Commit graph

205 commits

Author SHA1 Message Date
Nik Everett
0e6bbb0bea
ESQL: TOP support for strings (#113183) (#113408)
Adds support to the `TOP` aggregation for `keyword` and `text` field
types.

Closes #109849
2024-09-26 05:18:20 +10:00
Carlos Delgado
c3a2b19993
[8.x] ESQL QSTR function (#112590) (#113189) 2024-09-23 10:13:53 +02:00
Iraklis Psaroudakis
6f63a4e08b
fix a couple of docs typos (#112901) (#113283)
Co-authored-by: Pm Ching <41728178+pionCham@users.noreply.github.com>
2024-09-21 01:59:14 +10:00
Bogdan Pintea
6e314d6c2a
ESQL: Align year diffing to the rest of the units in DATE_DIFF: chronological (#113103) (#113258)
This will correct/switch "year" unit diffing from the current integer
subtraction to a crono subtraction. Consequently, two dates are (at
least) one year apart now if (at least) a full calendar year separates
them. The previous implementation simply subtracted the year part of the
dates.

Note: this parts with ES SQL's implementation of the same function,
which itself is aligned with MS SQL's implementation, which works
equivalent to an integer subtraction.

Fixes #112482.

(cherry picked from commit f7ff00f645)
2024-09-20 22:31:36 +10:00
Fang Xing
e8569356ea
[ES|QL] explicit cast a string literal to date_period and time_duration in arithmetic operations (#109193)
explicit cast to date_period and time_duration in arithmic operation
2024-09-09 14:56:43 -04:00
Nik Everett
ef3a5a1385
ESQL: Fix CASE when conditions are multivalued (#112401)
When CASE hits a multivalued field it was previously either crashing on
fold or evaluating it to the first value. Since booleans are loaded in
sorted order from lucene that *usually* means `false`. This changes the
behavior to line up with the rest of ESQL - now multivalued fields are
treated as `false` with a warning.

You might say "hey wait! multivalued fields usually become `null`, not
`false`!". Yes, dear reader, you are right. Very right. But! `CASE`'s
contract is to immediatly convert its values into `true` or `false`
using the standard boolean tri-valued logic. So `null` just become
`false` immediately. This is how PostgreSQL, MySQL, and SQLite behave:

```
> SELECT CASE WHEN null THEN 1 ELSE 2 END;
2
```

They turn that `null` into a false. And we're right there with them.
Except, of course, that we're turning `[false, false]` and the like into
`null` first. See!? It's consitent. Consistently confusing, but sane at
least.

The warning message just says "treating multivalued field as false"
rather than explaining all of that.

This also fixes up a few of CASE's docs which I noticed were kind of
busted while working on CASE. I think the docs generation is having a
lot of trouble with CASE so I've manually hacked the right thing into
place, but we should figure out a better solution eventually.

Closes #112359
2024-09-10 02:32:19 +10:00
Nik Everett
cf98240950 Update docs from code 2024-09-09 11:28:31 -04:00
Chris Berkhout
fbaeb1ee61
[ESQL] Add SPACE function (#112350)
Adds the SPACE(number) function, which is equivalent to REPEAT(" ", number).
2024-09-09 21:41:35 +10:00
Iván Cea Fontenla
fc2760cfd4
ESQL: mv_median_absolute_deviation function (#112055)
- Added mv_median_absolute_deviation function
- Added possibility of having a fixed param in Multivalue "ascending" functions
- Add surrogate to MedianAbsoluteDeviation

### Calculations used to avoid overflows
First, a quick recap of how the MAD is calculated:
1. Sort values, and get the median
2. Calculate the difference between each value with the median (`abs(median - value)`)
3. Sort the differences, and get their median

Calculating a MAD may overflow when calculating the differences (Step 2), given the type is a signed number, as the difference is a positive value, with potentially the same value as `POSITIVE_MAX - NEGATIVE_MIN`.
To solve this, some types are up-casted as follow:
- Int: Stored as longs, simple approach
- Long: Stored as longs, but switched to unsigned long representation when calculating the differences
- Unsigned long: No effect; the resulting range is the same
- Doubles: Nothing. If the values overflow to +/-infinity, they're left that way, as we'll just use those outliers to sort

Closes https://github.com/elastic/elasticsearch/issues/111590
2024-09-09 10:04:25 +02:00
Ioana Tagirta
90f1fb667c
[ES|QL] Document return value for locate in case substring is not found (#112202)
* Document return value for locate in case substring is not found

* Add note that string positions start from 1
2024-09-03 12:46:20 +02:00
Nik Everett
d8e705d5da
ESQL: Document date instead of datetime (#111985)
This changes the generated types tables in the docs to say `date`
instead of `datetime`. That's the name of the field in Elasticsearch so
it's a lot less confusing to call it that.

Closes #111650
2024-08-21 01:59:13 +10:00
Iván Cea Fontenla
65ce50c60a
ESQL: Added mv_percentile function (#111749)
- Added the `mv_percentile(values, percentile)` function
- Used as a surrogate in the `percentile(column, percentile)` aggregation
- Updated docs to specify that the surrogate _should_ be implemented if possible

The same way as mv_median does, this yields exact results (Ignoring double operations error).
For that, some decisions were made, specially in the long evaluator (Check the comments in context in `MvPercentile.java`)

Closes https://github.com/elastic/elasticsearch/issues/111591
2024-08-20 15:29:19 +02:00
Iván Cea Fontenla
e3f378ebd2
ESQL: Strings support for MAX and MIN aggregations (#111544)
Support Version, Keyword and Text in Max an Min aggregations.

The current implementation of both max and min does:

For non-grouping:
- Store a BytesRef
- When there's a max/min, copy it to the internal array. Grow it if needed

For grouping:
- Keep an array of BytesRef (null by default: there's no "initial/default value" here, as there's no "MAX" value for a string)
- Each BytesRef stores their own array, which will be grown as needed to copy the new max/min

Some notes:
- It's not shrinking the arrays, as to avoid having to copy, and potentially grow it again
- It's using raw arrays. But maybe it should use BigArrays to compute in the circuit breaker?

Part of https://github.com/elastic/elasticsearch/issues/110346
2024-08-20 15:24:55 +02:00
Bogdan Pintea
dd49c33479
ESQL: BUCKET: allow numerical spans as whole numbers (#111874)
This laxes the check on numerical spans to allow them be specified as whole numbers. So far it was required that they be provided as a double.

This also expands the tests for date ranges to include string types.

Resolves #109340, resolves #104646, resolves #105375.
2024-08-20 13:40:59 +02:00
Nik Everett
dc24003540
ESQL: Profile more timing information (#111855)
This profiles additional timing information for each individual driver.
To the results from `profile` it adds the start and stop time for each
driver. That was already in the task status. To the profile and task
status it also adds the number of times the driver slept and some more
detailed history about a few of those times.

Explanation time! The compute engine splits work into some number of
`Drivers` per node. Each `Driver` is a single threaded entity - it runs
on a thread for a while then does one of three things: 1. Finishes 2.
Goes async because one of it's `Operator`s has gone async 3. Yields the
thread pool because it has run for too long

This PR measures the second two. At this point only three operators can
go async: * ENRICH * Reading from an empty exchange * Writing to a full
exchange

We're quite interested the these sleeps at the moment because they think
they may be slowing things down. Here's what it looks like when a driver
goes async because it wants to read from an empty exchange:

```
... the rest of the profile ...
        "sleeps" : {
          "counts" : {
            "exchange empty" : 2
          },
          "first" : [
            {
              "reason" : "exchange empty",
              "sleep" : "2024-08-13T19:45:57.943Z",
              "sleep_millis" : 1723578357943,
              "wake" : "2024-08-13T19:45:58.159Z",
              "wake_millis" : 1723578358159
            },
            {
              "reason" : "exchange empty",
              "sleep" : "2024-08-13T19:45:58.164Z",
              "sleep_millis" : 1723578358164,
              "wake" : "2024-08-13T19:45:58.165Z",
              "wake_millis" : 1723578358165
            }
          ],
          "last": [same as above]
```

Every time the driver goes async we count it in the `counts` map -
grouped by the reason the driver slept. We also record the sleep and
wake times for the first and last ten times the driver sleeps. In this
case it only slept twice, so the `first` and `last` ten times is the
same array.

This should give us a good sense about why drivers sleep while using a
limited amount of memory per driver.
2024-08-20 07:29:01 +10:00
Nik Everett
2e22e73cdf
ESQL: Remove date_nanos from generated docs (#111884)
This removes date_nanos from the docs generated for all of our functions
because it's still under construction. I've done so as a sort of one-off
hack. My plan is to replace this in a follow up change with a
centralized registry of "under construction" data types. So we can make
new data types under a feature flag more easilly in the future. We're
going to be doing that a fair bit.
2024-08-15 00:22:25 +10:00
Mark Tozzi
67c69bb224
[ESQL] Date nanos type (#110205)
Resolves #109987

Add initial support for the date nanos data type. At this point, almost no functions are supported, including casting. This just covers loading and returning the values. Like millisecond dates, nanosecond dates are internally modeled as long values, so we don't need a new block type to support them.

This has very patchwork function support. Ideally, I don't think I would have added any function support yet, but the five MV functions you see here declare that they accept any non-spatial type, and will error tests if not wired up for new types. There are other functions, like Values, which also claim to support all non-spatial types, but don't currently enforce that in testing, so I didn't add them yet. Finally, there are functions like == which should work for all types, but are implemented as a specific list. I've left those for a follow up ticket as well.
2024-08-07 13:17:26 -04:00
Nik Everett
cc294a1a0f
ESQL: Finish migration of null testing (#111563)
This finishes the migration of `null` testing from a test method, namely
`testSimpleWithNulls`. It migrates it to `anyNullIsNull` and hand rolled
null cases.
2024-08-05 12:28:15 -04:00
Fang Xing
d87254369a
type = operator in kibana operator definition (#111436) 2024-07-31 11:07:18 -04:00
Pablo Machado
f79c62157d
ESQL: Add MV_PSERIES_WEIGHTED_SUM for score calculations used by security solution (#109017)
* Create MV_RIEMANN_ZETA scalar multivalue function



---------

Co-authored-by: Nik Everett <nik9000@gmail.com>
2024-07-31 12:08:28 +02:00
Iván Cea Fontenla
bc69827e1e
ESQL: WEIGHTED_AVG aggregation tests and docs (#111449) 2024-07-31 00:42:23 +10:00
Iván Cea Fontenla
735d80dffd
ESQL: Add COUNT and COUNT_DISTINCT aggregation tests (#111409) 2024-07-30 03:07:15 +10:00
Iván Cea Fontenla
826d49448b
ESQL: Added Median and MedianAbsoluteDeviation aggregations tests and kibana docs (#111231) 2024-07-26 22:11:01 +10:00
Iván Cea Fontenla
595d907f61
ESQL: SpatialCentroid aggregation tests and docs (#111236) 2024-07-26 10:41:18 +02:00
Fang Xing
66dd2687d5
[ES|QL] Generate docs for unregistered esql functions from annotations (#108749)
* render docs for operators
2024-07-22 14:58:17 -04:00
Iván Cea Fontenla
195b916e2b
ESQL: TOP aggregation IP support (#111105)
Added IP support to TOP() aggregation.

Adapted a bit the stringtemplates organization for esql/compute to
(also?) work with specific datatypes. Right now it may be a bit messy,
but we need the specific support for cases like this.
2024-07-22 22:35:48 +10:00
Iván Cea Fontenla
101775b93d
Added Sum aggregation tests and docs (#110984)
- Added SUM() agg tests (Which autogenerates docs)
- Converted non-finite doubles to nulls in aggregator

The complete set of tests depends on
https://github.com/elastic/elasticsearch/issues/110437, as commented in
code. After completion, the test can be uncommented and everything
should work fine
2024-07-22 21:43:58 +10:00
Iván Cea Fontenla
96e1b15b9d
ESQL: Support IP fields in MAX and MIN aggregations (#110921)
- Support IP in MAX() and MIN()
  - Used a custom IpArrayState for it, as it's quite different from the `X-ArrayState.java.st` generated ones
- Add IP test cases for aggregation tests
2024-07-19 23:23:13 +10:00
Iván Cea Fontenla
0e68117935
Added Percentile aggregation tests and Kibana docs (#111050)
- Added Percentile aggregation tests and autogen docs
- Added a new "appendix" section to FunctionInfo. Existing Percentile docs had a final, long section with info, and we need this to leep it. We have an "detailedDescription" attribute already, but it's right after the description, and it would make it harder to read the important bits of the function (types, examples...). So I'm not reusing it.
2024-07-19 14:28:11 +02:00
Carlos Delgado
453b82706d
Add the EXP ES|QL function (#110879) 2024-07-16 16:36:01 +02:00
Iván Cea Fontenla
43a3af66e8
ESQL: Add boolean support to TOP aggregation (#110718)
- Added a custom implementation of BooleanBucketedSort to keep the top booleans
- Added boolean aggregator to TOP
- Added tests (Boolean aggregator tests, Top tests for boolean, and added boolean fields to CSV cases)
2024-07-16 03:14:29 +10:00
Nik Everett
9f001169c6
ESQL: Document the pattern to count TRUE (#110820)
This adds an example to the docs an example of counting the TRUE results
of an expression. You do `COUNT(a > 0 OR NULL)`. That turns the `FALSE`
into `NULL`. Which you need to do because `COUNT(false)` is `1` -
because it's a value. But `COUNT(null)` is `0` - because it's the
absence of values.

We could like to make something more intuitive for this one day. But for
now, this is what works.
2024-07-12 14:08:22 -04:00
Nik Everett
55532c8d6f
ESQL: All descriptions are a full sentence (#110791)
This asserts that all functions have descriptions that are complete
sentences.
2024-07-11 16:44:15 -04:00
Iván Cea Fontenla
2901711c46
ESQL: Add boolean support to Max and Min aggs (#110527)
- Added support for Booleans on Max and Min
- Added some helper methods to BitArray (`set(index, value)` and `fill(from, to, value)`). This way, the container is more similar to other BigArrays, and it's easier to work with

Part of https://github.com/elastic/elasticsearch/issues/110346, as Max
and Min are dependencies of Top.
2024-07-10 23:10:32 +10:00
Iván Cea Fontenla
5d3512fb33
ESQL: Fix Max doubles bug with negatives and add tests for Max and Min (#110586)
`MAX()` currently doesn't work with doubles smaller than
`Double.MIN_VALUE` (Note that `Double.MIN_VALUE` returns the smallest
non-zero positive, not the smallest double).

This PR adds tests for Max and Min, and fixes the bug (Detected by the
tests).

Also, as the tests now generate the docs, replaced the old docs with the
generated ones, and updated the Max&Min examples.
2024-07-09 21:05:00 +10:00
Iván Cea Fontenla
38cd0b333e
ESQL: AVG aggregation tests and ignore complex surrogates (#110579)
Some work around aggregation tests, with AVG as an example:
- Added tests and autogenerated docs for AVG
- As AVG uses "complex" surrogates (A combination of functions), we can't trivially execute them without a complete plan. As I'm not sure it's worth it for most aggregations, I'm skipping those cases for now, as to avoid blocking other aggs tests.

The bad side effect of skipping those tests is that most tests in AvgTests are actually ignored (74 of 100)
2024-07-09 12:01:46 +02:00
Fang Xing
8abc8857f2
[ES|QL] weighted_avg (#109993)
* weighted_avg
2024-07-02 18:29:02 -04:00
Nik Everett
6fbc52d170
ESQL docs: Push down needs index and doc_values (#110353)
This adds a `NOTE` to each comparison saying that pushing the comparison
to the search index requires that the field have an `index` and
`doc_values`. This is unique compared to the rest of Elasticsearch which
only requires an `index` and it's caused by our insistence that
comparisons only return true for single-valued fields. We can in future
accelerate comparisons without `doc_values`, but we just haven't written
that code yet.
2024-07-02 14:22:50 -04:00
Iván Cea Fontenla
c89ee3b648
ESQL: Renamed TopList to Top (#110347)
Rename TopList aggregation to Top, after internal discussions
2024-07-02 03:52:24 +10:00
Iván Cea Fontenla
fc0313f429
ESQL: Add aggregations testing base and docs (#110042)
- Added a new `AbstractAggregationTestCase` base class for tests, that shares most of the code of function tests, adapted for aggregations. Including both testing and docs generation.
  - Reused the `AbstractFunctionTestCase` class to also let us test evaluators if the aggregation is foldable
- Added a `TopListTests` example
  - This includes the docs for Top_list _(Also added a missing include of Ip_prefix docs)_
- Adapted Kibana docs to use `type: "agg"` (@drewdaemon)

The current tests are very basic: Consume a page, generate an output,
all in Single aggregation mode (No intermediates, no grouping). More
complex testing will be added in future PRs

Initial PR of https://github.com/elastic/elasticsearch/issues/109917
2024-06-27 21:21:55 +10:00
Craig Taverner
536d614694
ES|QL ST_DISTANCE Function (#108764)
* WIP Started refactoring in preparation for ST_DISTANCE

* Initial evaluators for ST_DISTANCE

* Update docs/changelog/108764.yaml

* Fix invalid changelog generated by CI

* Register function and get unit tests working

* Fixed failing meta function description tests, and refined descriptions

* Added initial CsvTests and calculate Geo differently to Cartesian

* Added more csv-spec tests and changed to arcDistance for accuracy

* Added generated docs files

* Link to generated docs

* Fix examples tag for linking from generated docs

* Skip wrapper function

And note that we might want to include instead some of the related intelligence from Circle2D::HaversineDistance class

* Added ST_DWITHIN and more tests for ST_DISTANCE and ST_DWITHIN

* Code style

* Added more tests, this time for sorting on distance

* Fixes after rebase on main

* The ST_DWITHIN cannot use BinarySpatialFunction because it is ternary

So we moved the common code to a separate SpatialTypeResolver, and made a simpler TernarySpatialFunction based on a simple TernaryScalarFunction. This had additional consequences, simplifying the points-only cases.

The main reason for this change was to support StDWithinTests which need to test a lot of things that involve varying all three input types, generating expected error strings, etc. The original hack of just adding to BinarySpatialFunction worked for the actual integration tests, but clearly did not satisfy all the use cases tested by the unit tests.

We also restricted ST_DWITHIN to take only a double as the third argument, because otherwise the number of evaluators would explode, since we need a separate evaluator for each Block type, and Integer and Double use different block types.

* Fixed function count after rebasing on main

* Update docs/changelog/108764.yaml

* Added generated docs for ST_DWITHIN

* Connect docs for ST_DWITHIN

* Add back issue link

* Remove support for ST_DWITHIN

* Update docs/changelog/108764.yaml

* Bring back link to issue in changelog

* Update x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/StDistance.java

Co-authored-by: Ignacio Vera <iverase@gmail.com>

* Revert reformatting of function descriptions

We should put this into a separate PR

* Github merged commit with incorrectly formatted whitespace

---------

Co-authored-by: Ignacio Vera <iverase@gmail.com>
2024-06-21 11:59:44 +02:00
Nik Everett
b35f0ed48d
ESQL: Make a table of all inline casts (#109713)
This adds a test that generates
`docs/reference/esql/functions/kibana/inline_cast.json` which is a json
object who's keys are the names of valid inline casts and who's values
are the resulting data types.

I also moved one of the maps we use to make the inline casts to
`DataType`, which is a place where we want it.
2024-06-18 06:23:11 -04:00
Nik Everett
2aade9dd66
ESQL: Warn about division (#109716)
When you divide two integers or two longs we round towards 0. Like
Postgres or Java or Rust or C. Other systems, like MySQL or SPL or
Javascript or Python always produce a floating point number. We should
warn folks about this. It's genuinely unexpected for some folks. OTOH,
converting into a floating point number would be unexpected for other
folks. Oh well, let's document what we've got.
2024-06-14 08:36:27 -04:00
Luigi Dell'Aquila
47edae4fbd
ES|QL: reduce memory footprint for MvAppendTests with shapes (#109517)
Fixing MvAppendTests CB exceptions by generating smaller geometries: the
test generates a lot of documents and the CB is too small for multiple
big shapes.

Fixes https://github.com/elastic/elasticsearch/issues/109409
2024-06-13 02:44:49 +10:00
Luigi Dell'Aquila
3d0c65d0c5
ES|QL: add tests for COALESCE() function on VERSION type (#109468) 2024-06-07 18:01:42 +02:00
Nik Everett
7916e6a231
ESQL: Implement LOOKUP, an "inline" enrich (#107987)
This adds support for `LOOKUP`, a command that implements a sort of
inline `ENRICH`, using data that is passed in the request:

```
$ curl -uelastic:password -HContent-Type:application/json -XPOST \
    'localhost:9200/_query?error_trace&pretty&format=txt' \
-d'{
    "query": "ROW a=1::LONG | LOOKUP t ON a",
    "tables": {
        "t": {
            "a:long":     [    1,     4,     2],
            "v1:integer": [   10,    11,    12],
            "v2:keyword": ["cat", "dog", "wow"]
        }
    },
    "version": "2024.04.01"
}'
      v1       |      v2       |       a       
---------------+---------------+---------------
10             |cat            |1
```

This required these PRs: * #107624 * #107634 * #107701 * #107762 *
#107923 * #107894 * #107982 * #108012 * #108020 * #108169 * #108191 *
#108334 * #108482 * #108696 * #109040 * #109045

Closes #107306
2024-06-07 11:38:51 +10:00
Parker Timmins
bb3ff8e924
ESQL: add REPEAT string function (#109220)
Add support for the string manipulation function REPEAT(string, number). This function concatenates the string argument with itself the specified number of times. If number is 0 an empty string is returned. If number is less than 0, null is returned and a warning is logged. If number is less than 0 and is a constant, the query will fail without executing.
2024-06-04 16:32:43 -05:00
Luigi Dell'Aquila
5f6e8f687b
ES|QL: add MV_APPEND function (#107001)
Adding `MV_APPEND(value1, value2)` function, that appends two values
creating a single multi-value. If one or both the inputs are
multi-values, the result is the concatenation of all the values, eg.

```
MV_APPEND([a, b], [c, d]) -> [a, b, c, d]
```

~I think for this specific case it makes sense to consider `null` values
as empty arrays, so that~ ~MV_APPEND(value, null) -> value~ ~It is
pretty uncommon for ESQL (all the other functions, apart from
`COALESCE`, short-circuit to `null` when one of the values is null), so
let's discuss this behavior.~

[EDIT] considering the feedback from Andrei, I changed this logic and
made it consistent with the other functions: now if one of the
parameters is null, the function returns null
2024-06-05 03:42:29 +10:00
Luigi Dell'Aquila
21952c7e36
ES|QL: add geo tests for mv_dedupe (#109342)
Adding more unit tests for MV_DEDUPE function, covering geo_point,
geo_shape, cartesian_point and cartesian_shape. This also adds docs for
Kibana.

Fixes https://github.com/elastic/elasticsearch/issues/108982
2024-06-05 03:33:14 +10:00
Iván Cea Fontenla
f16f71e2a2
ESQL: Add ip_prefix function (#109070)
Added ESQL function to get the prefix of an IP. It works now with both
IPv4 and IPv6. For users planning to use it with mixed IPs, we may need
to add a function like "is_ipv4()" first.

**About the skipped test:** There's currently a "bug" in the
evaluators//functions that return null. Evaluators can't handle them.
We'll work on support for that in another PR. It affects other
functions, like `substring()`. In this function, however, it only
affects in "wrong" cases (Like an invalid prefix), so it has no impact.

Fixes https://github.com/elastic/elasticsearch/issues/99064
2024-05-29 10:23:45 -04:00