Commit graph

30 commits

Author SHA1 Message Date
Nik Everett
7916e6a231
ESQL: Implement LOOKUP, an "inline" enrich (#107987)
This adds support for `LOOKUP`, a command that implements a sort of
inline `ENRICH`, using data that is passed in the request:

```
$ curl -uelastic:password -HContent-Type:application/json -XPOST \
    'localhost:9200/_query?error_trace&pretty&format=txt' \
-d'{
    "query": "ROW a=1::LONG | LOOKUP t ON a",
    "tables": {
        "t": {
            "a:long":     [    1,     4,     2],
            "v1:integer": [   10,    11,    12],
            "v2:keyword": ["cat", "dog", "wow"]
        }
    },
    "version": "2024.04.01"
}'
      v1       |      v2       |       a       
---------------+---------------+---------------
10             |cat            |1
```

This required these PRs: * #107624 * #107634 * #107701 * #107762 *
#107923 * #107894 * #107982 * #108012 * #108020 * #108169 * #108191 *
#108334 * #108482 * #108696 * #109040 * #109045

Closes #107306
2024-06-07 11:38:51 +10:00
Nik Everett
5a612d4100
ESQL: Remove remaining IT_tests_only (#108434)
This moves examples from files marked to run in integration tests only
to the files where they belong and disables this pattern matching. We
now use supported features.
2024-05-09 09:32:46 -04:00
Liam Thompson
9b7e9b5d59
[DOCS] ESQL goes GA (#108342) 2024-05-07 14:12:50 +02:00
Nhat Nguyen
863cbf6bb4
Add docs for cross cluster search in ES|QL(#105934)
This change adds a documentation for cross cluster search in ES|QL.

Relates #102954
Closes #105529
2024-03-07 13:15:01 -08:00
Nik Everett
a7ca62de8e
Document ESQL docs examples (#105197)
This adds some docs to the top of `docs.csv-spec` and
`docs-IT_tests_only.csv-spec` telling folks not to add more stuff there
and instead put new examples into whatever files they line up with. It
also shifts some things out of the file to "prime the pump" on cleaning
it up.
2024-02-06 12:34:02 -05:00
Liam Thompson
8a3920ab85
[DOCS] Update KEEP command with duplicate precedence rules (#105146) 2024-02-06 15:55:41 +01:00
Abdon Pijpelink
980bc500b0
[DOCS] Support for nested functions in ES|QL STATS...BY (#104788)
* Document nested expressions for stats

* More docs

* Apply suggestions from review

- count-distinct.asciidoc
  - Content restructured, moving the section about approximate counts to end of doc.

- count.asciidoc
  - Clarified that omitting the `expression` parameter in `COUNT` is equivalent to `COUNT(*)`, which counts the number of rows.

- percentile.asciidoc
  - Moved the note about `PERCENTILE` being approximate and non-deterministic to end of doc.

- stats.asciidoc
  - Clarified the `STATS` command
  -  Added a note indicating that individual `null` values are skipped during aggregation

* Comment out mentioning a buggy behavior

* Update sum with inline function example, update test file

* Fix typo

* Delete line

* Simplify wording

* Fix conflict fix typo

---------

Co-authored-by: Liam Thompson <leemthompo@gmail.com>
Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
2024-01-30 19:29:12 +01:00
Abdon Pijpelink
e87c49cb4b
[DOCS] Improve ES|QL functions reference for functions E-Z (#104623)
* Functions E-Z

* Incorporate changes from #103686

* More functions

* More functions

* Update docs/reference/esql/functions/floor.asciidoc

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>

* Update docs/reference/esql/functions/left.asciidoc

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Alexander Spies <alexander.spies@elastic.co>

* Review feedback

* Fix geo_shape description

* Change 'colum'/'field' into 'expressions'

* Review feedback

* One more

---------

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
Co-authored-by: Alexander Spies <alexander.spies@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-01-25 16:32:24 +01:00
Abdon Pijpelink
c6723a3c1d
[DOCS] More ES|QL backtick examples (#103995) 2024-01-08 12:13:33 +01:00
Abdon Pijpelink
bc59315baa
[DOCS] Examples for ES|QL DISSECT and WHERE (#102591)
* DISSECT examples

* WHERE examples

* Remove references to empty keys

* Fix non-deterministic test
2023-11-27 10:56:48 +01:00
Abdon Pijpelink
2b4ba7a744
[DOCS] Small ES|QL improvements (#101877)
* [DOCS] Small ES|QL improvements

* Fix test failure
2023-11-07 17:24:59 +01:00
Abdon Pijpelink
90d3672d11
[DOCS] Default and max limits are now dynamic settings (#101831)
* [DOCS] Default and max limits are now dynamic settings

* Delete reference to Discover
2023-11-06 15:12:08 +01:00
Abdon Pijpelink
76ab37b35d
[DOCS] Uniform formatting for ES|QL commands (#101728)
* Source commands

* Missing word

* Processing commands

* Apply suggestions from code review

Co-authored-by: Alexander Spies <alexander.spies@elastic.co>

* Review feedback

* Add sort detail for mv

* More review feedback

---------

Co-authored-by: Alexander Spies <alexander.spies@elastic.co>
2023-11-06 08:42:13 +01:00
Andrei Stefan
74da80771a
ESQL: adds Enrich implicit match_fields to field_caps call (#101456)
* Take into account the Enrich implicit match_field when resolving
field names of the source index
2023-10-27 22:59:17 +03:00
Nik Everett
c73b3b6403
ESQL DOCS: speed note on stats (#101318)
Grouping by no fields is much much faster than grouping by one field.
Grouping by one field is like 5x faster than grouping on two fields.
2023-10-25 10:31:12 -04:00
Abdon Pijpelink
284f81873f
[DOCS] Expand ES|QL DISSECT and GROK documentation (#101225)
* Add 'Process data with DISSECT and GROK' page

* Expand DISSECT docs

* More DISSECT and GROK enhancements

* Improve examples

* Fix CSV tests

* Review feedback

* Reword
2023-10-25 13:19:17 +02:00
AlexB
931dcae41d
Add improvements to the ES|QL docs (#101195)
Content and structural improvements to the ES|QL docs

---------

Co-authored-by: Alexandros Batsakis <abatsakis@splunk.com>
Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
2023-10-23 07:45:42 -07:00
Abdon Pijpelink
fcdeb21993
[DOCS] Expand ES|QL ENRICH documentation (#101079)
* [DOCS] Expand ES|QL ENRICH documentation

* Add examples to 'Enrich data' page

* Add another diagram

* Remove redirect that's no longer needed

* Review feedback
2023-10-19 17:14:21 +02:00
Abdon Pijpelink
8ac4ba751e
Restructure ES|QL docs (#100806)
* Break out 'Limitations' into separate page

* Add REST API docs

* Restructure commands, functions, and operators refs

* Add placeholder for getting started guide

* Group 'Syntax', 'Metafields', and 'MV fields' under 'Language'

* Add placeholder for Kibana page

* Add link from landing page

* Apply uniform formatting to ACOS, CASE, and DATE_PARSE function refs

* Reword default LIMIT

* Add support for COUNT(*)

* Move 'Commands' and 'Functions and operators' to individual pages

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2023-10-17 17:36:14 +02:00
Bogdan Pintea
eaf21483fb
ESQL: Document the existing result-set limitations (#99880)
Document the newly implicit limit of 500 (if no other limit is
provided), as well as the global 10K one.

Related: #99816
2023-09-26 04:12:23 -04:00
Bogdan Pintea
fa8b34cb88 Change RENAME's syntax from using = to AS (ESQL-1462)
This changes the `RENAME` syntax from `RENAME new = old` to `RENAME old
AS new`.

Fixes ESQL-1447.
2023-07-25 12:26:35 +02:00
Abdon Pijpelink
73147db4d4 Remove unnecessary space 2023-06-26 16:33:41 +02:00
Abdon Pijpelink
f5c590bc6f [DOCS] Clarify the order for RENAME 2023-06-26 16:31:53 +02:00
Luigi Dell'Aquila
79596cc05c Add docs for ENRICH command (ESQL-1313)
Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
2023-06-23 12:13:06 +02:00
Luigi Dell'Aquila
100ca0acca Rename PROJECT command to KEEP (ESQL-1282) 2023-06-19 13:06:44 +02:00
Nik Everett
82d67dc289 Docs for aggregation functions (ESQL-1268)
This adds docs for all of ESQL's aggregation functions. Hopefully from
here on out we can add the docs as we add new functions.

I've created a few tagged regions in the aggs docs themselves so we can
include them into the ESQL docs.

---------

Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
2023-06-14 09:23:34 -05:00
Nik Everett
1f383f3cd2 Docs: compress results into query (ESQL-1259)
This compresses the results and the query on the page to take up less
space and make them more obviously connected.
2023-06-12 09:37:45 -05:00
Abdon Pijpelink
43a8346ed0 Review feedback 2023-06-12 13:08:14 +02:00
Abdon Pijpelink
2c3766cd3d Review feedback 2023-06-07 08:35:01 +02:00
Abdon Pijpelink
3b34382bdc [DOCS] Move processing commands to a file per command 2023-06-05 18:38:55 +02:00