mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-25 07:37:19 -04:00
b5c6c2da30
This implements `INLINESTATS`. Most of the heavy lifting is done by `LOOKUP`, with this change mostly adding a new abstraction to logical plans, and interface I'm calling `Phased`. Implementing this interface allows a logical plan node to cut the query into phases. `INLINESTATS` implements it by asking for a "first phase" that's the same query, up to `INLINESTATS`, but with `INLINESTATS` replaced with `STATS`. The next phase replaces the `INLINESTATS` with a `LOOKUP` on the results of the first phase. So, this query: ``` FROM foo | EVAL bar = a * b | INLINESTATS m = MAX(bar) BY b | WHERE m = bar | LIMIT 1 ``` gets split into ``` FROM foo | EVAL bar = a * b | STATS m = MAX(bar) BY b ``` followed by ``` FROM foo | EVAL bar = a * b | LOOKUP (results of m = MAX(bar) BY b) ON b | WHERE m = bar | LIMIT 1 ```
77 lines
2.1 KiB
Text
77 lines
2.1 KiB
Text
[[esql-commands]]
|
|
=== {esql} commands
|
|
|
|
++++
|
|
<titleabbrev>Commands</titleabbrev>
|
|
++++
|
|
|
|
[[esql-source-commands]]
|
|
// tag::source_commands[]
|
|
==== Source commands
|
|
|
|
An {esql} source command produces a table, typically with data from {es}. An {esql} query must start with a source command.
|
|
|
|
image::images/esql/source-command.svg[A source command producing a table from {es},align="center"]
|
|
|
|
{esql} supports these source commands:
|
|
|
|
* <<esql-from>>
|
|
* <<esql-row>>
|
|
* <<esql-show>>
|
|
|
|
// end::source_command[]
|
|
|
|
[[esql-processing-commands]]
|
|
// tag::proc_commands[]
|
|
==== Processing commands
|
|
|
|
{esql} processing commands change an input table by adding, removing, or changing
|
|
rows and columns.
|
|
|
|
image::images/esql/processing-command.svg[A processing command changing an input table,align="center"]
|
|
|
|
{esql} supports these processing commands:
|
|
|
|
* <<esql-dissect>>
|
|
* <<esql-drop>>
|
|
* <<esql-enrich>>
|
|
* <<esql-eval>>
|
|
* <<esql-grok>>
|
|
ifeval::["{release-state}"=="unreleased"]
|
|
* experimental:[] <<esql-inlinestats-by>>
|
|
endif::[]
|
|
* <<esql-keep>>
|
|
* <<esql-limit>>
|
|
ifeval::["{release-state}"=="unreleased"]
|
|
* experimental:[] <<esql-lookup>>
|
|
endif::[]
|
|
* experimental:[] <<esql-mv_expand>>
|
|
* <<esql-rename>>
|
|
* <<esql-sort>>
|
|
* <<esql-stats-by>>
|
|
* <<esql-where>>
|
|
|
|
// end::proc_command[]
|
|
|
|
include::source-commands/from.asciidoc[]
|
|
include::source-commands/row.asciidoc[]
|
|
include::source-commands/show.asciidoc[]
|
|
|
|
include::processing-commands/dissect.asciidoc[]
|
|
include::processing-commands/drop.asciidoc[]
|
|
include::processing-commands/enrich.asciidoc[]
|
|
include::processing-commands/eval.asciidoc[]
|
|
include::processing-commands/grok.asciidoc[]
|
|
ifeval::["{release-state}"=="unreleased"]
|
|
include::processing-commands/inlinestats.asciidoc[]
|
|
endif::[]
|
|
include::processing-commands/keep.asciidoc[]
|
|
include::processing-commands/limit.asciidoc[]
|
|
ifeval::["{release-state}"=="unreleased"]
|
|
include::processing-commands/lookup.asciidoc[]
|
|
endif::[]
|
|
include::processing-commands/mv_expand.asciidoc[]
|
|
include::processing-commands/rename.asciidoc[]
|
|
include::processing-commands/sort.asciidoc[]
|
|
include::processing-commands/stats.asciidoc[]
|
|
include::processing-commands/where.asciidoc[]
|