Commit Graph

349 Commits

Author SHA1 Message Date
Bogdan Pintea 7af45cc52e
ESQL: Document the cast operator (::) (#107871)
This documents the cast operator, `::`.
2024-04-25 10:10:59 -04:00
Bogdan Pintea 31f2fb85df
Docs: move STARTS/ENDS_WITH under string functions in the docs (#107867)
This moves the STARTS_WITH and ENDS_with under the strings functions
section (as they're not operators).
2024-04-25 09:41:11 -04:00
Bogdan Pintea 9482673fbe
Docs: move base64 functions under string functions (#107866)
This moves the TO_BASE64 and FROM_BASE64 from the type conversion
functions under string functions (they take a string as input and output
another string).
2024-04-25 13:57:45 +02:00
Fang Xing ad15d50863
[ES|QL] more doc generation via annotations (#107541)
Annotations for math functions, datetime functions, string functions, type conversion functions.
2024-04-22 14:43:36 -04:00
Mark Tozzi f620961812
[ESQL] Add in the autogenerated docs for a bunch of functions (#107633) 2024-04-18 14:09:30 -04:00
Liam Thompson 33a71e3289
[DOCS] Refactor book-scoped variables in `docs/reference/index.asciidoc` (#107413)
* Remove `es-test-dir` book-scoped variable

* Remove `plugins-examples-dir` book-scoped variable

* Remove `:dependencies-dir:` and `:xes-repo-dir:` book-scoped variables

- In `index.asciidoc`, two variables (`:dependencies-dir:` and `:xes-repo-dir:`) were removed.
- In `sql/index.asciidoc`, the `:sql-tests:` path was updated to fuller path
- In `esql/index.asciidoc`, the `:esql-tests:` path was updated idem

* Replace `es-repo-dir` with `es-ref-dir`

* Move `:include-xpack: true` to few files that use it, remove from index.asciidoc
2024-04-17 14:37:07 +02:00
Liam Thompson 84f1b26953
Update esql-version.asciidoc (#107547)
Fix heading misalignment and typo.
2024-04-17 09:54:56 +02:00
Bogdan Pintea a2c2e8fe47
ESQL: extend BUCKET with spans. Turn it into a grouping function (#107272)
This extends `BUCKET` function to accept a two-parameters-only
invocation: the first parameter remains as is, while the second is a
span. It can be a numeric (floating point) span, if the first argument
is numeric, or a date period or time duration, if the first argument is
a date.

Also, the function can now be invoked with the alias BIN.

Additionally, the function has been turned into a grouping-only function
and thus can only be used within a `STATS` command.
2024-04-16 12:57:18 +02:00
Fang Xing 353abef214
[ES|QL] Base64 decoding and encoding functions (#107390)
* add base64 functions
2024-04-15 18:39:26 -04:00
Alexander Spies 71b276da90
ESQL: Add version to docs (#107225)
Docs for https://github.com/elastic/elasticsearch/pull/106824.

Does not cover the [REST API
specs](https://github.com/elastic/elasticsearch/blob/main/rest-api-spec/src/main/resources/rest-api-spec/api/esql.query.json)
as these don't cover the request body.
2024-04-15 10:50:00 -04:00
Nik Everett aac17616a3
ESQL: Improve tests and docs for some functions (#107331)
This improves the tests and docs for a few functions, specifically `E`,
`FLOOR`, `PI`, `POW`, and `ROUND`. The examples and tested signatures
will get copied into the docs and kibana signatures.


Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
2024-04-11 12:41:56 -04:00
Fang Xing 0075c1fb1e
[ES|QL] String literal implicit casting (#106932)
* string literal casting for scalar functions and arithmetic operations.
2024-04-10 21:20:12 -04:00
Craig Taverner d915b964ba
Rename ST_CENTROID to ST_CENTROID_AGG (#107226)
* Rename ST_CENTROID to ST_CENTROID_AGG

In order to allow development of a scalar ST_CENTROID function.

* Fix table alignment
2024-04-10 17:56:45 +02:00
Liam Thompson 943885d0cd
[DOCS][ESQL] Render locate function docs (#107305) 2024-04-10 15:12:20 +02:00
Bogdan Pintea 8bcbc97128
Rename generated docs for (renamed) BUCKET func (#107299)
This checks in the generated-by-test doc files for newly renamed BUCKET
function.
2024-04-10 06:50:12 -04:00
Bogdan Pintea d6f9d1e69e
ESQL: Rename AUTO_BUCKET to just BUCKET (#107197)
This renames the function AUTO_BUCKET to just BUCKET.
It also removes the experimental tagging of the function in the docs, making it generally available.
2024-04-10 12:21:08 +02:00
Nik Everett 96227a1970
ESQL: Generate kibana inline docs (#106782)
This takes a stab at generating the markdown files that Kibana uses for
its inline help. It doesn't include all of the examples because the
`@Example` annotation is not filled in - we're tracking that in
https://github.com/elastic/elasticsearch/issues/104247#issuecomment-2018944371

There are some links in the output and they are in markdown syntax. We
should figure out how to make them work for kibana.
2024-04-09 14:19:48 -04:00
Nik Everett aba7566409
ESQL: Better tests to AUTO_BUCKET (#107228)
This improves the tests for AUTO_BUCKET marginally, specifically so that
it tests all valid combinations of arguments and generates a correct
types table. This'll combine nicely with #106782 to generate the
signatures that kibana needs for it's editor.
2024-04-09 12:22:15 -04:00
Liam Thompson 3dccc66c2c
[DOCS][ESQL] Rename _Learning ESQL_ to _ESQL reference_ (#107259) 2024-04-09 14:16:24 +02:00
Liam Thompson c1ef120fe2
[Docs][ESQL] Make functions reference more digestible (#107258)
* [Docs][ESQL] Make functions reference more digestible

* Remove redundant links
2024-04-09 14:15:54 +02:00
Luigi Dell'Aquila 2588c72a52
ES|QL: Add unit tests and docs for DATE_TRUNC() (#107145) 2024-04-09 10:41:34 +02:00
Craig Taverner a7b38394d9
ESQL: Support ST_DISJOINT (#107007)
* WIP Started developing ST_DISJOINT

Initially based on ST_INTERSECTS

* Fix functions list and add spatial point integration tests

* Update docs/changelog/107007.yaml

* More tests for shapes and cartesian-multigeoms

* Some more tests to highlight issues with DISJOINT on cartesian point indices

* Disable Lucene push-down for DISJOINT on cartesian point indices

* Added docs for ST_DISJOINT

* Support DISJOINT in the lucene-pushdown code for cartesian point indexes

* Re-enable push-to-source for DISJOINT on cartesian_point indices

* Fix docs example

* Try fix internal docs links which are not being rendered

* Fixed disjoint on empty geometry

* Added tests on empty linestring, and changed lucene push-down to exception

In lucene code only LineString can be empty, but in Elasticsearch even that is not allowed, resulting in parsing errors. So we cannot get to this code in the lucene push-down and now throw an error instead. The tests now assert on the warnings.

Note that for any predicate DISJOINT and INTERSECTS alike, the predicate fails, because the parsing error results in null, the function returns null, the predicate interprets this as false, and no documents match. This null-in-null-out rule means that DISJOINT and INTERSECTS give the same answer on invalid geometries.
2024-04-08 12:26:26 +02:00
Tommaso Teofili 54eeb622d5
Add ES|QL Locate function (#106899)
* Add ES|QL Locate function
2024-04-05 15:29:54 +02:00
Ioana Tagirta 7b254218fb
Add ES|QL signum function (#106866)
* Add ES|QL signum function

* Update docs/changelog/106866.yaml

* Skip csv tests for versions older than 8.14

* Reference layout docs file and fix instructions for adding functions

* Break csv specs by param type

* More tests
2024-04-04 09:48:35 +02:00
Bogdan Pintea f9ae6db319
ESQL: Add docs for the OPTIONS directive (#107013)
This adds the docs for the newly added `OPTIONS` directive to `FROM`.
2024-04-03 16:23:36 +02:00
Nik Everett b97e2d61fb
ESQL: Fixup docs for LOG and LOG10 (#106963)
This merges all of the hand written docs for `LOG` and `LOG10` into the
annotations which updates the `META FUNCTIONS` - now it'll always be the
same as the docs. This also deletes the hand maintained docs and let's
the documentation generation process rebuild it.
2024-04-03 09:46:32 -04:00
Nik Everett c74490c137
ESQL: Enable VALUES agg for datetime (#107016)
When I wrote the `VALUES` agg I didn't plug it in for `datetime` fields.
Ooops. We just have to plug it in.
2024-04-03 07:42:40 -04:00
Craig Taverner 2380492fac
ESQL: Support ST_CONTAINS and ST_WITHIN (#106503)
* WIP Started adding ST_CONTAINS

* Add generated evaluators

* Reduced warnings and use correct evaluators

* Refactored tests to remove duplicate code, and fixed Contains/multi-components

* Gradle build disallows using getDeclaredField

* Fixed cases where rectangles cross the dateline

* Fixed meta function tests

* Added ST_WITHIN to support inverting ST_CONTAINS

If the ST_CONTAINS is called with the constant on the left, we either have to create a lot more Evaluators to cover that case, or we have to invert it to ST_WITHIN. This inversion was a much easier option.

* Simplify inversion logic

* Add comment on choice of surrogate approach

* Add unit tests and missing fold() function

* Simple code cleanup

* Add integration tests for literals

* Add more integration tests based on actual data

* Generated documentation files

* Add documentation

* Fixed failing function count test

* Add tests that push-to-source works for ST_CONTAINS and ST_WITHIN

* Test more combinations of WITH/CONTAINS and literal on right and left

This also verifies that the re-writing of CONTAINS to WITHIN or vice versa occurs when the literal is on the left.

* test that physical planning also handles doc-values from STATS

* Added more tests for WITHIN/CONTAINS together with CENTROID

This should test the doc-values for points.

* Add cartesian_point tests

* Add cartesian_shape tests

* Disable Lucene-push-down for CARTESIAN data

This is a limitation in Lucene, which we could address as a performance optimization in a future PR, but since it probably requires Lucene changes, it cannot be done in this work.

* Fix doc links

* Added test data and tests for cartesian multi-polygons

Testing INTERSECTS, CONTAINS and WITHIN with multi-polydon fields

* Use required features for spatial points, shapes and centroid

* 8.13.0 is not yet historical version

This needs to be reverted as soon as 8.13.0 is released

* Added st_intersects and st_contains_within 'features'

* Code review updates

* Re-enable lucene push-down

* Added more required_features

* Fix point contains non-point

* Fix point contains point

* Re-enable lucene push-down in tests too

Forgot to change the physical planner unit tests after re-enabling lucene push-down

* Generate automatic docs

* Use generated examples docs

* Generated examples use '-result' prefix (singular)

* Mark spatial functions as preview/experimental
2024-04-02 10:31:00 +02:00
Nik Everett 00b0c54a74
ESQL: Generate docs for the trig functions (#106891)
This updates the in-code docs on the trig functions to line up with the
docs, removes the docs, and uses the now mostly identical generated
docs. This means we only need to document these functions in one place -
right next to the code.
2024-03-29 12:24:31 -04:00
Ioana Tagirta b85d4b1dbb
Fix typo in functions/README.md (#106870) 2024-03-28 14:02:47 +01:00
Luigi Dell'Aquila 3e406e2d57
ES|QL: Improve support for TEXT fields in functions (#106810)
Re-submitting https://github.com/elastic/elasticsearch/pull/106688 after
a revert due to a conflict after merge
2024-03-27 08:47:09 -04:00
Luigi Dell'Aquila 720188e95f Revert "ES|QL: Improve support for TEXT fields in functions (#106688)"
This reverts commit 62e3e5fd1b.
2024-03-27 12:14:02 +01:00
Luigi Dell'Aquila 62e3e5fd1b
ES|QL: Improve support for TEXT fields in functions (#106688) 2024-03-27 12:08:10 +01:00
Nik Everett d6d1edd529 ESQL: Fix typo in docs readme
s/and/are/
2024-03-25 09:22:20 -04:00
Nik Everett 35fcc9a29d
ESQL: Add README.md to docs (#106698)
This explains how to run the tests that build the docs. I tried to add
it in #106577 but the sync code deleted it. So I fixed that too.
2024-03-22 16:30:59 -04:00
Nik Everett 7c46c735e4
ESQL: Generate docs for ceil (#106616)
This replaces the hand maintained docs for `CEIL` and with the docs
generated by the tests. There shouldn't be any diff in the generated
docs.
2024-03-21 13:01:15 -04:00
Nik Everett fa00e6176f
ESQL: Values aggregation function (#106065)
This creates the `VALUES` aggregation function which buffers all field
values it receives and emits them as a multivalued field. It can use a
significant amount of memory and will circuit break if it uses too much
memory, but it's really useful for putting together self-join-like
behavior. It sort of functions as a stop-gap measure until we have more
self-join style things.

In the future we'll have spill-to-disk for aggregations and, likely,
some kind of self-join command for aggregations at least so this will be
able to grow beyond memory. But for now, memory it is.

Example:

```
  FROM employees
| EVAL first_letter = SUBSTRING(first_name, 0, 1)
| STATS first_name=VALUES(first_name) BY first_letter
| SORT first_letter
;

                                        first_name:keyword | first_letter:keyword
            [Anneke, Alejandro, Anoosh, Amabile, Arumugam] | A
[Bezalel, Berni, Bojan, Basil, Brendon, Berhard, Breannda] | B
                  [Chirstian, Cristinel, Claudi, Charlene] | C
                      [Duangkaew, Divier, Domenick, Danel] | D
```

I made this work for everything but `geo_point` and `cartesian_point`
because I'm not 100% sure how to integrate with those. We can grab those
in a follow up.

Closes #103600
2024-03-21 12:52:04 -04:00
Nik Everett 34899069b6
ESQL: Generate a few more docs (#106577)
And improve the error message on csv test failures.
2024-03-21 10:51:35 -04:00
Nik Everett a1305373f2
ESQL: Use generated docs for abs and acos (#106510)
ESQL: Use generated docs for abs and acos
2024-03-20 16:32:12 -04:00
Fang Xing 5d05d81854
[ES|QL] Remove variadic functions' optional args from the output of show functions (#106454)
* remove optional args from the output of show functions optionalArgs, argNames and argTypes for variadic functions
* consistent names for arguments
2024-03-20 10:15:49 -04:00
Nik Everett 1541da5e65
ESQL: Generate more docs (#106367)
This modifies the ESQL test infrastructure to generate more of the
documentation for functions. It generates the *Description* section, the
*Examples* section, and the *Parameters* section as separate files so we
can use them as needed. It also generates a `layout` file that's just
a guess as to how to render the whole thing. In some cases it'll work
and we can use that instead of hand maintaining a "top level"
description file for the function.

Most newly generated files are unused. We have to chose to pick them up
by replacing the sections we were manually maintaining with an include
of the generated section. Or by replacing the entire hand maintained
file with the generated top level file.

Relates to #104247
2024-03-19 15:40:13 -04:00
Craig Taverner e14dd54ae9
Support ST_INTERSECTS between two geometry columns (#104907)
* Support ST_INTERSECTS between geometry column and other geometry or string

* Pushdown to lucene for ST_INTERSECTS on GEO_POINT

* Get geo_shape working in ST_INTERSECTS bypassing SingleValueQuery

* Initial work to support cartesian shape queries in ESQL

* Fixed CSV tests for combined ST_INTERSECTS and ST_CENTROID

* Fixed bug in point-in-shape query for CARTESIAN_POINT

* Added unit tests for SpatialIntersects and fixed a few bugs found

* Added comments to public ShapeQueryBuilder class

* Move calls to random() later to avoid security exception

* Refined type checking support in ST_INTERSECTS

Improved the combinations supported as preparation for removing the uly try/catch way of detecting the difference between WKT and WKB in some code.

* Fixed bugs in incorrect use of doc-values in parameter type matching

Also made a few reminfments, including removing one try/catch approach to differentiating between WKT and WKB.

* Removed second place where we used try/catch to differentiate WKT from WKB

This was a workaround for a mistake in the planning, where we incorrectly mapped incoming types to the wrong FieldEvaluators. We fixed that mistake in an earlier commit.

* Fixed flaky tests were GEO was treated as CARTSIAN

We assumed if the incoming types were constants, they had no CRS, even when they did, which was wrong. For shapes crossing the dateline this lead to different (incorrect) behaviour.

* Fixed a flaky test by removing some point==point optimizations

* Moved spatial intersects to 'spatial' package

When we developed the ST_CENTROID work, this was requested, so let's do it here too.

* Use normal switch on enums

* Cleanup some static utility methods

Now all code paths that can convert a constant string to a geometry use the same code.

* Fixed bugs with non-quantized coordinates, and cleaned up code a little

* Fixed failing test after change to evaluator class names

* Refactored SpatialRelatesFunction into three files, and made evaluatorRules static

This was a general cleanup, making the code more organized, but did also achieve static evaluator rules so we don't re-created these on every query parsing.

* Fixed compile error after rebase

* Removed ConstantAndConstant support, using fold() correctly instead

* better error on circles

* Make sure compound predicates are supported in use-doc-values pushdown

* Testing ENRICH with ST_INTERSECTS

This required adding new data for an ENRICH index, and this data could be tested with a few other related tests, which were also added.

* Added missing mixed-cluster rules for testing only with 8.14

* Fixed some mixed-cluster issues where we failed to mark test for only 8.14

Also added an interesting polygon-polygon intersection case from real data.

* Fix flaky test where cartesian polygons were generated from geo

* Remove support for string literals in ST_INTERSECTS

* Fix failing tests after removing string support

* Removed unused code from previous string literal support (WKT parsing)

* Support case where both fields are points and doc-values

If we have an ST_INTERSECTS and an ST_CENTROID, the centroid asks to load the points as doc-values, and the ST_INTERSECTS needs to therefor support two doc-values points.

* Disallow more than one field from doc-values for ST_INTERSECTS

* Remove unused evaluator classes

* Add tests for multiple doc-values if not in same intersects

* Fix errors after rebase on main

* Fixed bug in missing support for spatial function expressions in EVAL

When a spatial aggregate expects doc-values, this was not being communicated to spatial functions in EVAL, only in WHERE.

* Reduce flaky tests when reading directly from enrich source indices

The test framework does not expect enrich source indices to be used directly in queries, leading to duplicated results on multi-node clusters, so we edit the queries to be less sensitive to this case.

* Fixed failing test

* Code style

* Fixed test file name and added function name annotation

* Added documentation for st_intersects

* Fixed failing show functions test

* Code review changes, notably simplifying the type resolution

* Fixed broken docs link
2024-03-19 17:58:37 +01:00
Bogdan Pintea 1fbb085bd0
ESQL: Rename `SHOW FUNCTIONS` to `META FUNCTIONS` (#106362)
This renames the `show functions` command to `meta functions`.
It also removes its documentation and usage tracking.
2024-03-19 13:02:34 +01:00
Craig Taverner 002ed8d49d
ESQL: Fix error on sorting unsortable geo_point and cartesian_point (#106351)
* Fix error on sorting unsortable geo_point and cartesian_point

Without a LIMIT the correct error worked, but with LIMIT it did not. This fix mimics the same error with LIMIT and adds tests for all three scenarios:
* Without limit
* With Limit
* From row with limit

* Update docs/changelog/106351.yaml

* Add tests for geo_shape and cartesian_shape also

* Updated changelog

* Separate point and shape error messages

* Move error to later so we get it only if geo field is actually used in sort.

* Implemented planner check in Verifier instead

This is a much better solution.

* Revert previous solution

* Also check non-field attributes so the same error is provided for ROW

* Changed "can't" to "cannot"

* Add unit tests for verifier error

* Added sort limitations to documentation

* Added unit tests for spatial fields in VerifierTests

* Don't run the new yaml tests on older versions

These tests mostly test the validation errors which were changed only in 8.14.0, so should not be tested in earlier versions.

* Simplify check based on code review, skip duplicate forEachDown
2024-03-14 23:16:53 +01:00
Liam Thompson 5f6b3ff7e6
[DOCS][ESQL] Add link to getting started notebook (#106345) 2024-03-14 17:33:31 +01:00
Liam Thompson 5c06c58b9f
[DOCS] Remove CCS limitation for 8.13+ (#106343) 2024-03-14 16:49:07 +01:00
Fang Xing e6d1c90501
[ES|QL] Add mv_sort (#106095)
* add mv_sort
2024-03-13 12:04:12 -04:00
Nik Everett 8485dfee3f
Mute ESQL async docs tests (#106294)
They are failing and tracked by #104013.
2024-03-13 11:08:12 -04:00
Fang Xing 8d839e3b52
add mv_slice and mv_zip (#106147) 2024-03-11 23:02:57 -04:00
Nhat Nguyen 863cbf6bb4
Add docs for cross cluster search in ES|QL(#105934)
This change adds a documentation for cross cluster search in ES|QL.

Relates #102954
Closes #105529
2024-03-07 13:15:01 -08:00
Craig Taverner 8d93a934f6
Add two new OGC functions ST_X and ST_Y (#105768)
* Add two new OGC functions ST_X and ST_Y

Recently Nik did work that involved extracting the X and Y coordinates from geo_point data using `to_string(field)` followed by a DISSECT command to re-parse the string to get the X and Y coordinates.

This is much more efficiently achieved using existing known OGC functions `ST_X` and `ST_Y`.

* Update docs/changelog/105768.yaml

* Fixed invalid changelog yaml

* Fixed mixed cluster tests

* Fixed tests and added docs

* Removed false impression that these functions were different for geo/cartesian

With the use of WKB as the core type in the compute engine, many spatial functions are actually the same between these two types, so we should not give the impression they are different.

* Code review comments and reduced object creation.

* Revert temporary StringUtils hack, and fix bug in x/y extraction from WKB

* Revert object creation reduction

* Fixed mistakes in documentation
2024-03-06 11:19:54 +01:00
Craig Taverner 85cd204317
Fix automatic generation of spatial function types files (#105766)
* Fix automatic generation of spatial function types files

The automatic mapping of spatial function names from class names was not working for spatial types, so the automatic generation of these files did not happen, and in fact existing files were deleted.

In addition, the generation of aggregation functions types does not yet exist at all, so the st_centroid.asciidoc file was always deleted. Until such support exists, this files contents will be moved back into the function definition file.

The railroad diagrams for syntax are now also created, however, not all functions in the documentation actually use these, and certainly none of the `TO_*` type-casting functions do, so we'll not include links to them from the docs, and leave that to the docs team to decide. Personally, while these diagrams are pretty, they contain no additional informational content, and in fact give a cluttered impression to the documentation visual appeal.

* Refined to use an annotation which is more generic
2024-03-05 18:04:09 +01:00
Luigi Dell'Aquila f06a580eb7
ES|QL: Set default query LIMIT to 1000 (#105618) 2024-02-21 09:25:25 +01:00
Bogdan Pintea f2550a8055
ESQL: Document `_source` requirements (#105321)
This documents the requirements for _source availability: - not
supported with disabled _source; - experimental support for synthetic.
2024-02-09 10:35:30 -05:00
Costin Leau fca3fc82be
ESQL: Grammar - FROM METADATA no longer require [] (#105221)
Remove usage of [ ] through-out the grammar, in this case inside
 FROM METADATA.
2024-02-08 07:03:19 -08:00
Bogdan Pintea f26691f987
ESQL: Mark a few features as experimental (#105263)
Mark the following features as experimental in the docs:
* `AUTO_BUCKET()`
* `SHOW FUNCTIONS`
* unsigned_long type
2024-02-07 17:28:13 -08:00
Liam Thompson fb743da0d7
[DOCS][ESQL] Document _source metadata field (#105237)
* [DOCS][ESQL] Document _source metadata field

* 🚗 Minor copyedit to entire page
2024-02-07 15:57:51 +01:00
Fang Xing 0fb5dee75b
[ES|QL] Add function log(base, value) (#104913)
Add a new scalar function log
2024-02-06 13:03:53 -05:00
Nik Everett a7ca62de8e
Document ESQL docs examples (#105197)
This adds some docs to the top of `docs.csv-spec` and
`docs-IT_tests_only.csv-spec` telling folks not to add more stuff there
and instead put new examples into whatever files they line up with. It
also shifts some things out of the file to "prime the pump" on cleaning
it up.
2024-02-06 12:34:02 -05:00
Liam Thompson 8a3920ab85
[DOCS] Update `KEEP` command with duplicate precedence rules (#105146) 2024-02-06 15:55:41 +01:00
Liam Thompson 2c83881a0b
[DOCS][ESQL] Document locale rest parameter (#104985) 2024-02-06 10:36:51 +01:00
Abdon Pijpelink 980bc500b0
[DOCS] Support for nested functions in ES|QL STATS...BY (#104788)
* Document nested expressions for stats

* More docs

* Apply suggestions from review

- count-distinct.asciidoc
  - Content restructured, moving the section about approximate counts to end of doc.

- count.asciidoc
  - Clarified that omitting the `expression` parameter in `COUNT` is equivalent to `COUNT(*)`, which counts the number of rows.

- percentile.asciidoc
  - Moved the note about `PERCENTILE` being approximate and non-deterministic to end of doc.

- stats.asciidoc
  - Clarified the `STATS` command
  -  Added a note indicating that individual `null` values are skipped during aggregation

* Comment out mentioning a buggy behavior

* Update sum with inline function example, update test file

* Fix typo

* Delete line

* Simplify wording

* Fix conflict fix typo

---------

Co-authored-by: Liam Thompson <leemthompo@gmail.com>
Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
2024-01-30 19:29:12 +01:00
Craig Taverner b0f978f41e
Support points as input types to the TO_GEOSHAPE and TO_CARTESIANSHAPE functions (#104799)
* Support points as input types to TO_GEOSHAPE and TO_CARTESIAN_SHAPE

* Update docs for TO_GEOSHAPE and TO_GEOPOINT
2024-01-29 15:26:40 +01:00
Abdon Pijpelink ef8c1e3ef0
[DOCS] Add DATE_DIFF function (#104794) 2024-01-29 09:51:46 +01:00
Abdon Pijpelink e87c49cb4b
[DOCS] Improve ES|QL functions reference for functions E-Z (#104623)
* Functions E-Z

* Incorporate changes from #103686

* More functions

* More functions

* Update docs/reference/esql/functions/floor.asciidoc

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>

* Update docs/reference/esql/functions/left.asciidoc

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Alexander Spies <alexander.spies@elastic.co>

* Review feedback

* Fix geo_shape description

* Change 'colum'/'field' into 'expressions'

* Review feedback

* One more

---------

Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
Co-authored-by: Alexander Spies <alexander.spies@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-01-25 16:32:24 +01:00
Craig Taverner eb1c490264
ESQL: Support reading points from doc-values for STATS (#104218)
* Add initial structure for ST_CENTROID

* Revert "Revert stab at implementing forStats for doc-values vs source"

This reverts commit cfc4341bf4.

* Refined csv-spect tests with st_centroid

* Spotless disagrees with intellij

* Fixes after reverting fieldmapper code to test GeoPointFieldMapper

* Get GeoPointFieldMapperTests working again after enabling doc-values reading

* Simplify after rebase on main

In particular, field-mappers that do not need to know about fields can have simpler calls.

* Support local physical planning of forStats attributes for spatial aggregations

* Get st_centroid aggregation working on doc-values

We changed it to produce BytesRef, so we don't (yet) need any doc-values types.

* Create both DocValues and SourceValues versions of st_centroid

* Support physical planning of DocValues and SourceValues SpatialCentroid

* Improve test for physical planning of DocValues in SpatialCentroid

* Fixed show functions for st_centroid

* More st_centroid tests with mv_expand

To test single and multi-value centroids

* Fix st_centroid from point literals

The blocks contained BytesRef byte[] with multiple values, and we were ignoring the offsets when decoding, so decoding the first value over and over instead of decoding the subsequent values.

* Teach CsvTests to handle spatial types alternative loading from doc-values

Spatial GEO_POINT and CARTESIAN_POINT load from doc-values in some cases. If the physical planner has planned for this, we need the CsvTests to also take that into account, changing the type of the point field from BytesRefBlock to LongBlock.

* Fixed failing NodeSubclassTests

Required making the new constructor public and enabling Set as a valid parameter in the test framework.

* More complex st_centroid tests and fixed bug with multiple aggs

When there were multiple agregations in the same STATS, we were inadvertently re-ordering them, causing the wrong Blocks to be fed to the wrong aggregator in the coordinator node.

* Update docs/changelog/104218.yaml

* Fix automatically generated changelog file

* Fixed failing test

The nodes can now sometimes be Set, which is also a Collection, but not a List, and therefor never can be a subset of the children.

* More tests covering more combinations including MV_EXPAND and grouping

* Added cartesian st_centroid with grouping test

We could not add MV_EXPAND tests since the cartesian data does not have multi-value columns, but the geo_point tests are sufficient for this since they share the same code.

* Reduce flaky tests by sorting results

* Reduce flaky tests by sorting results

* Added tests for stats on stats to ensure planner coped

* Add unit tests to ensure doc-values in query planning complex cases

* Some minor updates from code review

* Fixes after rebase on main

* Get correct error message on unsupported geo_shape for st_centroid

* Refined point vs shape differences after merging main

* Added basic docs

* Delete docs/changelog/104218.yaml

* Revert "Delete docs/changelog/104218.yaml"

This reverts commit 4bc596a442.

* Fixed broken docs tag link

* Simplify BlockReaderSupport in MapperTestCase from code review

* Moved spatial aggregations into a sub-package

* Added some more code review updates, including nested tests

* Get nested functions working, if only from source values for now

* Code review update

* Code review update

* Added second location column to airports for wider testing

* Use second location in tests, including nulls

Includes a test fix for loading and converting nulls to encoded longs.

* Fixed bug supporting multi spatial aggregations in the local node

The local physical planner only marked a single field for stats loading, but marked all spatial aggregations for stats loading, which load to only one aggregation getting the right data, while the rest would get the wrong data.

* Renamed forStats to fieldExtractPreference for clarity

Now the planner decides whether to load data from doc-values. To remove the confusion of preferDocValues==false in the non-spatial cases, we use an ENUM with the default value of NONE, to make it clear we're leaving the choice up to the field type in all non-spatial cases.

* EsqlSpecIT was failing on very high precision centroids on different computers

This was not reproducible on the development machine, but CI machines were sufficiently different to lead to very tiny precision changes over very large Kahan summations. We fixed this by reducing the need for precision checks in clustered integration tests.

* Delete docs/changelog/104218.yaml

* Revert "Delete docs/changelog/104218.yaml"

This reverts commit 12c6980881.

* Fixed changelog entry
2024-01-23 16:04:45 +01:00
Anton Dosov 990b603cbd
[Docs] Add ES|QL CSV limitations in Kibana (#104530)
Mentioned that the CSV rows limit is also 10,000 rows. CSV export added here: https://github.com/elastic/kibana/issues/173390
2024-01-18 16:32:57 +01:00
Abdon Pijpelink ef867c56a6
Update esql-security-solution.asciidoc (#104531)
Fixed a typo
2024-01-18 15:48:43 +01:00
Craig Taverner 9ac356bbcf
Update docs with support for geo_shape and cartesian_shape  (#104480)
* Document to_geoshape and to_cartesianshape

* Note that geo_point and point are now supported Elasticsearch types

* Fix doc links
2024-01-18 13:00:38 +01:00
Costin Leau 607185b280
ESQL: Nested expressions inside stats command (#104387)
Allow nested expressions to be used both for grouping or inside
 aggregate functions inside the stats command.
As such the grammar has been tweaked to allow the stats group to have 
 optional aliasing.
As part of this fix, preserve the original field declaration (including 
 spaces) for implicit aliases.
Improve validation for incorrect aggregate function use (as arguments,
 grouping or inside evals).

Fix #99828
2024-01-17 15:49:20 -08:00
Nik Everett 919d282aa6
ESQL: Add option to drop null fields (#102428)
This adds an option to drop columns that are entirely null from the
results. Is this something we want?
2024-01-17 09:06:19 -05:00
Ignacio Vera 585face0cf
ESQL: Support loading shapes from source into WKB blocks (#104269)
This commit adds support for reading geo_shape and shape fields into wkb blocks so they can use top project the 
data to the result of a ES|QL query.
2024-01-17 14:55:37 +01:00
Luigi Dell'Aquila ad28dc9a6c
ESQL: Add TO_UPPER and TO_LOWER functions (#104309) 2024-01-15 11:58:57 +01:00
Chris Hegarty 5d6b833fe6
ES|QL Minor async query doc parameter clarification (#104327)
This commit adds a minor clarification to an ESQL async query doc
parameter.
2024-01-12 11:50:00 -05:00
Ignacio Vera f64147f6c1
ESQL: Remove the possibility of CartesianPoint or GeoPoint literal to a long (#104197) 2024-01-11 14:25:48 +01:00
Marco Liberati 3145e9f9fc
[ES|QL] Annotate all ESQL functions (for SHOW FUNCTIONS) (#103686)
* 🔧 Initial annotations

* ✏️ Add substring doc

* 🏷️ Fix imports

* ✏️ Add annotations for string fns

* ♻️ Fix issues

* :rotatin_light: Fix linting issues

* ✏️ Add more annotations

* :rotatin_light: Fix linting issues

* ♻️ Add missing import

* ✏️ Add more annotations

* 🚨 Fix linting

*  Fix many tests for new annotations

*  Fix more tests

* 🐛 Fix missing flag

*  Annotate new functions

*  fix more tests

*  Fix signature issue

*  Make all csv tests pass

*  Fix remaining tests

*  New assets from annotations

*  Refactor test

*  Fix updated signature
2024-01-11 10:15:30 +01:00
Bogdan Pintea 9f6e5a4ccf
ESQL: Add Warning tests for all remaining functions (#103739)
This adds unit tests cases for all the functions that were missing tests
checking on the correct generation of the Warning headers in case the
execution raised an Exception that lead to a `null` result.
2024-01-10 22:27:13 +01:00
Mark Tozzi 282f0f0a00
[ESQL] Remove is_nan, is_finite, and is_infinite (#104091)
A while ago we decided we weren't going to support NaN or infinite values in the language. Removing these functions is part of that effort.
2024-01-09 14:51:32 -05:00
Nik Everett 5ef5dca334
ESQL: `MV_FIRST` and `MV_LAST` (#103928)
This creates the `MV_FIRST` and `MV_LAST` functions that return the
first and last values from a multivalue field. They are noops from a
single valued field. They are quite similar to `MV_MIN` and `MV_MAX`
except they work on positional data rather than relative size. That
sounds like a large distinction, but in practice our multivalued fields
are often sorted. And when they operate on sorted arrays `MV_MIN` does
*the same* thing as `MV_FIRST`.

But there are some cases where it really does matter - say you are
`SPLIT`ing something - so `MV_FIRST(SPLIT("foo;bar;baz", ";"))` gets you
`foo` like you'd expect. No sorting needed.

Relates to #103879
2024-01-09 08:46:34 -05:00
Luigi Dell'Aquila 770fc19b14
ESQL: add date_diff function (#104118)
Same as https://github.com/elastic/elasticsearch/pull/103208

Fixes #101942

We had to revert it after a Checkstyle failure (strange it didn't pop up
in the CI before merging)
2024-01-09 07:03:58 -05:00
ChrisHegarty 8500d33841 Fix doc typos 2024-01-09 10:54:23 +00:00
David Turner 943b2eae70 Revert "Esql/create DATE_DIFF function (#103208)"
This reverts commit ec2e18536d.
2024-01-09 09:50:48 +00:00
Nicolas Gras ec2e18536d
Esql/create DATE_DIFF function (#103208) 2024-01-09 10:37:42 +01:00
Chris Hegarty f14d87be58
Add ES|QL async query api docs (#104054)
This commit adds detailed API docs for the ES|QL async apis, as well as moving the narrative to the ES|QL specific REST docs. Additionally, a few top-level lists are reflowed to reflect that there are now multiple APIs.
2024-01-09 09:17:02 +00:00
Craig Taverner 6111d967a4
Fix missing links in geo_point docs for ESQL (#104073) 2024-01-08 23:09:07 +01:00
Bogdan Pintea a5aa900358
ESQL: Update the use of some user-caused exceptions (#104046)
This updates the use of the exceptions subclassed from
`QlServerException` when the failure reason is user-caused. This ensures
that a 400-class response is returned, instead of a 500-class one.
2024-01-08 21:13:20 +01:00
Abdon Pijpelink c6723a3c1d
[DOCS] More ES|QL backtick examples (#103995) 2024-01-08 12:13:33 +01:00
Abdon Pijpelink 3768fa6148
[DOCS] ES|QL backtick changes in 8.13 (#103958) 2024-01-08 12:13:16 +01:00
Chris Hegarty a6c642d4ac
Enable async in ES|QL REST tests (#103700)
This commit enables async in ES|QL REST tests, and also fixes a couple of issue relating to warnings and completion.
2024-01-06 22:06:04 +00:00
Nik Everett fac60e5803
ESQL: Delay finding field load infrastructure (#103821)
This optimizes loading fields across many, many indices by resolving the
field loading infrastructure when it's first needed rather than up
front. This speeds things up because, if you are loading from many many
shards, you often don't need to set up the field loading infrastructure
for all shards at all - often you'll just need to set it up for a couple
of the shards.
2024-01-03 14:00:32 -05:00
Bogdan Pintea 6e9215a1fa
ESQL: allow `null` in date math (#103610)
This fixes `null`'s handling in date math. So far the `null` (of type
`NULL`) has been rejected by the type resolution. This is now allowed
through, leading to a `null` result, inline with the other types.

Fixes #103085.
2024-01-03 07:48:31 -05:00
Bogdan Pintea 4e2389fb2c
ESQL: Improve docs for the floating points is_xxx() funtions (#103691)
Improve the docs for is_nan, is_finite, is_infinite functions.
This also adjusts the CamelCase to snake_case conversion, to not
consider the last capital letter (like in `IsNaN`).
2024-01-03 12:18:15 +01:00
Abdon Pijpelink 84d9392d74
[DOCS] Warn against using ES|QL on production environments (#103797) 2024-01-02 17:00:22 +01:00
Nik Everett 16e9bbe2d3 ESQL: Update generated docs 2023-12-27 15:58:02 -05:00
Chris Hegarty 695a04c69c
Fix GET API path in esql-async-query-api.asciidoc (#103725)
This commit fixes the GET API path in esql-async-query-api.asciidoc
2023-12-27 20:05:30 +00:00
Chris Hegarty 2d352e9cb4
Add ES|QL async delete API (#103628)
This commit adds the ES|QL async delete API, to cancel running ES|QL queries and/or remove stored results.
2023-12-22 13:49:45 +00:00
Chris Hegarty 6ca309983d
ES|QL Async Query API (#103398)
This commit adds two new endpoints to support ES|QL async querying.

The endpoints added are:
 1. GET /_query/async - for initiating a query
 2. GET /_query/async/{id} - for retrieving the result
2023-12-20 11:25:55 +00:00
Abdon Pijpelink 8e0d4e1846
[DOCS] Improve ES|QL functions reference for functions A-D (#103447)
* Functions starting with A

* Functions starting with 'C'

* More 'C' functions

* Fix tests

* Fix missing snippet

* DATE_* functions

* Apply suggestions from code review

Co-authored-by: Bogdan Pintea <pintea@mailbox.org>

---------

Co-authored-by: Bogdan Pintea <pintea@mailbox.org>
2023-12-19 15:59:02 +01:00
Craig Taverner e1835c97e8
ESQL: Documentation for support for geo_point and point (#103207)
* Start working on geo_point and point docs for ESQL

* Added to_cartesianpoint and includes

* Sub-headings for easier reading

* Improve sub-headings

* Hide to_long and support for longs in to_geopoint and to_cartesianpoint
2023-12-12 12:19:23 +01:00
Nik Everett 3b738905e1
ESQL: Add type tables for operators to docs (#103206)
This adds a tiny blurb for each operator to the docs with a railroad
diagram of the operator's syntax and a table of the input and output
types. This also fixes the tests to correctly generate the tables for
operators.
2023-12-11 10:51:38 -05:00
Abdon Pijpelink 7ddf450d19
[DOCS] Empty keys for ES|QL DISSECT (#102632)
* [DOCS] Empty keys for ES|QL DISSECT

* Update test
2023-12-11 11:23:27 +01:00
Mark Tozzi 690a8a2ef8
[ES|QL] Trig & hyperbolic function finishing pass (#103205)
Relates to #100558

These functions were mostly done already. I added descriptions and argument descriptions for most of them, otherwise not much work.
2023-12-08 14:27:22 -05:00
Nik Everett 6e0c031342
ESQL: Generate railroad diagrams for operators (#103143)
This enables the generation of railroad diagrams for unary minus and a
bunch of binary operators like `+`, `-`, `%`, and `>=`.

Relates to #100558
2023-12-08 09:24:34 -05:00
Abdon Pijpelink 3ace422668
[DOCS] More ES|QL getting started updates (#102980)
* [DOCS] More ES|QL getting started updates

* Change 'server.ip' into 'server_ip'
2023-12-05 14:37:52 +01:00
Abdon Pijpelink df097aae01
[DOCS] Change ES|QL getting started guide for updated dataset (#102970) 2023-12-05 12:53:21 +01:00
Bogdan Pintea 8d0551ecb9
ESQL: emit warnings from single-value functions processing multi-values (#102417)
When encountering a multi-value, a single-value function (i.e. all
non-`mv_xxx()`) returns a `null`. This behaviour is opaque to the user.
This PR adds the functionality for these functions to emit a `Warning`
header, so the user is informed about the cause for the `null`s.

Within testing, there are some differences between the emulated
CSV-based tests (`TestPhysical*`) and the REST CSV-tests and thus the
exact messages in the warnings: * The REST ones can push operations to
Lucene; when this happens, a query containing a negation, `not
<predicate>`, can be translated to a `must_not` query, that will include
the `not` in the `Source`. But outside of Lucene, the execution would
consider the predicate first, then the negation. So when the predicate
contains a SV function, only this part's `Source` will show up in the
warning. * When pushed to Lucene, a query is wrapped within the
`SingleValueQuery`. This emits now warnings when encountering MVs (and
returning no match). However, this only happens once the query that it
wraps returns something itself. Comparatively, the `TestPhysical*`
filters will issue a warning for every encountered MV (irrespective of
sigle values within the MV matching or not).

To differentiate between the slightly differing values of the warnings,
one can now append the `#[Emulated:` prefix to a warning, followed by
the value of the warning for the emulated checks, then a corresponding
`]`.  Example: `warning:Line 1:24: evaluation of [not(salary_change <
1)] failed, treating result as null. Only first 20 failures
recorded.#[Emulated:Line 1:28: evaluation of [salary_change < 1] failed,
treating result as null. Only first 20 failures recorded.]`

Closes #98743.
2023-12-05 05:50:50 -05:00
Abdon Pijpelink 89faf4497e
[DOCS] Add ES|QL 'getting started' code snippets to CSV tests (#102653)
* [DOCS] Add ES|QL 'getting started' code snippets to CSV tests

* Change dots in columns names into underscores

* Add LIMIT 0 to ENRICH test

* Move code snippets out of docs.csv-spec

* Replace code snippets by includes

* Add missing semicolon
2023-12-05 10:47:39 +01:00
Bogdan Pintea d3fefde0a3
ESQL: add unit tests for conversion functions. Extend `TEXT` type support for them (#102746)
This adds the missing unit tests for the conversion functions.
It also extends the type support by adding the `TEXT` type to those functions that support `KEYWORD` already (which also simplifies the testing, actually). Some functions did have it, some didn't; they now all do.

The change also fixes two defects resulting from better testing coverage: `ToInteger` and `ToUnsignedLong` had some missing necessary exceptions declarations in the decorators for the evaluators.
It also updates `ToInteger`'s `fromDouble()` conversion to use a newly added utility, so that the failed conversions contain the right message (`out of [integer] range`, instead of the confusing `out of [long] range`).

Related: #102488, #102552.
2023-12-04 13:58:23 +01:00
Nik Everett e39fdba02e ESQL: Add newly generated signature
We're generating it now, we should commit it so the docs can have it.
2023-11-27 13:29:03 -05:00
Abdon Pijpelink bc4db166af
[DOCS] ES|QL: add full-text search limitation (#102150)
* [DOCS] ES|QL: add full-text search limitation

* Improve wording
2023-11-27 11:36:23 +01:00
Abdon Pijpelink bc59315baa
[DOCS] Examples for ES|QL DISSECT and WHERE (#102591)
* DISSECT examples

* WHERE examples

* Remove references to empty keys

* Fix non-deterministic test
2023-11-27 10:56:48 +01:00
Nhat Nguyen 774a05cc0a
Update doc fields for pow and date_extract function (#102554)
These two generated files have not been updated and committed.
2023-11-23 17:33:38 -08:00
Mark Tozzi 7345e643ba
[ES|QL] pow function always returns double (#102183)
This corrects an earlier mistake in the ES|QL language design. Initially we had thought to have pow return the same type as its inputs, but in practice even for integer inputs this quickly grows out of the representable range, and we returned null much of the time. This also created a lot of edge cases around casting to/from doubles (which the underlying java function uses). The version in this PR follows the java spec, by always casting its inputs to doubles, and returning a double. Doing it this way also allows for a rather significant reduction in lines of code.

I removed many of the tests covering pow specific edge cases. This seems reasonable to me as I expect java.lang.math.pow to be well behaved and most of those edge cases were around type testing which no longer applies. At the same time, this simplification allows us to leverage the new scalar function testing framework, which means better null coverage, better type coverage, and much easier extensibility.

We do consider this a breaking change, but as the feature is still in tech preview and this is a relatively small surface area, we are not too concerned with disruptions.

Resolves #99055
Relates to #100558
---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2023-11-21 09:58:07 -05:00
Nik Everett d46c386c86
ESQL: Extra tests for trim/ltrim/rtrim (#102308)
This adds some extra tests, docs, and descriptions for the `trim`,
`ltrim`, and `rtrim` functions.
2023-11-16 14:44:56 -05:00
Abdon Pijpelink 158ca9674f
[DOCS] More ES|QL limitations (#101972) 2023-11-14 17:49:40 +01:00
Abdon Pijpelink b03939ec9d
[DOCS] Update ES|QL getting started for demo environment (#102134) 2023-11-14 13:17:48 +01:00
Bogdan Pintea 6bb63f5861
ESQL: Add syntax clarifications on identifiers and literals (#101790)
Document the syntax for identifiers and literals.
2023-11-13 12:38:58 -05:00
Abdon Pijpelink 75db2edb45
[DOCS] Clarify ES|QL grok escaping (#102059) 2023-11-13 11:31:51 +01:00
Abdon Pijpelink ae2626f07a
[DOCS] DISSECT does not support reference keys (#102002) 2023-11-10 12:40:23 +01:00
Abdon Pijpelink 2a4414ddd2
[DOCS] Add multivalue limitations to 'Limitations' page (#101952) 2023-11-09 13:19:13 +01:00
Nastasha Solomon 94287eee19
[DOCS] Adds AI assistant functionality to Using ES|QL page (#101918)
Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
2023-11-08 11:04:55 -05:00
Fabio Busatto 11cb81a09a
Update SVG reference for starts_with ESQL docs (#101909) 2023-11-08 13:39:49 +01:00
Abdon Pijpelink 4a2ed90f92
[DOCS] Explain ES|QL CASE behavior with even no. arguments (#101829) 2023-11-07 18:08:54 +01:00
Abdon Pijpelink 34d03912bd
[DOCS] Add CCS to ES|QL limitations (#101867) 2023-11-07 18:08:34 +01:00
Abdon Pijpelink 2b4ba7a744
[DOCS] Small ES|QL improvements (#101877)
* [DOCS] Small ES|QL improvements

* Fix test failure
2023-11-07 17:24:59 +01:00
Abdon Pijpelink 9132f95fb4
[DOCS] Add 'Using ES|QL in Elastic Security' (#101677)
* [DOCS] Add 'Using ES|QL in Elastic Security'

* Add a note about enabling knowledge base

* Update links
2023-11-07 11:35:37 +01:00
Abdon Pijpelink 90d3672d11
[DOCS] Default and max limits are now dynamic settings (#101831)
* [DOCS] Default and max limits are now dynamic settings

* Delete reference to Discover
2023-11-06 15:12:08 +01:00
Abdon Pijpelink 76ab37b35d
[DOCS] Uniform formatting for ES|QL commands (#101728)
* Source commands

* Missing word

* Processing commands

* Apply suggestions from code review

Co-authored-by: Alexander Spies <alexander.spies@elastic.co>

* Review feedback

* Add sort detail for mv

* More review feedback

---------

Co-authored-by: Alexander Spies <alexander.spies@elastic.co>
2023-11-06 08:42:13 +01:00
Abdon Pijpelink 4b0d1747c4
[DOCS] ES|QL limitations (#101673)
* Supported types

* More limitations

* Document the behavior of text fields

* Review feedback

* Review feedback
2023-11-03 13:57:23 +01:00
Abdon Pijpelink c6a1f831e0
[DOCS] Getting started with ES|QL queries guide (#101634)
* Page structure

* More getting started content

* Fix build errors

* Small improvements

* Typo

* Add link to public demo environment

* Review feedback

* Update docs/reference/esql/esql-get-started.asciidoc

Co-authored-by: Andrei Stefan <astefan@users.noreply.github.com>

* Review feedback

---------

Co-authored-by: Andrei Stefan <astefan@users.noreply.github.com>
2023-11-03 13:47:09 +01:00
Nik Everett 17389d270e
ESQL docs: Warn about huge response (#101568)
Add a warning about huge response sizes.

Closes #101490
2023-10-31 10:19:03 -04:00
Andrei Stefan 74da80771a
ESQL: adds Enrich implicit match_fields to field_caps call (#101456)
* Take into account the Enrich implicit match_field when resolving
field names of the source index
2023-10-27 22:59:17 +03:00
Luigi Dell'Aquila d53c0cbf82
ESQL: annotate trigonometric functions and auto_bucket() (SHOW FUNCTIONS) (#101460) 2023-10-27 16:35:44 +02:00
Abdon Pijpelink b921c1e627
[DOCS] Using ES|QL in Kibana (#101324)
* Initial Kibana content

* More docs

* Nino's feedback

* Amy's feedback
2023-10-26 12:02:41 +02:00
Abdon Pijpelink 8e96d285c0
[DOCS] One more round of restructuring the ES|QL documentation (#101340)
* Reorg some pages

* Add links to landing page
2023-10-26 10:57:05 +02:00
Nik Everett c73b3b6403
ESQL DOCS: speed note on stats (#101318)
Grouping by no fields is much much faster than grouping by one field.
Grouping by one field is like 5x faster than grouping on two fields.
2023-10-25 10:31:12 -04:00
AlexB b19ae8d5ee
esql docs: structure, examples, minor improvements (#101292)
Small improvements in ESQL docs and addition of examples

---------

Co-authored-by: Alexandros Batsakis <abatsakis@elastic.co>
Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
2023-10-25 05:00:48 -07:00
Abdon Pijpelink 284f81873f
[DOCS] Expand ES|QL DISSECT and GROK documentation (#101225)
* Add 'Process data with DISSECT and GROK' page

* Expand DISSECT docs

* More DISSECT and GROK enhancements

* Improve examples

* Fix CSV tests

* Review feedback

* Reword
2023-10-25 13:19:17 +02:00
Nik Everett 46f95a67b4
ESQL: More MV_* tests (#100564)
This adds more tests for some of the `MV_` functions and updates their
docs now that the railroad diagram and table generated by the tests
covers all of the types.
2023-10-24 16:55:17 -04:00
AlexB 48f1e4cf89
ESQL small doc improvement (#101226)
Move command list to the top

Co-authored-by: Alexandros Batsakis <abatsakis@splunk.com>
2023-10-23 12:23:58 -07:00
AlexB 931dcae41d
Add improvements to the ES|QL docs (#101195)
Content and structural improvements to the ES|QL docs

---------

Co-authored-by: Alexandros Batsakis <abatsakis@splunk.com>
Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
2023-10-23 07:45:42 -07:00
Abdon Pijpelink fcdeb21993
[DOCS] Expand ES|QL ENRICH documentation (#101079)
* [DOCS] Expand ES|QL ENRICH documentation

* Add examples to 'Enrich data' page

* Add another diagram

* Remove redirect that's no longer needed

* Review feedback
2023-10-19 17:14:21 +02:00
Luigi Dell'Aquila 8d89f913a1
ESQL: Add warning header when default LIMIT is applied (#100894)
Fixes https://github.com/elastic/elasticsearch/issues/100555

ESQL [by default](https://github.com/elastic/elasticsearch/pull/99816)
adds an implicit `LIMIT 500` to queries that do not define a limit.
Since this can be confusing for the end user, with this PR we also add a
warning to the response, making this default clear and explicit.
2023-10-18 07:44:33 -04:00
Abdon Pijpelink 8ac4ba751e
Restructure ES|QL docs (#100806)
* Break out 'Limitations' into separate page

* Add REST API docs

* Restructure commands, functions, and operators refs

* Add placeholder for getting started guide

* Group 'Syntax', 'Metafields', and 'MV fields' under 'Language'

* Add placeholder for Kibana page

* Add link from landing page

* Apply uniform formatting to ACOS, CASE, and DATE_PARSE function refs

* Reword default LIMIT

* Add support for COUNT(*)

* Move 'Commands' and 'Functions and operators' to individual pages

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2023-10-17 17:36:14 +02:00
gheorghepucea cb30096c65
Referenced the svgs of starts_with and trim in asciidoc for consistency. (#100834) 2023-10-13 16:01:47 +02:00
Nik Everett 38eac268b4
ESQL: Build tracked block in EVAL (#100268)
This changes `EVAL` to build tracked blocks so we can trip the breaker
when there are too many tracked blocks hanging about.
2023-10-04 10:29:54 -04:00
Nik Everett 9620512a89
ESQL: Tests for large concat and many evals (#100159) 2023-10-03 14:41:40 -04:00
Luigi Dell'Aquila 6e79013088
ESQL: enhance SHOW FUNCTIONS command (#99736)
Fixes https://github.com/elastic/elasticsearch/issues/99507

Enhance SHOW FUNCTIONS command to return as _structured_ information as
possible about the function signature, ie. - function name - return type
- param names - param types - param descriptions

For now, as an example, the annotations are used only on `sin()` and
`date_parse()` functions; **if we agree on this approach**, I'll proceed
to - enhance all the currently implemented functions with the needed
information - improve the function tests to verify that every new
implemented function provides meaningful information

---

This feature can be useful for the end user, but the main goal is to
give Kibana an easy way to produce in-line documentation (contextual
messages, autocomplete) for functions

Similar to current implementation, that has a `@Named("paramName")`
annotation for function parameters, this PR introduces two more
annotations `@Param(name, type, description, optional)` and
`@FunctionInfo()` to provide information about single parameters and
functions.

The result of `SHOW FUNCTIONS` query will have the following columns: -
name (keyword): the function name - synopsis (keyword): the full
signature of the funciton, eg. `double sin(n:integer|long|double)` -
argNames (keyword MV): the function argument names - argTypes (keyword
MV): the function argument types - argDescriptions (keyword MD): a
textual description of each function argument - returnType (keyword):
the return type of the function - description (keyword): a textual
description of the function

---

Open questions: - ~~how structured shoud *types* be? Eg. should we have
a strict `@Typed("keyword")`/`@Typed({"keyword", "text"})` or should we
have a more generic type description, eg. `@Typed("numeric")`,
`@Typed("any")`? The first one is more useful for API consumption but
it's hard with our complex type system (type classes, custom types,
unsupported and so on); the second one is less structured, but probably
more useful for documentation, that is the most immediate use case of
this feature.~~ All the types are listed explicitly

- ~~we have alternatives for the synopsis, eg.~~
  - ~~`functionName(<paramName>:<paramType>, ...): <returnType>`~
  - ~~`<returnType> functionName(<paramName>:<paramType>, ...)`~~
  - ~~`<returnType> functionName(<paramType> <paramName>, ...)`~~
  Using `<returnType> functionName(<paramName>:<paramType>, ...)` for now. If multiple types are supported, then they will be separated by pipes, eg. `double sin(n:integer|long|double)`.
2023-10-02 13:56:41 -04:00
AlexB 2ccdae6745
Eval REPLACE function (#98909)
Co-authored-by: Alexandros Batsakis <abatsakis@splunk.com>
Co-authored-by: Andrei Stefan <andrei@elastic.co>
2023-09-29 17:41:20 +03:00
Nik Everett e1b1f6f1db
ESQL: Create `Block.Ref` (#100042)
This creates `Block.Ref`, a reference to a `Block` which may or may not
be part of a `Page`. `Block.Ref` is `Releasable` and closing it is a
noop if the `Block` is part of a `Page`, but if it is "free floating"
then closing the `Block.Ref` will close the block.

It also modified `ExpressionEvaluator` to return a `Block.Ref` instead
of a `Block` - so you tend to work with `ExpressionEvaluator`s like
this:

```
try (Block.Ref ref = eval.eval(page)) {
  return ref.block().doStuff();
}
```

This should make it *much* easier to release the memory from `Block`s
built by `ExpressionEvaluator`s.

This change is mostly mechanical, introducing the new signature for
`ExpressionEvaluator`. In a follow up change I'll modify the tests to
make sure we're correctly using it to close pages.

I did think about changing `ExpressionEvaluator` to add a method telling
you if the block that it returns must be closed or not. This would have
been more difficult to work with, and, ultimately, limiting.
Specifically, it is possible for an `ExpressionEvaluator` to *sometimes*
return a free floating block and other times return one that is
contained in a `Page`. Imagine `mv_concat` - it returns the block it
receives if the block doesn't have multivalued fields. Otherwise it
concats things. If that block happens to come directly out of the
`Page`, then `mv_concat` will sometimes produce free floating blocks and
sometimes not.
2023-09-29 09:26:44 -04:00