mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-25 07:37:19 -04:00
b5c6c2da30
This implements `INLINESTATS`. Most of the heavy lifting is done by `LOOKUP`, with this change mostly adding a new abstraction to logical plans, and interface I'm calling `Phased`. Implementing this interface allows a logical plan node to cut the query into phases. `INLINESTATS` implements it by asking for a "first phase" that's the same query, up to `INLINESTATS`, but with `INLINESTATS` replaced with `STATS`. The next phase replaces the `INLINESTATS` with a `LOOKUP` on the results of the first phase. So, this query: ``` FROM foo | EVAL bar = a * b | INLINESTATS m = MAX(bar) BY b | WHERE m = bar | LIMIT 1 ``` gets split into ``` FROM foo | EVAL bar = a * b | STATS m = MAX(bar) BY b ``` followed by ``` FROM foo | EVAL bar = a * b | LOOKUP (results of m = MAX(bar) BY b) ON b | WHERE m = bar | LIMIT 1 ``` |
||
|---|---|---|
| .. | ||
| dissect.asciidoc | ||
| drop.asciidoc | ||
| enrich.asciidoc | ||
| eval.asciidoc | ||
| grok.asciidoc | ||
| inlinestats.asciidoc | ||
| keep.asciidoc | ||
| limit.asciidoc | ||
| lookup.asciidoc | ||
| mv_expand.asciidoc | ||
| rename.asciidoc | ||
| sort.asciidoc | ||
| stats.asciidoc | ||
| where.asciidoc | ||