicate names.
* Fix ResolveUnionTypes to not create multiple synthetic field attributes for the same union type.
* Add tests for commands using the same column name more than once.
* Update docs w.r.t. how commands behave if they are used with duplicate column names.
2024-07-17 11:39:02 +02:00
Nik Everett
1256a49c3a
ESQL: Move description of commands in docs (#110714)
This copies the first line of the description of each command to just
under the syntax so that it's "in order", before the `Parameters`
section. That way if you are reading from top to bottom you see:
```
syntax
short description
parameter names and descriptions
long description
examples
```

I've also removed the `Description` section entirely if the description
was just one sentence. So in some cases that just isn't `long
description`.
2024-07-11 08:31:35 -04:00
Nik Everett
a1695ffbea
ESQL: Documents STATS on multivalue groups (#110712)
This documents running `STATS` on a multivalued column. It also removes
a long out of date warning about a limitation of grouping.
2024-07-10 15:49:46 -04:00
Nik Everett
c888e5f4cd
ESQL: Run LOOKUP docs test only in SNAPSHOT (#109493)
LOOKUP is only registered on SNAPSHOT builds.

closes #109478
2024-06-11 23:27:22 +10:00
Nik Everett
c6fe3c3efe
ESQL: Improve syntax for LOOKUP tables (#109489)
Replace the syntax for `tables` with something a little more natural.

Now it is:

```
$ curl -uelastic:password -HContent-Type:application/json -XPOST \
    'localhost:9200/_query?error_trace&pretty&format=txt' \
-d'{
    "query": "ROW a=1::LONG | LOOKUP t ON a",
    "tables": {
        "t": {
            "a": {"long":     [    1,     4,     2]},
            "v1": {"integer": [   10,    11,    12]},
            "v2": {"keyword": ["cat", "dog", "wow"]}
        }
    }
}'
      v1       |      v2       |       a
---------------+---------------+---------------
10             |cat            |1
```
2024-06-11 23:26:04 +10:00
Nik Everett
7916e6a231
ESQL: Implement LOOKUP, an "inline" enrich (#107987)
This adds support for `LOOKUP`, a command that implements a sort of
inline `ENRICH`, using data that is passed in the request:

```
$ curl -uelastic:password -HContent-Type:application/json -XPOST \
    'localhost:9200/_query?error_trace&pretty&format=txt' \
-d'{
    "query": "ROW a=1::LONG | LOOKUP t ON a",
    "tables": {
        "t": {
            "a:long":     [    1,     4,     2],
            "v1:integer": [   10,    11,    12],
            "v2:keyword": ["cat", "dog", "wow"]
        }
    },
    "version": "2024.04.01"
}'
      v1       |      v2       |       a       
---------------+---------------+---------------
10             |cat            |1
```

This required these PRs: * #107624 * #107634 * #107701 * #107762 *
#107923 * #107894 * #107982 * #108012 * #108020 * #108169 * #108191 *
#108334 * #108482 * #108696 * #109040 * #109045

Closes #107306
2024-06-07 11:38:51 +10:00
Nik Everett
5a612d4100
ESQL: Remove remaining IT_tests_only (#108434)
This moves examples from files marked to run in integration tests only
to the files where they belong and disables this pattern matching. We
now use supported features.
2024-05-09 09:32:46 -04:00
Liam Thompson
9b7e9b5d59
[DOCS] ESQL goes GA (#108342) 2024-05-07 14:12:50 +02:00
Nhat Nguyen
863cbf6bb4
Add docs for cross cluster search in ES|QL(#105934)
This change adds a documentation for cross cluster search in ES|QL.

Relates #102954
Closes #105529
2024-03-07 13:15:01 -08:00
Nik Everett
a7ca62de8e
Document ESQL docs examples (#105197)
This adds some docs to the top of `docs.csv-spec` and
`docs-IT_tests_only.csv-spec` telling folks not to add more stuff there
and instead put new examples into whatever files they line up with. It
also shifts some things out of the file to "prime the pump" on cleaning
it up.
2024-02-06 12:34:02 -05:00
Liam Thompson
8a3920ab85
[DOCS] Update KEEP command with duplicate precedence rules (#105146) 2024-02-06 15:55:41 +01:00
Abdon Pijpelink
980bc500b0
[DOCS] Support for nested functions in ES|QL STATS...BY (#104788)
* Document nested expressions for stats

* More docs

* Apply suggestions from review

- count-distinct.asciidoc
  - Content restructured, moving the section about approximate counts to end of doc.

- count.asciidoc
  - Clarified that omitting the `expression` parameter in `COUNT` is equivalent to `COUNT(*)`, which counts the number of rows.

- percentile.asciidoc
  - Moved the note about `PERCENTILE` being approximate and non-deterministic to end of doc.

- stats.asciidoc
  - Clarified the `STATS` command
  -  Added a note indicating that individual `null` values are skipped during aggregation

* Comment out mentioning a buggy behavior

* Update sum with inline function example, update test file

* Fix typo

* Delete line

* Simplify wording

* Fix conflict fix typo

---------

Co-authored-by: Liam Thompson <leemthompo@gmail.com>
Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
2024-01-30 19:29:12 +01:00
Abdon Pijpelink
e87c49cb4b
[DOCS] Improve ES|QL functions reference for functions E-Z (#104623)
* Functions E-Z

* Incorporate changes from #103686

* More functions

* More functions

* Update docs/reference/esql/functions/floor.asciidoc

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>

* Update docs/reference/esql/functions/left.asciidoc

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Alexander Spies <alexander.spies@elastic.co>

* Review feedback

* Fix geo_shape description

* Change 'colum'/'field' into 'expressions'

* Review feedback

* One more

---------

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
Co-authored-by: Alexander Spies <alexander.spies@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-01-25 16:32:24 +01:00
Abdon Pijpelink
c6723a3c1d
[DOCS] More ES|QL backtick examples (#103995) 2024-01-08 12:13:33 +01:00
Abdon Pijpelink
bc59315baa
[DOCS] Examples for ES|QL DISSECT and WHERE (#102591)
* DISSECT examples

* WHERE examples

* Remove references to empty keys

* Fix non-deterministic test
2023-11-27 10:56:48 +01:00
Abdon Pijpelink
2b4ba7a744
[DOCS] Small ES|QL improvements (#101877)
* [DOCS] Small ES|QL improvements

* Fix test failure
2023-11-07 17:24:59 +01:00
Abdon Pijpelink
90d3672d11
[DOCS] Default and max limits are now dynamic settings (#101831)
* [DOCS] Default and max limits are now dynamic settings

* Delete reference to Discover
2023-11-06 15:12:08 +01:00
Abdon Pijpelink
76ab37b35d
[DOCS] Uniform formatting for ES|QL commands (#101728)
* Source commands

* Missing word

* Processing commands

* Apply suggestions from code review

Co-authored-by: Alexander Spies <alexander.spies@elastic.co>

* Review feedback

* Add sort detail for mv

* More review feedback

---------

Co-authored-by: Alexander Spies <alexander.spies@elastic.co>
2023-11-06 08:42:13 +01:00
Andrei Stefan
74da80771a
ESQL: adds Enrich implicit match_fields to field_caps call (#101456)
* Take into account the Enrich implicit match_field when resolving
field names of the source index
2023-10-27 22:59:17 +03:00
Nik Everett
c73b3b6403
ESQL DOCS: speed note on stats (#101318)
Grouping by no fields is much much faster than grouping by one field.
Grouping by one field is like 5x faster than grouping on two fields.
2023-10-25 10:31:12 -04:00
Abdon Pijpelink
284f81873f
[DOCS] Expand ES|QL DISSECT and GROK documentation (#101225)
* Add 'Process data with DISSECT and GROK' page

* Expand DISSECT docs

* More DISSECT and GROK enhancements

* Improve examples

* Fix CSV tests

* Review feedback

* Reword
2023-10-25 13:19:17 +02:00
AlexB
931dcae41d
Add improvements to the ES|QL docs (#101195)
Content and structural improvements to the ES|QL docs

---------

Co-authored-by: Alexandros Batsakis <abatsakis@splunk.com>
Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
2023-10-23 07:45:42 -07:00
Abdon Pijpelink
fcdeb21993
[DOCS] Expand ES|QL ENRICH documentation (#101079)
* [DOCS] Expand ES|QL ENRICH documentation

* Add examples to 'Enrich data' page

* Add another diagram

* Remove redirect that's no longer needed

* Review feedback
2023-10-19 17:14:21 +02:00
Abdon Pijpelink
8ac4ba751e
Restructure ES|QL docs (#100806)
* Break out 'Limitations' into separate page

* Add REST API docs

* Restructure commands, functions, and operators refs

* Add placeholder for getting started guide

* Group 'Syntax', 'Metafields', and 'MV fields' under 'Language'

* Add placeholder for Kibana page

* Add link from landing page

* Apply uniform formatting to ACOS, CASE, and DATE_PARSE function refs

* Reword default LIMIT

* Add support for COUNT(*)

* Move 'Commands' and 'Functions and operators' to individual pages

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2023-10-17 17:36:14 +02:00
Bogdan Pintea
eaf21483fb
ESQL: Document the existing result-set limitations (#99880)
Document the newly implicit limit of 500 (if no other limit is
provided), as well as the global 10K one.

Related: #99816
2023-09-26 04:12:23 -04:00
Bogdan Pintea
fa8b34cb88 Change RENAME's syntax from using = to AS (ESQL-1462)
This changes the `RENAME` syntax from `RENAME new = old` to `RENAME old
AS new`.

Fixes ESQL-1447.
2023-07-25 12:26:35 +02:00
Abdon Pijpelink
73147db4d4 Remove unnecessary space 2023-06-26 16:33:41 +02:00
Abdon Pijpelink
f5c590bc6f [DOCS] Clarify the order for RENAME 2023-06-26 16:31:53 +02:00
Luigi Dell'Aquila
79596cc05c Add docs for ENRICH command (ESQL-1313)
Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
2023-06-23 12:13:06 +02:00
Luigi Dell'Aquila
100ca0acca Rename PROJECT command to KEEP (ESQL-1282) 2023-06-19 13:06:44 +02:00
Nik Everett
82d67dc289 Docs for aggregation functions (ESQL-1268)
This adds docs for all of ESQL's aggregation functions. Hopefully from
here on out we can add the docs as we add new functions.

I've created a few tagged regions in the aggs docs themselves so we can
include them into the ESQL docs.

---------

Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
2023-06-14 09:23:34 -05:00
Nik Everett
1f383f3cd2 Docs: compress results into query (ESQL-1259)
This compresses the results and the query on the page to take up less
space and make them more obviously connected.
2023-06-12 09:37:45 -05:00
Abdon Pijpelink
43a8346ed0 Review feedback 2023-06-12 13:08:14 +02:00
Abdon Pijpelink
2c3766cd3d Review feedback 2023-06-07 08:35:01 +02:00
Abdon Pijpelink
3b34382bdc [DOCS] Move processing commands to a file per command 2023-06-05 18:38:55 +02:00