Allow nested expressions to be used both for grouping or inside
aggregate functions inside the stats command.
As such the grammar has been tweaked to allow the stats group to have
optional aliasing.
As part of this fix, preserve the original field declaration (including
spaces) for implicit aliases.
Improve validation for incorrect aggregate function use (as arguments,
grouping or inside evals).
Fix#99828
When encountering a multi-value, a single-value function (i.e. all
non-`mv_xxx()`) returns a `null`. This behaviour is opaque to the user.
This PR adds the functionality for these functions to emit a `Warning`
header, so the user is informed about the cause for the `null`s.
Within testing, there are some differences between the emulated
CSV-based tests (`TestPhysical*`) and the REST CSV-tests and thus the
exact messages in the warnings: * The REST ones can push operations to
Lucene; when this happens, a query containing a negation, `not
<predicate>`, can be translated to a `must_not` query, that will include
the `not` in the `Source`. But outside of Lucene, the execution would
consider the predicate first, then the negation. So when the predicate
contains a SV function, only this part's `Source` will show up in the
warning. * When pushed to Lucene, a query is wrapped within the
`SingleValueQuery`. This emits now warnings when encountering MVs (and
returning no match). However, this only happens once the query that it
wraps returns something itself. Comparatively, the `TestPhysical*`
filters will issue a warning for every encountered MV (irrespective of
sigle values within the MV matching or not).
To differentiate between the slightly differing values of the warnings,
one can now append the `#[Emulated:` prefix to a warning, followed by
the value of the warning for the emulated checks, then a corresponding
`]`. Example: `warning:Line 1:24: evaluation of [not(salary_change <
1)] failed, treating result as null. Only first 20 failures
recorded.#[Emulated:Line 1:28: evaluation of [salary_change < 1] failed,
treating result as null. Only first 20 failures recorded.]`
Closes#98743.
* Break out 'Limitations' into separate page
* Add REST API docs
* Restructure commands, functions, and operators refs
* Add placeholder for getting started guide
* Group 'Syntax', 'Metafields', and 'MV fields' under 'Language'
* Add placeholder for Kibana page
* Add link from landing page
* Apply uniform formatting to ACOS, CASE, and DATE_PARSE function refs
* Reword default LIMIT
* Add support for COUNT(*)
* Move 'Commands' and 'Functions and operators' to individual pages
---------
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
This adds a new ES|QL endpoint, `_query`, to replace the now deprecated
`_esql`. The latter is still kept for a while, emitting a deprecation
warning.
Fixes ESQL-1379.
Describes how we fetch multivalued fields by default, return them as
json arrays, how the internal sort order is not guaranteed, how most
functions will turn them into null, and how some fields remove
duplicates on save.
---------
Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
