diff --git a/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts b/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts index 8515a249f7686..144ba21f51ecb 100644 --- a/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts +++ b/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts @@ -25,11 +25,15 @@ const aliasTable: Record = { }; const aliases = new Set(Object.values(aliasTable).flat()); -const evalSupportedCommandsAndOptions = { +const scalarSupportedCommandsAndOptions = { supportedCommands: ['stats', 'inlinestats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], }; +const aggregationSupportedCommandsAndOptions = { + supportedCommands: ['stats', 'inlinestats', 'metrics'], +}; + // coalesce can be removed when a test is added for version type // (https://github.com/elastic/elasticsearch/pull/109032#issuecomment-2150033350) const excludedFunctions = new Set(['bucket', 'case']); @@ -40,7 +44,7 @@ const extraFunctions: FunctionDefinition[] = [ name: 'case', description: 'Accepts pairs of conditions and values. The function returns the value that belongs to the first condition that evaluates to `true`. If the number of arguments is odd, the last argument is the default value which is returned when no condition matches.', - ...evalSupportedCommandsAndOptions, + ...scalarSupportedCommandsAndOptions, signatures: [ { params: [ @@ -215,9 +219,22 @@ const functionEnrichments: Record> }, mv_sort: { signatures: new Array(9).fill({ - params: [{}, { literalOptions: ['asc', 'desc'] }], + params: [{}, { acceptedValues: ['asc', 'desc'] }], + }), + }, + percentile: { + signatures: new Array(9).fill({ + params: [{}, { constantOnly: true }], + }), + }, + top: { + signatures: new Array(6).fill({ + params: [{}, { constantOnly: true }, { constantOnly: true, acceptedValues: ['asc', 'desc'] }], }), }, + count: { + signatures: [{ params: [{ supportsWildcard: true }] }], + }, }; const convertDateTime = (s: string) => (s === 'datetime' ? 'date' : s); @@ -233,8 +250,8 @@ function getFunctionDefinition(ESFunctionDefinition: Record): Funct type: ESFunctionDefinition.type, name: ESFunctionDefinition.name, ...(ESFunctionDefinition.type === 'eval' - ? evalSupportedCommandsAndOptions - : { supportedCommands: ['stats'] }), + ? scalarSupportedCommandsAndOptions + : aggregationSupportedCommandsAndOptions), description: ESFunctionDefinition.description, alias: aliasTable[ESFunctionDefinition.name], signatures: _.uniqBy( @@ -263,7 +280,10 @@ function getFunctionDefinition(ESFunctionDefinition: Record): Funct return ret as FunctionDefinition; } -function printGeneratedFunctionsFile(functionDefinitions: FunctionDefinition[]) { +function printGeneratedFunctionsFile( + functionDefinitions: FunctionDefinition[], + functionsType: 'aggregation' | 'scalar' +) { /** * Deals with asciidoc internal cross-references in the function descriptions * @@ -341,10 +361,14 @@ function printGeneratedFunctionsFile(functionDefinitions: FunctionDefinition[]) * */ -import type { ESQLFunction } from '@kbn/esql-ast'; import { i18n } from '@kbn/i18n'; -import { isLiteralItem } from '../shared/helpers'; -import type { FunctionDefinition } from './types'; +import type { FunctionDefinition } from '../types'; +${ + functionsType === 'scalar' + ? `import type { ESQLFunction } from '@kbn/esql-ast'; +import { isLiteralItem } from '../../shared/helpers';` + : '' +} `; @@ -359,7 +383,7 @@ import type { FunctionDefinition } from './types'; .join('\n\n'); const fileContents = `${fileHeader}${functionDefinitionsString} - export const evalFunctionDefinitions = [${functionDefinitions + export const ${functionsType}FunctionDefinitions = [${functionDefinitions .map(({ name }) => getDefinitionName(name)) .join(',\n')}];`; @@ -379,25 +403,30 @@ import type { FunctionDefinition } from './types'; JSON.parse(readFileSync(`${ESFunctionDefinitionsDirectory}/${file}`, 'utf-8')) ); - const evalFunctionDefinitions: FunctionDefinition[] = []; + const scalarFunctionDefinitions: FunctionDefinition[] = []; + const aggFunctionDefinitions: FunctionDefinition[] = []; for (const ESDefinition of ESFunctionDefinitions) { - if ( - aliases.has(ESDefinition.name) || - excludedFunctions.has(ESDefinition.name) || - ESDefinition.type !== 'eval' - ) { + if (aliases.has(ESDefinition.name) || excludedFunctions.has(ESDefinition.name)) { continue; } const functionDefinition = getFunctionDefinition(ESDefinition); - evalFunctionDefinitions.push(functionDefinition); + if (functionDefinition.type === 'eval') { + scalarFunctionDefinitions.push(functionDefinition); + } else if (functionDefinition.type === 'agg') { + aggFunctionDefinitions.push(functionDefinition); + } } - evalFunctionDefinitions.push(...extraFunctions); + scalarFunctionDefinitions.push(...extraFunctions); await writeFile( - join(__dirname, '../src/definitions/functions.ts'), - printGeneratedFunctionsFile(evalFunctionDefinitions) + join(__dirname, '../src/definitions/generated/scalar_functions.ts'), + printGeneratedFunctionsFile(scalarFunctionDefinitions, 'scalar') + ); + await writeFile( + join(__dirname, '../src/definitions/generated/aggregation_functions.ts'), + printGeneratedFunctionsFile(aggFunctionDefinitions, 'aggregation') ); })(); diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.command.stats.test.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.command.stats.test.ts index 0a9cbb35d9a75..6f195d5ecb503 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.command.stats.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.command.stats.test.ts @@ -7,7 +7,9 @@ * License v3.0 only", or the "Server Side Public License, v 1". */ +import { FieldType, FunctionReturnType } from '../../definitions/types'; import { ESQL_COMMON_NUMERIC_TYPES, ESQL_NUMBER_TYPES } from '../../shared/esql_types'; +import { allStarConstant } from '../complete_items'; import { getAddDateHistogramSnippet } from '../factories'; import { roundParameterTypes } from './constants'; import { setup, getFunctionSignaturesByReturnType, getFieldNamesByType } from './helpers'; @@ -39,6 +41,9 @@ const allGroupingFunctions = getFunctionSignaturesByReturnType( 'by' ); +// types accepted by the AVG function +const avgTypes: Array = ['double', 'integer', 'long']; + describe('autocomplete.suggest', () => { describe('STATS [ BY ]', () => { describe('STATS ...', () => {}); @@ -121,18 +126,16 @@ describe('autocomplete.suggest', () => { ), ]); await assertSuggestions('from a | stats avg(/', [ - ...getFieldNamesByType(ESQL_NUMBER_TYPES), - ...getFunctionSignaturesByReturnType('eval', ESQL_NUMBER_TYPES, { scalar: true }), + ...getFieldNamesByType(avgTypes), + ...getFunctionSignaturesByReturnType('eval', avgTypes, { + scalar: true, + }), ]); await assertSuggestions('from a | stats round(avg(/', [ - ...getFieldNamesByType(ESQL_NUMBER_TYPES), - ...getFunctionSignaturesByReturnType( - 'eval', - ESQL_NUMBER_TYPES, - { scalar: true }, - undefined, - ['round'] - ), + ...getFieldNamesByType(avgTypes), + ...getFunctionSignaturesByReturnType('eval', avgTypes, { scalar: true }, undefined, [ + 'round', + ]), ]); }); @@ -150,16 +153,7 @@ describe('autocomplete.suggest', () => { ]), ...getFunctionSignaturesByReturnType( 'stats', - [ - ...ESQL_COMMON_NUMERIC_TYPES, - 'date', - 'date_period', - 'boolean', - 'ip', - 'version', - 'text', - 'keyword', - ], + [...ESQL_COMMON_NUMERIC_TYPES, 'date', 'boolean', 'ip', 'version', 'text', 'keyword'], { scalar: true, } @@ -175,14 +169,10 @@ describe('autocomplete.suggest', () => { const { assertSuggestions } = await setup(); await assertSuggestions('from a | stats avg(b/) by stringField', [ - ...getFieldNamesByType(ESQL_NUMBER_TYPES), - ...getFunctionSignaturesByReturnType( - 'eval', - ['double', 'integer', 'long', 'unsigned_long'], - { - scalar: true, - } - ), + ...getFieldNamesByType(avgTypes), + ...getFunctionSignaturesByReturnType('eval', avgTypes, { + scalar: true, + }), ]); }); @@ -297,15 +287,9 @@ describe('autocomplete.suggest', () => { }); test('count(/) to suggest * for all', async () => { - const { assertSuggestions } = await setup(); - - const expected = [ - '*', - ...getFieldNamesByType(['any']).map((field) => `${field}`), - ...allEvaFunctions, - ]; - await assertSuggestions('from a | stats count(/)', expected); - await assertSuggestions('from a | stats var0 = count(/)', expected); + const { suggest } = await setup(); + const suggestions = await suggest('from a | stats count(/)'); + expect(suggestions).toContain(allStarConstant); }); }); }); diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.suggest.eval.test.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.suggest.eval.test.ts index 356761966994a..c07b065b23ce8 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.suggest.eval.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.suggest.eval.test.ts @@ -17,7 +17,7 @@ import { getDateLiteralsByFieldType, } from './helpers'; import { ESQL_COMMON_NUMERIC_TYPES } from '../../shared/esql_types'; -import { evalFunctionDefinitions } from '../../definitions/functions'; +import { scalarFunctionDefinitions } from '../../definitions/generated/scalar_functions'; import { timeUnitsToSuggest } from '../../definitions/literals'; import { getCompatibleTypesToSuggestNext, @@ -361,7 +361,7 @@ describe('autocomplete.suggest', () => { describe('eval functions', () => { // // Test suggestions for each possible param, within each signature variation, for each function - for (const fn of evalFunctionDefinitions) { + for (const fn of scalarFunctionDefinitions) { // skip this fn for the moment as it's quite hard to test // if (!['bucket', 'date_extract', 'date_diff', 'case'].includes(fn.name)) { if (!['bucket', 'date_extract', 'date_diff', 'case'].includes(fn.name)) { @@ -541,7 +541,12 @@ describe('autocomplete.suggest', () => { ); await assertSuggestions( 'from a | eval var0=date_trunc(/)', - getLiteralsByType('time_literal').map((t) => `${t}, `), + [ + ...getLiteralsByType('time_literal').map((t) => `${t}, `), + ...getFunctionSignaturesByReturnType('eval', 'time_duration', { scalar: true }).map( + (t) => `${t.text},` + ), + ], { triggerCharacter: '(' } ); await assertSuggestions( diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/helpers.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/helpers.ts index 989eca0240c9c..70b1d717f6e4e 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/helpers.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/helpers.ts @@ -9,9 +9,9 @@ import { camelCase } from 'lodash'; import { getAstAndSyntaxErrors } from '@kbn/esql-ast'; -import { evalFunctionDefinitions } from '../../definitions/functions'; +import { scalarFunctionDefinitions } from '../../definitions/generated/scalar_functions'; import { builtinFunctions } from '../../definitions/builtin'; -import { statsAggregationFunctionDefinitions } from '../../definitions/aggs'; +import { aggregationFunctionDefinitions } from '../../definitions/generated/aggregation_functions'; import { timeUnitsToSuggest } from '../../definitions/literals'; import { groupingFunctionDefinitions } from '../../definitions/grouping'; import * as autocomplete from '../autocomplete'; @@ -149,7 +149,7 @@ export function getFunctionSignaturesByReturnType( const list = []; if (agg) { - list.push(...statsAggregationFunctionDefinitions); + list.push(...aggregationFunctionDefinitions); // right now all grouping functions are agg functions too list.push(...groupingFunctionDefinitions); } @@ -158,7 +158,7 @@ export function getFunctionSignaturesByReturnType( } // eval functions (eval is a special keyword in JS) if (scalar) { - list.push(...evalFunctionDefinitions); + list.push(...scalarFunctionDefinitions); } if (builtin) { list.push(...builtinFunctions.filter(({ name }) => (skipAssign ? name !== '=' : true))); diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts index 2c5f4bda941ba..80ff7148f8623 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts @@ -8,7 +8,7 @@ */ import { suggest } from './autocomplete'; -import { evalFunctionDefinitions } from '../definitions/functions'; +import { scalarFunctionDefinitions } from '../definitions/generated/scalar_functions'; import { timeUnitsToSuggest } from '../definitions/literals'; import { commandDefinitions as unmodifiedCommandDefinitions } from '../definitions/commands'; import { @@ -747,8 +747,8 @@ describe('autocomplete', () => { describe('function arguments', () => { // literalSuggestions parameter const dateDiffFirstParamSuggestions = - evalFunctionDefinitions.find(({ name }) => name === 'date_diff')?.signatures[0].params?.[0] - .literalSuggestions ?? []; + scalarFunctionDefinitions.find(({ name }) => name === 'date_diff')?.signatures[0] + .params?.[0].literalSuggestions ?? []; testSuggestions( 'FROM a | EVAL DATE_DIFF(/)', dateDiffFirstParamSuggestions.map((s) => `"${s}", `).map(attachTriggerCommand) diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts index 3b5cb1e58e2e2..3e528036dcadc 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts @@ -10,8 +10,8 @@ import { i18n } from '@kbn/i18n'; import { SuggestionRawDefinition } from './types'; import { groupingFunctionDefinitions } from '../definitions/grouping'; -import { statsAggregationFunctionDefinitions } from '../definitions/aggs'; -import { evalFunctionDefinitions } from '../definitions/functions'; +import { aggregationFunctionDefinitions } from '../definitions/generated/aggregation_functions'; +import { scalarFunctionDefinitions } from '../definitions/generated/scalar_functions'; import { getFunctionSignatures, getCommandSignature } from '../definitions/helpers'; import { timeUnitsToSuggest } from '../definitions/literals'; import { @@ -26,8 +26,8 @@ import { DOUBLE_BACKTICK, SINGLE_TICK_REGEX } from '../shared/constants'; import { ESQLRealField } from '../validation/types'; import { isNumericType } from '../shared/esql_types'; -const allFunctions = statsAggregationFunctionDefinitions - .concat(evalFunctionDefinitions) +const allFunctions = aggregationFunctionDefinitions + .concat(scalarFunctionDefinitions) .concat(groupingFunctionDefinitions); export const TIME_SYSTEM_PARAMS = ['?t_start', '?t_end']; diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts deleted file mode 100644 index 912dbd401fe71..0000000000000 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts +++ /dev/null @@ -1,393 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the "Elastic License - * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side - * Public License v 1"; you may not use this file except in compliance with, at - * your election, the "Elastic License 2.0", the "GNU Affero General Public - * License v3.0 only", or the "Server Side Public License, v 1". - */ - -import { i18n } from '@kbn/i18n'; -import { ESQL_COMMON_NUMERIC_TYPES, ESQL_NUMBER_TYPES } from '../shared/esql_types'; -import type { FunctionDefinition, FunctionParameterType, FunctionReturnType } from './types'; - -function createNumericAggDefinition({ - name, - description, - returnType, - args = [], -}: { - name: string; - description: string; - returnType?: (numericType: FunctionParameterType) => FunctionReturnType; - args?: Array<{ - name: string; - type: FunctionParameterType; - value: string; - constantOnly?: boolean; - }>; -}): FunctionDefinition { - const extraParamsExample = args.length ? `, ${args.map(({ value }) => value).join(',')}` : ''; - return { - name, - type: 'agg', - description, - supportedCommands: ['stats', 'inlinestats', 'metrics'], - signatures: [ - ...ESQL_NUMBER_TYPES.map((numericType) => ({ - params: [ - { name: 'column', type: numericType, noNestingFunctions: true }, - ...args.map(({ name: paramName, type, constantOnly }) => ({ - name: paramName, - type, - noNestingFunctions: true, - constantOnly, - })), - ], - returnType: returnType ? returnType(numericType) : numericType, - })), - ], - examples: [ - `from index | stats result = ${name}(field${extraParamsExample})`, - `from index | stats ${name}(field${extraParamsExample})`, - ], - }; -} - -export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ - { - name: 'avg', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.avgDoc', { - defaultMessage: 'Returns the average of the values in a field', - }), - returnType: () => 'double' as FunctionReturnType, - }, - { - name: 'sum', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sumDoc', { - defaultMessage: 'Returns the sum of the values in a field.', - }), - returnType: (numericType: FunctionParameterType): FunctionReturnType => { - switch (numericType) { - case 'double': - return 'double'; - default: - return 'long'; - } - }, - }, - { - name: 'median', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.medianDoc', { - defaultMessage: 'Returns the 50% percentile.', - }), - returnType: () => 'double' as FunctionReturnType, - }, - { - name: 'median_absolute_deviation', - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.medianDeviationDoc', - { - defaultMessage: - 'Returns the median of each data point’s deviation from the median of the entire sample.', - } - ), - returnType: () => 'double' as FunctionReturnType, - }, -] - .map(createNumericAggDefinition) - .concat([ - { - name: 'percentile', - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.percentiletDoc', - { - defaultMessage: 'Returns the n percentile of a field.', - } - ), - type: 'agg', - supportedCommands: ['stats', 'inlinestats', 'metrics'], - signatures: [ - ...ESQL_COMMON_NUMERIC_TYPES.map((numericType: FunctionParameterType) => { - return ESQL_COMMON_NUMERIC_TYPES.map((weightType: FunctionParameterType) => ({ - params: [ - { - name: 'column', - type: numericType, - noNestingFunctions: true, - }, - { - name: 'percentile', - type: weightType, - noNestingFunctions: true, - constantOnly: true, - }, - ], - returnType: 'double' as FunctionReturnType, - })); - }).flat(), - ], - }, - { - name: 'max', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.maxDoc', { - defaultMessage: 'Returns the maximum value in a field.', - }), - type: 'agg', - supportedCommands: ['stats', 'inlinestats', 'metrics'], - signatures: [ - ...ESQL_COMMON_NUMERIC_TYPES.map((type) => ({ - params: [{ name: 'column', type, noNestingFunctions: true }], - returnType: type, - })), - { - params: [{ name: 'column', type: 'date', noNestingFunctions: true }], - returnType: 'date', - }, - { - params: [{ name: 'column', type: 'date_period', noNestingFunctions: true }], - returnType: 'date_period', - }, - { - params: [{ name: 'column', type: 'boolean', noNestingFunctions: true }], - returnType: 'boolean', - }, - { - params: [{ name: 'column', type: 'ip', noNestingFunctions: true }], - returnType: 'ip', - }, - { - params: [{ name: 'column', type: 'version', noNestingFunctions: true }], - returnType: 'version', - }, - { - params: [{ name: 'column', type: 'keyword', noNestingFunctions: true }], - returnType: 'keyword', - }, - { - params: [{ name: 'column', type: 'text', noNestingFunctions: true }], - returnType: 'text', - }, - ], - examples: [`from index | stats result = max(field)`, `from index | stats max(field)`], - }, - { - name: 'min', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.minDoc', { - defaultMessage: 'Returns the minimum value in a field.', - }), - type: 'agg', - supportedCommands: ['stats', 'inlinestats', 'metrics'], - signatures: [ - ...ESQL_COMMON_NUMERIC_TYPES.map((type) => ({ - params: [{ name: 'column', type, noNestingFunctions: true }], - returnType: type, - })), - { - params: [{ name: 'column', type: 'date', noNestingFunctions: true }], - returnType: 'date', - }, - { - params: [{ name: 'column', type: 'date_period', noNestingFunctions: true }], - returnType: 'date_period', - }, - { - params: [{ name: 'column', type: 'boolean', noNestingFunctions: true }], - returnType: 'boolean', - }, - { - params: [{ name: 'column', type: 'ip', noNestingFunctions: true }], - returnType: 'ip', - }, - { - params: [{ name: 'column', type: 'version', noNestingFunctions: true }], - returnType: 'version', - }, - { - params: [{ name: 'column', type: 'keyword', noNestingFunctions: true }], - returnType: 'keyword', - }, - { - params: [{ name: 'column', type: 'text', noNestingFunctions: true }], - returnType: 'text', - }, - ], - examples: [`from index | stats result = min(field)`, `from index | stats min(field)`], - }, - ]) - .concat([ - { - name: 'count', - type: 'agg', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.countDoc', { - defaultMessage: 'Returns the count of the values in a field.', - }), - supportedCommands: ['stats', 'inlinestats', 'metrics'], - signatures: [ - { - params: [ - { - name: 'column', - type: 'any', - noNestingFunctions: true, - supportsWildcard: true, - optional: true, - }, - ], - returnType: 'long', - }, - ], - examples: [`from index | stats result = count(field)`, `from index | stats count(field)`], - }, - { - name: 'count_distinct', - type: 'agg', - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.countDistinctDoc', - { - defaultMessage: 'Returns the count of distinct values in a field.', - } - ), - supportedCommands: ['stats', 'inlinestats', 'metrics'], - signatures: [ - { - params: [ - { name: 'column', type: 'any', noNestingFunctions: true }, - ...ESQL_NUMBER_TYPES.map((type) => ({ - name: 'precision', - type, - noNestingFunctions: true, - optional: true, - })), - ], - returnType: 'long', - }, - ], - examples: [ - `from index | stats result = count_distinct(field)`, - `from index | stats count_distinct(field)`, - ], - }, - { - name: 'st_centroid_agg', - type: 'agg', - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.stCentroidDoc', - { - defaultMessage: 'Returns the count of distinct values in a field.', - } - ), - supportedCommands: ['stats', 'inlinestats', 'metrics'], - signatures: [ - { - params: [{ name: 'column', type: 'cartesian_point', noNestingFunctions: true }], - returnType: 'cartesian_point', - }, - { - params: [{ name: 'column', type: 'geo_point', noNestingFunctions: true }], - returnType: 'geo_point', - }, - ], - examples: [ - `from index | stats result = st_centroid_agg(cartesian_field)`, - `from index | stats st_centroid_agg(cartesian_field)`, - `from index | stats result = st_centroid_agg(geo_field)`, - `from index | stats st_centroid_agg(geo_field)`, - ], - }, - { - name: 'values', - type: 'agg', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.values', { - defaultMessage: 'Returns all values in a group as an array.', - }), - supportedCommands: ['stats', 'metrics'], - signatures: [ - { - params: [{ name: 'expression', type: 'any', noNestingFunctions: true }], - returnType: 'any', - }, - ], - examples: [ - 'from index | stats all_agents=values(agents.keyword)', - 'from index | stats all_sorted_agents=mv_sort(values(agents.keyword))', - ], - }, - { - name: 'top', - type: 'agg', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.topListDoc', { - defaultMessage: 'Collects top N values per bucket.', - }), - supportedCommands: ['stats', 'metrics'], - signatures: [ - { - params: [ - { - name: 'field', - type: 'any', - noNestingFunctions: true, - optional: false, - }, - { - name: 'limit', - type: 'integer', - noNestingFunctions: true, - optional: false, - constantOnly: true, - }, - { - name: 'order', - type: 'keyword', - noNestingFunctions: true, - optional: false, - constantOnly: true, - acceptedValues: ['asc', 'desc'], - }, - ], - returnType: 'any', - }, - ], - examples: [ - `from employees | stats top_salaries = top(salary, 10, "desc")`, - `from employees | stats date = top(hire_date, 2, "asc"), double = top(salary_change, 2, "asc"),`, - ], - }, - { - name: 'weighted_avg', - type: 'agg', - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.weightedAvgDoc', - { - defaultMessage: - 'An aggregation that computes the weighted average of numeric values that are extracted from the aggregated documents.', - } - ), - supportedCommands: ['stats', 'inlinestats', 'metrics'], - signatures: [ - ...ESQL_COMMON_NUMERIC_TYPES.map((numericType: FunctionParameterType) => { - return ESQL_COMMON_NUMERIC_TYPES.map((weightType: FunctionParameterType) => ({ - params: [ - { - name: 'number', - type: numericType, - noNestingFunctions: true, - optional: false, - }, - { - name: 'weight', - type: weightType, - noNestingFunctions: true, - optional: false, - }, - ], - returnType: 'double' as FunctionReturnType, - })); - }).flat(), - ], - examples: [ - `from employees | stats w_avg = weighted_avg(salary, height) by languages | eval w_avg = round(w_avg)`, - `from employees | stats w_avg_1 = weighted_avg(salary, 1), avg = avg(salary), w_avg_2 = weighted_avg(salary, height)`, - ], - }, - ]); diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/generated/aggregation_functions.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/generated/aggregation_functions.ts new file mode 100644 index 0000000000000..210eec36811de --- /dev/null +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/generated/aggregation_functions.ts @@ -0,0 +1,1740 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the "Elastic License + * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side + * Public License v 1"; you may not use this file except in compliance with, at + * your election, the "Elastic License 2.0", the "GNU Affero General Public + * License v3.0 only", or the "Server Side Public License, v 1". + */ + +/** + * __AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.__ + * + * @note This file is generated by the `generate_function_definitions.ts` + * script. Do not edit it manually. + * + * + * + * + * + * + * + * + * + * + * + * + */ + +import { i18n } from '@kbn/i18n'; +import type { FunctionDefinition } from '../types'; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const avgDefinition: FunctionDefinition = { + type: 'agg', + name: 'avg', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.avg', { + defaultMessage: 'The average of a numeric field.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM employees\n| STATS AVG(height)', + 'FROM employees\n| STATS avg_salary_change = ROUND(AVG(MV_AVG(salary_change)), 10)', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const countDefinition: FunctionDefinition = { + type: 'agg', + name: 'count', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.count', { + defaultMessage: 'Returns the total number (count) of input values.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: true, + supportsWildcard: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: true, + }, + ], + returnType: 'long', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM employees\n| STATS COUNT(height)', + 'FROM employees \n| STATS count = COUNT(*) BY languages \n| SORT languages DESC', + 'ROW words="foo;bar;baz;qux;quux;foo"\n| STATS word_count = COUNT(SPLIT(words, ";"))', + 'ROW n=1\n| WHERE n < 0\n| STATS COUNT(n)', + 'ROW n=1\n| STATS COUNT(n > 0 OR NULL), COUNT(n < 0 OR NULL)', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const countDistinctDefinition: FunctionDefinition = { + type: 'agg', + name: 'count_distinct', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.count_distinct', { + defaultMessage: 'Returns the approximate number of distinct values.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + { + name: 'precision', + type: 'integer', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + { + name: 'precision', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + { + name: 'precision', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + { + name: 'precision', + type: 'integer', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + { + name: 'precision', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + { + name: 'precision', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + { + name: 'precision', + type: 'integer', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + { + name: 'precision', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + { + name: 'precision', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + { + name: 'precision', + type: 'integer', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + { + name: 'precision', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + { + name: 'precision', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + { + name: 'precision', + type: 'integer', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + { + name: 'precision', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + { + name: 'precision', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + { + name: 'precision', + type: 'integer', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + { + name: 'precision', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + { + name: 'precision', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + { + name: 'precision', + type: 'integer', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + { + name: 'precision', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + { + name: 'precision', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + { + name: 'precision', + type: 'integer', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + { + name: 'precision', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + { + name: 'precision', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + { + name: 'precision', + type: 'integer', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + { + name: 'precision', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + { + name: 'precision', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'long', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM hosts\n| STATS COUNT_DISTINCT(ip0), COUNT_DISTINCT(ip1)', + 'FROM hosts\n| STATS COUNT_DISTINCT(ip0, 80000), COUNT_DISTINCT(ip1, 5)', + 'ROW words="foo;bar;baz;qux;quux;foo"\n| STATS distinct_word_count = COUNT_DISTINCT(SPLIT(words, ";"))', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const maxDefinition: FunctionDefinition = { + type: 'agg', + name: 'max', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.max', { + defaultMessage: 'The maximum value of a field.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + ], + returnType: 'text', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM employees\n| STATS MAX(languages)', + 'FROM employees\n| STATS max_avg_salary_change = MAX(MV_AVG(salary_change))', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const medianDefinition: FunctionDefinition = { + type: 'agg', + name: 'median', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.median', { + defaultMessage: + 'The value that is greater than half of all values and less than half of all values, also known as the 50% `PERCENTILE`.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM employees\n| STATS MEDIAN(salary), PERCENTILE(salary, 50)', + 'FROM employees\n| STATS median_max_salary_change = MEDIAN(MV_MAX(salary_change))', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const medianAbsoluteDeviationDefinition: FunctionDefinition = { + type: 'agg', + name: 'median_absolute_deviation', + description: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.definitions.median_absolute_deviation', + { + defaultMessage: + "Returns the median absolute deviation, a measure of variability. It is a robust statistic, meaning that it is useful for describing data that may have outliers, or may not be normally distributed. For such data it can be more descriptive than standard deviation.\n\nIt is calculated as the median of each data point's deviation from the median of the entire sample. That is, for a random variable `X`, the median absolute deviation is `median(|median(X) - X|)`.", + } + ), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM employees\n| STATS MEDIAN(salary), MEDIAN_ABSOLUTE_DEVIATION(salary)', + 'FROM employees\n| STATS m_a_d_max_salary_change = MEDIAN_ABSOLUTE_DEVIATION(MV_MAX(salary_change))', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const minDefinition: FunctionDefinition = { + type: 'agg', + name: 'min', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.min', { + defaultMessage: 'The minimum value of a field.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + ], + returnType: 'text', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM employees\n| STATS MIN(languages)', + 'FROM employees\n| STATS min_avg_salary_change = MIN(MV_AVG(salary_change))', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const percentileDefinition: FunctionDefinition = { + type: 'agg', + name: 'percentile', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.percentile', { + defaultMessage: + 'Returns the value at which a certain percentage of observed values occur. For example, the 95th percentile is the value which is greater than 95% of the observed values and the 50th percentile is the `MEDIAN`.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + { + name: 'percentile', + type: 'double', + optional: false, + constantOnly: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + { + name: 'percentile', + type: 'integer', + optional: false, + constantOnly: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + { + name: 'percentile', + type: 'long', + optional: false, + constantOnly: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + { + name: 'percentile', + type: 'double', + optional: false, + constantOnly: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + { + name: 'percentile', + type: 'integer', + optional: false, + constantOnly: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + { + name: 'percentile', + type: 'long', + optional: false, + constantOnly: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + { + name: 'percentile', + type: 'double', + optional: false, + constantOnly: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + { + name: 'percentile', + type: 'integer', + optional: false, + constantOnly: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + { + name: 'percentile', + type: 'long', + optional: false, + constantOnly: true, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM employees\n| STATS p0 = PERCENTILE(salary, 0)\n , p50 = PERCENTILE(salary, 50)\n , p99 = PERCENTILE(salary, 99)', + 'FROM employees\n| STATS p80_max_salary_change = PERCENTILE(MV_MAX(salary_change), 80)', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const stCentroidAggDefinition: FunctionDefinition = { + type: 'agg', + name: 'st_centroid_agg', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.st_centroid_agg', { + defaultMessage: 'Calculate the spatial centroid over a field with spatial point geometry type.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'cartesian_point', + }, + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'geo_point', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: ['FROM airports\n| STATS centroid=ST_CENTROID_AGG(location)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const sumDefinition: FunctionDefinition = { + type: 'agg', + name: 'sum', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sum', { + defaultMessage: 'The sum of a numeric expression.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM employees\n| STATS SUM(languages)', + 'FROM employees\n| STATS total_salary_changes = SUM(MV_MAX(salary_change))', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const topDefinition: FunctionDefinition = { + type: 'agg', + name: 'top', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.top', { + defaultMessage: 'Collects the top values for a field. Includes repeated values.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + { + name: 'limit', + type: 'integer', + optional: false, + constantOnly: true, + }, + { + name: 'order', + type: 'keyword', + optional: false, + constantOnly: true, + acceptedValues: ['asc', 'desc'], + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + { + name: 'limit', + type: 'integer', + optional: false, + constantOnly: true, + }, + { + name: 'order', + type: 'keyword', + optional: false, + constantOnly: true, + acceptedValues: ['asc', 'desc'], + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + { + name: 'limit', + type: 'integer', + optional: false, + constantOnly: true, + }, + { + name: 'order', + type: 'keyword', + optional: false, + constantOnly: true, + acceptedValues: ['asc', 'desc'], + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + { + name: 'limit', + type: 'integer', + optional: false, + constantOnly: true, + }, + { + name: 'order', + type: 'keyword', + optional: false, + constantOnly: true, + acceptedValues: ['asc', 'desc'], + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + { + name: 'limit', + type: 'integer', + optional: false, + constantOnly: true, + }, + { + name: 'order', + type: 'keyword', + optional: false, + constantOnly: true, + acceptedValues: ['asc', 'desc'], + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + { + name: 'limit', + type: 'integer', + optional: false, + constantOnly: true, + }, + { + name: 'order', + type: 'keyword', + optional: false, + constantOnly: true, + acceptedValues: ['asc', 'desc'], + }, + ], + returnType: 'long', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM employees\n| STATS top_salaries = TOP(salary, 3, "desc"), top_salary = MAX(salary)', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const valuesDefinition: FunctionDefinition = { + type: 'agg', + name: 'values', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.values', { + defaultMessage: + "Returns all values in a group as a multivalued field. The order of the returned values isn't guaranteed. If you need the values returned in order use esql-mv_sort.", + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + ], + returnType: 'text', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + ' FROM employees\n| EVAL first_letter = SUBSTRING(first_name, 0, 1)\n| STATS first_name=MV_SORT(VALUES(first_name)) BY first_letter\n| SORT first_letter', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const weightedAvgDefinition: FunctionDefinition = { + type: 'agg', + name: 'weighted_avg', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.weighted_avg', { + defaultMessage: 'The weighted average of a numeric expression.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + { + name: 'weight', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + { + name: 'weight', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + { + name: 'weight', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + { + name: 'weight', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + { + name: 'weight', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + { + name: 'weight', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + { + name: 'weight', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + { + name: 'weight', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + { + name: 'weight', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics'], + supportedOptions: undefined, + validate: undefined, + examples: [ + 'FROM employees\n| STATS w_avg = WEIGHTED_AVG(salary, height) by languages\n| EVAL w_avg = ROUND(w_avg)\n| KEEP w_avg, languages\n| SORT languages', + ], +}; +export const aggregationFunctionDefinitions = [ + avgDefinition, + countDefinition, + countDistinctDefinition, + maxDefinition, + medianDefinition, + medianAbsoluteDeviationDefinition, + minDefinition, + percentileDefinition, + stCentroidAggDefinition, + sumDefinition, + topDefinition, + valuesDefinition, + weightedAvgDefinition, +]; diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/generated/scalar_functions.ts similarity index 97% rename from packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts rename to packages/kbn-esql-validation-autocomplete/src/definitions/generated/scalar_functions.ts index 9cf2245fc2fad..3f5718b5417ba 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/generated/scalar_functions.ts @@ -26,10 +26,10 @@ * */ -import type { ESQLFunction } from '@kbn/esql-ast'; import { i18n } from '@kbn/i18n'; -import { isLiteralItem } from '../shared/helpers'; -import type { FunctionDefinition } from './types'; +import type { ESQLFunction } from '@kbn/esql-ast'; +import type { FunctionDefinition } from '../types'; +import { isLiteralItem } from '../../shared/helpers'; // Do not edit this manually... generated by scripts/generate_function_definitions.ts const absDefinition: FunctionDefinition = { @@ -1088,14 +1088,14 @@ const coshDefinition: FunctionDefinition = { type: 'eval', name: 'cosh', description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cosh', { - defaultMessage: 'Returns the hyperbolic cosine of an angle.', + defaultMessage: 'Returns the hyperbolic cosine of a number.', }), alias: undefined, signatures: [ { params: [ { - name: 'angle', + name: 'number', type: 'double', optional: false, }, @@ -1105,7 +1105,7 @@ const coshDefinition: FunctionDefinition = { { params: [ { - name: 'angle', + name: 'number', type: 'integer', optional: false, }, @@ -1115,7 +1115,7 @@ const coshDefinition: FunctionDefinition = { { params: [ { - name: 'angle', + name: 'number', type: 'long', optional: false, }, @@ -1125,7 +1125,7 @@ const coshDefinition: FunctionDefinition = { { params: [ { - name: 'angle', + name: 'number', type: 'unsigned_long', optional: false, }, @@ -4026,6 +4026,68 @@ const mvMedianDefinition: FunctionDefinition = { ], }; +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const mvMedianAbsoluteDeviationDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_median_absolute_deviation', + description: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.definitions.mv_median_absolute_deviation', + { + defaultMessage: + "Converts a multivalued field into a single valued field containing the median absolute deviation.\n\nIt is calculated as the median of each data point's deviation from the median of the entire sample. That is, for a random variable `X`, the median absolute deviation is `median(|median(X) - X|)`.", + } + ), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'unsigned_long', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW values = [0, 2, 5, 6]\n| EVAL median_absolute_deviation = MV_MEDIAN_ABSOLUTE_DEVIATION(values), median = MV_MEDIAN(values)', + ], +}; + // Do not edit this manually... generated by scripts/generate_function_definitions.ts const mvMinDefinition: FunctionDefinition = { type: 'eval', @@ -5849,7 +5911,7 @@ const sinDefinition: FunctionDefinition = { type: 'eval', name: 'sin', description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sin', { - defaultMessage: 'Returns ths Sine trigonometric function of an angle.', + defaultMessage: 'Returns the sine of an angle.', }), alias: undefined, signatures: [ @@ -5905,14 +5967,14 @@ const sinhDefinition: FunctionDefinition = { type: 'eval', name: 'sinh', description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sinh', { - defaultMessage: 'Returns the hyperbolic sine of an angle.', + defaultMessage: 'Returns the hyperbolic sine of a number.', }), alias: undefined, signatures: [ { params: [ { - name: 'angle', + name: 'number', type: 'double', optional: false, }, @@ -5922,7 +5984,7 @@ const sinhDefinition: FunctionDefinition = { { params: [ { - name: 'angle', + name: 'number', type: 'integer', optional: false, }, @@ -5932,7 +5994,7 @@ const sinhDefinition: FunctionDefinition = { { params: [ { - name: 'angle', + name: 'number', type: 'long', optional: false, }, @@ -5942,7 +6004,7 @@ const sinhDefinition: FunctionDefinition = { { params: [ { - name: 'angle', + name: 'number', type: 'unsigned_long', optional: false, }, @@ -5956,6 +6018,32 @@ const sinhDefinition: FunctionDefinition = { examples: ['ROW a=1.8 \n| EVAL sinh=SINH(a)'], }; +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const spaceDefinition: FunctionDefinition = { + type: 'eval', + name: 'space', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.space', { + defaultMessage: 'Returns a string made of `number` spaces.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'keyword', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW message = CONCAT("Hello", SPACE(1), "World!");'], +}; + // Do not edit this manually... generated by scripts/generate_function_definitions.ts const splitDefinition: FunctionDefinition = { type: 'eval', @@ -6915,7 +7003,7 @@ const tanDefinition: FunctionDefinition = { type: 'eval', name: 'tan', description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.tan', { - defaultMessage: 'Returns the Tangent trigonometric function of an angle.', + defaultMessage: 'Returns the tangent of an angle.', }), alias: undefined, signatures: [ @@ -6971,14 +7059,14 @@ const tanhDefinition: FunctionDefinition = { type: 'eval', name: 'tanh', description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.tanh', { - defaultMessage: 'Returns the Tangent hyperbolic function of an angle.', + defaultMessage: 'Returns the hyperbolic tangent of a number.', }), alias: undefined, signatures: [ { params: [ { - name: 'angle', + name: 'number', type: 'double', optional: false, }, @@ -6988,7 +7076,7 @@ const tanhDefinition: FunctionDefinition = { { params: [ { - name: 'angle', + name: 'number', type: 'integer', optional: false, }, @@ -6998,7 +7086,7 @@ const tanhDefinition: FunctionDefinition = { { params: [ { - name: 'angle', + name: 'number', type: 'long', optional: false, }, @@ -7008,7 +7096,7 @@ const tanhDefinition: FunctionDefinition = { { params: [ { - name: 'angle', + name: 'number', type: 'unsigned_long', optional: false, }, @@ -7279,6 +7367,54 @@ const toCartesianshapeDefinition: FunctionDefinition = { ], }; +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const toDateperiodDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_dateperiod', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_dateperiod', { + defaultMessage: 'Converts an input value into a `date_period` value.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'date_period', + optional: false, + }, + ], + returnType: 'date_period', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'date_period', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + ], + returnType: 'date_period', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'row x = "2024-01-01"::datetime | eval y = x + "3 DAYS"::date_period, z = x - to_dateperiod("3 days");', + ], +}; + // Do not edit this manually... generated by scripts/generate_function_definitions.ts const toDatetimeDefinition: FunctionDefinition = { type: 'eval', @@ -8182,6 +8318,54 @@ const toStringDefinition: FunctionDefinition = { examples: ['ROW a=10\n| EVAL j = TO_STRING(a)', 'ROW a=[10, 9, 8]\n| EVAL j = TO_STRING(a)'], }; +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const toTimedurationDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_timeduration', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_timeduration', { + defaultMessage: 'Converts an input value into a `time_duration` value.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'time_duration', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + ], + returnType: 'time_duration', + }, + { + params: [ + { + name: 'field', + type: 'time_duration', + optional: false, + }, + ], + returnType: 'time_duration', + }, + ], + supportedCommands: ['stats', 'inlinestats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'row x = "2024-01-01"::datetime | eval y = x + "3 hours"::time_duration, z = x - to_timeduration("3 hours");', + ], +}; + // Do not edit this manually... generated by scripts/generate_function_definitions.ts const toUnsignedLongDefinition: FunctionDefinition = { type: 'eval', @@ -8436,7 +8620,7 @@ const caseDefinition: FunctionDefinition = { 'from index | eval type = case(languages <= 1, "monolingual", languages <= 2, "bilingual", "polyglot")', ], }; -export const evalFunctionDefinitions = [ +export const scalarFunctionDefinitions = [ absDefinition, acosDefinition, asinDefinition, @@ -8477,6 +8661,7 @@ export const evalFunctionDefinitions = [ mvLastDefinition, mvMaxDefinition, mvMedianDefinition, + mvMedianAbsoluteDeviationDefinition, mvMinDefinition, mvPercentileDefinition, mvPseriesWeightedSumDefinition, @@ -8495,6 +8680,7 @@ export const evalFunctionDefinitions = [ signumDefinition, sinDefinition, sinhDefinition, + spaceDefinition, splitDefinition, sqrtDefinition, stContainsDefinition, @@ -8513,6 +8699,7 @@ export const evalFunctionDefinitions = [ toBooleanDefinition, toCartesianpointDefinition, toCartesianshapeDefinition, + toDateperiodDefinition, toDatetimeDefinition, toDegreesDefinition, toDoubleDefinition, @@ -8524,6 +8711,7 @@ export const evalFunctionDefinitions = [ toLowerDefinition, toRadiansDefinition, toStringDefinition, + toTimedurationDefinition, toUnsignedLongDefinition, toUpperDefinition, toVersionDefinition, diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts index 0ac850ef4862f..a6e297771cebe 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts @@ -120,7 +120,6 @@ export interface FunctionDefinition { name: string; type: FunctionParameterType; optional?: boolean; - noNestingFunctions?: boolean; supportsWildcard?: boolean; /** * If set, this parameter does not accept a field. It only accepts a constant, diff --git a/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts b/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts index 052ceb6f18fe0..0a7a2824d7b2e 100644 --- a/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts +++ b/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts @@ -19,10 +19,10 @@ import type { ESQLTimeInterval, } from '@kbn/esql-ast'; import { ESQLInlineCast, ESQLParamLiteral } from '@kbn/esql-ast/src/types'; -import { statsAggregationFunctionDefinitions } from '../definitions/aggs'; +import { aggregationFunctionDefinitions } from '../definitions/generated/aggregation_functions'; import { builtinFunctions } from '../definitions/builtin'; import { commandDefinitions } from '../definitions/commands'; -import { evalFunctionDefinitions } from '../definitions/functions'; +import { scalarFunctionDefinitions } from '../definitions/generated/scalar_functions'; import { groupingFunctionDefinitions } from '../definitions/grouping'; import { getTestFunctions } from './test_functions'; import { getFunctionSignatures } from '../definitions/helpers'; @@ -141,8 +141,8 @@ function buildFunctionLookup() { if (!fnLookups || getTestFunctions().length) { fnLookups = builtinFunctions .concat( - evalFunctionDefinitions, - statsAggregationFunctionDefinitions, + scalarFunctionDefinitions, + aggregationFunctionDefinitions, groupingFunctionDefinitions, getTestFunctions() ) diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/functions.test.ts b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/functions.test.ts index 61a4d66a3a65f..9cf211315757e 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/functions.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/functions.test.ts @@ -141,6 +141,60 @@ describe('function validation', () => { }); }); + describe('special parameter types', () => { + it('any type', async () => { + const testFn: FunctionDefinition = { + name: 'test', + type: 'eval', + description: '', + supportedCommands: ['eval'], + signatures: [ + { + params: [{ name: 'arg1', type: 'any' }], + returnType: 'integer', + }, + ], + }; + + setTestFunctions([testFn]); + + const { expectErrors } = await setup(); + + await expectErrors('FROM a_index | EVAL TEST(1)', []); + await expectErrors('FROM a_index | EVAL TEST("keyword")', []); + await expectErrors('FROM a_index | EVAL TEST(2.)', []); + await expectErrors('FROM a_index | EVAL TEST(to_cartesianpoint(""))', []); + await expectErrors('FROM a_index | EVAL TEST(NOW())', []); + }); + + it('list type', async () => { + const testFn: FunctionDefinition = { + name: 'in', + type: 'builtin', + description: '', + supportedCommands: ['row'], + signatures: [ + { + params: [ + { name: 'arg1', type: 'keyword' }, + { name: 'arg2', type: 'keyword[]' }, + ], + returnType: 'boolean', + }, + ], + }; + + setTestFunctions([testFn]); + + const { expectErrors } = await setup(); + + await expectErrors('ROW "a" IN ("a", "b", "c")', []); + await expectErrors('ROW "a" IN (1, "b", "c")', [ + 'Argument of [in] must be [keyword[]], found value [(1, "b", "c")] type [(integer, string, string)]', + ]); + }); + }); + it('checks types by signature', async () => { const testFn: FunctionDefinition = { name: 'test', @@ -605,16 +659,28 @@ describe('function validation', () => { supportedCommands: ['eval'], signatures: [ { - params: [{ name: 'arg1', type: 'integer' }], + params: [{ name: 'arg1', type: 'keyword' }], returnType: 'integer', }, ], }, + { + name: 'test2', + type: 'eval', + description: '', + supportedCommands: ['eval'], + signatures: [ + { + params: [{ name: 'arg1', type: 'integer' }], + returnType: 'keyword', + }, + ], + }, ]); const { expectErrors } = await setup(); - await expectErrors('FROM a_index | EVAL TEST(TEST(TEST(1)))', []); + await expectErrors('FROM a_index | EVAL TEST(TEST2(TEST(TEST2(1))))', []); }); it("doesn't allow nested aggregation functions", async () => { @@ -626,7 +692,7 @@ describe('function validation', () => { supportedCommands: ['stats'], signatures: [ { - params: [{ name: 'arg1', type: 'keyword', noNestingFunctions: true }], + params: [{ name: 'arg1', type: 'keyword' }], returnType: 'keyword', }, ], diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json b/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json index fd04d1f5646d7..1eb861168a13a 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json +++ b/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json @@ -9685,27990 +9685,6 @@ ], "warning": [] }, - { - "query": "row var = abs(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row abs(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = abs(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = abs(5)", - "error": [], - "warning": [] - }, - { - "query": "row abs(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = abs(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = abs(true)", - "error": [ - "Argument of [abs] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where abs(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where abs(booleanField) > 0", - "error": [ - "Argument of [abs] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where abs(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where abs(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where abs(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = abs(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval abs(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = abs(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval abs(booleanField)", - "error": [ - "Argument of [abs] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = abs(*)", - "error": [ - "Using wildcards (*) in abs is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = abs(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval abs(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = abs(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = abs(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval abs(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = abs(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval abs(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval abs(doubleField, extraArg)", - "error": [ - "Error: [abs] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort abs(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval abs(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval abs(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = acos(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row acos(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = acos(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = acos(5)", - "error": [], - "warning": [] - }, - { - "query": "row acos(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = acos(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = acos(true)", - "error": [ - "Argument of [acos] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where acos(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where acos(booleanField) > 0", - "error": [ - "Argument of [acos] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where acos(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where acos(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where acos(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = acos(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval acos(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = acos(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval acos(booleanField)", - "error": [ - "Argument of [acos] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = acos(*)", - "error": [ - "Using wildcards (*) in acos is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = acos(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval acos(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = acos(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = acos(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval acos(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = acos(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval acos(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval acos(doubleField, extraArg)", - "error": [ - "Error: [acos] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort acos(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval acos(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval acos(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = asin(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row asin(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = asin(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = asin(5)", - "error": [], - "warning": [] - }, - { - "query": "row asin(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = asin(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = asin(true)", - "error": [ - "Argument of [asin] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where asin(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where asin(booleanField) > 0", - "error": [ - "Argument of [asin] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where asin(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where asin(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where asin(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = asin(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval asin(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = asin(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval asin(booleanField)", - "error": [ - "Argument of [asin] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = asin(*)", - "error": [ - "Using wildcards (*) in asin is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = asin(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval asin(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = asin(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = asin(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval asin(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = asin(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval asin(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval asin(doubleField, extraArg)", - "error": [ - "Error: [asin] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort asin(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval asin(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval asin(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = atan(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row atan(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = atan(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = atan(5)", - "error": [], - "warning": [] - }, - { - "query": "row atan(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = atan(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = atan(true)", - "error": [ - "Argument of [atan] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where atan(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan(booleanField) > 0", - "error": [ - "Argument of [atan] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where atan(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan(booleanField)", - "error": [ - "Argument of [atan] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = atan(*)", - "error": [ - "Using wildcards (*) in atan is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = atan(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan(doubleField, extraArg)", - "error": [ - "Error: [atan] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort atan(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval atan(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row atan2(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(to_double(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(5.5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row atan2(5.5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(to_double(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(to_double(true), 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row atan2(5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(to_integer(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row atan2(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(to_integer(true), 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(5, to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(5, to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = atan2(true, true)", - "error": [ - "Argument of [atan2] must be [double], found value [true] type [boolean]", - "Argument of [atan2] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where atan2(doubleField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(booleanField, booleanField) > 0", - "error": [ - "Argument of [atan2] must be [double], found value [booleanField] type [boolean]", - "Argument of [atan2] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where atan2(doubleField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(doubleField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(doubleField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(integerField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(integerField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(integerField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(longField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(longField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(longField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(longField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(unsignedLongField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(unsignedLongField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(unsignedLongField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan2(unsignedLongField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(to_double(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(booleanField, booleanField)", - "error": [ - "Argument of [atan2] must be [double], found value [booleanField] type [boolean]", - "Argument of [atan2] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(to_double(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(to_double(booleanField), longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(doubleField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(doubleField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(to_double(booleanField), unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(to_integer(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(to_integer(booleanField), longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(integerField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(integerField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(to_integer(booleanField), unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(longField, to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(longField, to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(longField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(longField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(unsignedLongField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(unsignedLongField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(unsignedLongField, to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(unsignedLongField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(unsignedLongField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(unsignedLongField, to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(unsignedLongField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(unsignedLongField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = atan2(unsignedLongField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(unsignedLongField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(doubleField, doubleField, extraArg)", - "error": [ - "Error: [atan2] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort atan2(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval atan2(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = cbrt(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row cbrt(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = cbrt(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = cbrt(5)", - "error": [], - "warning": [] - }, - { - "query": "row cbrt(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = cbrt(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = cbrt(true)", - "error": [ - "Argument of [cbrt] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where cbrt(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where cbrt(booleanField) > 0", - "error": [ - "Argument of [cbrt] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where cbrt(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where cbrt(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where cbrt(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cbrt(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cbrt(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cbrt(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cbrt(booleanField)", - "error": [ - "Argument of [cbrt] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = cbrt(*)", - "error": [ - "Using wildcards (*) in cbrt is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = cbrt(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cbrt(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cbrt(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cbrt(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cbrt(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cbrt(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cbrt(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cbrt(doubleField, extraArg)", - "error": [ - "Error: [cbrt] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort cbrt(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cbrt(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval cbrt(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = ceil(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row ceil(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = ceil(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = ceil(5)", - "error": [], - "warning": [] - }, - { - "query": "row ceil(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = ceil(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = ceil(true)", - "error": [ - "Argument of [ceil] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where ceil(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where ceil(booleanField) > 0", - "error": [ - "Argument of [ceil] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where ceil(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where ceil(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where ceil(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = ceil(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ceil(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = ceil(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ceil(booleanField)", - "error": [ - "Argument of [ceil] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = ceil(*)", - "error": [ - "Using wildcards (*) in ceil is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = ceil(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ceil(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = ceil(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = ceil(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ceil(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = ceil(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ceil(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ceil(doubleField, extraArg)", - "error": [ - "Error: [ceil] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort ceil(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ceil(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval ceil(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = cidr_match(to_ip(\"127.0.0.1\"), \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row cidr_match(to_ip(\"127.0.0.1\"), \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = cidr_match(to_ip(to_ip(\"127.0.0.1\")), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = cidr_match(true, true)", - "error": [ - "Argument of [cidr_match] must be [ip], found value [true] type [boolean]", - "Argument of [cidr_match] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = cidr_match(ipField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cidr_match(ipField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cidr_match(to_ip(ipField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cidr_match(booleanField, booleanField)", - "error": [ - "Argument of [cidr_match] must be [ip], found value [booleanField] type [boolean]", - "Argument of [cidr_match] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = cidr_match(ipField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cidr_match(ipField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort cidr_match(ipField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cidr_match(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval cidr_match(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(true)", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(true, true)", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(true, true)", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_boolean(true), to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row coalesce(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = coalesce(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = coalesce(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = coalesce(to_datetime(\"2021-01-01T00:00:00Z\"), to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(to_datetime(\"2021-01-01T00:00:00Z\"), to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")), to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row coalesce(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = coalesce(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = coalesce(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = coalesce(5)", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_version(\"a\"), to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where coalesce(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where coalesce(counterDoubleField) > 0", - "error": [ - "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | where coalesce(integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where coalesce(counterDoubleField, counterDoubleField) > 0", - "error": [ - "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]", - "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | where coalesce(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where coalesce(longField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(counterDoubleField)", - "error": [ - "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(booleanField, booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(booleanField, booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_boolean(booleanField), to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(counterDoubleField, counterDoubleField)", - "error": [ - "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]", - "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_datetime(dateField), to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(ipField, ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(ipField, ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_ip(ipField), to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(versionField, versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(versionField, versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = coalesce(to_version(keywordField), to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort coalesce(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval coalesce(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(\"2022\", \"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval coalesce(concat(\"20\", \"22\"), concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row coalesce(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = coalesce(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = concat(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row concat(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = concat(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = concat(true, true)", - "error": [ - "Argument of [concat] must be [keyword], found value [true] type [boolean]", - "Argument of [concat] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = concat(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval concat(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = concat(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval concat(booleanField, booleanField)", - "error": [ - "Argument of [concat] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [concat] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = concat(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval concat(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = concat(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval concat(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = concat(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval concat(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort concat(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval concat(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval concat(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = cos(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row cos(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = cos(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = cos(5)", - "error": [], - "warning": [] - }, - { - "query": "row cos(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = cos(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = cos(true)", - "error": [ - "Argument of [cos] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where cos(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where cos(booleanField) > 0", - "error": [ - "Argument of [cos] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where cos(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where cos(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where cos(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cos(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cos(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cos(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cos(booleanField)", - "error": [ - "Argument of [cos] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = cos(*)", - "error": [ - "Using wildcards (*) in cos is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = cos(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cos(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cos(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cos(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cos(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cos(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cos(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cos(doubleField, extraArg)", - "error": [ - "Error: [cos] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort cos(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cos(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval cos(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = cosh(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row cosh(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = cosh(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = cosh(5)", - "error": [], - "warning": [] - }, - { - "query": "row cosh(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = cosh(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = cosh(true)", - "error": [ - "Argument of [cosh] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where cosh(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where cosh(booleanField) > 0", - "error": [ - "Argument of [cosh] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where cosh(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where cosh(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where cosh(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cosh(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cosh(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cosh(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cosh(booleanField)", - "error": [ - "Argument of [cosh] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = cosh(*)", - "error": [ - "Using wildcards (*) in cosh is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = cosh(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cosh(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cosh(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cosh(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cosh(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = cosh(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cosh(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cosh(doubleField, extraArg)", - "error": [ - "Error: [cosh] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort cosh(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval cosh(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval cosh(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = date_diff(\"year\", dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_diff(\"year\", dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = date_diff(\"year\", to_datetime(dateField), to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_diff(booleanField, booleanField, booleanField)", - "error": [ - "Argument of [date_diff] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [date_diff] must be [date], found value [booleanField] type [boolean]", - "Argument of [date_diff] must be [date], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_diff(textField, dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_diff(textField, dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = date_diff(to_string(booleanField), to_datetime(dateField), to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_diff(\"year\", dateField, dateField, extraArg)", - "error": [ - "Error: [date_diff] function expects exactly 3 arguments, got 4." - ], - "warning": [] - }, - { - "query": "from a_index | sort date_diff(\"year\", dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_diff(null, null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval date_diff(nullVar, nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_diff(\"year\", \"2022\", \"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_diff(\"year\", concat(\"20\", \"22\"), concat(\"20\", \"22\"))", - "error": [ - "Argument of [date_diff] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", - "Argument of [date_diff] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "from a_index | eval date_diff(textField, \"2022\", \"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_diff(textField, concat(\"20\", \"22\"), concat(\"20\", \"22\"))", - "error": [ - "Argument of [date_diff] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", - "Argument of [date_diff] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_diff(to_string(booleanField), dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "row var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = date_extract(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row date_extract(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = date_extract(true, true)", - "error": [ - "Argument of [date_extract] must be [keyword], found value [true] type [boolean]", - "Argument of [date_extract] must be [date], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_extract(booleanField, booleanField)", - "error": [ - "Argument of [date_extract] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [date_extract] must be [date], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_extract(textField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_extract(textField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = date_extract(to_string(booleanField), to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField, extraArg)", - "error": [ - "Error: [date_extract] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_extract(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval date_extract(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", \"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", concat(\"20\", \"22\"))", - "error": [ - "Argument of [date_extract] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "from a_index | eval date_extract(textField, \"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_extract(textField, concat(\"20\", \"22\"))", - "error": [ - "Argument of [date_extract] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_extract(to_string(booleanField), dateField)", - "error": [], - "warning": [] - }, - { - "query": "row var = date_format(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row date_format(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = date_format(true, true)", - "error": [ - "Argument of [date_format] must be [keyword], found value [true] type [boolean]", - "Argument of [date_format] must be [date], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_format(keywordField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_format(keywordField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = date_format(to_string(booleanField), to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_format(booleanField, booleanField)", - "error": [ - "Argument of [date_format] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [date_format] must be [date], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_format(textField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_format(textField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_format(keywordField, dateField, extraArg)", - "error": [ - "Error: [date_format] function expects no more than 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort date_format(keywordField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_format(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval date_format(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_format(keywordField, \"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_format(keywordField, concat(\"20\", \"22\"))", - "error": [ - "Argument of [date_format] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "from a_index | eval date_format(textField, \"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_format(textField, concat(\"20\", \"22\"))", - "error": [ - "Argument of [date_format] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_format(to_string(booleanField), dateField)", - "error": [], - "warning": [] - }, - { - "query": "row var = date_parse(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row date_parse(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = date_parse(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = date_parse(true, true)", - "error": [ - "Argument of [date_parse] must be [keyword], found value [true] type [boolean]", - "Argument of [date_parse] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_parse(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_parse(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = date_parse(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_parse(booleanField, booleanField)", - "error": [ - "Argument of [date_parse] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [date_parse] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_parse(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_parse(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = date_parse(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_parse(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = date_parse(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_parse(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_parse(keywordField, keywordField, extraArg)", - "error": [ - "Error: [date_parse] function expects no more than 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort date_parse(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_parse(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval date_parse(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = date_trunc(1 year, to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row date_trunc(1 year, to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = date_trunc(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [\"a\"] type [string]" - ], - "warning": [] - }, - { - "query": "row date_trunc(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [\"a\"] type [string]" - ], - "warning": [] - }, - { - "query": "row var = date_trunc(true, true)", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [true] type [boolean]", - "Argument of [date_trunc] must be [date], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_trunc(1 year, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_trunc(1 year, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = date_trunc(1 year, to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_trunc(booleanField, booleanField)", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [booleanField] type [boolean]", - "Argument of [date_trunc] must be [date], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_trunc(textField, dateField)", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [textField] type [text]" - ], - "warning": [] - }, - { - "query": "from a_index | eval date_trunc(textField, dateField)", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [textField] type [text]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_trunc(textField, to_datetime(dateField))", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [textField] type [text]" - ], - "warning": [] - }, - { - "query": "from a_index | eval date_trunc(1 year, dateField, extraArg)", - "error": [ - "Error: [date_trunc] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort date_trunc(1 year, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_trunc(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval date_trunc(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_trunc(1 year, \"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_trunc(1 year, concat(\"20\", \"22\"))", - "error": [ - "Argument of [date_trunc] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "from a_index | eval date_trunc(textField, \"2022\")", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [textField] type [text]" - ], - "warning": [] - }, - { - "query": "from a_index | eval date_trunc(textField, concat(\"20\", \"22\"))", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [textField] type [text]", - "Argument of [date_trunc] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "row var = date_trunc(1 day, to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row date_trunc(1 day, to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = e()", - "error": [], - "warning": [] - }, - { - "query": "row e()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where e() > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = e()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval e()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval e(extraArg)", - "error": [ - "Error: [e] function expects exactly 0 arguments, got 1." - ], - "warning": [] - }, - { - "query": "from a_index | sort e()", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval e()", - "error": [], - "warning": [] - }, - { - "query": "row var = ends_with(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row ends_with(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = ends_with(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = ends_with(true, true)", - "error": [ - "Argument of [ends_with] must be [keyword], found value [true] type [boolean]", - "Argument of [ends_with] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = ends_with(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ends_with(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = ends_with(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ends_with(booleanField, booleanField)", - "error": [ - "Argument of [ends_with] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [ends_with] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = ends_with(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ends_with(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ends_with(keywordField, keywordField, extraArg)", - "error": [ - "Error: [ends_with] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort ends_with(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ends_with(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval ends_with(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = ends_with(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ends_with(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = ends_with(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ends_with(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "row var = exp(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row exp(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = exp(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = exp(5)", - "error": [], - "warning": [] - }, - { - "query": "row exp(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = exp(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = exp(true)", - "error": [ - "Argument of [exp] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where exp(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where exp(booleanField) > 0", - "error": [ - "Argument of [exp] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where exp(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where exp(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where exp(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = exp(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval exp(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = exp(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval exp(booleanField)", - "error": [ - "Argument of [exp] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = exp(*)", - "error": [ - "Using wildcards (*) in exp is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = exp(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval exp(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = exp(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = exp(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval exp(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = exp(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval exp(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval exp(doubleField, extraArg)", - "error": [ - "Error: [exp] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort exp(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval exp(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval exp(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = floor(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row floor(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = floor(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = floor(5)", - "error": [], - "warning": [] - }, - { - "query": "row floor(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = floor(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = floor(true)", - "error": [ - "Argument of [floor] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where floor(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where floor(booleanField) > 0", - "error": [ - "Argument of [floor] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where floor(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where floor(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where floor(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = floor(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval floor(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = floor(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval floor(booleanField)", - "error": [ - "Argument of [floor] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = floor(*)", - "error": [ - "Using wildcards (*) in floor is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = floor(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval floor(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = floor(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = floor(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval floor(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = floor(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval floor(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval floor(doubleField, extraArg)", - "error": [ - "Error: [floor] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort floor(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval floor(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval floor(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = from_base64(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row from_base64(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = from_base64(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = from_base64(true)", - "error": [ - "Argument of [from_base64] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = from_base64(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval from_base64(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = from_base64(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval from_base64(booleanField)", - "error": [ - "Argument of [from_base64] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = from_base64(*)", - "error": [ - "Using wildcards (*) in from_base64 is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = from_base64(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval from_base64(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval from_base64(keywordField, extraArg)", - "error": [ - "Error: [from_base64] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort from_base64(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval from_base64(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval from_base64(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(true)", - "error": [], - "warning": [] - }, - { - "query": "row greatest(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(true, true)", - "error": [], - "warning": [] - }, - { - "query": "row greatest(true, true)", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_boolean(true), to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row greatest(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_double(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(5)", - "error": [], - "warning": [] - }, - { - "query": "row greatest(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row greatest(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row greatest(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row greatest(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row greatest(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row greatest(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_version(\"a\"), to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = greatest(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [greatest] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", - "Argument of [greatest] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where greatest(doubleField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where greatest(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where greatest(cartesianPointField) > 0", - "error": [ - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where greatest(integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where greatest(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where greatest(longField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(cartesianPointField)", - "error": [ - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(booleanField, booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(booleanField, booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(to_boolean(booleanField), to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(cartesianPointField, cartesianPointField)", - "error": [ - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(to_double(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(ipField, ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(ipField, ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(to_ip(ipField), to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(versionField, versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(versionField, versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = greatest(to_version(keywordField), to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort greatest(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval greatest(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval greatest(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where greatest(cartesianPointField, cartesianPointField) > 0", - "error": [ - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "row var = ip_prefix(to_ip(\"127.0.0.1\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row ip_prefix(to_ip(\"127.0.0.1\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = ip_prefix(to_ip(to_ip(\"127.0.0.1\")), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = ip_prefix(true, true, true)", - "error": [ - "Argument of [ip_prefix] must be [ip], found value [true] type [boolean]", - "Argument of [ip_prefix] must be [integer], found value [true] type [boolean]", - "Argument of [ip_prefix] must be [integer], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = ip_prefix(ipField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ip_prefix(ipField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = ip_prefix(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ip_prefix(booleanField, booleanField, booleanField)", - "error": [ - "Argument of [ip_prefix] must be [ip], found value [booleanField] type [boolean]", - "Argument of [ip_prefix] must be [integer], found value [booleanField] type [boolean]", - "Argument of [ip_prefix] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval ip_prefix(ipField, integerField, integerField, extraArg)", - "error": [ - "Error: [ip_prefix] function expects exactly 3 arguments, got 4." - ], - "warning": [] - }, - { - "query": "from a_index | sort ip_prefix(ipField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ip_prefix(null, null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval ip_prefix(nullVar, nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = least(true)", - "error": [], - "warning": [] - }, - { - "query": "row least(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(true, true)", - "error": [], - "warning": [] - }, - { - "query": "row least(true, true)", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_boolean(true), to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row least(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_double(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(5)", - "error": [], - "warning": [] - }, - { - "query": "row least(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row least(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row least(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row least(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row least(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row least(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_version(\"a\"), to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = least(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [least] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", - "Argument of [least] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where least(doubleField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where least(cartesianPointField, cartesianPointField) > 0", - "error": [ - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where least(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where least(cartesianPointField) > 0", - "error": [ - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where least(integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where least(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where least(longField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(cartesianPointField)", - "error": [ - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = least(booleanField, booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(booleanField, booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(to_boolean(booleanField), to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(cartesianPointField, cartesianPointField)", - "error": [ - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = least(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(to_double(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(ipField, ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(ipField, ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(to_ip(ipField), to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(versionField, versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(versionField, versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = least(to_version(keywordField), to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort least(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval least(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval least(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = left(\"a\", 5)", - "error": [], - "warning": [] - }, - { - "query": "row left(\"a\", 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = left(to_string(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = left(true, true)", - "error": [ - "Argument of [left] must be [keyword], found value [true] type [boolean]", - "Argument of [left] must be [integer], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = left(keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval left(keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = left(to_string(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval left(booleanField, booleanField)", - "error": [ - "Argument of [left] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [left] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = left(textField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval left(textField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval left(keywordField, integerField, extraArg)", - "error": [ - "Error: [left] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort left(keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval left(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval left(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = length(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row length(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = length(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = length(true)", - "error": [ - "Argument of [length] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = length(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval length(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = length(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval length(booleanField)", - "error": [ - "Argument of [length] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = length(*)", - "error": [ - "Using wildcards (*) in length is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = length(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval length(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval length(keywordField, extraArg)", - "error": [ - "Error: [length] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort length(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval length(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval length(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = locate(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row locate(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = locate(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = locate(\"a\", \"a\", 5)", - "error": [], - "warning": [] - }, - { - "query": "row locate(\"a\", \"a\", 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = locate(to_string(true), to_string(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = locate(true, true, true)", - "error": [ - "Argument of [locate] must be [keyword], found value [true] type [boolean]", - "Argument of [locate] must be [keyword], found value [true] type [boolean]", - "Argument of [locate] must be [integer], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = locate(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = locate(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(booleanField, booleanField)", - "error": [ - "Argument of [locate] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [locate] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = locate(keywordField, keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(keywordField, keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = locate(to_string(booleanField), to_string(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(booleanField, booleanField, booleanField)", - "error": [ - "Argument of [locate] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [locate] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [locate] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = locate(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = locate(keywordField, textField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(keywordField, textField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = locate(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = locate(textField, keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(textField, keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = locate(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = locate(textField, textField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(textField, textField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(keywordField, keywordField, integerField, extraArg)", - "error": [ - "Error: [locate] function expects no more than 3 arguments, got 4." - ], - "warning": [] - }, - { - "query": "from a_index | sort locate(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval locate(null, null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval locate(nullVar, nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = log(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row log(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = log(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = log(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row log(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = log(to_double(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = log(5.5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row log(5.5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = log(to_double(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = log(to_double(true), 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = log(5)", - "error": [], - "warning": [] - }, - { - "query": "row log(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = log(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = log(5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row log(5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = log(to_integer(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = log(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row log(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = log(to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = log(to_integer(true), 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = log(5, to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = log(5, to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = log(true, true)", - "error": [ - "Argument of [log] must be [double], found value [true] type [boolean]", - "Argument of [log] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where log(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(booleanField) > 0", - "error": [ - "Argument of [log] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where log(doubleField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(booleanField, booleanField) > 0", - "error": [ - "Argument of [log] must be [double], found value [booleanField] type [boolean]", - "Argument of [log] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where log(doubleField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(doubleField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(doubleField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(integerField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(integerField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(integerField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(longField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(longField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(longField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(longField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(unsignedLongField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(unsignedLongField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(unsignedLongField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log(unsignedLongField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(booleanField)", - "error": [ - "Argument of [log] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = log(*)", - "error": [ - "Using wildcards (*) in log is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = log(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(to_double(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(booleanField, booleanField)", - "error": [ - "Argument of [log] must be [double], found value [booleanField] type [boolean]", - "Argument of [log] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = log(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(to_double(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(to_double(booleanField), longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(doubleField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(doubleField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(to_double(booleanField), unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(to_integer(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(to_integer(booleanField), longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(integerField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(integerField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(to_integer(booleanField), unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(longField, to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(longField, to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(longField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(longField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(unsignedLongField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(unsignedLongField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(unsignedLongField, to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(unsignedLongField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(unsignedLongField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(unsignedLongField, to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(unsignedLongField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(unsignedLongField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log(unsignedLongField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(unsignedLongField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(doubleField, doubleField, extraArg)", - "error": [ - "Error: [log] function expects no more than 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort log(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval log(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = log10(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row log10(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = log10(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = log10(5)", - "error": [], - "warning": [] - }, - { - "query": "row log10(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = log10(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = log10(true)", - "error": [ - "Argument of [log10] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where log10(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log10(booleanField) > 0", - "error": [ - "Argument of [log10] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where log10(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log10(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where log10(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log10(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log10(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log10(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log10(booleanField)", - "error": [ - "Argument of [log10] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = log10(*)", - "error": [ - "Using wildcards (*) in log10 is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = log10(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log10(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log10(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log10(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log10(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = log10(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log10(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log10(doubleField, extraArg)", - "error": [ - "Error: [log10] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort log10(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log10(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval log10(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = ltrim(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row ltrim(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = ltrim(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = ltrim(true)", - "error": [ - "Argument of [ltrim] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = ltrim(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ltrim(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = ltrim(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ltrim(booleanField)", - "error": [ - "Argument of [ltrim] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = ltrim(*)", - "error": [ - "Using wildcards (*) in ltrim is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = ltrim(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ltrim(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ltrim(keywordField, extraArg)", - "error": [ - "Error: [ltrim] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort ltrim(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval ltrim(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval ltrim(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(true, true)", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(true, true)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_boolean(true), to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row mv_append(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_append(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_append(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_append(to_datetime(\"2021-01-01T00:00:00Z\"), to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(to_datetime(\"2021-01-01T00:00:00Z\"), to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")), to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_double(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row mv_append(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_append(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_append(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_append(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_version(\"a\"), to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_append(doubleField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_append(counterDoubleField, counterDoubleField) > 0", - "error": [ - "Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]", - "Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_append(integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_append(longField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(booleanField, booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(booleanField, booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_boolean(booleanField), to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(counterDoubleField, counterDoubleField)", - "error": [ - "Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]", - "Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_datetime(dateField), to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_double(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(ipField, ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(ipField, ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_ip(ipField), to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(versionField, versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(versionField, versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_append(to_version(keywordField), to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(booleanField, booleanField, extraArg)", - "error": [ - "Error: [mv_append] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_append(booleanField, booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_append(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(\"2022\", \"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_append(concat(\"20\", \"22\"), concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_append(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_append(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_avg(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_avg(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_avg(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_avg(5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_avg(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_avg(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_avg(true)", - "error": [ - "Argument of [mv_avg] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_avg(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_avg(booleanField) > 0", - "error": [ - "Argument of [mv_avg] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_avg(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_avg(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_avg(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_avg(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_avg(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_avg(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_avg(booleanField)", - "error": [ - "Argument of [mv_avg] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_avg(*)", - "error": [ - "Using wildcards (*) in mv_avg is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_avg(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_avg(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_avg(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_avg(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_avg(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_avg(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_avg(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_avg(doubleField, extraArg)", - "error": [ - "Error: [mv_avg] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_avg(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_avg(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_avg(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_concat(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_concat(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_concat(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_concat(true, true)", - "error": [ - "Argument of [mv_concat] must be [keyword], found value [true] type [boolean]", - "Argument of [mv_concat] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_concat(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_concat(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_concat(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_concat(booleanField, booleanField)", - "error": [ - "Argument of [mv_concat] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [mv_concat] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_concat(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_concat(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_concat(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_concat(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_concat(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_concat(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_concat(keywordField, keywordField, extraArg)", - "error": [ - "Error: [mv_concat] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_concat(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_concat(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_concat(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(true)", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row mv_count(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_count(to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_count(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_count(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row mv_count(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_count(to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_count(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_count(5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(booleanField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(counterDoubleField) > 0", - "error": [ - "Argument of [mv_count] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_count(cartesianPointField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(cartesianShapeField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(dateField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(geoPointField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(geoShapeField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(ipField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(keywordField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(textField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_count(versionField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(counterDoubleField)", - "error": [ - "Argument of [mv_count] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(*)", - "error": [ - "Using wildcards (*) in mv_count is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(booleanField, extraArg)", - "error": [ - "Error: [mv_count] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_count(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_count(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_count(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_count(to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(true)", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row mv_dedupe(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row mv_dedupe(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_dedupe(5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_dedupe(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_dedupe(counterDoubleField) > 0", - "error": [ - "Argument of [mv_dedupe] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_dedupe(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_dedupe(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(counterDoubleField)", - "error": [ - "Argument of [mv_dedupe] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(*)", - "error": [ - "Using wildcards (*) in mv_dedupe is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_dedupe(to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(booleanField, extraArg)", - "error": [ - "Error: [mv_dedupe] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_dedupe(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_dedupe(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_dedupe(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_dedupe(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_dedupe(to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(true)", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row mv_first(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_first(to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_first(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_first(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row mv_first(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_first(to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_first(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_first(5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_first(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_first(counterDoubleField) > 0", - "error": [ - "Argument of [mv_first] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_first(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_first(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_first(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(counterDoubleField)", - "error": [ - "Argument of [mv_first] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(*)", - "error": [ - "Using wildcards (*) in mv_first is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_first(to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(booleanField, extraArg)", - "error": [ - "Error: [mv_first] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_first(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_first(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_first(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_first(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(true)", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row mv_last(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_last(to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_last(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_last(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row mv_last(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_last(to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_last(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_last(5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_last(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_last(counterDoubleField) > 0", - "error": [ - "Argument of [mv_last] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_last(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_last(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_last(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(counterDoubleField)", - "error": [ - "Argument of [mv_last] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(*)", - "error": [ - "Using wildcards (*) in mv_last is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_last(to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(booleanField, extraArg)", - "error": [ - "Error: [mv_last] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_last(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_last(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_last(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_last(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(true)", - "error": [], - "warning": [] - }, - { - "query": "row mv_max(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_max(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_max(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_max(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_max(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_max(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_max(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_max(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [mv_max] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_max(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_max(cartesianPointField) > 0", - "error": [ - "Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_max(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_max(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_max(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(cartesianPointField)", - "error": [ - "Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(*)", - "error": [ - "Using wildcards (*) in mv_max is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_max(to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(booleanField, extraArg)", - "error": [ - "Error: [mv_max] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_max(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_max(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_max(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_median(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_median(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_median(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_median(5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_median(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_median(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_median(true)", - "error": [ - "Argument of [mv_median] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_median(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_median(booleanField) > 0", - "error": [ - "Argument of [mv_median] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_median(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_median(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_median(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_median(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_median(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_median(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_median(booleanField)", - "error": [ - "Argument of [mv_median] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_median(*)", - "error": [ - "Using wildcards (*) in mv_median is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_median(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_median(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_median(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_median(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_median(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_median(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_median(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_median(doubleField, extraArg)", - "error": [ - "Error: [mv_median] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_median(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_median(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_median(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(true)", - "error": [], - "warning": [] - }, - { - "query": "row mv_min(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_min(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_min(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_min(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_min(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_min(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row mv_min(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_min(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [mv_min] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_min(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_min(cartesianPointField) > 0", - "error": [ - "Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_min(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_min(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_min(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(cartesianPointField)", - "error": [ - "Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(*)", - "error": [ - "Using wildcards (*) in mv_min is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_min(to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(booleanField, extraArg)", - "error": [ - "Error: [mv_min] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_min(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_min(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_min(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(true, 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(true, 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_boolean(true), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(cartesianPointField, 5, 5)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row mv_slice(cartesianPointField, 5, 5)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_slice(to_cartesianpoint(cartesianPointField), to_integer(true), to_integer(true))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_slice(to_cartesianshape(\"POINT (30 10)\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(to_cartesianshape(\"POINT (30 10)\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_cartesianshape(cartesianPointField), to_integer(true), to_integer(true))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_slice(to_datetime(\"2021-01-01T00:00:00Z\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(to_datetime(\"2021-01-01T00:00:00Z\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(5.5, 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(5.5, 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_double(true), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(geoPointField, 5, 5)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row mv_slice(geoPointField, 5, 5)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_slice(to_geopoint(geoPointField), to_integer(true), to_integer(true))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_slice(to_geoshape(\"POINT (30 10)\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(to_geoshape(\"POINT (30 10)\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_geoshape(geoPointField), to_integer(true), to_integer(true))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = mv_slice(5, 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(5, 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_integer(true), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_ip(\"127.0.0.1\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(to_ip(\"127.0.0.1\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_ip(to_ip(\"127.0.0.1\")), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(\"a\", 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(\"a\", 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_string(true), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(5, to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_version(\"1.0.0\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(to_version(\"1.0.0\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_version(\"a\"), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(5.5, true, true)", - "error": [ - "Argument of [mv_slice] must be [integer], found value [true] type [boolean]", - "Argument of [mv_slice] must be [integer], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_slice(doubleField, integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_slice(counterDoubleField, booleanField, booleanField) > 0", - "error": [ - "Argument of [mv_slice] must be [boolean], found value [counterDoubleField] type [counter_double]", - "Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_slice(integerField, integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_slice(longField, integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(booleanField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(booleanField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_boolean(booleanField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(counterDoubleField, booleanField, booleanField)", - "error": [ - "Argument of [mv_slice] must be [boolean], found value [counterDoubleField] type [counter_double]", - "Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(cartesianPointField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(cartesianPointField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_cartesianpoint(cartesianPointField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(cartesianShapeField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(cartesianShapeField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_cartesianshape(cartesianPointField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(dateField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(dateField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_datetime(dateField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(doubleField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(doubleField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_double(booleanField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(geoPointField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(geoPointField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_geopoint(geoPointField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(geoShapeField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(geoShapeField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_geoshape(geoPointField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(integerField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(integerField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_integer(booleanField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(ipField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(ipField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(keywordField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(keywordField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(longField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(longField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(longField, to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(textField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(textField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(versionField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(versionField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(to_version(keywordField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(booleanField, integerField, integerField, extraArg)", - "error": [ - "Error: [mv_slice] function expects no more than 3 arguments, got 4." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_slice(booleanField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(null, null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_slice(nullVar, nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(\"2022\", integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_slice(concat(\"20\", \"22\"), integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_cartesianpoint(\"POINT (30 10)\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(to_cartesianpoint(\"POINT (30 10)\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_datetime(\"2021-01-01T00:00:00Z\"), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_geopoint(\"POINT (30 10)\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_slice(to_geopoint(\"POINT (30 10)\"), 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_slice(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_slice(dateField, to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sort(true, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_sort(true, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sort(to_datetime(\"2021-01-01T00:00:00Z\"), \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_sort(to_datetime(\"2021-01-01T00:00:00Z\"), \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sort(5.5, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_sort(5.5, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sort(5, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_sort(5, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sort(to_ip(\"127.0.0.1\"), \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_sort(to_ip(\"127.0.0.1\"), \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sort(\"a\", \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_sort(\"a\", \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sort(to_version(\"1.0.0\"), \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_sort(to_version(\"1.0.0\"), \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sort(to_cartesianpoint(\"POINT (30 10)\"), true)", - "error": [ - "Argument of [mv_sort] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", - "Argument of [mv_sort] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(booleanField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(booleanField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(dateField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(dateField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(doubleField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(doubleField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(integerField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(integerField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(ipField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(ipField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(keywordField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(keywordField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(longField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(longField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(textField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(textField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(versionField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(versionField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(booleanField, \"asc\", extraArg)", - "error": [ - "Error: [mv_sort] function expects no more than 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_sort(booleanField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_sort(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(\"2022\", \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(concat(\"20\", \"22\"), \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sort(5, \"a\")", - "error": [], - "warning": [ - "Invalid option [\"a\"] for mv_sort. Supported options: [\"asc\", \"desc\"]." - ] - }, - { - "query": "row mv_sort(5, \"a\")", - "error": [], - "warning": [ - "Invalid option [\"a\"] for mv_sort. Supported options: [\"asc\", \"desc\"]." - ] - }, - { - "query": "row var = mv_sort(\"a\", \"a\")", - "error": [], - "warning": [ - "Invalid option [\"a\"] for mv_sort. Supported options: [\"asc\", \"desc\"]." - ] - }, - { - "query": "row mv_sort(\"a\", \"a\")", - "error": [], - "warning": [ - "Invalid option [\"a\"] for mv_sort. Supported options: [\"asc\", \"desc\"]." - ] - }, - { - "query": "row var = mv_sort(to_version(\"1.0.0\"), \"a\")", - "error": [], - "warning": [ - "Invalid option [\"a\"] for mv_sort. Supported options: [\"asc\", \"desc\"]." - ] - }, - { - "query": "row mv_sort(to_version(\"1.0.0\"), \"a\")", - "error": [], - "warning": [ - "Invalid option [\"a\"] for mv_sort. Supported options: [\"asc\", \"desc\"]." - ] - }, - { - "query": "from a_index | eval var = mv_sort(longField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(longField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(versionField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(versionField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sum(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_sum(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sum(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sum(5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_sum(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sum(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_sum(true)", - "error": [ - "Argument of [mv_sum] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_sum(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_sum(booleanField) > 0", - "error": [ - "Argument of [mv_sum] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_sum(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_sum(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_sum(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sum(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sum(booleanField)", - "error": [ - "Argument of [mv_sum] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sum(*)", - "error": [ - "Using wildcards (*) in mv_sum is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sum(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sum(doubleField, extraArg)", - "error": [ - "Error: [mv_sum] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_sum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sum(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_sum(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_zip(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_zip(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_zip(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_zip(\"a\", \"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row mv_zip(\"a\", \"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_zip(to_string(true), to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_zip(true, true, true)", - "error": [ - "Argument of [mv_zip] must be [keyword], found value [true] type [boolean]", - "Argument of [mv_zip] must be [keyword], found value [true] type [boolean]", - "Argument of [mv_zip] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(booleanField, booleanField)", - "error": [ - "Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(keywordField, keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(keywordField, keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(booleanField, booleanField, booleanField)", - "error": [ - "Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(keywordField, keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(keywordField, keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(keywordField, textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(keywordField, textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(keywordField, textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(keywordField, textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(textField, keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(textField, keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(textField, keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(textField, keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(textField, textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(textField, textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_zip(textField, textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(textField, textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(keywordField, keywordField, keywordField, extraArg)", - "error": [ - "Error: [mv_zip] function expects no more than 3 arguments, got 4." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_zip(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_zip(null, null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_zip(nullVar, nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = now()", - "error": [], - "warning": [] - }, - { - "query": "row now()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = now()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval now()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval now(extraArg)", - "error": [ - "Error: [now] function expects exactly 0 arguments, got 1." - ], - "warning": [] - }, - { - "query": "from a_index | sort now()", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval now()", - "error": [], - "warning": [] - }, - { - "query": "row var = pi()", - "error": [], - "warning": [] - }, - { - "query": "row pi()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pi() > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pi()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pi()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pi(extraArg)", - "error": [ - "Error: [pi] function expects exactly 0 arguments, got 1." - ], - "warning": [] - }, - { - "query": "from a_index | sort pi()", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval pi()", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row pow(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(to_double(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(5.5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row pow(5.5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(to_double(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(to_double(true), 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row pow(5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(to_integer(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row pow(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(to_integer(true), 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(5, to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(5, to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = pow(true, true)", - "error": [ - "Argument of [pow] must be [double], found value [true] type [boolean]", - "Argument of [pow] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where pow(doubleField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(booleanField, booleanField) > 0", - "error": [ - "Argument of [pow] must be [double], found value [booleanField] type [boolean]", - "Argument of [pow] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where pow(doubleField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(doubleField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(doubleField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(integerField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(integerField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(integerField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(longField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(longField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(longField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(longField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(unsignedLongField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(unsignedLongField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(unsignedLongField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where pow(unsignedLongField, unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(to_double(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(booleanField, booleanField)", - "error": [ - "Argument of [pow] must be [double], found value [booleanField] type [boolean]", - "Argument of [pow] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(to_double(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(to_double(booleanField), longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(doubleField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(doubleField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(to_double(booleanField), unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(to_integer(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(to_integer(booleanField), longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(integerField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(integerField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(to_integer(booleanField), unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(longField, to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(longField, to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(longField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(longField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(unsignedLongField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(unsignedLongField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(unsignedLongField, to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(unsignedLongField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(unsignedLongField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(unsignedLongField, to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(unsignedLongField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(unsignedLongField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(unsignedLongField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(unsignedLongField, unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(doubleField, doubleField, extraArg)", - "error": [ - "Error: [pow] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort pow(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval pow(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval pow(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = repeat(\"a\", 5)", - "error": [], - "warning": [] - }, - { - "query": "row repeat(\"a\", 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = repeat(to_string(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = repeat(true, true)", - "error": [ - "Argument of [repeat] must be [keyword], found value [true] type [boolean]", - "Argument of [repeat] must be [integer], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = repeat(keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval repeat(keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = repeat(to_string(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval repeat(booleanField, booleanField)", - "error": [ - "Argument of [repeat] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [repeat] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = repeat(textField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval repeat(textField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval repeat(keywordField, integerField, extraArg)", - "error": [ - "Error: [repeat] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort repeat(keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval repeat(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval repeat(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = replace(\"a\", \"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row replace(\"a\", \"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = replace(to_string(true), to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = replace(true, true, true)", - "error": [ - "Argument of [replace] must be [keyword], found value [true] type [boolean]", - "Argument of [replace] must be [keyword], found value [true] type [boolean]", - "Argument of [replace] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = replace(keywordField, keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(keywordField, keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = replace(to_string(booleanField), to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(booleanField, booleanField, booleanField)", - "error": [ - "Argument of [replace] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [replace] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [replace] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = replace(keywordField, keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(keywordField, keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = replace(keywordField, textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(keywordField, textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = replace(keywordField, textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(keywordField, textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = replace(textField, keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(textField, keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = replace(textField, keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(textField, keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = replace(textField, textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(textField, textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = replace(textField, textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(textField, textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(keywordField, keywordField, keywordField, extraArg)", - "error": [ - "Error: [replace] function expects exactly 3 arguments, got 4." - ], - "warning": [] - }, - { - "query": "from a_index | sort replace(keywordField, keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval replace(null, null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval replace(nullVar, nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = right(\"a\", 5)", - "error": [], - "warning": [] - }, - { - "query": "row right(\"a\", 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = right(to_string(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = right(true, true)", - "error": [ - "Argument of [right] must be [keyword], found value [true] type [boolean]", - "Argument of [right] must be [integer], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = right(keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval right(keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = right(to_string(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval right(booleanField, booleanField)", - "error": [ - "Argument of [right] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [right] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = right(textField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval right(textField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval right(keywordField, integerField, extraArg)", - "error": [ - "Error: [right] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort right(keywordField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval right(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval right(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = round(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row round(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = round(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = round(5.5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row round(5.5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = round(to_double(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = round(5)", - "error": [], - "warning": [] - }, - { - "query": "row round(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = round(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = round(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row round(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = round(to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = round(5, to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = round(true, true)", - "error": [ - "Argument of [round] must be [double], found value [true] type [boolean]", - "Argument of [round] must be [integer], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where round(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where round(booleanField) > 0", - "error": [ - "Argument of [round] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where round(doubleField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where round(booleanField, booleanField) > 0", - "error": [ - "Argument of [round] must be [double], found value [booleanField] type [boolean]", - "Argument of [round] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where round(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where round(integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where round(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where round(longField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where round(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = round(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = round(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(booleanField)", - "error": [ - "Argument of [round] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = round(*)", - "error": [ - "Using wildcards (*) in round is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = round(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = round(to_double(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(booleanField, booleanField)", - "error": [ - "Argument of [round] must be [double], found value [booleanField] type [boolean]", - "Argument of [round] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = round(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = round(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = round(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = round(to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = round(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = round(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = round(longField, to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = round(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(doubleField, integerField, extraArg)", - "error": [ - "Error: [round] function expects no more than 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort round(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval round(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval round(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = rtrim(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row rtrim(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = rtrim(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = rtrim(true)", - "error": [ - "Argument of [rtrim] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = rtrim(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval rtrim(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = rtrim(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval rtrim(booleanField)", - "error": [ - "Argument of [rtrim] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = rtrim(*)", - "error": [ - "Using wildcards (*) in rtrim is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = rtrim(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval rtrim(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval rtrim(keywordField, extraArg)", - "error": [ - "Error: [rtrim] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort rtrim(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval rtrim(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval rtrim(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = signum(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row signum(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = signum(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = signum(5)", - "error": [], - "warning": [] - }, - { - "query": "row signum(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = signum(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = signum(true)", - "error": [ - "Argument of [signum] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where signum(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where signum(booleanField) > 0", - "error": [ - "Argument of [signum] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where signum(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where signum(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where signum(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = signum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval signum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = signum(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval signum(booleanField)", - "error": [ - "Argument of [signum] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = signum(*)", - "error": [ - "Using wildcards (*) in signum is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = signum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval signum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = signum(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = signum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval signum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = signum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval signum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval signum(doubleField, extraArg)", - "error": [ - "Error: [signum] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort signum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval signum(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval signum(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = sin(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row sin(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = sin(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = sin(5)", - "error": [], - "warning": [] - }, - { - "query": "row sin(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = sin(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = sin(true)", - "error": [ - "Argument of [sin] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where sin(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where sin(booleanField) > 0", - "error": [ - "Argument of [sin] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where sin(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where sin(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where sin(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sin(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sin(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sin(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sin(booleanField)", - "error": [ - "Argument of [sin] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sin(*)", - "error": [ - "Using wildcards (*) in sin is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sin(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sin(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sin(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sin(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sin(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sin(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sin(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sin(doubleField, extraArg)", - "error": [ - "Error: [sin] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort sin(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sin(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval sin(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = sinh(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row sinh(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = sinh(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = sinh(5)", - "error": [], - "warning": [] - }, - { - "query": "row sinh(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = sinh(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = sinh(true)", - "error": [ - "Argument of [sinh] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where sinh(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where sinh(booleanField) > 0", - "error": [ - "Argument of [sinh] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where sinh(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where sinh(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where sinh(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sinh(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sinh(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sinh(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sinh(booleanField)", - "error": [ - "Argument of [sinh] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sinh(*)", - "error": [ - "Using wildcards (*) in sinh is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sinh(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sinh(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sinh(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sinh(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sinh(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sinh(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sinh(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sinh(doubleField, extraArg)", - "error": [ - "Error: [sinh] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort sinh(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sinh(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval sinh(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = split(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row split(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = split(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = split(true, true)", - "error": [ - "Argument of [split] must be [keyword], found value [true] type [boolean]", - "Argument of [split] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = split(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval split(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = split(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval split(booleanField, booleanField)", - "error": [ - "Argument of [split] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [split] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = split(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval split(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = split(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval split(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = split(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval split(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval split(keywordField, keywordField, extraArg)", - "error": [ - "Error: [split] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort split(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval split(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval split(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = sqrt(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row sqrt(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = sqrt(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = sqrt(5)", - "error": [], - "warning": [] - }, - { - "query": "row sqrt(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = sqrt(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = sqrt(true)", - "error": [ - "Argument of [sqrt] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where sqrt(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where sqrt(booleanField) > 0", - "error": [ - "Argument of [sqrt] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where sqrt(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where sqrt(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where sqrt(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sqrt(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sqrt(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sqrt(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sqrt(booleanField)", - "error": [ - "Argument of [sqrt] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sqrt(*)", - "error": [ - "Using wildcards (*) in sqrt is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sqrt(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sqrt(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sqrt(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sqrt(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sqrt(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = sqrt(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sqrt(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sqrt(doubleField, extraArg)", - "error": [ - "Error: [sqrt] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort sqrt(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sqrt(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval sqrt(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_contains(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_contains(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_contains(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(geoPointField, to_geoshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_contains(geoPointField, to_geoshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(to_geopoint(geoPointField), to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(to_geoshape(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_contains(true, true)", - "error": [ - "Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]", - "Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(booleanField, booleanField)", - "error": [ - "Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]", - "Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(cartesianPointField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(cartesianShapeField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(cartesianShapeField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(geoPointField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(geoPointField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(geoShapeField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(geoShapeField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort st_contains(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval st_contains(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_contains(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_contains(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_contains(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_disjoint(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_disjoint(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_disjoint(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(geoPointField, to_geoshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_disjoint(geoPointField, to_geoshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geopoint(geoPointField), to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geoshape(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_disjoint(true, true)", - "error": [ - "Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]", - "Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(booleanField, booleanField)", - "error": [ - "Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]", - "Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(cartesianPointField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(cartesianShapeField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(geoPointField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(geoPointField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(geoShapeField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(geoShapeField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort st_disjoint(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval st_disjoint(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_distance(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_distance(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_distance(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_distance(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_distance(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_distance(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_distance(true, true)", - "error": [ - "Argument of [st_distance] must be [cartesian_point], found value [true] type [boolean]", - "Argument of [st_distance] must be [cartesian_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_distance(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_distance(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_distance(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_distance(booleanField, booleanField)", - "error": [ - "Argument of [st_distance] must be [cartesian_point], found value [booleanField] type [boolean]", - "Argument of [st_distance] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_distance(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_distance(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_distance(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_distance(cartesianPointField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_distance] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort st_distance(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_distance(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval st_distance(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = st_distance(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_distance(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_distance(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_distance(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_distance(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_distance(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_intersects(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_intersects(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_intersects(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(geoPointField, to_geoshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_intersects(geoPointField, to_geoshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geopoint(geoPointField), to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geoshape(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_intersects(true, true)", - "error": [ - "Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]", - "Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(booleanField, booleanField)", - "error": [ - "Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]", - "Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(cartesianPointField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(cartesianShapeField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(geoPointField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(geoPointField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(geoShapeField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(geoShapeField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort st_intersects(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval st_intersects(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_intersects(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_intersects(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_intersects(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_within(cartesianPointField, cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_within(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]", - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_within(geoPointField, geoPointField)", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(geoPointField, to_geoshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_within(geoPointField, to_geoshape(\"POINT (30 10)\"))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(to_geopoint(geoPointField), to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_within(to_geoshape(\"POINT (30 10)\"), geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(to_geoshape(geoPointField), to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_within(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]", - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_within(true, true)", - "error": [ - "Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]", - "Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(booleanField, booleanField)", - "error": [ - "Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]", - "Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(cartesianPointField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(cartesianPointField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(cartesianShapeField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(cartesianShapeField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(cartesianShapeField, cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(to_geopoint(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(geoPointField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(geoPointField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(to_geopoint(geoPointField), to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(geoShapeField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(geoShapeField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(to_geoshape(geoPointField), to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort st_within(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval st_within(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_within(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_within(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_within(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_x(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_x(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_x(to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_x(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_x(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_x(to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_x(true)", - "error": [ - "Argument of [st_x] must be [cartesian_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_x(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_x(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_x(to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_x(booleanField)", - "error": [ - "Argument of [st_x] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_x(*)", - "error": [ - "Using wildcards (*) in st_x is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_x(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_x(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_x(to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_x(cartesianPointField, extraArg)", - "error": [ - "Error: [st_x] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort st_x(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_x(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval st_x(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = st_x(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_x(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_x(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_x(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_x(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_x(to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_y(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row st_y(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_y(to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_y(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row st_y(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_y(to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = st_y(true)", - "error": [ - "Argument of [st_y] must be [cartesian_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_y(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_y(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_y(to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_y(booleanField)", - "error": [ - "Argument of [st_y] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_y(*)", - "error": [ - "Using wildcards (*) in st_y is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_y(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_y(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = st_y(to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_y(cartesianPointField, extraArg)", - "error": [ - "Error: [st_y] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort st_y(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_y(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval st_y(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = st_y(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_y(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_y(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_y(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row st_y(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = st_y(to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = starts_with(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row starts_with(\"a\", \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = starts_with(to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = starts_with(true, true)", - "error": [ - "Argument of [starts_with] must be [keyword], found value [true] type [boolean]", - "Argument of [starts_with] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = starts_with(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval starts_with(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = starts_with(to_string(booleanField), to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval starts_with(booleanField, booleanField)", - "error": [ - "Argument of [starts_with] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [starts_with] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = starts_with(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval starts_with(textField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval starts_with(keywordField, keywordField, extraArg)", - "error": [ - "Error: [starts_with] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort starts_with(keywordField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval starts_with(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval starts_with(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = starts_with(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval starts_with(keywordField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = starts_with(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval starts_with(textField, keywordField)", - "error": [], - "warning": [] - }, - { - "query": "row var = substring(\"a\", 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row substring(\"a\", 5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = substring(to_string(true), to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = substring(true, true, true)", - "error": [ - "Argument of [substring] must be [keyword], found value [true] type [boolean]", - "Argument of [substring] must be [integer], found value [true] type [boolean]", - "Argument of [substring] must be [integer], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = substring(keywordField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval substring(keywordField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = substring(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval substring(booleanField, booleanField, booleanField)", - "error": [ - "Argument of [substring] must be [keyword], found value [booleanField] type [boolean]", - "Argument of [substring] must be [integer], found value [booleanField] type [boolean]", - "Argument of [substring] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = substring(textField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval substring(textField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval substring(keywordField, integerField, integerField, extraArg)", - "error": [ - "Error: [substring] function expects no more than 3 arguments, got 4." - ], - "warning": [] - }, - { - "query": "from a_index | sort substring(keywordField, integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval substring(null, null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval substring(nullVar, nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = tan(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row tan(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = tan(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = tan(5)", - "error": [], - "warning": [] - }, - { - "query": "row tan(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = tan(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = tan(true)", - "error": [ - "Argument of [tan] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where tan(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where tan(booleanField) > 0", - "error": [ - "Argument of [tan] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where tan(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where tan(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where tan(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tan(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tan(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tan(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tan(booleanField)", - "error": [ - "Argument of [tan] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = tan(*)", - "error": [ - "Using wildcards (*) in tan is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = tan(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tan(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tan(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tan(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tan(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tan(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tan(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tan(doubleField, extraArg)", - "error": [ - "Error: [tan] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort tan(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tan(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval tan(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = tanh(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row tanh(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = tanh(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = tanh(5)", - "error": [], - "warning": [] - }, - { - "query": "row tanh(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = tanh(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = tanh(true)", - "error": [ - "Argument of [tanh] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where tanh(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where tanh(booleanField) > 0", - "error": [ - "Argument of [tanh] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where tanh(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where tanh(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where tanh(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tanh(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tanh(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tanh(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tanh(booleanField)", - "error": [ - "Argument of [tanh] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = tanh(*)", - "error": [ - "Using wildcards (*) in tanh is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = tanh(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tanh(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tanh(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tanh(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tanh(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tanh(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tanh(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tanh(doubleField, extraArg)", - "error": [ - "Error: [tanh] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort tanh(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tanh(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval tanh(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = tau()", - "error": [], - "warning": [] - }, - { - "query": "row tau()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where tau() > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = tau()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tau()", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval tau(extraArg)", - "error": [ - "Error: [tau] function expects exactly 0 arguments, got 1." - ], - "warning": [] - }, - { - "query": "from a_index | sort tau()", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval tau()", - "error": [], - "warning": [] - }, - { - "query": "row var = to_base64(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_base64(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_base64(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_base64(true)", - "error": [ - "Argument of [to_base64] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_base64(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_base64(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_base64(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_base64(booleanField)", - "error": [ - "Argument of [to_base64] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_base64(*)", - "error": [ - "Using wildcards (*) in to_base64 is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_base64(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_base64(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_base64(keywordField, extraArg)", - "error": [ - "Error: [to_base64] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_base64(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_base64(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_base64(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_boolean(true)", - "error": [], - "warning": [] - }, - { - "query": "row to_boolean(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_bool(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_boolean(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_boolean(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row to_boolean(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_bool(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_boolean(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_boolean(5)", - "error": [], - "warning": [] - }, - { - "query": "row to_boolean(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_bool(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_boolean(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_boolean(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_boolean(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_bool(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_boolean(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_boolean(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [to_boolean] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_boolean(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_bool(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_boolean(cartesianPointField)", - "error": [ - "Argument of [to_boolean] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(*)", - "error": [ - "Using wildcards (*) in to_boolean is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_boolean(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_bool(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_boolean(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_bool(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_boolean(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_bool(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_boolean(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_bool(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_boolean(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_bool(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_boolean(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_boolean(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_bool(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_boolean(booleanField, extraArg)", - "error": [ - "Error: [to_boolean] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_boolean(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_boolean(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_boolean(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianpoint(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row to_cartesianpoint(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_cartesianpoint(to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_cartesianpoint(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_cartesianpoint(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianpoint(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianpoint(true)", - "error": [ - "Argument of [to_cartesianpoint] must be [cartesian_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianpoint(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianpoint(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianpoint(to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianpoint(booleanField)", - "error": [ - "Argument of [to_cartesianpoint] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianpoint(*)", - "error": [ - "Using wildcards (*) in to_cartesianpoint is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianpoint(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianpoint(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianpoint(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianpoint(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianpoint(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianpoint(cartesianPointField, extraArg)", - "error": [ - "Error: [to_cartesianpoint] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_cartesianpoint(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianpoint(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_cartesianpoint(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianpoint(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianshape(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row to_cartesianshape(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_cartesianshape(to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_cartesianshape(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_cartesianshape(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianshape(to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_cartesianshape(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_cartesianshape(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianshape(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianshape(true)", - "error": [ - "Argument of [to_cartesianshape] must be [cartesian_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianshape(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianshape(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianshape(to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianshape(booleanField)", - "error": [ - "Argument of [to_cartesianshape] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianshape(*)", - "error": [ - "Using wildcards (*) in to_cartesianshape is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianshape(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianshape(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianshape(to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianshape(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianshape(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianshape(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_cartesianshape(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianshape(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianshape(cartesianPointField, extraArg)", - "error": [ - "Error: [to_cartesianshape] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_cartesianshape(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_cartesianshape(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_cartesianshape(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianshape(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_cartesianshape(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_datetime(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_datetime(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_dt(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_datetime(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_datetime(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row to_datetime(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_dt(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_datetime(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_datetime(5)", - "error": [], - "warning": [] - }, - { - "query": "row to_datetime(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_dt(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_datetime(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_datetime(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_datetime(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_dt(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_datetime(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_datetime(true)", - "error": [ - "Argument of [to_datetime] must be [date], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dt(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(booleanField)", - "error": [ - "Argument of [to_datetime] must be [date], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(*)", - "error": [ - "Using wildcards (*) in to_datetime is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dt(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dt(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dt(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dt(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dt(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_datetime(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dt(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(dateField, extraArg)", - "error": [ - "Error: [to_datetime] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_datetime(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_datetime(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_datetime(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_degrees(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row to_degrees(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_degrees(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_degrees(5)", - "error": [], - "warning": [] - }, - { - "query": "row to_degrees(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_degrees(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_degrees(true)", - "error": [ - "Argument of [to_degrees] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_degrees(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_degrees(booleanField) > 0", - "error": [ - "Argument of [to_degrees] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_degrees(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_degrees(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_degrees(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_degrees(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_degrees(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_degrees(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_degrees(booleanField)", - "error": [ - "Argument of [to_degrees] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_degrees(*)", - "error": [ - "Using wildcards (*) in to_degrees is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_degrees(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_degrees(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_degrees(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_degrees(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_degrees(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_degrees(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_degrees(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_degrees(doubleField, extraArg)", - "error": [ - "Error: [to_degrees] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_degrees(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_degrees(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_degrees(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(true)", - "error": [], - "warning": [] - }, - { - "query": "row to_double(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_dbl(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row to_double(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_dbl(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(5)", - "error": [], - "warning": [] - }, - { - "query": "row to_double(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_dbl(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_double(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_dbl(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_double(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_dbl(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_double(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [to_double] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_double(booleanField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(cartesianPointField) > 0", - "error": [ - "Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_double(counterDoubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(counterIntegerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(counterLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(dateField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(keywordField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(textField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(cartesianPointField)", - "error": [ - "Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(*)", - "error": [ - "Using wildcards (*) in to_double is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_double(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_dbl(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(booleanField, extraArg)", - "error": [ - "Error: [to_double] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_double(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_double(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_double(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geopoint(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row to_geopoint(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_geopoint(to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_geopoint(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_geopoint(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geopoint(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geopoint(true)", - "error": [ - "Argument of [to_geopoint] must be [geo_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geopoint(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geopoint(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geopoint(to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geopoint(booleanField)", - "error": [ - "Argument of [to_geopoint] must be [geo_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geopoint(*)", - "error": [ - "Using wildcards (*) in to_geopoint is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geopoint(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geopoint(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geopoint(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geopoint(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geopoint(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geopoint(geoPointField, extraArg)", - "error": [ - "Error: [to_geopoint] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_geopoint(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geopoint(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_geopoint(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geopoint(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_geopoint(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geopoint(to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geoshape(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row to_geoshape(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_geoshape(to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_geoshape(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_geoshape(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geoshape(to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_geoshape(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_geoshape(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geoshape(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geoshape(true)", - "error": [ - "Argument of [to_geoshape] must be [geo_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geoshape(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geoshape(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geoshape(to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geoshape(booleanField)", - "error": [ - "Argument of [to_geoshape] must be [geo_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geoshape(*)", - "error": [ - "Using wildcards (*) in to_geoshape is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geoshape(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geoshape(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geoshape(to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geoshape(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geoshape(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geoshape(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_geoshape(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geoshape(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geoshape(geoPointField, extraArg)", - "error": [ - "Error: [to_geoshape] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_geoshape(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_geoshape(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_geoshape(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geoshape(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_geoshape(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geoshape(to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_geoshape(to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(true)", - "error": [], - "warning": [] - }, - { - "query": "row to_integer(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_int(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(5)", - "error": [], - "warning": [] - }, - { - "query": "row to_integer(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_int(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_integer(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_int(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row to_integer(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_int(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_integer(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_int(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_integer(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [to_integer] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_integer(booleanField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_integer(cartesianPointField) > 0", - "error": [ - "Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_integer(counterIntegerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_integer(dateField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_integer(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_integer(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_integer(keywordField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_integer(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_integer(textField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_integer(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_int(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(cartesianPointField)", - "error": [ - "Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(*)", - "error": [ - "Using wildcards (*) in to_integer is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_int(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_int(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_int(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_int(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_int(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_int(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_int(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_integer(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_int(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(booleanField, extraArg)", - "error": [ - "Error: [to_integer] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_integer(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_integer(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_integer(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ip(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_ip(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ip(to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ip(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_ip(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ip(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ip(true)", - "error": [ - "Argument of [to_ip] must be [ip], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ip(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_ip(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ip(to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_ip(booleanField)", - "error": [ - "Argument of [to_ip] must be [ip], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ip(*)", - "error": [ - "Using wildcards (*) in to_ip is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ip(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_ip(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ip(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ip(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_ip(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_ip(ipField, extraArg)", - "error": [ - "Error: [to_ip] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_ip(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_ip(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_ip(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(true)", - "error": [], - "warning": [] - }, - { - "query": "row to_long(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(5)", - "error": [], - "warning": [] - }, - { - "query": "row to_long(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_long(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row to_long(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_long(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_long(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [to_long] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_long(booleanField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_long(cartesianPointField) > 0", - "error": [ - "Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_long(counterIntegerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_long(counterLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_long(dateField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_long(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_long(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_long(keywordField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_long(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_long(textField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_long(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(cartesianPointField)", - "error": [ - "Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(*)", - "error": [ - "Using wildcards (*) in to_long is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_long(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(booleanField, extraArg)", - "error": [ - "Error: [to_long] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_long(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_long(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_long(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_lower(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_lower(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_lower(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_lower(true)", - "error": [ - "Argument of [to_lower] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_lower(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_lower(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_lower(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_lower(booleanField)", - "error": [ - "Argument of [to_lower] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_lower(*)", - "error": [ - "Using wildcards (*) in to_lower is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_lower(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_lower(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_lower(keywordField, extraArg)", - "error": [ - "Error: [to_lower] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_lower(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_lower(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_lower(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_radians(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row to_radians(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_radians(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_radians(5)", - "error": [], - "warning": [] - }, - { - "query": "row to_radians(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_radians(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_radians(true)", - "error": [ - "Argument of [to_radians] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_radians(doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_radians(booleanField) > 0", - "error": [ - "Argument of [to_radians] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_radians(integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_radians(longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_radians(unsignedLongField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_radians(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_radians(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_radians(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_radians(booleanField)", - "error": [ - "Argument of [to_radians] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_radians(*)", - "error": [ - "Using wildcards (*) in to_radians is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_radians(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_radians(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_radians(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_radians(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_radians(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_radians(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_radians(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_radians(doubleField, extraArg)", - "error": [ - "Error: [to_radians] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_radians(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_radians(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_radians(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(true)", - "error": [], - "warning": [] - }, - { - "query": "row to_unsigned_long(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ul(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ulong(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_unsigned_long(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ul(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ulong(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row to_unsigned_long(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ul(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ulong(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(5)", - "error": [], - "warning": [] - }, - { - "query": "row to_unsigned_long(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ul(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ulong(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_unsigned_long(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ul(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ulong(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_unsigned_long(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [to_unsigned_long] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_unsigned_long(booleanField) > 0", - "error": [ - "Argument of [>] must be [double], found value [to_unsigned_long(booleanField)] type [unsigned_long]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_unsigned_long(cartesianPointField) > 0", - "error": [ - "Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [>] must be [double], found value [to_unsigned_long(cartesianPointField)] type [unsigned_long]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_unsigned_long(dateField) > 0", - "error": [ - "Argument of [>] must be [double], found value [to_unsigned_long(dateField)] type [unsigned_long]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_unsigned_long(doubleField) > 0", - "error": [ - "Argument of [>] must be [double], found value [to_unsigned_long(doubleField)] type [unsigned_long]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_unsigned_long(integerField) > 0", - "error": [ - "Argument of [>] must be [double], found value [to_unsigned_long(integerField)] type [unsigned_long]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_unsigned_long(keywordField) > 0", - "error": [ - "Argument of [>] must be [double], found value [to_unsigned_long(keywordField)] type [unsigned_long]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_unsigned_long(longField) > 0", - "error": [ - "Argument of [>] must be [double], found value [to_unsigned_long(longField)] type [unsigned_long]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_unsigned_long(textField) > 0", - "error": [ - "Argument of [>] must be [double], found value [to_unsigned_long(textField)] type [unsigned_long]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_unsigned_long(unsignedLongField) > 0", - "error": [ - "Argument of [>] must be [double], found value [to_unsigned_long(unsignedLongField)] type [unsigned_long]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ul(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ulong(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(cartesianPointField)", - "error": [ - "Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(*)", - "error": [ - "Using wildcards (*) in to_unsigned_long is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ul(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ulong(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ul(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ulong(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ul(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ulong(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ul(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ulong(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ul(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ulong(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ul(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ulong(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_unsigned_long(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ul(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ulong(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(booleanField, extraArg)", - "error": [ - "Error: [to_unsigned_long] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_unsigned_long(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_unsigned_long(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_unsigned_long(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_upper(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_upper(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_upper(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_upper(true)", - "error": [ - "Argument of [to_upper] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_upper(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_upper(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_upper(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_upper(booleanField)", - "error": [ - "Argument of [to_upper] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_upper(*)", - "error": [ - "Using wildcards (*) in to_upper is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_upper(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_upper(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_upper(keywordField, extraArg)", - "error": [ - "Error: [to_upper] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_upper(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_upper(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_upper(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_version(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_version(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ver(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_version(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_version(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ver(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_version(true)", - "error": [ - "Argument of [to_version] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_version(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_version(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ver(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_version(*)", - "error": [ - "Using wildcards (*) in to_version is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_version(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_version(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ver(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_version(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_version(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ver(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_version(keywordField, extraArg)", - "error": [ - "Error: [to_version] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_version(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_version(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_version(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = trim(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row trim(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = trim(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = trim(true)", - "error": [ - "Argument of [trim] must be [keyword], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = trim(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval trim(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = trim(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval trim(booleanField)", - "error": [ - "Argument of [trim] must be [keyword], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = trim(*)", - "error": [ - "Using wildcards (*) in trim is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = trim(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval trim(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval trim(keywordField, extraArg)", - "error": [ - "Error: [trim] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort trim(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval trim(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval trim(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = case(true, \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row case(true, \"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = case(to_cartesianpoint(\"POINT (30 10)\"), true)", - "error": [ - "Argument of [case] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = case(booleanField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval case(booleanField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort case(booleanField, textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval case(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval case(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = avg(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(integerField)) + avg(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(integerField)) + avg(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(integerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(integerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(integerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(integerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(integerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = avg(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(booleanField)", - "error": [ - "Argument of [avg] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = avg(*)", - "error": [ - "Using wildcards (*) in avg is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = avg(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(counterIntegerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(counterIntegerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(counterIntegerField)) + avg(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(counterIntegerField)) + avg(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(counterIntegerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(counterIntegerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(counterIntegerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(counterIntegerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(counterIntegerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = avg(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(doubleField)) + avg(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(doubleField)) + avg(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(doubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(doubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(doubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(doubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = avg(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(unsignedLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(unsignedLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(unsignedLongField)) + avg(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(unsignedLongField)) + avg(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(unsignedLongField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(unsignedLongField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(unsignedLongField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(unsignedLongField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(unsignedLongField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = avg(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(longField)) + avg(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(longField)) + avg(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(longField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(longField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(longField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(longField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(longField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = avg(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(counterLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(counterLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(counterLongField)) + avg(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(counterLongField)) + avg(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(counterLongField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(counterLongField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(counterLongField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(counterLongField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(counterLongField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(counterLongField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = avg(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(counterDoubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(counterDoubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(avg(counterDoubleField)) + avg(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(avg(counterDoubleField)) + avg(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(counterDoubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = avg(counterDoubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(counterDoubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(counterDoubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), avg(counterDoubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = avg(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort avg(integerField)", - "error": [ - "SORT does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(integerField)", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(integerField) > 0", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(counterIntegerField)", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(counterIntegerField) > 0", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(doubleField)", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(doubleField) > 0", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(unsignedLongField)", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(unsignedLongField) > 0", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(longField)", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(longField) > 0", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(counterLongField)", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(counterLongField) > 0", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(counterDoubleField)", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | where avg(counterDoubleField) > 0", - "error": [ - "WHERE does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(integerField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(integerField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(integerField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(integerField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(counterIntegerField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(counterIntegerField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(counterIntegerField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(counterIntegerField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(doubleField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(doubleField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(doubleField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(doubleField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(unsignedLongField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(unsignedLongField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(unsignedLongField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(unsignedLongField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(longField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(longField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(longField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(longField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(counterLongField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(counterLongField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(counterLongField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(counterLongField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(counterDoubleField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = avg(counterDoubleField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(counterDoubleField)", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval avg(counterDoubleField) > 0", - "error": [ - "EVAL does not support function avg" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats avg(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = sum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(integerField)) + sum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(integerField)) + sum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(integerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(integerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(integerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(integerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(integerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = sum(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats sum(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats sum(booleanField)", - "error": [ - "Argument of [sum] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = sum(*)", - "error": [ - "Using wildcards (*) in sum is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = sum(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(counterIntegerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(counterIntegerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(counterIntegerField)) + sum(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(counterIntegerField)) + sum(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(counterIntegerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(counterIntegerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(counterIntegerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(counterIntegerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(counterIntegerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = sum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(doubleField)) + sum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(doubleField)) + sum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(doubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(doubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(doubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(doubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(doubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = sum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(unsignedLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(unsignedLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(unsignedLongField)) + sum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(unsignedLongField)) + sum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(unsignedLongField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(unsignedLongField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(unsignedLongField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(unsignedLongField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(unsignedLongField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = sum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(longField)) + sum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(longField)) + sum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(longField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(longField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(longField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(longField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(longField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = sum(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(counterLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(counterLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(counterLongField)) + sum(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(counterLongField)) + sum(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(counterLongField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(counterLongField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(counterLongField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(counterLongField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(counterLongField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(counterLongField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = sum(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(counterDoubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(counterDoubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(sum(counterDoubleField)) + sum(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(sum(counterDoubleField)) + sum(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats sum(counterDoubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = sum(counterDoubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(counterDoubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(counterDoubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), sum(counterDoubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = sum(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort sum(integerField)", - "error": [ - "SORT does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(integerField)", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(integerField) > 0", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(counterIntegerField)", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(counterIntegerField) > 0", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(doubleField)", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(doubleField) > 0", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(unsignedLongField)", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(unsignedLongField) > 0", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(longField)", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(longField) > 0", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(counterLongField)", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(counterLongField) > 0", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(counterDoubleField)", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | where sum(counterDoubleField) > 0", - "error": [ - "WHERE does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(integerField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(integerField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(integerField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(integerField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(counterIntegerField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(counterIntegerField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(counterIntegerField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(counterIntegerField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(doubleField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(doubleField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(doubleField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(doubleField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(unsignedLongField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(unsignedLongField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(unsignedLongField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(unsignedLongField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(longField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(longField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(longField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(longField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(counterLongField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(counterLongField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(counterLongField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(counterLongField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(counterDoubleField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sum(counterDoubleField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(counterDoubleField)", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | eval sum(counterDoubleField) > 0", - "error": [ - "EVAL does not support function sum" - ], - "warning": [] - }, - { - "query": "from a_index | stats sum(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats sum(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(integerField)) + median(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(integerField)) + median(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(integerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(integerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(integerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(integerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(integerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats median(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats median(booleanField)", - "error": [ - "Argument of [median] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = median(*)", - "error": [ - "Using wildcards (*) in median is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = median(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(counterIntegerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(counterIntegerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(counterIntegerField)) + median(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(counterIntegerField)) + median(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(counterIntegerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(counterIntegerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(counterIntegerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(counterIntegerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(counterIntegerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(doubleField)) + median(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(doubleField)) + median(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(doubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(doubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(doubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(doubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(doubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(unsignedLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(unsignedLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(unsignedLongField)) + median(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(unsignedLongField)) + median(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(unsignedLongField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(unsignedLongField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(unsignedLongField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(unsignedLongField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(unsignedLongField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(longField)) + median(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(longField)) + median(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(longField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(longField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(longField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(longField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(longField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(counterLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(counterLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(counterLongField)) + median(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(counterLongField)) + median(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(counterLongField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(counterLongField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(counterLongField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(counterLongField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(counterLongField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(counterLongField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(counterDoubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(counterDoubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median(counterDoubleField)) + median(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median(counterDoubleField)) + median(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median(counterDoubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median(counterDoubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(counterDoubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(counterDoubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median(counterDoubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort median(integerField)", - "error": [ - "SORT does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(integerField)", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(integerField) > 0", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(counterIntegerField)", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(counterIntegerField) > 0", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(doubleField)", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(doubleField) > 0", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(unsignedLongField)", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(unsignedLongField) > 0", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(longField)", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(longField) > 0", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(counterLongField)", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(counterLongField) > 0", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(counterDoubleField)", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | where median(counterDoubleField) > 0", - "error": [ - "WHERE does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(integerField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(integerField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(integerField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(integerField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(counterIntegerField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(counterIntegerField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(counterIntegerField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(counterIntegerField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(doubleField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(doubleField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(doubleField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(doubleField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(unsignedLongField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(unsignedLongField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(unsignedLongField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(unsignedLongField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(longField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(longField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(longField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(longField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(counterLongField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(counterLongField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(counterLongField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(counterLongField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(counterDoubleField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median(counterDoubleField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(counterDoubleField)", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | eval median(counterDoubleField) > 0", - "error": [ - "EVAL does not support function median" - ], - "warning": [] - }, - { - "query": "from a_index | stats median(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats median(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median_absolute_deviation(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(integerField)) + median_absolute_deviation(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(integerField)) + median_absolute_deviation(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(integerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(integerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(integerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(integerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(integerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median_absolute_deviation(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(booleanField)", - "error": [ - "Argument of [median_absolute_deviation] must be [integer], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = median_absolute_deviation(*)", - "error": [ - "Using wildcards (*) in median_absolute_deviation is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = median_absolute_deviation(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(counterIntegerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(counterIntegerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(counterIntegerField)) + median_absolute_deviation(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(counterIntegerField)) + median_absolute_deviation(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterIntegerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(counterIntegerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(counterIntegerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterIntegerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterIntegerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterIntegerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median_absolute_deviation(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(doubleField)) + median_absolute_deviation(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(doubleField)) + median_absolute_deviation(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(doubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(doubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(doubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(doubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median_absolute_deviation(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(unsignedLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(unsignedLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(unsignedLongField)) + median_absolute_deviation(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(unsignedLongField)) + median_absolute_deviation(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(unsignedLongField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(unsignedLongField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(unsignedLongField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(unsignedLongField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(unsignedLongField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median_absolute_deviation(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(longField)) + median_absolute_deviation(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(longField)) + median_absolute_deviation(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(longField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(longField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(longField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(longField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(longField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median_absolute_deviation(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(counterLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(counterLongField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(counterLongField)) + median_absolute_deviation(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(counterLongField)) + median_absolute_deviation(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(counterLongField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(counterLongField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterLongField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterLongField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterLongField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterLongField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = median_absolute_deviation(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(counterDoubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(counterDoubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(median_absolute_deviation(counterDoubleField)) + median_absolute_deviation(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(median_absolute_deviation(counterDoubleField)) + median_absolute_deviation(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(counterDoubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = median_absolute_deviation(counterDoubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterDoubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterDoubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterDoubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort median_absolute_deviation(integerField)", - "error": [ - "SORT does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(integerField)", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(integerField) > 0", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(counterIntegerField)", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(counterIntegerField) > 0", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(doubleField)", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(doubleField) > 0", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(unsignedLongField)", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(unsignedLongField) > 0", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(longField)", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(longField) > 0", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(counterLongField)", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(counterLongField) > 0", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(counterDoubleField)", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | where median_absolute_deviation(counterDoubleField) > 0", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(integerField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(integerField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(integerField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(integerField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(counterIntegerField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(counterIntegerField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(counterIntegerField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(counterIntegerField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(doubleField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(doubleField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(doubleField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(doubleField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(unsignedLongField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(unsignedLongField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(unsignedLongField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(unsignedLongField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(longField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(longField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(longField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(longField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(counterLongField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(counterLongField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(counterLongField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(counterLongField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(counterDoubleField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = median_absolute_deviation(counterDoubleField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(counterDoubleField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | eval median_absolute_deviation(counterDoubleField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], - "warning": [] - }, - { - "query": "from a_index | stats median_absolute_deviation(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats median_absolute_deviation(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = max(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(max(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(max(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(max(doubleField)) + max(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(max(doubleField)) + max(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = max(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), max(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = max(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = max(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), max(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = max(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(doubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = max(doubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), max(doubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = max(doubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), max(doubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = max(doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = max(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats max(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats max(cartesianPointField)", - "error": [ - "Argument of [max] must be [double], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = max(*)", - "error": [ - "Using wildcards (*) in max is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = max(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(max(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(max(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(max(longField)) + max(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(max(longField)) + max(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = max(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), max(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = max(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(longField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = max(longField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), max(longField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = max(longField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), max(longField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = max(longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = max(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(max(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(max(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(max(integerField)) + max(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(max(integerField)) + max(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = max(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), max(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = max(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(integerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = max(integerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), max(integerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = max(integerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), max(integerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = max(integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = max(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = max(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = max(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort max(doubleField)", - "error": [ - "SORT does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(doubleField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(doubleField) > 0", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(longField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(longField) > 0", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(integerField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(integerField) > 0", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(dateField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(dateField) > 0", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(booleanField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(booleanField) > 0", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(ipField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(ipField) > 0", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(doubleField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(doubleField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(doubleField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(doubleField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(longField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(longField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(longField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(longField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(integerField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(integerField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(integerField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(integerField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(dateField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(dateField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(dateField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(dateField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(booleanField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(booleanField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(booleanField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(booleanField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(ipField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(ipField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(ipField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(ipField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | stats max(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats max(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = max(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where max(textField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(textField) > 0", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(textField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(textField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(textField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(textField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = max(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = max(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats max(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where max(versionField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(versionField) > 0", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(keywordField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(keywordField) > 0", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(versionField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(versionField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(versionField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(versionField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(keywordField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = max(keywordField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(keywordField)", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | eval max(keywordField) > 0", - "error": [ - "EVAL does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = min(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(min(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(min(doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(min(doubleField)) + min(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(min(doubleField)) + min(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = min(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), min(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = min(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = min(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), min(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = min(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(doubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = min(doubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), min(doubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = min(doubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), min(doubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = min(doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = min(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats min(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats min(cartesianPointField)", - "error": [ - "Argument of [min] must be [double], found value [cartesianPointField] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = min(*)", - "error": [ - "Using wildcards (*) in min is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = min(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(min(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(min(longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(min(longField)) + min(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(min(longField)) + min(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = min(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), min(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = min(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(longField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = min(longField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), min(longField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = min(longField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), min(longField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = min(longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = min(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(min(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(min(integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(min(integerField)) + min(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(min(integerField)) + min(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = min(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), min(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = min(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(integerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = min(integerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), min(integerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = min(integerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), min(integerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = min(integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = min(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = min(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = min(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort min(doubleField)", - "error": [ - "SORT does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(doubleField)", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(doubleField) > 0", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(longField)", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(longField) > 0", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(integerField)", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(integerField) > 0", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(dateField)", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(dateField) > 0", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(booleanField)", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(booleanField) > 0", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(ipField)", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(ipField) > 0", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(doubleField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(doubleField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(doubleField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(doubleField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(longField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(longField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(longField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(longField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(integerField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(integerField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(integerField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(integerField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(dateField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(dateField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(dateField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(dateField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(booleanField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(booleanField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(booleanField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(booleanField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(ipField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(ipField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(ipField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(ipField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | stats min(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats min(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = min(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where min(textField)", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(textField) > 0", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(textField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(textField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(textField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(textField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = min(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = min(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats min(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where min(versionField)", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(versionField) > 0", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(keywordField)", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | where min(keywordField) > 0", - "error": [ - "WHERE does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(versionField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(versionField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(versionField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(versionField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(keywordField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = min(keywordField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(keywordField)", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | eval min(keywordField) > 0", - "error": [ - "EVAL does not support function min" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = count(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats count(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(count(textField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(count(textField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(count(textField)) + count(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(count(textField)) + count(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort count(textField)", - "error": [ - "SORT does not support function count" - ], - "warning": [] - }, - { - "query": "from a_index | where count(textField)", - "error": [ - "WHERE does not support function count" - ], - "warning": [] - }, - { - "query": "from a_index | where count(textField) > 0", - "error": [ - "WHERE does not support function count" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = count(textField)", - "error": [ - "EVAL does not support function count" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = count(textField) > 0", - "error": [ - "EVAL does not support function count" - ], - "warning": [] - }, - { - "query": "from a_index | eval count(textField)", - "error": [ - "EVAL does not support function count" - ], - "warning": [] - }, - { - "query": "from a_index | eval count(textField) > 0", - "error": [ - "EVAL does not support function count" - ], - "warning": [] - }, - { - "query": "from a_index | stats count(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats count(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats count_distinct(null, null, null, null, null, null, null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats count_distinct(nullVar, nullVar, nullVar, nullVar, nullVar, nullVar, nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField)) + count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField)) + count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField)", - "error": [ - "SORT does not support function count_distinct" - ], - "warning": [] - }, - { - "query": "from a_index | where count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField)", - "error": [ - "WHERE does not support function count_distinct" - ], - "warning": [] - }, - { - "query": "from a_index | where count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField) > 0", - "error": [ - "WHERE does not support function count_distinct" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField)", - "error": [ - "EVAL does not support function count_distinct" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField) > 0", - "error": [ - "EVAL does not support function count_distinct" - ], - "warning": [] - }, - { - "query": "from a_index | eval count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField)", - "error": [ - "EVAL does not support function count_distinct" - ], - "warning": [] - }, - { - "query": "from a_index | eval count_distinct(textField, integerField, counterIntegerField, doubleField, unsignedLongField, longField, counterLongField, counterDoubleField) > 0", - "error": [ - "EVAL does not support function count_distinct" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = st_centroid_agg(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats st_centroid_agg(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = st_centroid_agg(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats st_centroid_agg(avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats st_centroid_agg(booleanField)", - "error": [ - "Argument of [st_centroid_agg] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = st_centroid_agg(*)", - "error": [ - "Using wildcards (*) in st_centroid_agg is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = st_centroid_agg(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats st_centroid_agg(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort st_centroid_agg(cartesianPointField)", - "error": [ - "SORT does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | where st_centroid_agg(cartesianPointField)", - "error": [ - "WHERE does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | where st_centroid_agg(cartesianPointField) > 0", - "error": [ - "WHERE does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | where st_centroid_agg(geoPointField)", - "error": [ - "WHERE does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | where st_centroid_agg(geoPointField) > 0", - "error": [ - "WHERE does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_centroid_agg(cartesianPointField)", - "error": [ - "EVAL does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_centroid_agg(cartesianPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | eval st_centroid_agg(cartesianPointField)", - "error": [ - "EVAL does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | eval st_centroid_agg(cartesianPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_centroid_agg(geoPointField)", - "error": [ - "EVAL does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_centroid_agg(geoPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | eval st_centroid_agg(geoPointField)", - "error": [ - "EVAL does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | eval st_centroid_agg(geoPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], - "warning": [] - }, - { - "query": "from a_index | stats st_centroid_agg(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats st_centroid_agg(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = values(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats values(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | sort values(textField)", - "error": [ - "SORT does not support function values" - ], - "warning": [] - }, - { - "query": "from a_index | where values(textField)", - "error": [ - "WHERE does not support function values" - ], - "warning": [] - }, - { - "query": "from a_index | where values(textField) > 0", - "error": [ - "WHERE does not support function values" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = values(textField)", - "error": [ - "EVAL does not support function values" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = values(textField) > 0", - "error": [ - "EVAL does not support function values" - ], - "warning": [] - }, - { - "query": "from a_index | eval values(textField)", - "error": [ - "EVAL does not support function values" - ], - "warning": [] - }, - { - "query": "from a_index | eval values(textField) > 0", - "error": [ - "EVAL does not support function values" - ], - "warning": [] - }, - { - "query": "from a_index | stats values(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats values(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = top(textField, integerField, textField)", - "error": [ - "Argument of [=] must be a constant, received [top(textField,integerField,textField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats top(textField, integerField, textField)", - "error": [ - "Argument of [top] must be a constant, received [integerField]", - "Argument of [top] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | sort top(textField, integerField, textField)", - "error": [ - "SORT does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | where top(textField, integerField, textField)", - "error": [ - "WHERE does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | where top(textField, integerField, textField) > 0", - "error": [ - "WHERE does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = top(textField, integerField, textField)", - "error": [ - "EVAL does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = top(textField, integerField, textField) > 0", - "error": [ - "EVAL does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | eval top(textField, integerField, textField)", - "error": [ - "EVAL does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | eval top(textField, integerField, textField) > 0", - "error": [ - "EVAL does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | stats top(null, null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats top(nullVar, nullVar, nullVar)", - "error": [ - "Argument of [top] must be a constant, received [nullVar]", - "Argument of [top] must be a constant, received [nullVar]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = top(textField, integerField, \"asc\")", - "error": [ - "Argument of [=] must be a constant, received [top(textField,integerField,\"asc\")]" - ], - "warning": [] - }, - { - "query": "from a_index | stats top(textField, integerField, \"asc\")", - "error": [ - "Argument of [top] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | sort top(textField, integerField, \"asc\")", - "error": [ - "SORT does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | where top(textField, integerField, \"asc\")", - "error": [ - "WHERE does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | where top(textField, integerField, \"asc\") > 0", - "error": [ - "WHERE does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = top(textField, integerField, \"asc\")", - "error": [ - "EVAL does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = top(textField, integerField, \"asc\") > 0", - "error": [ - "EVAL does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | eval top(textField, integerField, \"asc\")", - "error": [ - "EVAL does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | eval top(textField, integerField, \"asc\") > 0", - "error": [ - "EVAL does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = weighted_avg(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(doubleField, doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(doubleField, doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(doubleField, doubleField)) + weighted_avg(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(doubleField, doubleField)) + weighted_avg(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(doubleField / 2, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(doubleField / 2, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField / 2, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField / 2, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(doubleField, doubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(doubleField, doubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, doubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, doubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, doubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = weighted_avg(avg(integerField), avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(avg(integerField), avg(integerField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(booleanField, booleanField)", - "error": [ - "Argument of [weighted_avg] must be [double], found value [booleanField] type [boolean]", - "Argument of [weighted_avg] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | sort weighted_avg(doubleField, doubleField)", - "error": [ - "SORT does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(doubleField, doubleField)", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(doubleField, doubleField) > 0", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(doubleField, doubleField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(doubleField, doubleField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(doubleField, doubleField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(doubleField, doubleField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats weighted_avg(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = weighted_avg(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(doubleField, longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(doubleField, longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(doubleField, longField)) + weighted_avg(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(doubleField, longField)) + weighted_avg(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(doubleField / 2, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(doubleField / 2, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField / 2, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField / 2, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(doubleField, longField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(doubleField, longField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, longField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, longField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, longField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = weighted_avg(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(doubleField, integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(doubleField, integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(doubleField, integerField)) + weighted_avg(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(doubleField, integerField)) + weighted_avg(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(doubleField / 2, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(doubleField / 2, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField / 2, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField / 2, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(doubleField, integerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(doubleField, integerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, integerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, integerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, integerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = weighted_avg(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(longField, doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(longField, doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(longField, doubleField)) + weighted_avg(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(longField, doubleField)) + weighted_avg(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(longField, doubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(longField, doubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(longField, doubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, doubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(longField, doubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = weighted_avg(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(longField, longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(longField, longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(longField, longField)) + weighted_avg(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(longField, longField)) + weighted_avg(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(longField, longField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(longField, longField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(longField, longField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, longField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(longField, longField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = weighted_avg(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(longField, integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(longField, integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(longField, integerField)) + weighted_avg(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(longField, integerField)) + weighted_avg(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(longField, integerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(longField, integerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(longField, integerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, integerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(longField, integerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = weighted_avg(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(integerField, doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(integerField, doubleField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(integerField, doubleField)) + weighted_avg(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(integerField, doubleField)) + weighted_avg(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(integerField, doubleField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(integerField, doubleField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, doubleField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, doubleField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, doubleField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = weighted_avg(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(integerField, longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(integerField, longField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(integerField, longField)) + weighted_avg(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(integerField, longField)) + weighted_avg(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(integerField, longField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(integerField, longField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, longField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, longField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, longField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = weighted_avg(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(integerField, integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(integerField, integerField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var = round(weighted_avg(integerField, integerField)) + weighted_avg(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats round(weighted_avg(integerField, integerField)) + weighted_avg(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats weighted_avg(integerField, integerField) by round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats var0 = weighted_avg(integerField, integerField) by var1 = round(doubleField / 2)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, integerField) by round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, integerField) by var1 = round(doubleField / 2), ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, integerField) by round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(doubleField, longField)", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(doubleField, longField) > 0", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(doubleField, integerField)", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(doubleField, integerField) > 0", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(longField, doubleField)", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(longField, doubleField) > 0", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(longField, longField)", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(longField, longField) > 0", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(longField, integerField)", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(longField, integerField) > 0", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(integerField, doubleField)", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(integerField, doubleField) > 0", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(integerField, longField)", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(integerField, longField) > 0", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(integerField, integerField)", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | where weighted_avg(integerField, integerField) > 0", - "error": [ - "WHERE does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(doubleField, longField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(doubleField, longField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(doubleField, longField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(doubleField, longField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(doubleField, integerField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(doubleField, integerField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(doubleField, integerField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(doubleField, integerField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(longField, doubleField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(longField, doubleField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(longField, doubleField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(longField, doubleField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(longField, longField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(longField, longField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(longField, longField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(longField, longField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(longField, integerField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(longField, integerField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(longField, integerField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(longField, integerField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(integerField, doubleField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(integerField, doubleField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(integerField, doubleField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(integerField, doubleField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(integerField, longField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(integerField, longField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(integerField, longField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(integerField, longField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(integerField, integerField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = weighted_avg(integerField, integerField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(integerField, integerField)", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | eval weighted_avg(integerField, integerField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(dateField, 1 year)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats by bin(dateField, 1 year)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, integerField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, integerField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(dateField, integerField, textField, textField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [textField]", - "Argument of [bucket] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(dateField, integerField, textField, textField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [textField]", - "Argument of [bin] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(dateField, integerField, dateField, dateField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [dateField]", - "Argument of [bucket] must be a constant, received [dateField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(dateField, integerField, dateField, dateField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [dateField]", - "Argument of [bin] must be a constant, received [dateField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(dateField, integerField, textField, dateField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [textField]", - "Argument of [bucket] must be a constant, received [dateField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(dateField, integerField, textField, dateField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [textField]", - "Argument of [bin] must be a constant, received [dateField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(dateField, integerField, dateField, textField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [dateField]", - "Argument of [bucket] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(dateField, integerField, dateField, textField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [dateField]", - "Argument of [bin] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, integerField, integerField, integerField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, integerField, integerField, integerField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | sort bucket(dateField, 1 year)", - "error": [ - "SORT does not support function bucket" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(null, null, null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats bucket(nullVar, nullVar, nullVar, nullVar)", - "error": [ - "Argument of [bucket] must be a constant, received [nullVar]", - "Argument of [bucket] must be a constant, received [nullVar]", - "Argument of [bucket] must be a constant, received [nullVar]" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(\"2022\", 1 year)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), 1 year)", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(\"2022\", integerField, textField, textField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [textField]", - "Argument of [bucket] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), integerField, textField, textField)", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [textField]", - "Argument of [bucket] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(\"2022\", integerField, \"2022\", \"2022\")", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), integerField, concat(\"20\", \"22\"), concat(\"20\", \"22\"))", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(\"2022\", integerField, textField, \"2022\")", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), integerField, textField, concat(\"20\", \"22\"))", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [textField]", - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(\"2022\", integerField, \"2022\", textField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), integerField, concat(\"20\", \"22\"), textField)", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", - "Argument of [bucket] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(dateField, integerField, now(), now())", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(dateField, integerField, now(), now())", - "error": [ - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(doubleField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(doubleField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(doubleField, integerField, doubleField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]", - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(doubleField, integerField, doubleField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]", - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(doubleField, integerField, doubleField, integerField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]", - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(doubleField, integerField, doubleField, integerField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]", - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(doubleField, integerField, doubleField, longField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]", - "Argument of [bucket] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(doubleField, integerField, doubleField, longField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]", - "Argument of [bin] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(doubleField, integerField, integerField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(doubleField, integerField, integerField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(doubleField, integerField, integerField, integerField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(doubleField, integerField, integerField, integerField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(doubleField, integerField, integerField, longField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(doubleField, integerField, integerField, longField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(doubleField, integerField, longField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]", - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(doubleField, integerField, longField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]", - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(doubleField, integerField, longField, integerField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]", - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(doubleField, integerField, longField, integerField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]", - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(doubleField, integerField, longField, longField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]", - "Argument of [bucket] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(doubleField, integerField, longField, longField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]", - "Argument of [bin] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, integerField, doubleField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]", - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, integerField, doubleField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]", - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, integerField, doubleField, integerField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]", - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, integerField, doubleField, integerField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]", - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, integerField, doubleField, longField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]", - "Argument of [bucket] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, integerField, doubleField, longField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]", - "Argument of [bin] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, integerField, integerField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, integerField, integerField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, integerField, integerField, longField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, integerField, integerField, longField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, integerField, longField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]", - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, integerField, longField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]", - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, integerField, longField, integerField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]", - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, integerField, longField, integerField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]", - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(integerField, integerField, longField, longField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]", - "Argument of [bucket] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(integerField, integerField, longField, longField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]", - "Argument of [bin] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(longField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(longField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(longField, integerField, doubleField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]", - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(longField, integerField, doubleField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]", - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(longField, integerField, doubleField, integerField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]", - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(longField, integerField, doubleField, integerField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]", - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(longField, integerField, doubleField, longField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]", - "Argument of [bucket] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(longField, integerField, doubleField, longField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]", - "Argument of [bin] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(longField, integerField, integerField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(longField, integerField, integerField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(longField, integerField, integerField, integerField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(longField, integerField, integerField, integerField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(longField, integerField, integerField, longField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(longField, integerField, integerField, longField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(longField, integerField, longField, doubleField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]", - "Argument of [bucket] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(longField, integerField, longField, doubleField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]", - "Argument of [bin] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(longField, integerField, longField, integerField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]", - "Argument of [bucket] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(longField, integerField, longField, integerField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]", - "Argument of [bin] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(longField, integerField, longField, longField)", - "error": [ - "Argument of [bucket] must be a constant, received [integerField]", - "Argument of [bucket] must be a constant, received [longField]", - "Argument of [bucket] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(longField, integerField, longField, longField)", - "error": [ - "Argument of [bin] must be a constant, received [integerField]", - "Argument of [bin] must be a constant, received [longField]", - "Argument of [bin] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bucket(dateField, textField)", - "error": [ - "Argument of [bucket] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats by bin(dateField, textField)", - "error": [ - "Argument of [bin] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | sort bucket(dateField, textField)", - "error": [ - "SORT does not support function bucket" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(\"2022\", textField)", - "error": [ - "Argument of [bucket] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), textField)", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", - "Argument of [bucket] must be a constant, received [textField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = percentile(doubleField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(doubleField, doubleField)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(doubleField, doubleField))", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(doubleField,doubleField))]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(doubleField, doubleField))", - "error": [ - "Argument of [round] must be a constant, received [percentile(doubleField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(doubleField, doubleField)) + percentile(doubleField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(doubleField,doubleField))+percentile(doubleField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(doubleField, doubleField)) + percentile(doubleField, doubleField)", - "error": [ - "Argument of [+] must be a constant, received [round(percentile(doubleField,doubleField))]", - "Argument of [+] must be a constant, received [percentile(doubleField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(doubleField / 2, doubleField)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(doubleField / 2, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField/2,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField / 2, doubleField)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField / 2, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField/2,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(doubleField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField, doubleField)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(doubleField, doubleField) by round(doubleField / 2)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(doubleField, doubleField) by var1 = round(doubleField / 2)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField, doubleField) by round(doubleField / 2), ipField", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, doubleField) by var1 = round(doubleField / 2), ipField", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField, doubleField) by round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = percentile(avg(integerField), avg(integerField))", - "error": [ - "Argument of [=] must be a constant, received [percentile(avg(integerField),avg(integerField))]", - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(avg(integerField), avg(integerField))", - "error": [ - "Argument of [percentile] must be a constant, received [avg(integerField)]", - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(booleanField, )", - "error": [ - "SyntaxError: no viable alternative at input 'percentile(booleanField, )'", - "SyntaxError: mismatched input ')' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", - "At least one aggregation or grouping expression required in [STATS]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = percentile(doubleField, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(doubleField, longField)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(doubleField, longField))", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(doubleField,longField))]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(doubleField, longField))", - "error": [ - "Argument of [round] must be a constant, received [percentile(doubleField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(doubleField, longField)) + percentile(doubleField, longField)", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(doubleField,longField))+percentile(doubleField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(doubleField, longField)) + percentile(doubleField, longField)", - "error": [ - "Argument of [+] must be a constant, received [round(percentile(doubleField,longField))]", - "Argument of [+] must be a constant, received [percentile(doubleField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(doubleField / 2, longField)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(doubleField / 2, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField/2,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField / 2, longField)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField / 2, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField/2,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(doubleField, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField, longField)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(doubleField, longField) by round(doubleField / 2)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(doubleField, longField) by var1 = round(doubleField / 2)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField, longField) by round(doubleField / 2), ipField", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, longField) by var1 = round(doubleField / 2), ipField", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField, longField) by round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = percentile(doubleField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(doubleField, integerField)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(doubleField, integerField))", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(doubleField,integerField))]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(doubleField, integerField))", - "error": [ - "Argument of [round] must be a constant, received [percentile(doubleField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(doubleField, integerField)) + percentile(doubleField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(doubleField,integerField))+percentile(doubleField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(doubleField, integerField)) + percentile(doubleField, integerField)", - "error": [ - "Argument of [+] must be a constant, received [round(percentile(doubleField,integerField))]", - "Argument of [+] must be a constant, received [percentile(doubleField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(doubleField / 2, integerField)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(doubleField / 2, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField/2,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField / 2, integerField)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField / 2, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField/2,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(doubleField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField, integerField)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(doubleField, integerField) by round(doubleField / 2)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(doubleField, integerField) by var1 = round(doubleField / 2)", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField, integerField) by round(doubleField / 2), ipField", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, integerField) by var1 = round(doubleField / 2), ipField", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(doubleField, integerField) by round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = percentile(longField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(longField, doubleField)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(longField, doubleField))", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(longField,doubleField))]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(longField, doubleField))", - "error": [ - "Argument of [round] must be a constant, received [percentile(longField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(longField, doubleField)) + percentile(longField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(longField,doubleField))+percentile(longField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(longField, doubleField)) + percentile(longField, doubleField)", - "error": [ - "Argument of [+] must be a constant, received [round(percentile(longField,doubleField))]", - "Argument of [+] must be a constant, received [percentile(longField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(longField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(longField, doubleField)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(longField, doubleField) by round(doubleField / 2)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(longField, doubleField) by var1 = round(doubleField / 2)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(longField, doubleField) by round(doubleField / 2), ipField", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, doubleField) by var1 = round(doubleField / 2), ipField", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(longField, doubleField) by round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = percentile(longField, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(longField, longField)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(longField, longField))", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(longField,longField))]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(longField, longField))", - "error": [ - "Argument of [round] must be a constant, received [percentile(longField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(longField, longField)) + percentile(longField, longField)", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(longField,longField))+percentile(longField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(longField, longField)) + percentile(longField, longField)", - "error": [ - "Argument of [+] must be a constant, received [round(percentile(longField,longField))]", - "Argument of [+] must be a constant, received [percentile(longField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(longField, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(longField, longField)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(longField, longField) by round(doubleField / 2)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(longField, longField) by var1 = round(doubleField / 2)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(longField, longField) by round(doubleField / 2), ipField", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, longField) by var1 = round(doubleField / 2), ipField", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(longField, longField) by round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = percentile(longField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(longField, integerField)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(longField, integerField))", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(longField,integerField))]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(longField, integerField))", - "error": [ - "Argument of [round] must be a constant, received [percentile(longField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(longField, integerField)) + percentile(longField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(longField,integerField))+percentile(longField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(longField, integerField)) + percentile(longField, integerField)", - "error": [ - "Argument of [+] must be a constant, received [round(percentile(longField,integerField))]", - "Argument of [+] must be a constant, received [percentile(longField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(longField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(longField, integerField)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(longField, integerField) by round(doubleField / 2)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(longField, integerField) by var1 = round(doubleField / 2)", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(longField, integerField) by round(doubleField / 2), ipField", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, integerField) by var1 = round(doubleField / 2), ipField", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(longField, integerField) by round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [=] must be a constant, received [percentile(longField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = percentile(integerField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(integerField, doubleField)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(integerField, doubleField))", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(integerField,doubleField))]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(integerField, doubleField))", - "error": [ - "Argument of [round] must be a constant, received [percentile(integerField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(integerField, doubleField)) + percentile(integerField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(integerField,doubleField))+percentile(integerField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(integerField, doubleField)) + percentile(integerField, doubleField)", - "error": [ - "Argument of [+] must be a constant, received [round(percentile(integerField,doubleField))]", - "Argument of [+] must be a constant, received [percentile(integerField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(integerField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(integerField, doubleField)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, doubleField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(integerField, doubleField) by round(doubleField / 2)", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(integerField, doubleField) by var1 = round(doubleField / 2)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(integerField, doubleField) by round(doubleField / 2), ipField", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, doubleField) by var1 = round(doubleField / 2), ipField", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(integerField, doubleField) by round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [percentile] must be a constant, received [doubleField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = percentile(integerField, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(integerField, longField)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(integerField, longField))", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(integerField,longField))]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(integerField, longField))", - "error": [ - "Argument of [round] must be a constant, received [percentile(integerField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(integerField, longField)) + percentile(integerField, longField)", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(integerField,longField))+percentile(integerField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(integerField, longField)) + percentile(integerField, longField)", - "error": [ - "Argument of [+] must be a constant, received [round(percentile(integerField,longField))]", - "Argument of [+] must be a constant, received [percentile(integerField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(integerField, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(integerField, longField)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, longField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(integerField, longField) by round(doubleField / 2)", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(integerField, longField) by var1 = round(doubleField / 2)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(integerField, longField) by round(doubleField / 2), ipField", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, longField) by var1 = round(doubleField / 2), ipField", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(integerField, longField) by round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [percentile] must be a constant, received [longField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, longField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,longField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = percentile(integerField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(integerField, integerField)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(integerField, integerField))", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(integerField,integerField))]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(integerField, integerField))", - "error": [ - "Argument of [round] must be a constant, received [percentile(integerField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var = round(percentile(integerField, integerField)) + percentile(integerField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [round(percentile(integerField,integerField))+percentile(integerField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats round(percentile(integerField, integerField)) + percentile(integerField, integerField)", - "error": [ - "Argument of [+] must be a constant, received [round(percentile(integerField,integerField))]", - "Argument of [+] must be a constant, received [percentile(integerField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(integerField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(integerField, integerField)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, integerField)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(integerField, integerField) by round(doubleField / 2)", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats var0 = percentile(integerField, integerField) by var1 = round(doubleField / 2)", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(integerField, integerField) by round(doubleField / 2), ipField", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, integerField) by var1 = round(doubleField / 2), ipField", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), percentile(integerField, integerField) by round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [percentile] must be a constant, received [integerField]" - ], - "warning": [] - }, - { - "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, integerField) by var1 = round(doubleField / 2), doubleField / 2", - "error": [ - "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" - ], - "warning": [] - }, - { - "query": "from a_index | sort percentile(doubleField, doubleField)", - "error": [ - "SORT does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(doubleField, doubleField)", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(doubleField, doubleField) > 0", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(doubleField, longField)", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(doubleField, longField) > 0", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(doubleField, integerField)", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(doubleField, integerField) > 0", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(longField, doubleField)", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(longField, doubleField) > 0", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(longField, longField)", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(longField, longField) > 0", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(longField, integerField)", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(longField, integerField) > 0", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(integerField, doubleField)", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(integerField, doubleField) > 0", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(integerField, longField)", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(integerField, longField) > 0", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(integerField, integerField)", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | where percentile(integerField, integerField) > 0", - "error": [ - "WHERE does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(doubleField, doubleField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(doubleField, doubleField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(doubleField, doubleField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(doubleField, doubleField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(doubleField, longField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(doubleField, longField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(doubleField, longField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(doubleField, longField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(doubleField, integerField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(doubleField, integerField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(doubleField, integerField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(doubleField, integerField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(longField, doubleField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(longField, doubleField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(longField, doubleField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(longField, doubleField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(longField, longField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(longField, longField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(longField, longField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(longField, longField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(longField, integerField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(longField, integerField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(longField, integerField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(longField, integerField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(integerField, doubleField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(integerField, doubleField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(integerField, doubleField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(integerField, doubleField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(integerField, longField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(integerField, longField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(integerField, longField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(integerField, longField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(integerField, integerField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = percentile(integerField, integerField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(integerField, integerField)", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | eval percentile(integerField, integerField) > 0", - "error": [ - "EVAL does not support function percentile" - ], - "warning": [] - }, - { - "query": "from a_index | stats percentile(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | stats percentile(nullVar, nullVar)", - "error": [ - "Argument of [percentile] must be a constant, received [nullVar]" - ], - "warning": [] - }, - { - "query": "row var = to_string(true)", - "error": [], - "warning": [] - }, - { - "query": "row to_string(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(true)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_boolean(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row to_string(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_str(cartesianPointField)", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_string(to_cartesianpoint(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_string(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_string(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_cartesianshape(cartesianPointField))", - "error": [ - "Unknown column [cartesianPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_string(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_string(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(to_datetime(\"2021-01-01T00:00:00Z\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row to_string(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row to_string(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_str(geoPointField)", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_string(to_geopoint(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_string(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_string(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(to_geoshape(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_geoshape(geoPointField))", - "error": [ - "Unknown column [geoPointField]" - ], - "warning": [] - }, - { - "query": "row var = to_string(5)", - "error": [], - "warning": [] - }, - { - "query": "row to_string(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_string(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(to_ip(\"127.0.0.1\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_ip(to_ip(\"127.0.0.1\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row to_string(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(\"a\")", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_string(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_version(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_boolean(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(counterDoubleField)", - "error": [ - "Argument of [to_string] must be [boolean], found value [counterDoubleField] type [counter_double]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(*)", - "error": [ - "Using wildcards (*) in to_string is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(cartesianShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_cartesianshape(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_datetime(dateField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_geopoint(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_geoshape(geoPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(keywordField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_string(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(textField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(unsignedLongField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_str(versionField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = to_string(to_version(keywordField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(booleanField, extraArg)", - "error": [ - "Error: [to_string] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_string(booleanField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval to_string(nullVar)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(\"2022\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval to_string(concat(\"20\", \"22\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_string(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_string(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_str(to_geopoint(\"POINT (30 10)\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_string(to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_pseries_weighted_sum(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_pseries_weighted_sum(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_pseries_weighted_sum(to_double(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_pseries_weighted_sum(true, true)", - "error": [ - "Argument of [mv_pseries_weighted_sum] must be [double], found value [true] type [boolean]", - "Argument of [mv_pseries_weighted_sum] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_pseries_weighted_sum(doubleField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_pseries_weighted_sum(booleanField, booleanField) > 0", - "error": [ - "Argument of [mv_pseries_weighted_sum] must be [double], found value [booleanField] type [boolean]", - "Argument of [mv_pseries_weighted_sum] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_pseries_weighted_sum(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_pseries_weighted_sum(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_pseries_weighted_sum(to_double(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_pseries_weighted_sum(booleanField, booleanField)", - "error": [ - "Argument of [mv_pseries_weighted_sum] must be [double], found value [booleanField] type [boolean]", - "Argument of [mv_pseries_weighted_sum] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval mv_pseries_weighted_sum(doubleField, doubleField, extraArg)", - "error": [ - "Error: [mv_pseries_weighted_sum] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_pseries_weighted_sum(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_pseries_weighted_sum(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_pseries_weighted_sum(nullVar, nullVar)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_percentile(5.5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(to_double(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(5.5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_percentile(5.5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(to_double(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(to_double(true), 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_percentile(5, 5.5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(to_integer(true), to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row mv_percentile(5, 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(to_integer(true), to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(to_integer(true), 5)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(5, to_double(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(5, to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_percentile(true, true)", - "error": [ - "Argument of [mv_percentile] must be [double], found value [true] type [boolean]", - "Argument of [mv_percentile] must be [double], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_percentile(doubleField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_percentile(booleanField, booleanField) > 0", - "error": [ - "Argument of [mv_percentile] must be [double], found value [booleanField] type [boolean]", - "Argument of [mv_percentile] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_percentile(doubleField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_percentile(doubleField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_percentile(integerField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_percentile(integerField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_percentile(integerField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_percentile(longField, doubleField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_percentile(longField, integerField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where mv_percentile(longField, longField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(to_double(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(booleanField, booleanField)", - "error": [ - "Argument of [mv_percentile] must be [double], found value [booleanField] type [boolean]", - "Argument of [mv_percentile] must be [double], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(doubleField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(to_double(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(doubleField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(to_double(booleanField), longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(integerField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(to_integer(booleanField), to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(integerField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(integerField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(to_integer(booleanField), longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(longField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(longField, to_double(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(longField, integerField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(longField, to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_percentile(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(longField, longField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(doubleField, doubleField, extraArg)", - "error": [ - "Error: [mv_percentile] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_percentile(doubleField, doubleField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_percentile(null, null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval mv_percentile(nullVar, nullVar)", - "error": [], - "warning": [] - }, { "query": "f", "error": [ diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts b/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts index 8fb4b8b90d6eb..8d78851f8c17b 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts @@ -10,7 +10,7 @@ import { join } from 'path'; import { writeFile, readFile } from 'fs/promises'; import { ignoreErrorsMap, validateQuery } from './validation'; -import { evalFunctionDefinitions } from '../definitions/functions'; +import { scalarFunctionDefinitions } from '../definitions/generated/scalar_functions'; import { getFunctionSignatures } from '../definitions/helpers'; import { FieldType, @@ -20,7 +20,7 @@ import { fieldTypes as _fieldTypes, } from '../definitions/types'; import { timeUnits, timeUnitsToSuggest } from '../definitions/literals'; -import { statsAggregationFunctionDefinitions } from '../definitions/aggs'; +import { aggregationFunctionDefinitions } from '../definitions/generated/aggregation_functions'; import capitalize from 'lodash/capitalize'; import { camelCase } from 'lodash'; import { getAstAndSyntaxErrors } from '@kbn/esql-ast'; @@ -43,22 +43,22 @@ const NESTED_DEPTHS = Array(NESTING_LEVELS) .fill(0) .map((_, i) => i + 1); -const toAvgSignature = statsAggregationFunctionDefinitions.find(({ name }) => name === 'avg')!; -const toInteger = evalFunctionDefinitions.find(({ name }) => name === 'to_integer')!; -const toDoubleSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_double')!; -const toStringSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_string')!; -const toDateSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_datetime')!; -const toBooleanSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_boolean')!; -const toIpSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_ip')!; -const toGeoPointSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_geopoint')!; -const toGeoShapeSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_geoshape')!; -const toCartesianPointSignature = evalFunctionDefinitions.find( +const toAvgSignature = aggregationFunctionDefinitions.find(({ name }) => name === 'avg')!; +const toInteger = scalarFunctionDefinitions.find(({ name }) => name === 'to_integer')!; +const toDoubleSignature = scalarFunctionDefinitions.find(({ name }) => name === 'to_double')!; +const toStringSignature = scalarFunctionDefinitions.find(({ name }) => name === 'to_string')!; +const toDateSignature = scalarFunctionDefinitions.find(({ name }) => name === 'to_datetime')!; +const toBooleanSignature = scalarFunctionDefinitions.find(({ name }) => name === 'to_boolean')!; +const toIpSignature = scalarFunctionDefinitions.find(({ name }) => name === 'to_ip')!; +const toGeoPointSignature = scalarFunctionDefinitions.find(({ name }) => name === 'to_geopoint')!; +const toGeoShapeSignature = scalarFunctionDefinitions.find(({ name }) => name === 'to_geoshape')!; +const toCartesianPointSignature = scalarFunctionDefinitions.find( ({ name }) => name === 'to_cartesianpoint' )!; -const toCartesianShapeSignature = evalFunctionDefinitions.find( +const toCartesianShapeSignature = scalarFunctionDefinitions.find( ({ name }) => name === 'to_cartesianshape' )!; -const toVersionSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_version')!; +const toVersionSignature = scalarFunctionDefinitions.find(({ name }) => name === 'to_version')!; const nestedFunctions = { double: prepareNestedFunction(toDoubleSignature), diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts b/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts index 3b5cc60f5b13f..468d5bb6e5233 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts @@ -199,11 +199,7 @@ function validateNestedFunctionArg( const argFn = getFunctionDefinition(actualArg.name)!; const fnDef = getFunctionDefinition(astFunction.name)!; // no nestying criteria should be enforced only for same type function - if ( - 'noNestingFunctions' in parameterDefinition && - parameterDefinition.noNestingFunctions && - fnDef.type === argFn.type - ) { + if (fnDef.type === 'agg' && argFn.type === 'agg') { messages.push( getMessageFromId({ messageId: 'noNestedArgumentSupport', diff --git a/packages/kbn-text-based-editor/package.json b/packages/kbn-text-based-editor/package.json index 3bdc8c0ee6e65..3eeb282f953c2 100644 --- a/packages/kbn-text-based-editor/package.json +++ b/packages/kbn-text-based-editor/package.json @@ -9,6 +9,6 @@ "scripts": { "make:docs": "ts-node --transpileOnly scripts/generate_esql_docs.ts", "postmake:docs": "yarn run lint:fix", - "lint:fix": "cd ../.. && node ./scripts/eslint --fix ./packages/kbn-text-based-editor/src/esql_documentation_sections.tsx" + "lint:fix": "cd ../.. && node ./scripts/eslint --fix ./packages/kbn-text-based-editor/src/inline_documentation/generated" } } diff --git a/packages/kbn-text-based-editor/scripts/generate_esql_docs.ts b/packages/kbn-text-based-editor/scripts/generate_esql_docs.ts index 13e21ab4ffea3..8a38908e2b211 100644 --- a/packages/kbn-text-based-editor/scripts/generate_esql_docs.ts +++ b/packages/kbn-text-based-editor/scripts/generate_esql_docs.ts @@ -11,12 +11,19 @@ import * as recast from 'recast'; const n = recast.types.namedTypes; import fs from 'fs'; import path from 'path'; -import { functions } from '../src/esql_documentation_sections'; +import { functions } from '../src/inline_documentation/generated/scalar_functions'; (function () { const pathToElasticsearch = process.argv[2]; - const functionDocs = loadFunctionDocs(pathToElasticsearch); - writeFunctionDocs(functionDocs); + const { scalarFunctions, aggregationFunctions } = loadFunctionDocs(pathToElasticsearch); + writeFunctionDocs( + scalarFunctions, + path.join(__dirname, '../src/inline_documentation/generated/scalar_functions.tsx') + ); + writeFunctionDocs( + aggregationFunctions, + path.join(__dirname, '../src/inline_documentation/generated/aggregation_functions.tsx') + ); })(); function loadFunctionDocs(pathToElasticsearch: string) { @@ -34,21 +41,21 @@ function loadFunctionDocs(pathToElasticsearch: string) { .readdirSync(definitionsPath) .map((file) => JSON.parse(fs.readFileSync(`${definitionsPath}/${file}`, 'utf-8'))); - // Initialize an empty map - const functionMap = new Map(); + const scalarFunctions = new Map(); + const aggregationFunctions = new Map(); // Iterate over each file in the directory for (const file of docsFiles) { // Ensure we only process .md files if (path.extname(file) === '.md') { - if ( - !ESFunctionDefinitions.find( - (def) => def.name === path.basename(file, '.md') && def.type === 'eval' - ) - ) { - // Exclude non-scalar functions (for now) + const functionDefinition = ESFunctionDefinitions.find( + (def) => def.name === path.basename(file, '.md') + ); + + if (!functionDefinition) { continue; } + // Read the file content const content = fs.readFileSync(path.join(docsPath, file), 'utf-8'); @@ -56,14 +63,19 @@ function loadFunctionDocs(pathToElasticsearch: string) { const functionName = path.basename(file, '.md'); // Add the function name and content to the map - functionMap.set(functionName, content); + if (functionDefinition.type === 'eval') { + scalarFunctions.set(functionName, content); + } + if (functionDefinition.type === 'agg') { + aggregationFunctions.set(functionName, content); + } } } - return functionMap; + return { scalarFunctions, aggregationFunctions }; } -function writeFunctionDocs(functionDocs: Map) { +function writeFunctionDocs(functionDocs: Map, pathToDocsFile: string) { const codeStrings = Array.from(functionDocs.entries()).map(([name, doc]) => { const docWithoutLinks = removeAsciiDocInternalCrossReferences( doc, @@ -81,6 +93,9 @@ function writeFunctionDocs(functionDocs: Map) { ), description: ( ) { };`; }); - const pathToDocsFile = path.join(__dirname, '../src/esql_documentation_sections.tsx'); - const ast = recast.parse(fs.readFileSync(pathToDocsFile, 'utf-8'), { parser: require('recast/parsers/babel'), }); diff --git a/packages/kbn-text-based-editor/src/helpers.ts b/packages/kbn-text-based-editor/src/helpers.ts index 5e7e9fb091400..f83d7a97342e6 100644 --- a/packages/kbn-text-based-editor/src/helpers.ts +++ b/packages/kbn-text-based-editor/src/helpers.ts @@ -170,11 +170,11 @@ export const getDocumentationSections = async (language: string) => { sourceCommands, processingCommands, initialSection, - functions, + scalarFunctions, aggregationFunctions, groupingFunctions, operators, - } = await import('./esql_documentation_sections'); + } = await import('./inline_documentation/esql_documentation_sections'); groups.push({ label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.esql', { defaultMessage: 'ES|QL', @@ -184,7 +184,7 @@ export const getDocumentationSections = async (language: string) => { groups.push( sourceCommands, processingCommands, - functions, + scalarFunctions, aggregationFunctions, groupingFunctions, operators diff --git a/packages/kbn-text-based-editor/src/inline_documentation/esql_documentation_sections.tsx b/packages/kbn-text-based-editor/src/inline_documentation/esql_documentation_sections.tsx new file mode 100644 index 0000000000000..d0c136cf6d01e --- /dev/null +++ b/packages/kbn-text-based-editor/src/inline_documentation/esql_documentation_sections.tsx @@ -0,0 +1,1053 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the "Elastic License + * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side + * Public License v 1"; you may not use this file except in compliance with, at + * your election, the "Elastic License 2.0", the "GNU Affero General Public + * License v3.0 only", or the "Server Side Public License, v 1". + */ + +import React from 'react'; +import { i18n } from '@kbn/i18n'; +import { Markdown as SharedUXMarkdown } from '@kbn/shared-ux-markdown'; + +const Markdown = (props: Parameters[0]) => ( + +); + +export const initialSection = ( + +); + +export const sourceCommands = { + label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.sourceCommands', { + defaultMessage: 'Source commands', + }), + description: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.commandsDescription', + { + defaultMessage: `A source command produces a table, typically with data from Elasticsearch. ES|QL supports the following source commands.`, + } + ), + items: [ + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.from', + { + defaultMessage: 'FROM', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.row', + { + defaultMessage: 'ROW', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.show', + { + defaultMessage: 'SHOW', + } + ), + description: ( + \` source command returns information about the deployment and its capabilities: + +* Use \`SHOW INFO\` to return the deployment's version, build date and hash. +* Use \`SHOW FUNCTIONS\` to return a list of all supported functions and a synopsis of each function. + `, + ignoreTag: true, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + } + )} + /> + ), + }, + ], +}; + +export const processingCommands = { + label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.processingCommands', { + defaultMessage: 'Processing commands', + }), + description: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.processingCommandsDescription', + { + defaultMessage: `Processing commands change an input table by adding, removing, or changing rows and columns. ES|QL supports the following processing commands.`, + } + ), + items: [ + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.dissect', + { + defaultMessage: 'DISSECT', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.drop', + { + defaultMessage: 'DROP', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.enrich', + { + defaultMessage: 'ENRICH', + } + ), + description: ( + \`; if it’s not specified, the match will be performed on a field with the same name as the match field defined in the enrich policy. + +\`\`\` +ROW a = "1" +| ENRICH languages_policy ON a +\`\`\` + +You can specify which attributes (between those defined as enrich fields in the policy) have to be added to the result, using \`WITH , ...\` syntax. + +\`\`\` +ROW a = "1" +| ENRICH languages_policy ON a WITH language_name +\`\`\` + +Attributes can also be renamed using \`WITH new_name=\` + +\`\`\` +ROW a = "1" +| ENRICH languages_policy ON a WITH name = language_name +\`\`\` + +By default (if no \`WITH\` is defined), \`ENRICH\` will add all the enrich fields defined in the enrich policy to the result. + +In case of name collisions, the newly created fields will override the existing fields. + `, + ignoreTag: true, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + } + )} + /> + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.eval', + { + defaultMessage: 'EVAL', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.grok', + { + defaultMessage: 'GROK', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.keep', + { + defaultMessage: 'KEEP', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.limit', + { + defaultMessage: 'LIMIT', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mvExpand', + { + defaultMessage: 'MV_EXPAND', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.rename', + { + defaultMessage: 'RENAME', + } + ), + description: ( + AS +\`\`\` + +For example: + +\`\`\` +FROM employees +| KEEP first_name, last_name, still_hired +| RENAME still_hired AS employed +\`\`\` + +If a column with the new name already exists, it will be replaced by the new column. + +Multiple columns can be renamed with a single \`RENAME\` command: + +\`\`\` +FROM employees +| KEEP first_name, last_name +| RENAME first_name AS fn, last_name AS ln +\`\`\` + `, + ignoreTag: true, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + } + )} + /> + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sort', + { + defaultMessage: 'SORT', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.statsby', + { + defaultMessage: 'STATS ... BY', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.where', + { + defaultMessage: 'WHERE', + } + ), + description: ( + + ), + }, + ], +}; + +export const groupingFunctions = { + label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.groupingFunctions', { + defaultMessage: 'Grouping functions', + }), + description: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.groupingFunctionsDocumentationESQLDescription', + { + defaultMessage: `These grouping functions can be used with \`STATS...BY\`:`, + } + ), + items: [ + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.autoBucketFunction', + { + defaultMessage: 'BUCKET', + } + ), + description: ( + = "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" +| STATS hire_date = MV_SORT(VALUES(hire_date)) BY month = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z") +| SORT hire_date +\`\`\` + +**NOTE**: The goal isn’t to provide the exact target number of buckets, it’s to pick a range that provides _at most_ the target number of buckets. + +You can combine \`BUCKET\` with an aggregation to create a histogram: + +\`\`\` +FROM employees +| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" +| STATS hires_per_month = COUNT(*) BY month = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z") +| SORT month +\`\`\` + +**NOTE**: \`BUCKET\` does not create buckets that match zero documents. That’s why the previous example is missing \`1985-03-01\` and other dates. + +Asking for more buckets can result in a smaller range. For example, requesting at most 100 buckets in a year results in weekly buckets: + +\`\`\` +FROM employees +| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" +| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 100, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z") +| SORT week +\`\`\` + +**NOTE**: \`BUCKET\` does not filter any rows. It only uses the provided range to pick a good bucket size. For rows with a value outside of the range, it returns a bucket value that corresponds to a bucket outside the range. Combine \`BUCKET\` with \`WHERE\` to filter rows. + +If the desired bucket size is known in advance, simply provide it as the second argument, leaving the range out: + +\`\`\` +FROM employees +| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" +| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 1 week) +| SORT week +\`\`\` + +**NOTE**: When providing the bucket size as the second parameter, it must be a time duration or date period. + +\`BUCKET\` can also operate on numeric fields. For example, to create a salary histogram: + +\`\`\` +FROM employees +| STATS COUNT(*) by bs = BUCKET(salary, 20, 25324, 74999) +| SORT bs +\`\`\` + +Unlike the earlier example that intentionally filters on a date range, you rarely want to filter on a numeric range. You have to find the min and max separately. ES|QL doesn’t yet have an easy way to do that automatically. + +The range can be omitted if the desired bucket size is known in advance. Simply provide it as the second argument: + +\`\`\` +FROM employees +| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" +| STATS c = COUNT(1) BY b = BUCKET(salary, 5000.) +| SORT b +\`\`\` + +**NOTE**: When providing the bucket size as the second parameter, it must be of a **floating point type**. + +Here's an example to create hourly buckets for the last 24 hours, and calculate the number of events per hour: + +\`\`\` +FROM sample_data +| WHERE @timestamp >= NOW() - 1 day and @timestamp < NOW() +| STATS COUNT(*) BY bucket = BUCKET(@timestamp, 25, NOW() - 1 day, NOW()) +\`\`\` + +Here's an example to create monthly buckets for the year 1985, and calculate the average salary by hiring month: + +\`\`\` +FROM employees +| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" +| STATS AVG(salary) BY bucket = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z") +| SORT bucket +\`\`\` + +\`BUCKET\` may be used in both the aggregating and grouping part of the \`STATS …​ BY …\`​ command, provided that in the aggregating part the function is **referenced by an alias defined in the grouping part**, or that it is invoked with the exact same expression. + +For example: + +\`\`\` +FROM employees +| STATS s1 = b1 + 1, s2 = BUCKET(salary / 1000 + 999, 50.) + 2 BY b1 = BUCKET(salary / 100 + 99, 50.), b2 = BUCKET(salary / 1000 + 999, 50.) +| SORT b1, b2 +| KEEP s1, b1, s2, b2 +\`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + } + )} + /> + ), + }, + ], +}; + +export const operators = { + label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.operators', { + defaultMessage: 'Operators', + }), + description: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.operatorsDocumentationESQLDescription', + { + defaultMessage: `ES|QL supports the following operators:`, + } + ), + items: [ + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.binaryOperators', + { + defaultMessage: 'Binary operators', + } + ), + description: ( + \` +* greater than or equal: \`>=\` +* add: \`+\` +* subtract: \`-\` +* multiply: \`*\` +* divide: \`/\` +* modulus: \`%\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + } + )} + /> + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.booleanOperators', + { + defaultMessage: 'Boolean operators', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.castOperator', + { + defaultMessage: 'Cast (::)', + } + ), + description: ( + \` type conversion functions. + +Example: +\`\`\` +ROW ver = CONCAT(("0"::INT + 1)::STRING, ".2.3")::VERSION +\`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.inOperator', + { + defaultMessage: 'IN', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stringOperators', + { + defaultMessage: 'LIKE and RLIKE', + } + ), + description: ( + + ), + }, + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.predicates', + { + defaultMessage: 'NULL values', + } + ), + description: ( + + ), + }, + ], +}; + +export { functions as scalarFunctions } from './generated/scalar_functions'; +export { functions as aggregationFunctions } from './generated/aggregation_functions'; diff --git a/packages/kbn-text-based-editor/src/inline_documentation/generated/aggregation_functions.tsx b/packages/kbn-text-based-editor/src/inline_documentation/generated/aggregation_functions.tsx new file mode 100644 index 0000000000000..00c651aabfc70 --- /dev/null +++ b/packages/kbn-text-based-editor/src/inline_documentation/generated/aggregation_functions.tsx @@ -0,0 +1,507 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the "Elastic License + * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side + * Public License v 1"; you may not use this file except in compliance with, at + * your election, the "Elastic License 2.0", the "GNU Affero General Public + * License v3.0 only", or the "Server Side Public License, v 1". + */ + +import React from 'react'; +import { i18n } from '@kbn/i18n'; +import { Markdown } from '@kbn/shared-ux-markdown'; + +// DO NOT RENAME! +export const functions = { + label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.aggregationFunctions', { + defaultMessage: 'Aggregation functions', + }), + description: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.aggregationFunctionsDocumentationESQLDescription', + { + defaultMessage: `These functions can by used with STATS...BY:`, + } + ), + // items are managed by scripts/generate_esql_docs.ts + items: [ + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.avg', + { + defaultMessage: 'AVG', + } + ), + description: ( + + + ### AVG + The average of a numeric field. + + \`\`\` + FROM employees + | STATS AVG(height) + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.count', + { + defaultMessage: 'COUNT', + } + ), + description: ( + + + ### COUNT + Returns the total number (count) of input values. + + \`\`\` + FROM employees + | STATS COUNT(height) + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.count_distinct', + { + defaultMessage: 'COUNT_DISTINCT', + } + ), + description: ( + + + ### COUNT_DISTINCT + Returns the approximate number of distinct values. + + \`\`\` + FROM hosts + | STATS COUNT_DISTINCT(ip0), COUNT_DISTINCT(ip1) + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.max', + { + defaultMessage: 'MAX', + } + ), + description: ( + + + ### MAX + The maximum value of a field. + + \`\`\` + FROM employees + | STATS MAX(languages) + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.median', + { + defaultMessage: 'MEDIAN', + } + ), + description: ( + + + ### MEDIAN + The value that is greater than half of all values and less than half of all values, also known as the 50% \`PERCENTILE\`. + + \`\`\` + FROM employees + | STATS MEDIAN(salary), PERCENTILE(salary, 50) + \`\`\` + Note: Like \`PERCENTILE\`, \`MEDIAN\` is usually approximate. + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.median_absolute_deviation', + { + defaultMessage: 'MEDIAN_ABSOLUTE_DEVIATION', + } + ), + description: ( + + + ### MEDIAN_ABSOLUTE_DEVIATION + Returns the median absolute deviation, a measure of variability. It is a robust statistic, meaning that it is useful for describing data that may have outliers, or may not be normally distributed. For such data it can be more descriptive than standard deviation. + + It is calculated as the median of each data point's deviation from the median of the entire sample. That is, for a random variable \`X\`, the median absolute deviation is \`median(|median(X) - X|)\`. + + \`\`\` + FROM employees + | STATS MEDIAN(salary), MEDIAN_ABSOLUTE_DEVIATION(salary) + \`\`\` + Note: Like \`PERCENTILE\`, \`MEDIAN_ABSOLUTE_DEVIATION\` is usually approximate. + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.min', + { + defaultMessage: 'MIN', + } + ), + description: ( + + + ### MIN + The minimum value of a field. + + \`\`\` + FROM employees + | STATS MIN(languages) + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.percentile', + { + defaultMessage: 'PERCENTILE', + } + ), + description: ( + + + ### PERCENTILE + Returns the value at which a certain percentage of observed values occur. For example, the 95th percentile is the value which is greater than 95% of the observed values and the 50th percentile is the \`MEDIAN\`. + + \`\`\` + FROM employees + | STATS p0 = PERCENTILE(salary, 0) + , p50 = PERCENTILE(salary, 50) + , p99 = PERCENTILE(salary, 99) + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_centroid_agg', + { + defaultMessage: 'ST_CENTROID_AGG', + } + ), + description: ( + + + ### ST_CENTROID_AGG + Calculate the spatial centroid over a field with spatial point geometry type. + + \`\`\` + FROM airports + | STATS centroid=ST_CENTROID_AGG(location) + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sum', + { + defaultMessage: 'SUM', + } + ), + description: ( + + + ### SUM + The sum of a numeric expression. + + \`\`\` + FROM employees + | STATS SUM(languages) + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.top', + { + defaultMessage: 'TOP', + } + ), + description: ( + + + ### TOP + Collects the top values for a field. Includes repeated values. + + \`\`\` + FROM employees + | STATS top_salaries = TOP(salary, 3, "desc"), top_salary = MAX(salary) + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.values', + { + defaultMessage: 'VALUES', + } + ), + description: ( + + + ### VALUES + Returns all values in a group as a multivalued field. The order of the returned values isn't guaranteed. If you need the values returned in order use esql-mv_sort. + + \`\`\` + FROM employees + | EVAL first_letter = SUBSTRING(first_name, 0, 1) + | STATS first_name=MV_SORT(VALUES(first_name)) BY first_letter + | SORT first_letter + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts + { + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.weighted_avg', + { + defaultMessage: 'WEIGHTED_AVG', + } + ), + description: ( + + + ### WEIGHTED_AVG + The weighted average of a numeric expression. + + \`\`\` + FROM employees + | STATS w_avg = WEIGHTED_AVG(salary, height) by languages + | EVAL w_avg = ROUND(w_avg) + | KEEP w_avg, languages + | SORT languages + \`\`\` + `, + description: + 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, + } + )} + /> + ), + }, + ], +}; diff --git a/packages/kbn-text-based-editor/src/esql_documentation_sections.tsx b/packages/kbn-text-based-editor/src/inline_documentation/generated/scalar_functions.tsx similarity index 68% rename from packages/kbn-text-based-editor/src/esql_documentation_sections.tsx rename to packages/kbn-text-based-editor/src/inline_documentation/generated/scalar_functions.tsx index 3b93002000f40..82d4b9f07d210 100644 --- a/packages/kbn-text-based-editor/src/esql_documentation_sections.tsx +++ b/packages/kbn-text-based-editor/src/inline_documentation/generated/scalar_functions.tsx @@ -9,1188 +9,47 @@ import React from 'react'; import { i18n } from '@kbn/i18n'; -import { Markdown as SharedUXMarkdown } from '@kbn/shared-ux-markdown'; - -const Markdown = (props: Parameters[0]) => ( - -); - -export const initialSection = ( - -); - -export const sourceCommands = { - label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.sourceCommands', { - defaultMessage: 'Source commands', - }), - description: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.commandsDescription', - { - defaultMessage: `A source command produces a table, typically with data from Elasticsearch. ES|QL supports the following source commands.`, - } - ), - items: [ - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.from', - { - defaultMessage: 'FROM', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.row', - { - defaultMessage: 'ROW', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.show', - { - defaultMessage: 'SHOW', - } - ), - description: ( - \` source command returns information about the deployment and its capabilities: - -* Use \`SHOW INFO\` to return the deployment's version, build date and hash. -* Use \`SHOW FUNCTIONS\` to return a list of all supported functions and a synopsis of each function. - `, - ignoreTag: true, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - } - )} - /> - ), - }, - ], -}; - -export const processingCommands = { - label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.processingCommands', { - defaultMessage: 'Processing commands', - }), - description: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.processingCommandsDescription', - { - defaultMessage: `Processing commands change an input table by adding, removing, or changing rows and columns. ES|QL supports the following processing commands.`, - } - ), - items: [ - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.dissect', - { - defaultMessage: 'DISSECT', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.drop', - { - defaultMessage: 'DROP', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.enrich', - { - defaultMessage: 'ENRICH', - } - ), - description: ( - \`; if it’s not specified, the match will be performed on a field with the same name as the match field defined in the enrich policy. - -\`\`\` -ROW a = "1" -| ENRICH languages_policy ON a -\`\`\` - -You can specify which attributes (between those defined as enrich fields in the policy) have to be added to the result, using \`WITH , ...\` syntax. - -\`\`\` -ROW a = "1" -| ENRICH languages_policy ON a WITH language_name -\`\`\` - -Attributes can also be renamed using \`WITH new_name=\` - -\`\`\` -ROW a = "1" -| ENRICH languages_policy ON a WITH name = language_name -\`\`\` - -By default (if no \`WITH\` is defined), \`ENRICH\` will add all the enrich fields defined in the enrich policy to the result. - -In case of name collisions, the newly created fields will override the existing fields. - `, - ignoreTag: true, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - } - )} - /> - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.eval', - { - defaultMessage: 'EVAL', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.grok', - { - defaultMessage: 'GROK', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.keep', - { - defaultMessage: 'KEEP', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.limit', - { - defaultMessage: 'LIMIT', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mvExpand', - { - defaultMessage: 'MV_EXPAND', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.rename', - { - defaultMessage: 'RENAME', - } - ), - description: ( - AS -\`\`\` - -For example: - -\`\`\` -FROM employees -| KEEP first_name, last_name, still_hired -| RENAME still_hired AS employed -\`\`\` - -If a column with the new name already exists, it will be replaced by the new column. - -Multiple columns can be renamed with a single \`RENAME\` command: - -\`\`\` -FROM employees -| KEEP first_name, last_name -| RENAME first_name AS fn, last_name AS ln -\`\`\` - `, - ignoreTag: true, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - } - )} - /> - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sort', - { - defaultMessage: 'SORT', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.statsby', - { - defaultMessage: 'STATS ... BY', - } - ), - description: ( - - ), - }, - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.where', - { - defaultMessage: 'WHERE', - } - ), - description: ( - - ), - }, - ], -}; - -// DO NOT RENAME! -// managed by scripts/generate_esql_docs.ts -export const functions = { - label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.functions', { - defaultMessage: 'Functions', - }), - description: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.functionsDocumentationESQLDescription', - { - defaultMessage: `Functions are supported by ROW, EVAL and WHERE.`, - } - ), - items: [ - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.abs', - { - defaultMessage: 'ABS', - } - ), - description: ( - - - ### ABS - Returns the absolute value. - - \`\`\` - ROW number = -1.0 - | EVAL abs_number = ABS(number) - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.acos', - { - defaultMessage: 'ACOS', - } - ), - description: ( - - - ### ACOS - Returns the arccosine of \`n\` as an angle, expressed in radians. - - \`\`\` - ROW a=.9 - | EVAL acos=ACOS(a) - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.asin', - { - defaultMessage: 'ASIN', - } - ), - description: ( - - - ### ASIN - Returns the arcsine of the input - numeric expression as an angle, expressed in radians. - - \`\`\` - ROW a=.9 - | EVAL asin=ASIN(a) - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.atan', - { - defaultMessage: 'ATAN', - } - ), - description: ( - - - ### ATAN - Returns the arctangent of the input - numeric expression as an angle, expressed in radians. - - \`\`\` - ROW a=12.9 - | EVAL atan=ATAN(a) - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.atan2', - { - defaultMessage: 'ATAN2', - } - ), - description: ( - - - ### ATAN2 - The angle between the positive x-axis and the ray from the - origin to the point (x , y) in the Cartesian plane, expressed in radians. - - \`\`\` - ROW y=12.9, x=.6 - | EVAL atan2=ATAN2(y, x) - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.bucket', - { - defaultMessage: 'BUCKET', - } - ), - description: ( - - - ### BUCKET - Creates groups of values - buckets - out of a datetime or numeric input. - The size of the buckets can either be provided directly, or chosen based on a recommended count and values range. - - \`\`\` - FROM employees - | WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" - | STATS hire_date = MV_SORT(VALUES(hire_date)) BY month = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z") - | SORT hire_date - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.case', - { - defaultMessage: 'CASE', - } - ), - description: ( - - - ### CASE - Accepts pairs of conditions and values. The function returns the value that - belongs to the first condition that evaluates to \`true\`. - - If the number of arguments is odd, the last argument is the default value which - is returned when no condition matches. If the number of arguments is even, and - no condition matches, the function returns \`null\`. - - \`\`\` - FROM employees - | EVAL type = CASE( - languages <= 1, "monolingual", - languages <= 2, "bilingual", - "polyglot") - | KEEP emp_no, languages, type - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cbrt', - { - defaultMessage: 'CBRT', - } - ), - description: ( - - - ### CBRT - Returns the cube root of a number. The input can be any numeric value, the return value is always a double. - Cube roots of infinities are null. - - \`\`\` - ROW d = 1000.0 - | EVAL c = cbrt(d) - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ceil', - { - defaultMessage: 'CEIL', - } - ), - description: ( - - - ### CEIL - Round a number up to the nearest integer. - - \`\`\` - ROW a=1.8 - | EVAL a=CEIL(a) - \`\`\` - Note: This is a noop for \`long\` (including unsigned) and \`integer\`. For \`double\` this picks the closest \`double\` value to the integer similar to Math.ceil. - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cidr_match', - { - defaultMessage: 'CIDR_MATCH', - } - ), - description: ( - - - ### CIDR_MATCH - Returns true if the provided IP is contained in one of the provided CIDR blocks. - - \`\`\` - FROM hosts - | WHERE CIDR_MATCH(ip1, "127.0.0.2/32", "127.0.0.3/32") - | KEEP card, host, ip0, ip1 - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.coalesce', - { - defaultMessage: 'COALESCE', - } - ), - description: ( - - - ### COALESCE - Returns the first of its arguments that is not null. If all arguments are null, it returns \`null\`. - - \`\`\` - ROW a=null, b="b" - | EVAL COALESCE(a, b) - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.concat', - { - defaultMessage: 'CONCAT', - } - ), - description: ( - - - ### CONCAT - Concatenates two or more strings. +import { Markdown } from '@kbn/shared-ux-markdown'; - \`\`\` - FROM employees - | KEEP first_name, last_name - | EVAL fullname = CONCAT(first_name, " ", last_name) - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts +// DO NOT RENAME! +export const functions = { + label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.functions', { + defaultMessage: 'Functions', + }), + description: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.functionsDocumentationESQLDescription', { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cos', - { - defaultMessage: 'COS', - } - ), - description: ( - - - ### COS - Returns the cosine of an angle. - - \`\`\` - ROW a=1.8 - | EVAL cos=COS(a) - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, + defaultMessage: `Functions are supported by ROW, EVAL and WHERE.`, + } + ), + // items are managed by scripts/generate_esql_docs.ts + items: [ // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cosh', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.abs', { - defaultMessage: 'COSH', + defaultMessage: 'ABS', } ), description: ( - ### COSH - Returns the hyperbolic cosine of an angle. + ### ABS + Returns the absolute value. \`\`\` - ROW a=1.8 - | EVAL cosh=COSH(a) + ROW number = -1.0 + | EVAL abs_number = ABS(number) \`\`\` `, description: @@ -1204,27 +63,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_diff', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.acos', { - defaultMessage: 'DATE_DIFF', + defaultMessage: 'ACOS', } ), description: ( - ### DATE_DIFF - Subtracts the \`startTimestamp\` from the \`endTimestamp\` and returns the difference in multiples of \`unit\`. - If \`startTimestamp\` is later than the \`endTimestamp\`, negative values are returned. + ### ACOS + Returns the arccosine of \`n\` as an angle, expressed in radians. \`\`\` - ROW date1 = TO_DATETIME("2023-12-02T11:00:00.000Z"), date2 = TO_DATETIME("2023-12-02T11:00:00.001Z") - | EVAL dd_ms = DATE_DIFF("microseconds", date1, date2) + ROW a=.9 + | EVAL acos=ACOS(a) \`\`\` `, description: @@ -1238,26 +99,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_extract', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.asin', { - defaultMessage: 'DATE_EXTRACT', + defaultMessage: 'ASIN', } ), description: ( - ### DATE_EXTRACT - Extracts parts of a date, like year, month, day, hour. + ### ASIN + Returns the arcsine of the input + numeric expression as an angle, expressed in radians. \`\`\` - ROW date = DATE_PARSE("yyyy-MM-dd", "2022-05-06") - | EVAL year = DATE_EXTRACT("year", date) + ROW a=.9 + | EVAL asin=ASIN(a) \`\`\` `, description: @@ -1271,27 +136,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_format', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.atan', { - defaultMessage: 'DATE_FORMAT', + defaultMessage: 'ATAN', } ), description: ( - ### DATE_FORMAT - Returns a string representation of a date, in the provided format. + ### ATAN + Returns the arctangent of the input + numeric expression as an angle, expressed in radians. \`\`\` - FROM employees - | KEEP first_name, last_name, hire_date - | EVAL hired = DATE_FORMAT("YYYY-MM-dd", hire_date) + ROW a=12.9 + | EVAL atan=ATAN(a) \`\`\` `, description: @@ -1305,26 +173,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_parse', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.atan2', { - defaultMessage: 'DATE_PARSE', + defaultMessage: 'ATAN2', } ), description: ( - ### DATE_PARSE - Returns a date by parsing the second argument using the format specified in the first argument. + ### ATAN2 + The angle between the positive x-axis and the ray from the + origin to the point (x , y) in the Cartesian plane, expressed in radians. \`\`\` - ROW date_string = "2022-05-06" - | EVAL date = DATE_PARSE("yyyy-MM-dd", date_string) + ROW y=12.9, x=.6 + | EVAL atan2=ATAN2(y, x) \`\`\` `, description: @@ -1338,56 +210,32 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_trunc', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.bucket', { - defaultMessage: 'DATE_TRUNC', + defaultMessage: 'BUCKET', } ), description: ( - ### DATE_TRUNC - Rounds down a date to the closest interval. + ### BUCKET + Creates groups of values - buckets - out of a datetime or numeric input. + The size of the buckets can either be provided directly, or chosen based on a recommended count and values range. \`\`\` FROM employees - | KEEP first_name, last_name, hire_date - | EVAL year_hired = DATE_TRUNC(1 year, hire_date) - \`\`\` - `, - description: - 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', - ignoreTag: true, - } - )} - /> - ), - }, - // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts - { - label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.e', { - defaultMessage: 'E', - }), - description: ( - - - ### E - Returns Euler's number. - - \`\`\` - ROW E() + | WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" + | STATS hire_date = MV_SORT(VALUES(hire_date)) BY month = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z") + | SORT hire_date \`\`\` `, description: @@ -1401,27 +249,38 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ends_with', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.case', { - defaultMessage: 'ENDS_WITH', + defaultMessage: 'CASE', } ), description: ( - ### ENDS_WITH - Returns a boolean that indicates whether a keyword string ends with another string. + ### CASE + Accepts pairs of conditions and values. The function returns the value that + belongs to the first condition that evaluates to \`true\`. + + If the number of arguments is odd, the last argument is the default value which + is returned when no condition matches. If the number of arguments is even, and + no condition matches, the function returns \`null\`. \`\`\` FROM employees - | KEEP last_name - | EVAL ln_E = ENDS_WITH(last_name, "d") + | EVAL type = CASE( + languages <= 1, "monolingual", + languages <= 2, "bilingual", + "polyglot") + | KEEP emp_no, languages, type \`\`\` `, description: @@ -1435,26 +294,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.exp', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cbrt', { - defaultMessage: 'EXP', + defaultMessage: 'CBRT', } ), description: ( - ### EXP - Returns the value of e raised to the power of the given number. + ### CBRT + Returns the cube root of a number. The input can be any numeric value, the return value is always a double. + Cube roots of infinities are null. \`\`\` - ROW d = 5.0 - | EVAL s = EXP(d) + ROW d = 1000.0 + | EVAL c = cbrt(d) \`\`\` `, description: @@ -1468,30 +331,31 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.floor', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ceil', { - defaultMessage: 'FLOOR', + defaultMessage: 'CEIL', } ), description: ( - ### FLOOR - Round a number down to the nearest integer. + ### CEIL + Round a number up to the nearest integer. \`\`\` ROW a=1.8 - | EVAL a=FLOOR(a) + | EVAL a=CEIL(a) \`\`\` - Note: This is a noop for \`long\` (including unsigned) and \`integer\`. - For \`double\` this picks the closest \`double\` value to the integer - similar to Math.floor. + Note: This is a noop for \`long\` (including unsigned) and \`integer\`. For \`double\` this picks the closest \`double\` value to the integer similar to Math.ceil. `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -1504,26 +368,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.from_base64', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cidr_match', { - defaultMessage: 'FROM_BASE64', + defaultMessage: 'CIDR_MATCH', } ), description: ( - ### FROM_BASE64 - Decode a base64 string. + ### CIDR_MATCH + Returns true if the provided IP is contained in one of the provided CIDR blocks. \`\`\` - row a = "ZWxhc3RpYw==" - | eval d = from_base64(a) + FROM hosts + | WHERE CIDR_MATCH(ip1, "127.0.0.2/32", "127.0.0.3/32") + | KEEP card, host, ip0, ip1 \`\`\` `, description: @@ -1537,29 +405,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.greatest', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.coalesce', { - defaultMessage: 'GREATEST', + defaultMessage: 'COALESCE', } ), description: ( - ### GREATEST - Returns the maximum value from multiple columns. This is similar to \`MV_MAX\` - except it is intended to run on multiple columns at once. + ### COALESCE + Returns the first of its arguments that is not null. If all arguments are null, it returns \`null\`. \`\`\` - ROW a = 10, b = 20 - | EVAL g = GREATEST(a, b) + ROW a=null, b="b" + | EVAL COALESCE(a, b) \`\`\` - Note: When run on \`keyword\` or \`text\` fields, this returns the last string in alphabetical order. When run on \`boolean\` columns this will return \`true\` if any values are \`true\`. `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -1572,26 +441,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ip_prefix', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.concat', { - defaultMessage: 'IP_PREFIX', + defaultMessage: 'CONCAT', } ), description: ( - ### IP_PREFIX - Truncates an IP to a given prefix length. + ### CONCAT + Concatenates two or more strings. \`\`\` - row ip4 = to_ip("1.2.3.4"), ip6 = to_ip("fe80::cae2:65ff:fece:feb9") - | eval ip4_prefix = ip_prefix(ip4, 24, 0), ip6_prefix = ip_prefix(ip6, 0, 112); + FROM employees + | KEEP first_name, last_name + | EVAL fullname = CONCAT(first_name, " ", last_name) \`\`\` `, description: @@ -1605,26 +478,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.least', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cos', { - defaultMessage: 'LEAST', + defaultMessage: 'COS', } ), description: ( - ### LEAST - Returns the minimum value from multiple columns. This is similar to \`MV_MIN\` except it is intended to run on multiple columns at once. + ### COS + Returns the cosine of an angle. \`\`\` - ROW a = 10, b = 20 - | EVAL l = LEAST(a, b) + ROW a=1.8 + | EVAL cos=COS(a) \`\`\` `, description: @@ -1638,29 +514,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.left', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cosh', { - defaultMessage: 'LEFT', + defaultMessage: 'COSH', } ), description: ( - ### LEFT - Returns the substring that extracts 'length' chars from 'string' starting from the left. + ### COSH + Returns the hyperbolic cosine of a number. \`\`\` - FROM employees - | KEEP last_name - | EVAL left = LEFT(last_name, 3) - | SORT last_name ASC - | LIMIT 5 + ROW a=1.8 + | EVAL cosh=COSH(a) \`\`\` `, description: @@ -1674,27 +550,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.length', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_diff', { - defaultMessage: 'LENGTH', + defaultMessage: 'DATE_DIFF', } ), description: ( - ### LENGTH - Returns the character length of a string. + ### DATE_DIFF + Subtracts the \`startTimestamp\` from the \`endTimestamp\` and returns the difference in multiples of \`unit\`. + If \`startTimestamp\` is later than the \`endTimestamp\`, negative values are returned. \`\`\` - FROM employees - | KEEP first_name, last_name - | EVAL fn_length = LENGTH(first_name) + ROW date1 = TO_DATETIME("2023-12-02T11:00:00.000Z"), date2 = TO_DATETIME("2023-12-02T11:00:00.001Z") + | EVAL dd_ms = DATE_DIFF("microseconds", date1, date2) \`\`\` `, description: @@ -1708,28 +587,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.locate', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_extract', { - defaultMessage: 'LOCATE', + defaultMessage: 'DATE_EXTRACT', } ), description: ( - ### LOCATE - Returns an integer that indicates the position of a keyword substring within another string. - Returns \`0\` if the substring cannot be found. - Note that string positions start from \`1\`. + ### DATE_EXTRACT + Extracts parts of a date, like year, month, day, hour. \`\`\` - row a = "hello" - | eval a_ll = locate(a, "ll") + ROW date = DATE_PARSE("yyyy-MM-dd", "2022-05-06") + | EVAL year = DATE_EXTRACT("year", date) \`\`\` `, description: @@ -1743,28 +623,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.log', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_format', { - defaultMessage: 'LOG', + defaultMessage: 'DATE_FORMAT', } ), description: ( - ### LOG - Returns the logarithm of a value to a base. The input can be any numeric value, the return value is always a double. - - Logs of zero, negative numbers, and base of one return \`null\` as well as a warning. + ### DATE_FORMAT + Returns a string representation of a date, in the provided format. \`\`\` - ROW base = 2.0, value = 8.0 - | EVAL s = LOG(base, value) + FROM employees + | KEEP first_name, last_name, hire_date + | EVAL hired = DATE_FORMAT("YYYY-MM-dd", hire_date) \`\`\` `, description: @@ -1778,28 +660,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.log10', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_parse', { - defaultMessage: 'LOG10', + defaultMessage: 'DATE_PARSE', } ), description: ( - ### LOG10 - Returns the logarithm of a value to base 10. The input can be any numeric value, the return value is always a double. - - Logs of 0 and negative numbers return \`null\` as well as a warning. + ### DATE_PARSE + Returns a date by parsing the second argument using the format specified in the first argument. \`\`\` - ROW d = 1000.0 - | EVAL s = LOG10(d) + ROW date_string = "2022-05-06" + | EVAL date = DATE_PARSE("yyyy-MM-dd", date_string) \`\`\` `, description: @@ -1813,29 +696,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ltrim', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_trunc', { - defaultMessage: 'LTRIM', + defaultMessage: 'DATE_TRUNC', } ), description: ( - ### LTRIM - Removes leading whitespaces from a string. + ### DATE_TRUNC + Rounds down a date to the closest interval. \`\`\` - ROW message = " some text ", color = " red " - | EVAL message = LTRIM(message) - | EVAL color = LTRIM(color) - | EVAL message = CONCAT("'", message, "'") - | EVAL color = CONCAT("'", color, "'") + FROM employees + | KEEP first_name, last_name, hire_date + | EVAL year_hired = DATE_TRUNC(1 year, hire_date) \`\`\` `, description: @@ -1848,24 +732,27 @@ export const functions = { }, // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_append', - { - defaultMessage: 'MV_APPEND', - } - ), + label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.e', { + defaultMessage: 'E', + }), description: ( - ### MV_APPEND - Concatenates values of two multi-value fields. + ### E + Returns Euler's number. + \`\`\` + ROW E() + \`\`\` `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -1878,26 +765,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_avg', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ends_with', { - defaultMessage: 'MV_AVG', + defaultMessage: 'ENDS_WITH', } ), description: ( - ### MV_AVG - Converts a multivalued field into a single valued field containing the average of all of the values. + ### ENDS_WITH + Returns a boolean that indicates whether a keyword string ends with another string. \`\`\` - ROW a=[3, 5, 1, 6] - | EVAL avg_a = MV_AVG(a) + FROM employees + | KEEP last_name + | EVAL ln_E = ENDS_WITH(last_name, "d") \`\`\` `, description: @@ -1911,26 +802,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_concat', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.exp', { - defaultMessage: 'MV_CONCAT', + defaultMessage: 'EXP', } ), description: ( - ### MV_CONCAT - Converts a multivalued string expression into a single valued column containing the concatenation of all values separated by a delimiter. + ### EXP + Returns the value of e raised to the power of the given number. \`\`\` - ROW a=["foo", "zoo", "bar"] - | EVAL j = MV_CONCAT(a, ", ") + ROW d = 5.0 + | EVAL s = EXP(d) \`\`\` `, description: @@ -1944,27 +838,33 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_count', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.floor', { - defaultMessage: 'MV_COUNT', + defaultMessage: 'FLOOR', } ), description: ( - ### MV_COUNT - Converts a multivalued expression into a single valued column containing a count of the number of values. + ### FLOOR + Round a number down to the nearest integer. \`\`\` - ROW a=["foo", "zoo", "bar"] - | EVAL count_a = MV_COUNT(a) + ROW a=1.8 + | EVAL a=FLOOR(a) \`\`\` + Note: This is a noop for \`long\` (including unsigned) and \`integer\`. + For \`double\` this picks the closest \`double\` value to the integer + similar to Math.floor. `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -1977,28 +877,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_dedupe', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.from_base64', { - defaultMessage: 'MV_DEDUPE', + defaultMessage: 'FROM_BASE64', } ), description: ( - ### MV_DEDUPE - Remove duplicate values from a multivalued field. + ### FROM_BASE64 + Decode a base64 string. \`\`\` - ROW a=["foo", "foo", "bar", "foo"] - | EVAL dedupe_a = MV_DEDUPE(a) + row a = "ZWxhc3RpYw==" + | eval d = from_base64(a) \`\`\` - Note: \`MV_DEDUPE\` may, but won't always, sort the values in the column. `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -2011,35 +913,32 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_first', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.greatest', { - defaultMessage: 'MV_FIRST', + defaultMessage: 'GREATEST', } ), description: ( - ### MV_FIRST - Converts a multivalued expression into a single valued column containing the - first value. This is most useful when reading from a function that emits - multivalued columns in a known order like \`SPLIT\`. - - The order that multivalued fields are read from - underlying storage is not guaranteed. It is *frequently* ascending, but don't - rely on that. If you need the minimum value use \`MV_MIN\` instead of - \`MV_FIRST\`. \`MV_MIN\` has optimizations for sorted values so there isn't a - performance benefit to \`MV_FIRST\`. + ### GREATEST + Returns the maximum value from multiple columns. This is similar to \`MV_MAX\` + except it is intended to run on multiple columns at once. \`\`\` - ROW a="foo;bar;baz" - | EVAL first_a = MV_FIRST(SPLIT(a, ";")) + ROW a = 10, b = 20 + | EVAL g = GREATEST(a, b) \`\`\` + Note: When run on \`keyword\` or \`text\` fields, this returns the last string in alphabetical order. When run on \`boolean\` columns this will return \`true\` if any values are \`true\`. `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -2052,34 +951,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_last', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ip_prefix', { - defaultMessage: 'MV_LAST', + defaultMessage: 'IP_PREFIX', } ), description: ( - ### MV_LAST - Converts a multivalue expression into a single valued column containing the last - value. This is most useful when reading from a function that emits multivalued - columns in a known order like \`SPLIT\`. - - The order that multivalued fields are read from - underlying storage is not guaranteed. It is *frequently* ascending, but don't - rely on that. If you need the maximum value use \`MV_MAX\` instead of - \`MV_LAST\`. \`MV_MAX\` has optimizations for sorted values so there isn't a - performance benefit to \`MV_LAST\`. + ### IP_PREFIX + Truncates an IP to a given prefix length. \`\`\` - ROW a="foo;bar;baz" - | EVAL last_a = MV_LAST(SPLIT(a, ";")) + row ip4 = to_ip("1.2.3.4"), ip6 = to_ip("fe80::cae2:65ff:fece:feb9") + | eval ip4_prefix = ip_prefix(ip4, 24, 0), ip6_prefix = ip_prefix(ip6, 0, 112); \`\`\` `, description: @@ -2093,26 +987,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_max', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.least', { - defaultMessage: 'MV_MAX', + defaultMessage: 'LEAST', } ), description: ( - ### MV_MAX - Converts a multivalued expression into a single valued column containing the maximum value. + ### LEAST + Returns the minimum value from multiple columns. This is similar to \`MV_MIN\` except it is intended to run on multiple columns at once. \`\`\` - ROW a=[3, 5, 1] - | EVAL max_a = MV_MAX(a) + ROW a = 10, b = 20 + | EVAL l = LEAST(a, b) \`\`\` `, description: @@ -2126,26 +1023,32 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_median', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.left', { - defaultMessage: 'MV_MEDIAN', + defaultMessage: 'LEFT', } ), description: ( - ### MV_MEDIAN - Converts a multivalued field into a single valued field containing the median value. + ### LEFT + Returns the substring that extracts 'length' chars from 'string' starting from the left. \`\`\` - ROW a=[3, 5, 1] - | EVAL median_a = MV_MEDIAN(a) + FROM employees + | KEEP last_name + | EVAL left = LEFT(last_name, 3) + | SORT last_name ASC + | LIMIT 5 \`\`\` `, description: @@ -2159,26 +1062,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_min', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.length', { - defaultMessage: 'MV_MIN', + defaultMessage: 'LENGTH', } ), description: ( - ### MV_MIN - Converts a multivalued expression into a single valued column containing the minimum value. + ### LENGTH + Returns the character length of a string. \`\`\` - ROW a=[2, 1] - | EVAL min_a = MV_MIN(a) + FROM employees + | KEEP first_name, last_name + | EVAL fn_length = LENGTH(first_name) \`\`\` `, description: @@ -2192,26 +1099,31 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_percentile', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.locate', { - defaultMessage: 'MV_PERCENTILE', + defaultMessage: 'LOCATE', } ), description: ( - ### MV_PERCENTILE - Converts a multivalued field into a single valued field containing the value at which a certain percentage of observed values occur. + ### LOCATE + Returns an integer that indicates the position of a keyword substring within another string. + Returns \`0\` if the substring cannot be found. + Note that string positions start from \`1\`. \`\`\` - ROW values = [5, 5, 10, 12, 5000] - | EVAL p50 = MV_PERCENTILE(values, 50), median = MV_MEDIAN(values) + row a = "hello" + | eval a_ll = locate(a, "ll") \`\`\` `, description: @@ -2225,27 +1137,31 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_pseries_weighted_sum', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.log', { - defaultMessage: 'MV_PSERIES_WEIGHTED_SUM', + defaultMessage: 'LOG', } ), description: ( - ### MV_PSERIES_WEIGHTED_SUM - Converts a multivalued expression into a single-valued column by multiplying every element on the input list by its corresponding term in P-Series and computing the sum. + ### LOG + Returns the logarithm of a value to a base. The input can be any numeric value, the return value is always a double. + + Logs of zero, negative numbers, and base of one return \`null\` as well as a warning. \`\`\` - ROW a = [70.0, 45.0, 21.0, 21.0, 21.0] - | EVAL sum = MV_PSERIES_WEIGHTED_SUM(a, 1.5) - | KEEP sum + ROW base = 2.0, value = 8.0 + | EVAL s = LOG(base, value) \`\`\` `, description: @@ -2259,26 +1175,31 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_slice', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.log10', { - defaultMessage: 'MV_SLICE', + defaultMessage: 'LOG10', } ), description: ( - ### MV_SLICE - Returns a subset of the multivalued field using the start and end index values. + ### LOG10 + Returns the logarithm of a value to base 10. The input can be any numeric value, the return value is always a double. + + Logs of 0 and negative numbers return \`null\` as well as a warning. \`\`\` - row a = [1, 2, 2, 3] - | eval a1 = mv_slice(a, 1), a2 = mv_slice(a, 2, 3) + ROW d = 1000.0 + | EVAL s = LOG10(d) \`\`\` `, description: @@ -2292,26 +1213,32 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_sort', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ltrim', { - defaultMessage: 'MV_SORT', + defaultMessage: 'LTRIM', } ), description: ( - ### MV_SORT - Sorts a multivalued field in lexicographical order. + ### LTRIM + Removes leading whitespaces from a string. \`\`\` - ROW a = [4, 2, -3, 2] - | EVAL sa = mv_sort(a), sd = mv_sort(a, "DESC") + ROW message = " some text ", color = " red " + | EVAL message = LTRIM(message) + | EVAL color = LTRIM(color) + | EVAL message = CONCAT("'", message, "'") + | EVAL color = CONCAT("'", color, "'") \`\`\` `, description: @@ -2325,27 +1252,26 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_sum', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_append', { - defaultMessage: 'MV_SUM', + defaultMessage: 'MV_APPEND', } ), description: ( - ### MV_SUM - Converts a multivalued field into a single valued field containing the sum of all of the values. + ### MV_APPEND + Concatenates values of two multi-value fields. - \`\`\` - ROW a=[3, 5, 6] - | EVAL sum_a = MV_SUM(a) - \`\`\` `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -2358,27 +1284,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_zip', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_avg', { - defaultMessage: 'MV_ZIP', + defaultMessage: 'MV_AVG', } ), description: ( - ### MV_ZIP - Combines the values from two multivalued fields with a delimiter that joins them together. + ### MV_AVG + Converts a multivalued field into a single valued field containing the average of all of the values. \`\`\` - ROW a = ["x", "y", "z"], b = ["1", "2"] - | EVAL c = mv_zip(a, b, "-") - | KEEP a, b, c + ROW a=[3, 5, 1, 6] + | EVAL avg_a = MV_AVG(a) \`\`\` `, description: @@ -2392,25 +1320,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.now', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_concat', { - defaultMessage: 'NOW', + defaultMessage: 'MV_CONCAT', } ), description: ( - ### NOW - Returns current date and time. + ### MV_CONCAT + Converts a multivalued string expression into a single valued column containing the concatenation of all values separated by a delimiter. \`\`\` - ROW current_date = NOW() + ROW a=["foo", "zoo", "bar"] + | EVAL j = MV_CONCAT(a, ", ") \`\`\` `, description: @@ -2423,23 +1355,30 @@ export const functions = { }, // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { - label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pi', { - defaultMessage: 'PI', - }), + label: i18n.translate( + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_count', + { + defaultMessage: 'MV_COUNT', + } + ), description: ( - ### PI - Returns Pi, the ratio of a circle's circumference to its diameter. + ### MV_COUNT + Converts a multivalued expression into a single valued column containing a count of the number of values. \`\`\` - ROW PI() + ROW a=["foo", "zoo", "bar"] + | EVAL count_a = MV_COUNT(a) \`\`\` `, description: @@ -2453,28 +1392,31 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pow', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_dedupe', { - defaultMessage: 'POW', + defaultMessage: 'MV_DEDUPE', } ), description: ( - ### POW - Returns the value of \`base\` raised to the power of \`exponent\`. + ### MV_DEDUPE + Remove duplicate values from a multivalued field. \`\`\` - ROW base = 2.0, exponent = 2 - | EVAL result = POW(base, exponent) + ROW a=["foo", "foo", "bar", "foo"] + | EVAL dedupe_a = MV_DEDUPE(a) \`\`\` - Note: It is still possible to overflow a double result here; in that case, null will be returned. + Note: \`MV_DEDUPE\` may, but won't always, sort the values in the column. `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -2487,26 +1429,37 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.repeat', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_first', { - defaultMessage: 'REPEAT', + defaultMessage: 'MV_FIRST', } ), description: ( - ### REPEAT - Returns a string constructed by concatenating \`string\` with itself the specified \`number\` of times. + ### MV_FIRST + Converts a multivalued expression into a single valued column containing the + first value. This is most useful when reading from a function that emits + multivalued columns in a known order like \`SPLIT\`. + + The order that multivalued fields are read from + underlying storage is not guaranteed. It is *frequently* ascending, but don't + rely on that. If you need the minimum value use \`MV_MIN\` instead of + \`MV_FIRST\`. \`MV_MIN\` has optimizations for sorted values so there isn't a + performance benefit to \`MV_FIRST\`. \`\`\` - ROW a = "Hello!" - | EVAL triple_a = REPEAT(a, 3); + ROW a="foo;bar;baz" + | EVAL first_a = MV_FIRST(SPLIT(a, ";")) \`\`\` `, description: @@ -2520,28 +1473,37 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.replace', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_last', { - defaultMessage: 'REPLACE', + defaultMessage: 'MV_LAST', } ), description: ( - ### REPLACE - The function substitutes in the string \`str\` any match of the regular expression \`regex\` - with the replacement string \`newStr\`. + ### MV_LAST + Converts a multivalue expression into a single valued column containing the last + value. This is most useful when reading from a function that emits multivalued + columns in a known order like \`SPLIT\`. + + The order that multivalued fields are read from + underlying storage is not guaranteed. It is *frequently* ascending, but don't + rely on that. If you need the maximum value use \`MV_MAX\` instead of + \`MV_LAST\`. \`MV_MAX\` has optimizations for sorted values so there isn't a + performance benefit to \`MV_LAST\`. \`\`\` - ROW str = "Hello World" - | EVAL str = REPLACE(str, "World", "Universe") - | KEEP str + ROW a="foo;bar;baz" + | EVAL last_a = MV_LAST(SPLIT(a, ";")) \`\`\` `, description: @@ -2555,29 +1517,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.right', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_max', { - defaultMessage: 'RIGHT', + defaultMessage: 'MV_MAX', } ), description: ( - ### RIGHT - Return the substring that extracts 'length' chars from 'str' starting from the right. + ### MV_MAX + Converts a multivalued expression into a single valued column containing the maximum value. \`\`\` - FROM employees - | KEEP last_name - | EVAL right = RIGHT(last_name, 3) - | SORT last_name ASC - | LIMIT 5 + ROW a=[3, 5, 1] + | EVAL max_a = MV_MAX(a) \`\`\` `, description: @@ -2591,30 +1553,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.round', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_median', { - defaultMessage: 'ROUND', + defaultMessage: 'MV_MEDIAN', } ), description: ( - ### ROUND - Rounds a number to the specified number of decimal places. - Defaults to 0, which returns the nearest integer. If the - precision is a negative number, rounds to the number of digits left - of the decimal point. + ### MV_MEDIAN + Converts a multivalued field into a single valued field containing the median value. \`\`\` - FROM employees - | KEEP first_name, last_name, height - | EVAL height_ft = ROUND(height * 3.281, 1) + ROW a=[3, 5, 1] + | EVAL median_a = MV_MEDIAN(a) \`\`\` `, description: @@ -2628,30 +1589,33 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.rtrim', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_median_absolute_deviation', { - defaultMessage: 'RTRIM', + defaultMessage: 'MV_MEDIAN_ABSOLUTE_DEVIATION', } ), description: ( - ### RTRIM - Removes trailing whitespaces from a string. + ### MV_MEDIAN_ABSOLUTE_DEVIATION + Converts a multivalued field into a single valued field containing the median absolute deviation. + + It is calculated as the median of each data point's deviation from the median of the entire sample. That is, for a random variable \`X\`, the median absolute deviation is \`median(|median(X) - X|)\`. \`\`\` - ROW message = " some text ", color = " red " - | EVAL message = RTRIM(message) - | EVAL color = RTRIM(color) - | EVAL message = CONCAT("'", message, "'") - | EVAL color = CONCAT("'", color, "'") + ROW values = [0, 2, 5, 6] + | EVAL median_absolute_deviation = MV_MEDIAN_ABSOLUTE_DEVIATION(values), median = MV_MEDIAN(values) \`\`\` + Note: If the field has an even number of values, the medians will be calculated as the average of the middle two values. If the value is not a floating point number, the averages are rounded towards 0. `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -2664,27 +1628,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.signum', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_min', { - defaultMessage: 'SIGNUM', + defaultMessage: 'MV_MIN', } ), description: ( - ### SIGNUM - Returns the sign of the given number. - It returns \`-1\` for negative numbers, \`0\` for \`0\` and \`1\` for positive numbers. + ### MV_MIN + Converts a multivalued expression into a single valued column containing the minimum value. \`\`\` - ROW d = 100.0 - | EVAL s = SIGNUM(d) + ROW a=[2, 1] + | EVAL min_a = MV_MIN(a) \`\`\` `, description: @@ -2698,26 +1664,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sin', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_percentile', { - defaultMessage: 'SIN', + defaultMessage: 'MV_PERCENTILE', } ), description: ( - ### SIN - Returns ths Sine trigonometric function of an angle. + ### MV_PERCENTILE + Converts a multivalued field into a single valued field containing the value at which a certain percentage of observed values occur. \`\`\` - ROW a=1.8 - | EVAL sin=SIN(a) + ROW values = [5, 5, 10, 12, 5000] + | EVAL p50 = MV_PERCENTILE(values, 50), median = MV_MEDIAN(values) \`\`\` `, description: @@ -2731,26 +1700,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sinh', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_pseries_weighted_sum', { - defaultMessage: 'SINH', + defaultMessage: 'MV_PSERIES_WEIGHTED_SUM', } ), description: ( - ### SINH - Returns the hyperbolic sine of an angle. + ### MV_PSERIES_WEIGHTED_SUM + Converts a multivalued expression into a single-valued column by multiplying every element on the input list by its corresponding term in P-Series and computing the sum. \`\`\` - ROW a=1.8 - | EVAL sinh=SINH(a) + ROW a = [70.0, 45.0, 21.0, 21.0, 21.0] + | EVAL sum = MV_PSERIES_WEIGHTED_SUM(a, 1.5) + | KEEP sum \`\`\` `, description: @@ -2764,26 +1737,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.split', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_slice', { - defaultMessage: 'SPLIT', + defaultMessage: 'MV_SLICE', } ), description: ( - ### SPLIT - Split a single valued string into multiple strings. + ### MV_SLICE + Returns a subset of the multivalued field using the start and end index values. \`\`\` - ROW words="foo;bar;baz;qux;quux;corge" - | EVAL word = SPLIT(words, ";") + row a = [1, 2, 2, 3] + | eval a1 = mv_slice(a, 1), a2 = mv_slice(a, 2, 3) \`\`\` `, description: @@ -2797,27 +1773,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sqrt', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_sort', { - defaultMessage: 'SQRT', + defaultMessage: 'MV_SORT', } ), description: ( - ### SQRT - Returns the square root of a number. The input can be any numeric value, the return value is always a double. - Square roots of negative numbers and infinities are null. + ### MV_SORT + Sorts a multivalued field in lexicographical order. \`\`\` - ROW d = 100.0 - | EVAL s = SQRT(d) + ROW a = [4, 2, -3, 2] + | EVAL sa = mv_sort(a), sd = mv_sort(a, "DESC") \`\`\` `, description: @@ -2831,28 +1809,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_contains', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_sum', { - defaultMessage: 'ST_CONTAINS', + defaultMessage: 'MV_SUM', } ), description: ( - ### ST_CONTAINS - Returns whether the first geometry contains the second geometry. - This is the inverse of the \`ST_WITHIN\` function. + ### MV_SUM + Converts a multivalued field into a single valued field containing the sum of all of the values. \`\`\` - FROM airport_city_boundaries - | WHERE ST_CONTAINS(city_boundary, TO_GEOSHAPE("POLYGON((109.35 18.3, 109.45 18.3, 109.45 18.4, 109.35 18.4, 109.35 18.3))")) - | KEEP abbrev, airport, region, city, city_location + ROW a=[3, 5, 6] + | EVAL sum_a = MV_SUM(a) \`\`\` `, description: @@ -2866,29 +1845,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_disjoint', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_zip', { - defaultMessage: 'ST_DISJOINT', + defaultMessage: 'MV_ZIP', } ), description: ( - ### ST_DISJOINT - Returns whether the two geometries or geometry columns are disjoint. - This is the inverse of the \`ST_INTERSECTS\` function. - In mathematical terms: ST_Disjoint(A, B) ⇔ A ⋂ B = ∅ + ### MV_ZIP + Combines the values from two multivalued fields with a delimiter that joins them together. \`\`\` - FROM airport_city_boundaries - | WHERE ST_DISJOINT(city_boundary, TO_GEOSHAPE("POLYGON((-10 -60, 120 -60, 120 60, -10 60, -10 -60))")) - | KEEP abbrev, airport, region, city, city_location + ROW a = ["x", "y", "z"], b = ["1", "2"] + | EVAL c = mv_zip(a, b, "-") + | KEEP a, b, c \`\`\` `, description: @@ -2902,30 +1882,28 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_distance', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.now', { - defaultMessage: 'ST_DISTANCE', + defaultMessage: 'NOW', } ), description: ( - ### ST_DISTANCE - Computes the distance between two points. - For cartesian geometries, this is the pythagorean distance in the same units as the original coordinates. - For geographic geometries, this is the circular distance along the great circle in meters. + ### NOW + Returns current date and time. \`\`\` - FROM airports - | WHERE abbrev == "CPH" - | EVAL distance = ST_DISTANCE(location, city_location) - | KEEP abbrev, name, location, city_location, distance + ROW current_date = NOW() \`\`\` `, description: @@ -2938,31 +1916,26 @@ export const functions = { }, // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { - label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_intersects', - { - defaultMessage: 'ST_INTERSECTS', - } - ), + label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pi', { + defaultMessage: 'PI', + }), description: ( - ### ST_INTERSECTS - Returns true if two geometries intersect. - They intersect if they have any point in common, including their interior points - (points along lines or within polygons). - This is the inverse of the \`ST_DISJOINT\` function. - In mathematical terms: ST_Intersects(A, B) ⇔ A ⋂ B ≠ ∅ + ### PI + Returns Pi, the ratio of a circle's circumference to its diameter. \`\`\` - FROM airports - | WHERE ST_INTERSECTS(location, TO_GEOSHAPE("POLYGON((42 14, 43 14, 43 15, 42 15, 42 14))")) + ROW PI() \`\`\` `, description: @@ -2976,29 +1949,31 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_within', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pow', { - defaultMessage: 'ST_WITHIN', + defaultMessage: 'POW', } ), description: ( - ### ST_WITHIN - Returns whether the first geometry is within the second geometry. - This is the inverse of the \`ST_CONTAINS\` function. + ### POW + Returns the value of \`base\` raised to the power of \`exponent\`. \`\`\` - FROM airport_city_boundaries - | WHERE ST_WITHIN(city_boundary, TO_GEOSHAPE("POLYGON((109.1 18.15, 109.6 18.15, 109.6 18.65, 109.1 18.65, 109.1 18.15))")) - | KEEP abbrev, airport, region, city, city_location + ROW base = 2.0, exponent = 2 + | EVAL result = POW(base, exponent) \`\`\` + Note: It is still possible to overflow a double result here; in that case, null will be returned. `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -3011,27 +1986,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_x', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.repeat', { - defaultMessage: 'ST_X', + defaultMessage: 'REPEAT', } ), description: ( - ### ST_X - Extracts the \`x\` coordinate from the supplied point. - If the points is of type \`geo_point\` this is equivalent to extracting the \`longitude\` value. + ### REPEAT + Returns a string constructed by concatenating \`string\` with itself the specified \`number\` of times. \`\`\` - ROW point = TO_GEOPOINT("POINT(42.97109629958868 14.7552534006536)") - | EVAL x = ST_X(point), y = ST_Y(point) + ROW a = "Hello!" + | EVAL triple_a = REPEAT(a, 3); \`\`\` `, description: @@ -3045,27 +2022,31 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_y', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.replace', { - defaultMessage: 'ST_Y', + defaultMessage: 'REPLACE', } ), description: ( - ### ST_Y - Extracts the \`y\` coordinate from the supplied point. - If the points is of type \`geo_point\` this is equivalent to extracting the \`latitude\` value. + ### REPLACE + The function substitutes in the string \`str\` any match of the regular expression \`regex\` + with the replacement string \`newStr\`. \`\`\` - ROW point = TO_GEOPOINT("POINT(42.97109629958868 14.7552534006536)") - | EVAL x = ST_X(point), y = ST_Y(point) + ROW str = "Hello World" + | EVAL str = REPLACE(str, "World", "Universe") + | KEEP str \`\`\` `, description: @@ -3079,27 +2060,32 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.starts_with', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.right', { - defaultMessage: 'STARTS_WITH', + defaultMessage: 'RIGHT', } ), description: ( - ### STARTS_WITH - Returns a boolean that indicates whether a keyword string starts with another string. + ### RIGHT + Return the substring that extracts 'length' chars from 'str' starting from the right. \`\`\` FROM employees | KEEP last_name - | EVAL ln_S = STARTS_WITH(last_name, "B") + | EVAL right = RIGHT(last_name, 3) + | SORT last_name ASC + | LIMIT 5 \`\`\` `, description: @@ -3113,27 +2099,33 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.substring', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.round', { - defaultMessage: 'SUBSTRING', + defaultMessage: 'ROUND', } ), description: ( - ### SUBSTRING - Returns a substring of a string, specified by a start position and an optional length. + ### ROUND + Rounds a number to the specified number of decimal places. + Defaults to 0, which returns the nearest integer. If the + precision is a negative number, rounds to the number of digits left + of the decimal point. \`\`\` FROM employees - | KEEP last_name - | EVAL ln_sub = SUBSTRING(last_name, 1, 3) + | KEEP first_name, last_name, height + | EVAL height_ft = ROUND(height * 3.281, 1) \`\`\` `, description: @@ -3147,26 +2139,32 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tan', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.rtrim', { - defaultMessage: 'TAN', + defaultMessage: 'RTRIM', } ), description: ( - ### TAN - Returns the Tangent trigonometric function of an angle. + ### RTRIM + Removes trailing whitespaces from a string. \`\`\` - ROW a=1.8 - | EVAL tan=TAN(a) + ROW message = " some text ", color = " red " + | EVAL message = RTRIM(message) + | EVAL color = RTRIM(color) + | EVAL message = CONCAT("'", message, "'") + | EVAL color = CONCAT("'", color, "'") \`\`\` `, description: @@ -3180,26 +2178,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tanh', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.signum', { - defaultMessage: 'TANH', + defaultMessage: 'SIGNUM', } ), description: ( - ### TANH - Returns the Tangent hyperbolic function of an angle. + ### SIGNUM + Returns the sign of the given number. + It returns \`-1\` for negative numbers, \`0\` for \`0\` and \`1\` for positive numbers. \`\`\` - ROW a=1.8 - | EVAL tanh=TANH(a) + ROW d = 100.0 + | EVAL s = SIGNUM(d) \`\`\` `, description: @@ -3213,25 +2215,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tau', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sin', { - defaultMessage: 'TAU', + defaultMessage: 'SIN', } ), description: ( - ### TAU - Returns the ratio of a circle's circumference to its radius. + ### SIN + Returns the sine of an angle. \`\`\` - ROW TAU() + ROW a=1.8 + | EVAL sin=SIN(a) \`\`\` `, description: @@ -3245,26 +2251,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_base64', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sinh', { - defaultMessage: 'TO_BASE64', + defaultMessage: 'SINH', } ), description: ( - ### TO_BASE64 - Encode a string to a base64 string. + ### SINH + Returns the hyperbolic sine of a number. \`\`\` - row a = "elastic" - | eval e = to_base64(a) + ROW a=1.8 + | EVAL sinh=SINH(a) \`\`\` `, description: @@ -3278,29 +2287,28 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_boolean', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.space', { - defaultMessage: 'TO_BOOLEAN', + defaultMessage: 'SPACE', } ), description: ( - ### TO_BOOLEAN - Converts an input value to a boolean value. - A string value of *true* will be case-insensitive converted to the Boolean *true*. - For anything else, including the empty string, the function will return *false*. - The numerical value of *0* will be converted to *false*, anything else will be converted to *true*. + ### SPACE + Returns a string made of \`number\` spaces. \`\`\` - ROW str = ["true", "TRuE", "false", "", "yes", "1"] - | EVAL bool = TO_BOOLEAN(str) + ROW message = CONCAT("Hello", SPACE(1), "World!"); \`\`\` `, description: @@ -3314,28 +2322,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_cartesianpoint', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.split', { - defaultMessage: 'TO_CARTESIANPOINT', + defaultMessage: 'SPLIT', } ), description: ( - ### TO_CARTESIANPOINT - Converts an input value to a \`cartesian_point\` value. - A string will only be successfully converted if it respects WKT Point format. + ### SPLIT + Split a single valued string into multiple strings. \`\`\` - ROW wkt = ["POINT(4297.11 -1475.53)", "POINT(7580.93 2272.77)"] - | MV_EXPAND wkt - | EVAL pt = TO_CARTESIANPOINT(wkt) + ROW words="foo;bar;baz;qux;quux;corge" + | EVAL word = SPLIT(words, ";") \`\`\` `, description: @@ -3349,28 +2358,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_cartesianshape', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sqrt', { - defaultMessage: 'TO_CARTESIANSHAPE', + defaultMessage: 'SQRT', } ), description: ( - ### TO_CARTESIANSHAPE - Converts an input value to a \`cartesian_shape\` value. - A string will only be successfully converted if it respects WKT format. + ### SQRT + Returns the square root of a number. The input can be any numeric value, the return value is always a double. + Square roots of negative numbers and infinities are null. \`\`\` - ROW wkt = ["POINT(4297.11 -1475.53)", "POLYGON ((3339584.72 1118889.97, 4452779.63 4865942.27, 2226389.81 4865942.27, 1113194.90 2273030.92, 3339584.72 1118889.97))"] - | MV_EXPAND wkt - | EVAL geom = TO_CARTESIANSHAPE(wkt) + ROW d = 100.0 + | EVAL s = SQRT(d) \`\`\` `, description: @@ -3384,30 +2395,32 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_datetime', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_contains', { - defaultMessage: 'TO_DATETIME', + defaultMessage: 'ST_CONTAINS', } ), description: ( - ### TO_DATETIME - Converts an input value to a date value. - A string will only be successfully converted if it's respecting the format \`yyyy-MM-dd'T'HH:mm:ss.SSS'Z'\`. - To convert dates in other formats, use \`DATE_PARSE\`. + ### ST_CONTAINS + Returns whether the first geometry contains the second geometry. + This is the inverse of the \`ST_WITHIN\` function. \`\`\` - ROW string = ["1953-09-02T00:00:00.000Z", "1964-06-02T00:00:00.000Z", "1964-06-02 00:00:00"] - | EVAL datetime = TO_DATETIME(string) + FROM airport_city_boundaries + | WHERE ST_CONTAINS(city_boundary, TO_GEOSHAPE("POLYGON((109.35 18.3, 109.45 18.3, 109.45 18.4, 109.35 18.4, 109.35 18.3))")) + | KEEP abbrev, airport, region, city, city_location \`\`\` - Note: Note that when converting from nanosecond resolution to millisecond resolution with this function, the nanosecond date is truncated, not rounded. `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', @@ -3420,26 +2433,32 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_degrees', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_disjoint', { - defaultMessage: 'TO_DEGREES', + defaultMessage: 'ST_DISJOINT', } ), description: ( - ### TO_DEGREES - Converts a number in radians to degrees. + ### ST_DISJOINT + Returns whether the two geometries or geometry columns are disjoint. + This is the inverse of the \`ST_INTERSECTS\` function. + In mathematical terms: ST_Disjoint(A, B) ⇔ A ⋂ B = ∅ \`\`\` - ROW rad = [1.57, 3.14, 4.71] - | EVAL deg = TO_DEGREES(rad) + FROM airport_city_boundaries + | WHERE ST_DISJOINT(city_boundary, TO_GEOSHAPE("POLYGON((-10 -60, 120 -60, 120 60, -10 60, -10 -60))")) + | KEEP abbrev, airport, region, city, city_location \`\`\` `, description: @@ -3453,28 +2472,33 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_double', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_distance', { - defaultMessage: 'TO_DOUBLE', + defaultMessage: 'ST_DISTANCE', } ), description: ( - ### TO_DOUBLE - Converts an input value to a double value. If the input parameter is of a date type, - its value will be interpreted as milliseconds since the Unix epoch, - converted to double. Boolean *true* will be converted to double *1.0*, *false* to *0.0*. + ### ST_DISTANCE + Computes the distance between two points. + For cartesian geometries, this is the pythagorean distance in the same units as the original coordinates. + For geographic geometries, this is the circular distance along the great circle in meters. \`\`\` - ROW str1 = "5.20128E11", str2 = "foo" - | EVAL dbl = TO_DOUBLE("520128000000"), dbl1 = TO_DOUBLE(str1), dbl2 = TO_DOUBLE(str2) + FROM airports + | WHERE abbrev == "CPH" + | EVAL distance = ST_DISTANCE(location, city_location) + | KEEP abbrev, name, location, city_location, distance \`\`\` `, description: @@ -3488,27 +2512,33 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_geopoint', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_intersects', { - defaultMessage: 'TO_GEOPOINT', + defaultMessage: 'ST_INTERSECTS', } ), description: ( - ### TO_GEOPOINT - Converts an input value to a \`geo_point\` value. - A string will only be successfully converted if it respects WKT Point format. + ### ST_INTERSECTS + Returns true if two geometries intersect. + They intersect if they have any point in common, including their interior points + (points along lines or within polygons). + This is the inverse of the \`ST_DISJOINT\` function. + In mathematical terms: ST_Intersects(A, B) ⇔ A ⋂ B ≠ ∅ \`\`\` - ROW wkt = "POINT(42.97109630194 14.7552534413725)" - | EVAL pt = TO_GEOPOINT(wkt) + FROM airports + | WHERE ST_INTERSECTS(location, TO_GEOSHAPE("POLYGON((42 14, 43 14, 43 15, 42 15, 42 14))")) \`\`\` `, description: @@ -3522,27 +2552,31 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_geoshape', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_within', { - defaultMessage: 'TO_GEOSHAPE', + defaultMessage: 'ST_WITHIN', } ), description: ( - ### TO_GEOSHAPE - Converts an input value to a \`geo_shape\` value. - A string will only be successfully converted if it respects WKT format. + ### ST_WITHIN + Returns whether the first geometry is within the second geometry. + This is the inverse of the \`ST_CONTAINS\` function. \`\`\` - ROW wkt = "POLYGON ((30 10, 40 40, 20 40, 10 20, 30 10))" - | EVAL geom = TO_GEOSHAPE(wkt) + FROM airport_city_boundaries + | WHERE ST_WITHIN(city_boundary, TO_GEOSHAPE("POLYGON((109.1 18.15, 109.6 18.15, 109.6 18.65, 109.1 18.65, 109.1 18.15))")) + | KEEP abbrev, airport, region, city, city_location \`\`\` `, description: @@ -3556,29 +2590,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_integer', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_x', { - defaultMessage: 'TO_INTEGER', + defaultMessage: 'ST_X', } ), description: ( - - ### TO_INTEGER - Converts an input value to an integer value. - If the input parameter is of a date type, its value will be interpreted as milliseconds - since the Unix epoch, converted to integer. - Boolean *true* will be converted to integer *1*, *false* to *0*. + --> + + ### ST_X + Extracts the \`x\` coordinate from the supplied point. + If the points is of type \`geo_point\` this is equivalent to extracting the \`longitude\` value. \`\`\` - ROW long = [5013792, 2147483647, 501379200000] - | EVAL int = TO_INTEGER(long) + ROW point = TO_GEOPOINT("POINT(42.97109629958868 14.7552534006536)") + | EVAL x = ST_X(point), y = ST_Y(point) \`\`\` `, description: @@ -3592,27 +2627,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_ip', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.st_y', { - defaultMessage: 'TO_IP', + defaultMessage: 'ST_Y', } ), description: ( - ### TO_IP - Converts an input string to an IP value. + ### ST_Y + Extracts the \`y\` coordinate from the supplied point. + If the points is of type \`geo_point\` this is equivalent to extracting the \`latitude\` value. \`\`\` - ROW str1 = "1.1.1.1", str2 = "foo" - | EVAL ip1 = TO_IP(str1), ip2 = TO_IP(str2) - | WHERE CIDR_MATCH(ip1, "1.0.0.0/8") + ROW point = TO_GEOPOINT("POINT(42.97109629958868 14.7552534006536)") + | EVAL x = ST_X(point), y = ST_Y(point) \`\`\` `, description: @@ -3626,28 +2664,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_long', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.starts_with', { - defaultMessage: 'TO_LONG', + defaultMessage: 'STARTS_WITH', } ), description: ( - ### TO_LONG - Converts an input value to a long value. If the input parameter is of a date type, - its value will be interpreted as milliseconds since the Unix epoch, converted to long. - Boolean *true* will be converted to long *1*, *false* to *0*. + ### STARTS_WITH + Returns a boolean that indicates whether a keyword string starts with another string. \`\`\` - ROW str1 = "2147483648", str2 = "2147483648.2", str3 = "foo" - | EVAL long1 = TO_LONG(str1), long2 = TO_LONG(str2), long3 = TO_LONG(str3) + FROM employees + | KEEP last_name + | EVAL ln_S = STARTS_WITH(last_name, "B") \`\`\` `, description: @@ -3661,26 +2701,30 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_lower', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.substring', { - defaultMessage: 'TO_LOWER', + defaultMessage: 'SUBSTRING', } ), description: ( - ### TO_LOWER - Returns a new string representing the input string converted to lower case. + ### SUBSTRING + Returns a substring of a string, specified by a start position and an optional length. \`\`\` - ROW message = "Some Text" - | EVAL message_lower = TO_LOWER(message) + FROM employees + | KEEP last_name + | EVAL ln_sub = SUBSTRING(last_name, 1, 3) \`\`\` `, description: @@ -3694,26 +2738,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_radians', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tan', { - defaultMessage: 'TO_RADIANS', + defaultMessage: 'TAN', } ), description: ( - ### TO_RADIANS - Converts a number in degrees to radians. + ### TAN + Returns the tangent of an angle. \`\`\` - ROW deg = [90.0, 180.0, 270.0] - | EVAL rad = TO_RADIANS(deg) + ROW a=1.8 + | EVAL tan=TAN(a) \`\`\` `, description: @@ -3727,26 +2774,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_string', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tanh', { - defaultMessage: 'TO_STRING', + defaultMessage: 'TANH', } ), description: ( - ### TO_STRING - Converts an input value into a string. + ### TANH + Returns the hyperbolic tangent of a number. \`\`\` - ROW a=10 - | EVAL j = TO_STRING(a) + ROW a=1.8 + | EVAL tanh=TANH(a) \`\`\` `, description: @@ -3760,28 +2810,28 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_unsigned_long', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tau', { - defaultMessage: 'TO_UNSIGNED_LONG', + defaultMessage: 'TAU', } ), description: ( - ### TO_UNSIGNED_LONG - Converts an input value to an unsigned long value. If the input parameter is of a date type, - its value will be interpreted as milliseconds since the Unix epoch, converted to unsigned long. - Boolean *true* will be converted to unsigned long *1*, *false* to *0*. + ### TAU + Returns the ratio of a circle's circumference to its radius. \`\`\` - ROW str1 = "2147483648", str2 = "2147483648.2", str3 = "foo" - | EVAL long1 = TO_UNSIGNED_LONG(str1), long2 = TO_ULONG(str2), long3 = TO_UL(str3) + ROW TAU() \`\`\` `, description: @@ -3795,26 +2845,29 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_upper', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_base64', { - defaultMessage: 'TO_UPPER', + defaultMessage: 'TO_BASE64', } ), description: ( - ### TO_UPPER - Returns a new string representing the input string converted to upper case. + ### TO_BASE64 + Encode a string to a base64 string. \`\`\` - ROW message = "Some Text" - | EVAL message_upper = TO_UPPER(message) + row a = "elastic" + | eval e = to_base64(a) \`\`\` `, description: @@ -3828,25 +2881,32 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_version', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_boolean', { - defaultMessage: 'TO_VERSION', + defaultMessage: 'TO_BOOLEAN', } ), description: ( - ### TO_VERSION - Converts an input string to a version value. + ### TO_BOOLEAN + Converts an input value to a boolean value. + A string value of *true* will be case-insensitive converted to the Boolean *true*. + For anything else, including the empty string, the function will return *false*. + The numerical value of *0* will be converted to *false*, anything else will be converted to *true*. \`\`\` - ROW v = TO_VERSION("1.2.3") + ROW str = ["true", "TRuE", "false", "", "yes", "1"] + | EVAL bool = TO_BOOLEAN(str) \`\`\` `, description: @@ -3860,27 +2920,31 @@ export const functions = { // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.trim', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_cartesianpoint', { - defaultMessage: 'TRIM', + defaultMessage: 'TO_CARTESIANPOINT', } ), description: ( - ### TRIM - Removes leading and trailing whitespaces from a string. + ### TO_CARTESIANPOINT + Converts an input value to a \`cartesian_point\` value. + A string will only be successfully converted if it respects WKT Point format. \`\`\` - ROW message = " some text ", color = " red " - | EVAL message = TRIM(message) - | EVAL color = TRIM(color) + ROW wkt = ["POINT(4297.11 -1475.53)", "POINT(7580.93 2272.77)"] + | MV_EXPAND wkt + | EVAL pt = TO_CARTESIANPOINT(wkt) \`\`\` `, description: @@ -3891,663 +2955,553 @@ export const functions = { /> ), }, - ], -}; - -export const aggregationFunctions = { - label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.aggregationFunctions', { - defaultMessage: 'Aggregation functions', - }), - description: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.aggregationFunctionsDocumentationESQLDescription', - { - defaultMessage: `These functions can by used with STATS...BY:`, - } - ), - items: [ + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.avgFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_cartesianshape', { - defaultMessage: 'AVG', + defaultMessage: 'TO_CARTESIANSHAPE', } ), description: ( -The expression can use inline functions. For example, to calculate the average over a multivalued column, first use \`MV_AVG\` to average the multiple values per row, and use the result with the \`AVG\` function: + ### TO_CARTESIANSHAPE + Converts an input value to a \`cartesian_shape\` value. + A string will only be successfully converted if it respects WKT format. -\`\`\` -FROM employees -| STATS avg_salary_change = AVG(MV_AVG(salary_change)) -\`\`\` - `, + \`\`\` + ROW wkt = ["POINT(4297.11 -1475.53)", "POLYGON ((3339584.72 1118889.97, 4452779.63 4865942.27, 2226389.81 4865942.27, 1113194.90 2273030.92, 3339584.72 1118889.97))"] + | MV_EXPAND wkt + | EVAL geom = TO_CARTESIANSHAPE(wkt) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_dateperiod', { - defaultMessage: 'COUNT', + defaultMessage: 'TO_DATEPERIOD', } ), description: ( -The expression can use inline functions. This example splits a string into multiple values using the \`SPLIT\` function and counts the values: + ### TO_DATEPERIOD + Converts an input value into a \`date_period\` value. -\`\`\` -ROW words="foo;bar;baz;qux;quux;foo" -| STATS word_count = COUNT(SPLIT(words, ";")) -\`\`\` - `, + \`\`\` + row x = "2024-01-01"::datetime | eval y = x + "3 DAYS"::date_period, z = x - to_dateperiod("3 days"); + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countDistinctFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_datetime', { - defaultMessage: 'COUNT_DISTINCT', + defaultMessage: 'TO_DATETIME', } ), description: ( -The expression can use inline functions. This example splits a string into multiple values using the \`SPLIT\` function and counts the unique values: + ### TO_DATETIME + Converts an input value to a date value. + A string will only be successfully converted if it's respecting the format \`yyyy-MM-dd'T'HH:mm:ss.SSS'Z'\`. + To convert dates in other formats, use \`DATE_PARSE\`. -\`\`\` -ROW words="foo;bar;baz;qux;quux;foo" -| STATS distinct_word_count = COUNT_DISTINCT(SPLIT(words, ";")) -\`\`\` - `, + \`\`\` + ROW string = ["1953-09-02T00:00:00.000Z", "1964-06-02T00:00:00.000Z", "1964-06-02 00:00:00"] + | EVAL datetime = TO_DATETIME(string) + \`\`\` + Note: Note that when converting from nanosecond resolution to millisecond resolution with this function, the nanosecond date is truncated, not rounded. + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.maxFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_degrees', { - defaultMessage: 'MAX', + defaultMessage: 'TO_DEGREES', } ), description: ( -The expression can use inline functions. For example, to calculate the maximum over an average of a multivalued column, use \`MV_AVG\` to first average the multiple values per row, and use the result with the \`MAX\` function: + ### TO_DEGREES + Converts a number in radians to degrees. -\`\`\` -FROM employees -| STATS max_avg_salary_change = MAX(MV_AVG(salary_change)) -\`\`\` - `, + \`\`\` + ROW rad = [1.57, 3.14, 4.71] + | EVAL deg = TO_DEGREES(rad) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_double', { - defaultMessage: 'MEDIAN', + defaultMessage: 'TO_DOUBLE', } ), description: ( -The expression can use inline functions. For example, to calculate the median of the maximum values of a multivalued column, first use \`MV_MAX\` to get the maximum value per row, and use the result with the \`MEDIAN\` function: + ### TO_DOUBLE + Converts an input value to a double value. If the input parameter is of a date type, + its value will be interpreted as milliseconds since the Unix epoch, + converted to double. Boolean *true* will be converted to double *1.0*, *false* to *0.0*. -\`\`\` -FROM employees -| STATS median_max_salary_change = MEDIAN(MV_MAX(salary_change)) -\`\`\` - `, + \`\`\` + ROW str1 = "5.20128E11", str2 = "foo" + | EVAL dbl = TO_DOUBLE("520128000000"), dbl1 = TO_DOUBLE(str1), dbl2 = TO_DOUBLE(str2) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianAbsoluteDeviationFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_geopoint', { - defaultMessage: 'MEDIAN_ABSOLUTE_DEVIATION', + defaultMessage: 'TO_GEOPOINT', } ), description: ( -\`\`\` -FROM employees -| STATS m_a_d_max_salary_change = MEDIAN_ABSOLUTE_DEVIATION(MV_MAX(salary_change)) -\`\`\` + ### TO_GEOPOINT + Converts an input value to a \`geo_point\` value. + A string will only be successfully converted if it respects WKT Point format. -`, + \`\`\` + ROW wkt = "POINT(42.97109630194 14.7552534413725)" + | EVAL pt = TO_GEOPOINT(wkt) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.minFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_geoshape', { - defaultMessage: 'MIN', + defaultMessage: 'TO_GEOSHAPE', } ), description: ( -The expression can use inline functions. For example, to calculate the minimum over an average of a multivalued column, use \`MV_AVG\` to first average the multiple values per row, and use the result with the \`MIN\` function: + ### TO_GEOSHAPE + Converts an input value to a \`geo_shape\` value. + A string will only be successfully converted if it respects WKT format. -\`\`\` -FROM employees -| STATS min_avg_salary_change = MIN(MV_AVG(salary_change)) -\`\`\` - `, + \`\`\` + ROW wkt = "POLYGON ((30 10, 40 40, 20 40, 10 20, 30 10))" + | EVAL geom = TO_GEOSHAPE(wkt) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.percentileFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_integer', { - defaultMessage: 'PERCENTILE', + defaultMessage: 'TO_INTEGER', } ), description: ( -The expression can use inline functions. For example, to calculate a percentile of the maximum values of a multivalued column, first use \`MV_MAX\` to get the maximum value per row, and use the result with the \`PERCENTILE\` function: + ### TO_INTEGER + Converts an input value to an integer value. + If the input parameter is of a date type, its value will be interpreted as milliseconds + since the Unix epoch, converted to integer. + Boolean *true* will be converted to integer *1*, *false* to *0*. -\`\`\` -FROM employees -| STATS p80_max_salary_change = PERCENTILE(MV_MAX(salary_change), 80) -\`\`\` - `, + \`\`\` + ROW long = [5013792, 2147483647, 501379200000] + | EVAL int = TO_INTEGER(long) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stCentroidFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_ip', { - defaultMessage: 'ST_CENTROID_AGG', + defaultMessage: 'TO_IP', } ), description: ( -Calculates the spatial centroid over a field with spatial point geometry type. + ### TO_IP + Converts an input string to an IP value. -\`\`\` -FROM airports -| STATS centroid=ST_CENTROID_AGG(location) -\`\`\` - `, + \`\`\` + ROW str1 = "1.1.1.1", str2 = "foo" + | EVAL ip1 = TO_IP(str1), ip2 = TO_IP(str2) + | WHERE CIDR_MATCH(ip1, "1.0.0.0/8") + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sumFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_long', { - defaultMessage: 'SUM', + defaultMessage: 'TO_LONG', } ), description: ( -The expression can use inline functions. For example, to calculate the sum of each employee’s maximum salary changes, apply the \`MV_MAX\` function to each row and then \`SUM\` the results: + ### TO_LONG + Converts an input value to a long value. If the input parameter is of a date type, + its value will be interpreted as milliseconds since the Unix epoch, converted to long. + Boolean *true* will be converted to long *1*, *false* to *0*. -\`\`\` -FROM employees -| STATS total_salary_changes = SUM(MV_MAX(salary_change)) -\`\`\` - `, + \`\`\` + ROW str1 = "2147483648", str2 = "2147483648.2", str3 = "foo" + | EVAL long1 = TO_LONG(str1), long2 = TO_LONG(str2), long3 = TO_LONG(str3) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.valuesFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_lower', { - defaultMessage: 'VALUES', + defaultMessage: 'TO_LOWER', } ), description: ( -> _**WARNING:** This can use a significant amount of memory and ES|QL doesn’t yet grow aggregations beyond memory. So this aggregation will work until it is used to collect more values than can fit into memory. Once it collects too many values it will fail the query with a [Circuit Breaker Error](https://www.elastic.co/guide/en/elasticsearch/reference/current/circuit-breaker-errors.html)._ + ### TO_LOWER + Returns a new string representing the input string converted to lower case. - `, + \`\`\` + ROW message = "Some Text" + | EVAL message_lower = TO_LOWER(message) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, - ], -}; - -export const groupingFunctions = { - label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.groupingFunctions', { - defaultMessage: 'Grouping functions', - }), - description: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.groupingFunctionsDocumentationESQLDescription', - { - defaultMessage: `These grouping functions can be used with \`STATS...BY\`:`, - } - ), - items: [ + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.autoBucketFunction', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_radians', { - defaultMessage: 'BUCKET', + defaultMessage: 'TO_RADIANS', } ), description: ( = "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" -| STATS hire_date = MV_SORT(VALUES(hire_date)) BY month = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z") -| SORT hire_date -\`\`\` - -**NOTE**: The goal isn’t to provide the exact target number of buckets, it’s to pick a range that provides _at most_ the target number of buckets. - -You can combine \`BUCKET\` with an aggregation to create a histogram: - -\`\`\` -FROM employees -| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" -| STATS hires_per_month = COUNT(*) BY month = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z") -| SORT month -\`\`\` - -**NOTE**: \`BUCKET\` does not create buckets that match zero documents. That’s why the previous example is missing \`1985-03-01\` and other dates. - -Asking for more buckets can result in a smaller range. For example, requesting at most 100 buckets in a year results in weekly buckets: - -\`\`\` -FROM employees -| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" -| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 100, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z") -| SORT week -\`\`\` - -**NOTE**: \`BUCKET\` does not filter any rows. It only uses the provided range to pick a good bucket size. For rows with a value outside of the range, it returns a bucket value that corresponds to a bucket outside the range. Combine \`BUCKET\` with \`WHERE\` to filter rows. - -If the desired bucket size is known in advance, simply provide it as the second argument, leaving the range out: - -\`\`\` -FROM employees -| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" -| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 1 week) -| SORT week -\`\`\` - -**NOTE**: When providing the bucket size as the second parameter, it must be a time duration or date period. - -\`BUCKET\` can also operate on numeric fields. For example, to create a salary histogram: - -\`\`\` -FROM employees -| STATS COUNT(*) by bs = BUCKET(salary, 20, 25324, 74999) -| SORT bs -\`\`\` - -Unlike the earlier example that intentionally filters on a date range, you rarely want to filter on a numeric range. You have to find the min and max separately. ES|QL doesn’t yet have an easy way to do that automatically. - -The range can be omitted if the desired bucket size is known in advance. Simply provide it as the second argument: - -\`\`\` -FROM employees -| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" -| STATS c = COUNT(1) BY b = BUCKET(salary, 5000.) -| SORT b -\`\`\` - -**NOTE**: When providing the bucket size as the second parameter, it must be of a **floating point type**. - -Here's an example to create hourly buckets for the last 24 hours, and calculate the number of events per hour: - -\`\`\` -FROM sample_data -| WHERE @timestamp >= NOW() - 1 day and @timestamp < NOW() -| STATS COUNT(*) BY bucket = BUCKET(@timestamp, 25, NOW() - 1 day, NOW()) -\`\`\` - -Here's an example to create monthly buckets for the year 1985, and calculate the average salary by hiring month: - -\`\`\` -FROM employees -| WHERE hire_date >= "1985-01-01T00:00:00Z" AND hire_date < "1986-01-01T00:00:00Z" -| STATS AVG(salary) BY bucket = BUCKET(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z") -| SORT bucket -\`\`\` - -\`BUCKET\` may be used in both the aggregating and grouping part of the \`STATS …​ BY …\`​ command, provided that in the aggregating part the function is **referenced by an alias defined in the grouping part**, or that it is invoked with the exact same expression. + defaultMessage: ` -For example: + ### TO_RADIANS + Converts a number in degrees to radians. -\`\`\` -FROM employees -| STATS s1 = b1 + 1, s2 = BUCKET(salary / 1000 + 999, 50.) + 2 BY b1 = BUCKET(salary / 100 + 99, 50.), b2 = BUCKET(salary / 1000 + 999, 50.) -| SORT b1, b2 -| KEEP s1, b1, s2, b2 -\`\`\` - `, + \`\`\` + ROW deg = [90.0, 180.0, 270.0] + | EVAL rad = TO_RADIANS(deg) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, - ], -}; - -export const operators = { - label: i18n.translate('textBasedEditor.query.textBasedLanguagesEditor.operators', { - defaultMessage: 'Operators', - }), - description: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.operatorsDocumentationESQLDescription', - { - defaultMessage: `ES|QL supports the following operators:`, - } - ), - items: [ + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.binaryOperators', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_string', { - defaultMessage: 'Binary operators', + defaultMessage: 'TO_STRING', } ), description: ( \` -* greater than or equal: \`>=\` -* add: \`+\` -* subtract: \`-\` -* multiply: \`*\` -* divide: \`/\` -* modulus: \`%\` - `, + defaultMessage: ` + + ### TO_STRING + Converts an input value into a string. + + \`\`\` + ROW a=10 + | EVAL j = TO_STRING(a) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.booleanOperators', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_timeduration', { - defaultMessage: 'Boolean operators', + defaultMessage: 'TO_TIMEDURATION', } ), description: ( + + ### TO_TIMEDURATION + Converts an input value into a \`time_duration\` value. -* \`AND\` -* \`OR\` -* \`NOT\` - `, + \`\`\` + row x = "2024-01-01"::datetime | eval y = x + "3 hours"::time_duration, z = x - to_timeduration("3 hours"); + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.castOperator', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_unsigned_long', { - defaultMessage: 'Cast (::)', + defaultMessage: 'TO_UNSIGNED_LONG', } ), description: ( \` type conversion functions. - -Example: -\`\`\` -ROW ver = CONCAT(("0"::INT + 1)::STRING, ".2.3")::VERSION -\`\`\` - `, + defaultMessage: ` + + ### TO_UNSIGNED_LONG + Converts an input value to an unsigned long value. If the input parameter is of a date type, + its value will be interpreted as milliseconds since the Unix epoch, converted to unsigned long. + Boolean *true* will be converted to unsigned long *1*, *false* to *0*. + + \`\`\` + ROW str1 = "2147483648", str2 = "2147483648.2", str3 = "foo" + | EVAL long1 = TO_UNSIGNED_LONG(str1), long2 = TO_ULONG(str2), long3 = TO_UL(str3) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', ignoreTag: true, @@ -4556,105 +3510,109 @@ ROW ver = CONCAT(("0"::INT + 1)::STRING, ".2.3")::VERSION /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.inOperator', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_upper', { - defaultMessage: 'IN', + defaultMessage: 'TO_UPPER', } ), description: ( + + ### TO_UPPER + Returns a new string representing the input string converted to upper case. + + \`\`\` + ROW message = "Some Text" + | EVAL message_upper = TO_UPPER(message) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stringOperators', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_version', { - defaultMessage: 'LIKE and RLIKE', + defaultMessage: 'TO_VERSION', } ), description: ( -Use \`RLIKE\` to match strings using regular expressions: + ### TO_VERSION + Converts an input string to a version value. -\`\`\` -FROM employees -| WHERE first_name RLIKE ".leja.*" -| KEEP first_name, last_name -\`\`\` - `, + \`\`\` + ROW v = TO_VERSION("1.2.3") + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> ), }, + // Do not edit manually... automatically generated by scripts/generate_esql_docs.ts { label: i18n.translate( - 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.predicates', + 'textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.trim', { - defaultMessage: 'NULL values', + defaultMessage: 'TRIM', } ), description: ( + + ### TRIM + Removes leading and trailing whitespaces from a string. + + \`\`\` + ROW message = " some text ", color = " red " + | EVAL message = TRIM(message) + | EVAL color = TRIM(color) + \`\`\` + `, description: 'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)', + ignoreTag: true, } )} /> diff --git a/src/plugins/console/server/lib/spec_definitions/json/overrides/esql.query.json b/src/plugins/console/server/lib/spec_definitions/json/overrides/esql.query.json index 4aa91f099c077..2dd1f9b50ee3b 100644 --- a/src/plugins/console/server/lib/spec_definitions/json/overrides/esql.query.json +++ b/src/plugins/console/server/lib/spec_definitions/json/overrides/esql.query.json @@ -12,7 +12,7 @@ "csv", "json", "smile", - "text", + "txt", "tsv", "yaml" ], diff --git a/x-pack/plugins/observability_solution/synthetics/e2e/synthetics/journeys/global_parameters.journey.ts b/x-pack/plugins/observability_solution/synthetics/e2e/synthetics/journeys/global_parameters.journey.ts index 587806e136937..831f8d107f36a 100644 --- a/x-pack/plugins/observability_solution/synthetics/e2e/synthetics/journeys/global_parameters.journey.ts +++ b/x-pack/plugins/observability_solution/synthetics/e2e/synthetics/journeys/global_parameters.journey.ts @@ -10,12 +10,7 @@ import { byTestId } from '../../helpers/utils'; import { cleanTestParams } from './services/add_monitor'; import { syntheticsAppPageProvider } from '../page_objects/synthetics_app'; -const journeySkip = - (...params: Parameters) => - () => - journey(...params); -// See details: https://github.com/elastic/kibana/issues/191961 -journeySkip(`GlobalParameters`, async ({ page, params }) => { +journey(`GlobalParameters`, async ({ page, params }) => { const syntheticsApp = syntheticsAppPageProvider({ page, kibanaUrl: params.kibanaUrl, params }); before(async () => { @@ -64,7 +59,7 @@ journeySkip(`GlobalParameters`, async ({ page, params }) => { await page.click('[placeholder="Search..."]'); await page.fill('[placeholder="Search..."]', 'username'); await page.click('text=username'); - await page.click('[aria-label="Clear input"]'); + await page.click('[aria-label="Clear search input"]'); await page.click('[placeholder="Search..."]'); await page.fill('[placeholder="Search..."]', 'website'); await page.click('text=website username'); @@ -74,7 +69,7 @@ journeySkip(`GlobalParameters`, async ({ page, params }) => { await page.fill('[placeholder="Search..."]', 'extra'); await page.keyboard.press('Enter'); await page.click('text=No items found'); - await page.click('[aria-label="Clear input"]'); + await page.click('[aria-label="Clear search input"]'); }); step('Click text=Delete ParameterEdit Parameter >> :nth-match(button, 2)', async () => { @@ -91,7 +86,7 @@ journeySkip(`GlobalParameters`, async ({ page, params }) => { await page.click('text=staging'); await page.click('button:has-text("Tags")'); await page.click('[aria-label="Tags"] >> text=staging'); - await page.click('[aria-label="Clear input"]'); + await page.click('[aria-label="Clear search input"]'); }); step('Click text=Delete ParameterEdit Parameter >> button', async () => { await page.click('text=Delete ParameterEdit Parameter >> button'); diff --git a/x-pack/plugins/security_solution/public/detections/index.ts b/x-pack/plugins/security_solution/public/detections/index.ts index b93481c0c253b..77d131377f9f5 100644 --- a/x-pack/plugins/security_solution/public/detections/index.ts +++ b/x-pack/plugins/security_solution/public/detections/index.ts @@ -11,6 +11,7 @@ import type { TableIdLiteral } from '@kbn/securitysolution-data-table'; import { getDataTablesInStorageByIds } from '../timelines/containers/local_storage'; import { routes } from './routes'; import type { SecuritySubPlugin } from '../app/types'; +import { runDetectionMigrations } from './migrations'; export const DETECTIONS_TABLE_IDS: TableIdLiteral[] = [ TableId.alertsOnRuleDetailsPage, @@ -21,6 +22,8 @@ export class Detections { public setup() {} public start(storage: Storage): SecuritySubPlugin { + runDetectionMigrations(); + return { storageDataTables: { tableById: getDataTablesInStorageByIds(storage, DETECTIONS_TABLE_IDS), diff --git a/x-pack/plugins/security_solution/public/detections/migrations.ts b/x-pack/plugins/security_solution/public/detections/migrations.ts new file mode 100644 index 0000000000000..81009f63747a6 --- /dev/null +++ b/x-pack/plugins/security_solution/public/detections/migrations.ts @@ -0,0 +1,20 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { Storage } from '@kbn/kibana-utils-plugin/public'; +import { migrateAlertPageControlsTo816 } from '../timelines/containers/local_storage/migrate_alert_page_controls'; + +type LocalStorageMigrator = (storage: Storage) => void; + +const runLocalStorageMigration = (fn: LocalStorageMigrator) => { + const storage = new Storage(localStorage); + fn(storage); +}; + +export const runDetectionMigrations = () => { + runLocalStorageMigration(migrateAlertPageControlsTo816); +}; diff --git a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/migrate_alert_page_contorls.test.ts b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/migrate_alert_page_contorls.test.ts new file mode 100644 index 0000000000000..575d5bcd6dab3 --- /dev/null +++ b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/migrate_alert_page_contorls.test.ts @@ -0,0 +1,255 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { Storage } from '@kbn/kibana-utils-plugin/public'; +import { + PAGE_FILTER_STORAGE_KEY, + migrateAlertPageControlsTo816, +} from './migrate_alert_page_controls'; + +const OLD_FORMAT = { + viewMode: 'view', + id: '5bc0ef0f-c6a9-4eaf-9fc5-9703fcb85482', + panels: { + '0': { + type: 'optionsListControl', + order: 0, + grow: true, + width: 'small', + explicitInput: { + id: '0', + dataViewId: 'security_solution_alerts_dv', + fieldName: 'kibana.alert.workflow_status', + title: 'Status', + hideExclude: true, + hideSort: true, + hidePanelTitles: true, + placeholder: '', + ignoreParentSettings: { + ignoreValidations: true, + }, + selectedOptions: ['open'], + hideActionBar: true, + persist: true, + hideExists: true, + existsSelected: false, + exclude: false, + }, + }, + '1': { + type: 'optionsListControl', + order: 1, + grow: true, + width: 'small', + explicitInput: { + id: '1', + dataViewId: 'security_solution_alerts_dv', + fieldName: 'kibana.alert.severity', + title: 'Severity', + hideExclude: true, + hideSort: true, + hidePanelTitles: true, + placeholder: '', + ignoreParentSettings: { + ignoreValidations: true, + }, + selectedOptions: [], + hideActionBar: true, + hideExists: true, + existsSelected: false, + exclude: false, + }, + }, + '2': { + type: 'optionsListControl', + order: 2, + grow: true, + width: 'small', + explicitInput: { + id: '2', + dataViewId: 'security_solution_alerts_dv', + fieldName: 'user.name', + title: 'User', + hideExclude: true, + hideSort: true, + hidePanelTitles: true, + placeholder: '', + ignoreParentSettings: { + ignoreValidations: true, + }, + selectedOptions: [], + existsSelected: false, + exclude: false, + }, + }, + '3': { + type: 'optionsListControl', + order: 3, + grow: true, + width: 'small', + explicitInput: { + id: '3', + dataViewId: 'security_solution_alerts_dv', + fieldName: 'host.name', + title: 'Host', + hideExclude: true, + hideSort: true, + hidePanelTitles: true, + placeholder: '', + ignoreParentSettings: { + ignoreValidations: true, + }, + selectedOptions: [], + existsSelected: false, + exclude: false, + }, + }, + }, + defaultControlWidth: 'small', + defaultControlGrow: true, + controlStyle: 'oneLine', + chainingSystem: 'HIERARCHICAL', + showApplySelections: false, + ignoreParentSettings: { + ignoreFilters: false, + ignoreQuery: false, + ignoreTimerange: false, + ignoreValidations: false, + }, + timeRange: { + from: '2024-09-10T22:00:00.000Z', + to: '2024-09-11T21:59:59.999Z', + mode: 'absolute', + }, + filters: [ + { + meta: { + alias: null, + negate: true, + disabled: false, + type: 'exists', + key: 'kibana.alert.building_block_type', + index: 'security-solution-default', + }, + query: { + exists: { + field: 'kibana.alert.building_block_type', + }, + }, + }, + ], + query: { + query: '', + language: 'kuery', + }, +}; + +const NEW_FORMAT = { + initialChildControlState: { + '0': { + type: 'optionsListControl', + order: 0, + hideExclude: true, + hideSort: true, + placeholder: '', + width: 'small', + dataViewId: 'security_solution_alerts_dv', + title: 'Status', + fieldName: 'kibana.alert.workflow_status', + selectedOptions: ['open'], + hideActionBar: true, + persist: true, + hideExists: true, + }, + '1': { + type: 'optionsListControl', + order: 1, + hideExclude: true, + hideSort: true, + placeholder: '', + width: 'small', + dataViewId: 'security_solution_alerts_dv', + title: 'Severity', + fieldName: 'kibana.alert.severity', + selectedOptions: [], + hideActionBar: true, + hideExists: true, + }, + '2': { + type: 'optionsListControl', + order: 2, + hideExclude: true, + hideSort: true, + placeholder: '', + width: 'small', + dataViewId: 'security_solution_alerts_dv', + title: 'User', + fieldName: 'user.name', + }, + '3': { + type: 'optionsListControl', + order: 3, + hideExclude: true, + hideSort: true, + placeholder: '', + width: 'small', + dataViewId: 'security_solution_alerts_dv', + title: 'Host', + fieldName: 'host.name', + }, + }, + labelPosition: 'oneLine', + chainingSystem: 'HIERARCHICAL', + autoApplySelections: false, + ignoreParentSettings: { + ignoreValidations: false, + }, + editorConfig: { + hideWidthSettings: true, + hideDataViewSelector: true, + hideAdditionalSettings: true, + }, +}; +const storage = new Storage(localStorage); + +describe('migrateAlertPageControlsTo816', () => { + beforeEach(() => { + storage.clear(); + }); + it('should migrate the old format to the new format', () => { + storage.set(PAGE_FILTER_STORAGE_KEY, OLD_FORMAT); + migrateAlertPageControlsTo816(storage); + const migrated = storage.get(PAGE_FILTER_STORAGE_KEY); + expect(migrated).toMatchObject(NEW_FORMAT); + }); + + it('should be a no-op if the new format already exists', () => { + storage.set(PAGE_FILTER_STORAGE_KEY, NEW_FORMAT); + migrateAlertPageControlsTo816(storage); + const migrated = storage.get(PAGE_FILTER_STORAGE_KEY); + expect(migrated).toMatchObject(NEW_FORMAT); + }); + + it('should be a no-op if no value is present in localstorage for page filters ', () => { + migrateAlertPageControlsTo816(storage); + const migrated = storage.get(PAGE_FILTER_STORAGE_KEY); + expect(migrated).toBeNull(); + }); + + it('should convert custom old format correctly', () => { + const MODIFIED_OLD_FORMAT = structuredClone(OLD_FORMAT); + MODIFIED_OLD_FORMAT.panels['0'].explicitInput.hideExists = true; + MODIFIED_OLD_FORMAT.chainingSystem = 'NONE'; + storage.set(PAGE_FILTER_STORAGE_KEY, MODIFIED_OLD_FORMAT); + migrateAlertPageControlsTo816(storage); + const migrated = storage.get(PAGE_FILTER_STORAGE_KEY); + const EXPECTED_NEW_FORMAT = structuredClone(NEW_FORMAT); + EXPECTED_NEW_FORMAT.initialChildControlState['0'].hideExists = true; + EXPECTED_NEW_FORMAT.chainingSystem = 'NONE'; + expect(migrated).toMatchObject(EXPECTED_NEW_FORMAT); + }); +}); diff --git a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/migrate_alert_page_controls.ts b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/migrate_alert_page_controls.ts new file mode 100644 index 0000000000000..d3e17f47983d9 --- /dev/null +++ b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/migrate_alert_page_controls.ts @@ -0,0 +1,137 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import type { ControlGroupRuntimeState } from '@kbn/controls-plugin/public'; +import type { DefaultControlState } from '@kbn/controls-plugin/public/react_controls/controls/types'; +import type { Storage } from '@kbn/kibana-utils-plugin/public'; + +export const PAGE_FILTER_STORAGE_KEY = 'siem.default.pageFilters'; + +interface OldFormat { + viewMode: string; + id: string; + panels: { + [key: string]: { + type: string; + order: number; + grow: boolean; + width: string; + explicitInput: { + id: string; + dataViewId: string; + fieldName: string; + title: string; + hideExclude: boolean; + hideSort: boolean; + hidePanelTitles: boolean; + placeholder: string; + ignoreParentSettings: { + ignoreValidations: boolean; + }; + selectedOptions: string[]; + hideActionBar: boolean; + persist: boolean; + hideExists: boolean; + existsSelected: boolean; + exclude: boolean; + }; + }; + }; + defaultControlWidth: string; + defaultControlGrow: boolean; + controlStyle: string; + chainingSystem: string; + showApplySelections: boolean; + ignoreParentSettings: { + ignoreFilters: boolean; + ignoreQuery: boolean; + ignoreTimerange: boolean; + ignoreValidations: boolean; + }; + timeRange: { + from: string; + to: string; + mode: string; + }; + filters: Array<{ + meta: { + alias: null; + negate: boolean; + disabled: boolean; + type: string; + key: string; + index: string; + }; + query: { + exists: { + field: string; + }; + }; + }>; + query: { + query: string; + }; +} + +interface NewFormatExplicitInput { + dataViewId: string; + fieldName: string; + title: string; + hideExclude: boolean; + hideSort: boolean; + placeholder: string; + selectedOptions: string[]; + hideActionBar: boolean; + persist: boolean; + hideExists: boolean; +} + +/** + * Ref PR : https://github.com/elastic/kibana/pull/190561 + * + * The above PR breaks the local storage format of page filters controls. + * This migration script is to migrate the old format to the new format. + * + */ +export function migrateAlertPageControlsTo816(storage: Storage) { + const oldFormat: OldFormat = storage.get(PAGE_FILTER_STORAGE_KEY); + if (oldFormat && Object.keys(oldFormat).includes('panels')) { + // Only run when it is old format + const newFormat: ControlGroupRuntimeState = { + initialChildControlState: {}, + labelPosition: oldFormat.controlStyle as ControlGroupRuntimeState['labelPosition'], + chainingSystem: oldFormat.chainingSystem as ControlGroupRuntimeState['chainingSystem'], + autoApplySelections: oldFormat.showApplySelections ?? true, + ignoreParentSettings: oldFormat.ignoreParentSettings, + editorConfig: { + hideWidthSettings: true, + hideDataViewSelector: true, + hideAdditionalSettings: true, + }, + }; + + for (const [key, value] of Object.entries(oldFormat.panels)) { + newFormat.initialChildControlState[key] = { + type: 'optionsListControl', + order: value.order, + hideExclude: value.explicitInput.hideExclude ?? true, + hideSort: value.explicitInput.hideSort ?? true, + placeholder: value.explicitInput.placeholder ?? '', + width: value.width as DefaultControlState['width'], + dataViewId: value.explicitInput.dataViewId ?? 'security_solution_alerts_dv', + title: value.explicitInput.title, + fieldName: value.explicitInput.fieldName, + selectedOptions: value.explicitInput.selectedOptions, + hideActionBar: value.explicitInput.hideActionBar, + persist: value.explicitInput.persist, + hideExists: value.explicitInput.hideExists, + }; + } + + storage.set(PAGE_FILTER_STORAGE_KEY, newFormat); + } +} diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json index 3f3a6e8b1fef9..dd4d2709bd4cf 100644 --- a/x-pack/plugins/translations/translations/fr-FR.json +++ b/x-pack/plugins/translations/translations/fr-FR.json @@ -5331,7 +5331,6 @@ "kbn-esql-validation-autocomplete.esql.definitions.atan": "Renvoie l'arc tangente de l'entrée\nexpression numérique sous forme d'angle, exprimée en radians.", "kbn-esql-validation-autocomplete.esql.definitions.atan2": "L'angle entre l'axe positif des x et le rayon allant de\nl'origine au point (x , y) dans le plan cartésien, exprimée en radians.", "kbn-esql-validation-autocomplete.esql.definitions.autoBucketDoc": "Groupement automatique des dates en fonction d'une plage et d'un compartiment cible donnés.", - "kbn-esql-validation-autocomplete.esql.definitions.avgDoc": "Renvoie la moyenne des valeurs dans un champ", "kbn-esql-validation-autocomplete.esql.definitions.byDoc": "Par", "kbn-esql-validation-autocomplete.esql.definitions.case": "Accepte les paires de conditions et de valeurs. La fonction renvoie la valeur correspondant à la première condition évaluée à `true` (vraie). Si le nombre d'arguments est impair, le dernier argument est la valeur par défaut qui est renvoyée si aucune condition ne correspond.", "kbn-esql-validation-autocomplete.esql.definitions.cbrt": "Renvoie la racine cubique d'un nombre. La valeur de renvoi est toujours un double, quelle que soit la valeur numérique de l'entrée.\nLa racine cubique de l’infini est nulle.", @@ -5345,8 +5344,6 @@ "kbn-esql-validation-autocomplete.esql.definitions.concat": "Concatène deux ou plusieurs chaînes.", "kbn-esql-validation-autocomplete.esql.definitions.cos": "Renvoie le cosinus d'un angle.", "kbn-esql-validation-autocomplete.esql.definitions.cosh": "Renvoie le cosinus hyperbolique d'un angle.", - "kbn-esql-validation-autocomplete.esql.definitions.countDistinctDoc": "Renvoie le décompte des valeurs distinctes dans un champ.", - "kbn-esql-validation-autocomplete.esql.definitions.countDoc": "Renvoie le décompte des valeurs dans un champ.", "kbn-esql-validation-autocomplete.esql.definitions.date_diff": "Soustrait le `startTimestamp` du `endTimestamp` et renvoie la différence en multiples d'`unité`.\nSi `startTimestamp` est postérieur à `endTimestamp`, des valeurs négatives sont renvoyées.", "kbn-esql-validation-autocomplete.esql.definitions.date_extract": "Extrait des parties d'une date, telles que l'année, le mois, le jour, l'heure.", "kbn-esql-validation-autocomplete.esql.definitions.date_format": "Renvoie une représentation sous forme de chaîne d'une date dans le format fourni.", @@ -5391,12 +5388,8 @@ "kbn-esql-validation-autocomplete.esql.definitions.log": "Renvoie le logarithme d'une valeur dans une base. La valeur de renvoi est toujours un double, quelle que soit la valeur numérique de l'entrée.\n\nLes journaux de zéros, de nombres négatifs et de base 1 renvoient `null` ainsi qu'un avertissement.", "kbn-esql-validation-autocomplete.esql.definitions.log10": "Renvoie le logarithme d'une valeur en base 10. La valeur de renvoi est toujours un double, quelle que soit la valeur numérique de l'entrée.\n\nLes logs de 0 et de nombres négatifs renvoient `null` ainsi qu'un avertissement.", "kbn-esql-validation-autocomplete.esql.definitions.ltrim": "Retire les espaces au début des chaînes.", - "kbn-esql-validation-autocomplete.esql.definitions.maxDoc": "Renvoie la valeur maximale dans un champ.", - "kbn-esql-validation-autocomplete.esql.definitions.medianDeviationDoc": "Renvoie la médiane de chaque écart de point de données par rapport à la médiane de l'ensemble de l'échantillon.", - "kbn-esql-validation-autocomplete.esql.definitions.medianDoc": "Renvoie le 50e centile.", "kbn-esql-validation-autocomplete.esql.definitions.metadataDoc": "Métadonnées", "kbn-esql-validation-autocomplete.esql.definitions.metricsDoc": "Une commande source spécifique aux indicateurs, utilisez-la pour charger des données à partir des index de TSDB. Similaire à la commande STATS : calcule les statistiques agrégées, telles que la moyenne, le décompte et la somme, sur l'ensemble des résultats de recherche entrants. Si elle est utilisée sans clause BY, une seule ligne est renvoyée, qui est l'agrégation de tout l'ensemble des résultats de recherche entrants. Lorsque vous utilisez une clause BY, une ligne est renvoyée pour chaque valeur distincte dans le champ spécifié dans la clause BY. La commande renvoie uniquement les champs dans l'agrégation, et vous pouvez utiliser un large éventail de fonctions statistiques avec la commande stats. Lorsque vous effectuez plusieurs agrégations, séparez chacune d'entre elle par une virgule.", - "kbn-esql-validation-autocomplete.esql.definitions.minDoc": "Renvoie la valeur minimale dans un champ.", "kbn-esql-validation-autocomplete.esql.definitions.mv_append": "Concatène les valeurs de deux champs à valeurs multiples.", "kbn-esql-validation-autocomplete.esql.definitions.mv_avg": "Convertit un champ multivalué en un champ à valeur unique comprenant la moyenne de toutes les valeurs.", "kbn-esql-validation-autocomplete.esql.definitions.mv_concat": "Convertit une expression de type chaîne multivalué en une colonne à valeur unique comprenant la concaténation de toutes les valeurs, séparées par un délimiteur.", @@ -5414,7 +5407,6 @@ "kbn-esql-validation-autocomplete.esql.definitions.mvExpandDoc": "Développe des champs comportant des valeurs multiples en indiquant une valeur par ligne et en dupliquant les autres champs", "kbn-esql-validation-autocomplete.esql.definitions.now": "Renvoie la date et l'heure actuelles.", "kbn-esql-validation-autocomplete.esql.definitions.onDoc": "Activé", - "kbn-esql-validation-autocomplete.esql.definitions.percentiletDoc": "Renvoie le n-ième centile d'un champ.", "kbn-esql-validation-autocomplete.esql.definitions.pi": "Renvoie Pi, le rapport entre la circonférence et le diamètre d'un cercle.", "kbn-esql-validation-autocomplete.esql.definitions.pow": "Renvoie la valeur d’une `base` élevée à la puissance d’un `exposant`.", "kbn-esql-validation-autocomplete.esql.definitions.renameDoc": "Attribue un nouveau nom à une ancienne colonne", @@ -5440,9 +5432,7 @@ "kbn-esql-validation-autocomplete.esql.definitions.st_y": "Extrait la coordonnée `y` du point fourni.\nSi les points sont de type `geo_point`, cela revient à extraire la valeur de la `latitude`.", "kbn-esql-validation-autocomplete.esql.definitions.starts_with": "Renvoie un booléen qui indique si une chaîne de mot-clés débute par une autre chaîne.", "kbn-esql-validation-autocomplete.esql.definitions.statsDoc": "Calcule les statistiques agrégées, telles que la moyenne, le décompte et la somme, sur l'ensemble des résultats de recherche entrants. Comme pour l'agrégation SQL, si la commande stats est utilisée sans clause BY, une seule ligne est renvoyée, qui est l'agrégation de tout l'ensemble des résultats de recherche entrants. Lorsque vous utilisez une clause BY, une ligne est renvoyée pour chaque valeur distincte dans le champ spécifié dans la clause BY. La commande stats renvoie uniquement les champs dans l'agrégation, et vous pouvez utiliser un large éventail de fonctions statistiques avec la commande stats. Lorsque vous effectuez plusieurs agrégations, séparez chacune d'entre elle par une virgule.", - "kbn-esql-validation-autocomplete.esql.definitions.stCentroidDoc": "Renvoie le décompte des valeurs distinctes dans un champ.", "kbn-esql-validation-autocomplete.esql.definitions.substring": "Renvoie la sous-chaîne d'une chaîne, délimitée en fonction d'une position de départ et d'une longueur facultative", - "kbn-esql-validation-autocomplete.esql.definitions.sumDoc": "Renvoie la somme des valeurs dans un champ.", "kbn-esql-validation-autocomplete.esql.definitions.tan": "Renvoie la fonction trigonométrique Tangente d'un angle.", "kbn-esql-validation-autocomplete.esql.definitions.tanh": "Renvoie la fonction hyperbolique Tangente d'un angle.", "kbn-esql-validation-autocomplete.esql.definitions.tau": "Renvoie le rapport entre la circonférence et le rayon d'un cercle.", @@ -5464,10 +5454,8 @@ "kbn-esql-validation-autocomplete.esql.definitions.to_unsigned_long": "Convertit une valeur d'entrée en une valeur longue non signée. Si le paramètre d'entrée est de type date,\nsa valeur sera interprétée en millisecondes depuis l'heure Unix, convertie en valeur longue non signée.\nLe booléen *true* sera converti en valeur longue non signée *1*, et *false* en *0*.", "kbn-esql-validation-autocomplete.esql.definitions.to_upper": "Renvoie une nouvelle chaîne représentant la chaîne d'entrée convertie en majuscules.", "kbn-esql-validation-autocomplete.esql.definitions.to_version": "Convertit une chaîne d'entrée en une valeur de version.", - "kbn-esql-validation-autocomplete.esql.definitions.topListDoc": "Collecte les N premières valeurs par compartiment.", "kbn-esql-validation-autocomplete.esql.definitions.trim": "Supprime les espaces de début et de fin d'une chaîne.", "kbn-esql-validation-autocomplete.esql.definitions.values": "Renvoie toutes les valeurs d'un groupe dans un tableau.", - "kbn-esql-validation-autocomplete.esql.definitions.weightedAvgDoc": "Une agrégation qui calcule la moyenne pondérée des valeurs numériques extraites des documents agrégés.", "kbn-esql-validation-autocomplete.esql.definitions.whereDoc": "Utilise \"predicate-expressions\" pour filtrer les résultats de recherche. Une expression predicate, lorsqu'elle est évaluée, renvoie TRUE ou FALSE. La commande where renvoie uniquement les résultats qui donnent la valeur TRUE. Par exemple, pour filtrer les résultats pour une valeur de champ spécifique", "kbn-esql-validation-autocomplete.esql.definitions.withDoc": "Avec", "kbn-esql-validation-autocomplete.esql.divide.warning.divideByZero": "Impossible de diviser par zéro : {left}/{right}", @@ -7215,8 +7203,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.atan2.markdown": "\n\n ### ATAN2\n L'angle entre l'axe positif des x et le rayon allant de\n l'origine au point (x , y) dans le plan cartésien, exprimée en radians.\n\n ````\n ROW y=12.9, x=.6\n | EVAL atan2=ATAN2(y, x)\n ````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.autoBucketFunction": "COMPARTIMENT", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.autoBucketFunction.markdown": "### COMPARTIMENT\nCréer des groupes de valeurs, des compartiments (\"buckets\"), à partir d'une entrée d'un numéro ou d'un horodatage. La taille des compartiments peut être fournie directement ou choisie selon une plage de valeurs et de décompte recommandée.\n\n`BUCKET` a deux modes de fonctionnement : \n\n1. Dans lequel la taille du compartiment est calculée selon la recommandation de décompte d'un compartiment (quatre paramètres) et une plage.\n2. Dans lequel la taille du compartiment est fournie directement (deux paramètres).\n\nAvec un nombre cible de compartiments, le début d'une plage et la fin d'une plage, `BUCKET` choisit une taille de compartiment appropriée afin de générer le nombre cible de compartiments ou moins.\n\nPar exemple, demander jusqu'à 20 compartiments pour une année organisera les données en intervalles mensuels :\n\n````\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hire_date = MV_SORT(VALUES(hire_date)) BY month = BUCKET(hire_date, 20, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT hire_date\n````\n\n**REMARQUE** : Le but n'est pas de fournir le nombre précis de compartiments, mais plutôt de sélectionner une plage qui fournit, tout au plus, le nombre cible de compartiments.\n\nVous pouvez combiner `BUCKET` avec une agrégation pour créer un histogramme :\n\n````\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hires_per_month = COUNT(*) BY month = BUCKET(hire_date, 20, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT month\n````\n\n**REMARQUE** : `BUCKET` ne crée pas de compartiments qui ne correspondent à aucun document. C'est pourquoi, dans l'exemple précédent, il manque 1985-03-01 ainsi que d'autres dates.\n\nDemander d'autres compartiments peut résulter en une plage réduite. Par exemple, demander jusqu'à 100 compartiments en un an résulte en des compartiments hebdomadaires :\n\n````\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 100, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT week\n````\n\n**REMARQUE** : `AUTO_BUCKET` ne filtre aucune ligne. Il n'utilise que la plage fournie pour choisir une taille de compartiment appropriée. Pour les lignes dont la valeur se situe en dehors de la plage, il renvoie une valeur de compartiment qui correspond à un compartiment situé en dehors de la plage. Associez `BUCKET` à `WHERE` pour filtrer les lignes.\n\nSi la taille de compartiment désirée est connue à l'avance, fournissez-la comme second argument, en ignorant la plage :\n\n````\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 1 week)\n| SORT week\n````\n\n**REMARQUE** : Lorsque vous fournissez la taille du compartiment comme second argument, ce dernier doit être une période temporelle ou une durée.\n\n`BUCKET` peut également être utilisé pour des champs numériques. Par exemple, pour créer un histogramme de salaire :\n\n````\nFROM employees\n| STATS COUNT(*) by bs = BUCKET(salary, 20, 25324, 74999)\n| SORT bs\n````\n\nContrairement à l'exemple précédent qui filtre intentionnellement sur une plage temporelle, vous n'avez pas souvent besoin de filtrer sur une plage numérique. Vous devez trouver les valeurs min et max séparément. ES|QL n'a pas encore de façon aisée d'effectuer cette opération automatiquement.\n\nLa plage peut être ignorée si la taille désirée de compartiment est connue à l'avance. Fournissez-la simplement comme second argument :\n\n````\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS c = COUNT(1) BY b = BUCKET(salary, 5000.)\n| SORT b\n````\n\n**REMARQUE** : Lorsque vous fournissez la taille du compartiment comme second argument, elle doit être de type à **virgule flottante**.\n\nVoici un exemple sur comment créer des compartiments horaires pour les dernières 24 heures, et calculer le nombre d'événements par heure :\n\n````\nFROM sample_data\n| WHERE @timestamp >= NOW() - 1 day and @timestamp < NOW()\n| STATS COUNT(*) BY bucket = BUCKET(@timestamp, 25, NOW() - 1 day, NOW())\n````\n\nVoici un exemple permettant de créer des compartiments mensuels pour l'année 1985, et calculer le salaire moyen par mois d'embauche :\n\n````\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS AVG(salary) BY bucket = BUCKET(hire_date, 20, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT bucket\n````\n\n`BUCKET` peut être utilisé pour les parties de groupage et d'agrégation de la commande `STATS …​ BY ...`, tant que la partie d'agrégation de la fonction est **référencée par un alias défini dans la partie de groupage**, ou que celle-ci est invoquée avec exactement la même expression.\n\nPar exemple :\n\n````\nFROM employees\n| STATS s1 = b1 + 1, s2 = BUCKET(salary / 1000 + 999, 50.) + 2 BY b1 = BUCKET(salary / 100 + 99, 50.), b2 = BUCKET(salary / 1000 + 999, 50.)\n| SORT b1, b2\n| KEEP s1, b1, s2, b2\n````\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.avgFunction": "AVG", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.avgFunction.markdown": "### AVG\nRenvoie la moyenne d'un champ numérique.\n\n````\nFROM employees\n| STATS AVG(height)\n````\n\nCette expression peut utiliser des fonctions alignées. Par exemple, pour calculer la moyenne sur une colonne multivaluée, il faut d'abord utiliser`MV_AVG` pour faire la moyenne des multiples valeurs par ligne et utiliser le résultat avec la fonction `AVG` :\n\n````\nFROM employees\n| STATS avg_salary_change = AVG(MV_AVG(salary_change))\n````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.binaryOperators": "Opérateurs binaires", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.binaryOperators.markdown": "### Opérateurs binaires\nLes opérateurs de comparaison binaire suivants sont pris en charge :\n\n* égalité : `==`\n* inégalité : `!=`\n* inférieur à : `<`\n* inférieur ou égal à : `<=`\n* supérieur à : `>`\n* supérieur ou égal à : `>=`\n* ajouter : `+`\n* soustraire : `-`\n* multiplier par : `*`\n* diviser par : `/`\n* module : `%`\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.booleanOperators": "Opérateurs booléens", @@ -7241,10 +7227,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cos.markdown": "\n\n ### COS\n Renvoie le cosinus d'un angle.\n\n ````\n ROW a=1.8 \n | EVAL cos=COS(a)\n ````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cosh": "COSH", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cosh.markdown": "\n\n ### COSH\n Renvoie le cosinus hyperbolique d'un angle.\n\n ````\n ROW a=1.8 \n | EVAL cosh=COSH(a)\n ```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countDistinctFunction": "COUNT_DISTINCT", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countDistinctFunction.markdown": "### COUNT_DISTINCT\nDécompte le nombre approximatif de valeurs distinctes.\n\n````\nFROM hosts\n| STATS COUNT_DISTINCT(ip0), COUNT_DISTINCT(ip1)\n```\n\nLa fonction `COUNT_DISTINCT` est approximative, basée sur l'algorithme HyperLogLog++. Pour en savoir plus, consultez la [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-cardinality-aggregation.html#_counts_are_approximate). La précision est configurable à l'aide d'un deuxième paramètre facultatif. La valeur maximale compatible est 40000. Les seuils supérieurs à ce nombre auront le même effet qu'un seuil de 40000. La valeur par défaut est 3000.\n\n````\nFROM hosts\n| STATS COUNT_DISTINCT(ip0, 80000), COUNT_DISTINCT(ip1, 5)\n````\n\nCette expression peut utiliser des fonctions alignées. Cet exemple divise une chaîne en plusieurs valeurs à l'aide de la fonction `SPLIT` et compte les valeurs uniques :\n\n````\nROW words=\"foo;bar;baz;qux;quux;foo\"\n| STATS distinct_word_count = COUNT_DISTINCT(SPLIT(words, \";\"))\n````\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countFunction": "COUNT", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countFunction.markdown": "### COUNT\nRenvoie le nombre total de valeurs en entrée.\n\n````\nFROM employees\n| STATS COUNT(height)\n````\n\nPeut prendre n'importe quel type de champ en entrée.\n\nPour compter le nombre de lignes, utiliser `COUNT()` ou `COUNT(*)` :\n\n````\nFROM employees\n| STATS count = COUNT(*) BY languages\n| SORT languages DESC\n````\n\nCette expression peut utiliser des fonctions alignées. Cet exemple divise une chaîne en plusieurs valeurs à l'aide de la fonction `SPLIT` et compte les valeurs :\n\n````\nROW words=\"foo;bar;baz;qux;quux;foo\"\n| STATS word_count = COUNT(SPLIT(words, \";\"))\n````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_diff": "DATE_DIFF", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_diff.markdown": "\n\n ### DATE_DIFF\n Soustrait le `startTimestamp` du `endTimestamp` et renvoie la différence en multiples `d'unité`.\n Si `startTimestamp` est postérieur à `endTimestamp`, des valeurs négatives sont renvoyées.\n\n ````\n ROW date1 = TO_DATETIME(\"2023-12-02T11:00:00.000Z\"), date2 = TO_DATETIME(\"2023-12-02T11:00:00.001Z\")\n | EVAL dd_ms = DATE_DIFF(\"microseconds\", date1, date2)\n ````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_extract": "DATE_EXTRACT", @@ -7300,14 +7282,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ltrim": "LTRIM", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ltrim.markdown": "\n\n ### LTRIM\n Retire les espaces au début des chaînes.\n\n ````\n ROW message = \" some text \", color = \" red \"\n | EVAL message = LTRIM(message)\n | EVAL color = LTRIM(color)\n | EVAL message = CONCAT(\"'\", message, \"'\")\n | EVAL color = CONCAT(\"'\", color, \"'\")\n ````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.markdown": "## ES|QL\n\nUne requête ES|QL (langage de requête Elasticsearch) se compose d'une série de commandes, séparées par une barre verticale : `|`. Chaque requête commence par une **commande source**, qui produit un tableau, habituellement avec des données issues d'Elasticsearch. \n\nUne commande source peut être suivie d'une ou plusieurs **commandes de traitement**. Les commandes de traitement peuvent modifier le tableau de sortie de la commande précédente en ajoutant, supprimant ou modifiant les lignes et les colonnes.\n\n````\nsource-command\n| processing-command1\n| processing-command2\n````\n\nLe résultat d'une requête est le tableau produit par la dernière commande de traitement. \n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.maxFunction": "MAX", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.maxFunction.markdown": "### MAX\nRenvoie la valeur maximale d'une expression numérique.\n\n````\nFROM employees\n| STATS MAX(languages)\n````\n\nCette expression peut utiliser des fonctions alignées. Par exemple, pour calculer le maximum sur une moyenne d'une colonne multivaluée, il faut utiliser `MV_AVG` pour faire la moyenne des multiples valeurs par ligne et utiliser le résultat avec la fonction `MAX` :\n\n````\nFROM employees\n| STATS max_avg_salary_change = MAX(MV_AVG(salary_change))\n````\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianAbsoluteDeviationFunction": "MEDIAN_ABSOLUTE_DEVIATION", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianAbsoluteDeviationFunction.markdown": "### MEDIAN_ABSOLUTE_DEVIATION\nRenvoie l'écart absolu médian, une mesure de la variabilité. Il s'agit d'un indicateur robuste, ce qui signifie qu'il est utile pour décrire des données qui peuvent présenter des valeurs aberrantes ou ne pas être normalement distribuées. Pour de telles données, il peut être plus descriptif que l'écart-type.\n\nIl est calculé comme la médiane de chaque écart de point de données par rapport à la médiane de l'ensemble de l'échantillon. Autrement dit, pour une variable aléatoire X, l'écart absolu médian est `median(|median(X) - X|)`.\n\n````\nFROM employees\n| STATS MEDIAN(salary), MEDIAN_ABSOLUTE_DEVIATION(salary)\n````\n\nREMARQUE : Comme la fonction `PERCENTILE`, la fonction `MEDIAN_ABSOLUTE_DEVIATION` est généralement approximative, et basée sur l'algorithme TDigest. Elle est également non déterministe. Cela signifie que vous pouvez obtenir des résultats légèrement différents en utilisant les mêmes données.\n\nCette expression peut utiliser des fonctions alignées. Par exemple, pour calculer l'écart absolu médian des valeurs maximales d'une colonne multivaluée, il faut d'abord utiliser `MV_MAX` pour obtenir la valeur maximale par ligne, et utiliser le résultat avec la fonction `MEDIAN_ABSOLUTE_DEVIATION` :\n\n````\nFROM employees\n| STATS m_a_d_max_salary_change = MEDIAN_ABSOLUTE_DEVIATION(MV_MAX(salary_change))\n````\n\n", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianFunction": "MEDIAN", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianFunction.markdown": "### MEDIAN\nRenvoie la valeur qui est supérieure à la moitié de toutes les valeurs et inférieure à la moitié de toutes les valeurs, également connue sous le nom de `PERCENTILE` 50 %.\n\n**REMARQUE :** Comme la fonction `PERCENTILE`, la fonction `MEDIAN` est généralement approximative et basée sur l'algorithme TDigest.\n\n**AVERTISSEMENT :** `MEDIAN` est également [non déterministe](https://en.wikipedia.org/wiki/Nondeterministic_algorithm). Cela signifie que vous pouvez obtenir des résultats légèrement différents en utilisant les mêmes données.\n\nExemple :\n\n````\nFROM employees\n| STATS MEDIAN(salary), PERCENTILE(salary, 50)\n````\n\nCette expression peut utiliser des fonctions alignées. Par exemple, pour calculer le médian des valeurs maximales d'une colonne multivaluée, il faut d'abord utiliser `MV_MAX` pour obtenir la valeur maximale par ligne et utiliser le résultat avec la fonction `MEDIAN` :\n\n````\nFROM employees\n| STATS median_max_salary_change = MEDIAN(MV_MAX(salary_change))\n````\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.minFunction": "MIN", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.minFunction.markdown": "### MIN\nRenvoie la valeur minimale d'un champ numérique.\n\n````\nFROM employees\n| STATS MIN(languages)\n````\n\nCette expression peut utiliser des fonctions alignées. Par exemple, pour calculer le minimum sur une moyenne d'une colonne multivaluée, il faut utiliser `MV_AVG` pour faire la moyenne des valeurs multiples par ligne et utiliser le résultat avec la fonction `MIN` :\n\n````\nFROM employees\n| STATS min_avg_salary_change = MIN(MV_AVG(salary_change))\n````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_append": "MV_APPEND", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_append.markdown": "\n\n ### MV_APPEND\n Concatène les valeurs de deux champs à valeurs multiples.\n\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_avg": "MV_AVG", @@ -7340,8 +7314,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mvExpand.markdown": "### MV_EXPAND\nLa commande de traitement `MV_EXPAND` développe les champs multivalués en indiquant une valeur par ligne et en dupliquant les autres champs : \n````\nROW a=[1,2,3], b=\"b\", j=[\"a\",\"b\"]\n| MV_EXPAND a\n````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.now": "NOW", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.now.markdown": "\n\n ### NOW\n Renvoie la date et l'heure actuelles.\n\n ````\n ROW current_date = NOW()\n ````\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.percentileFunction": "PERCENTILE", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.percentileFunction.markdown": "### PERCENTILE\nValeur à laquelle un certain pourcentage des valeurs observées se produit. Par exemple, le 95e percentile est la valeur qui est supérieure à 95 % des valeurs observées et le 50e percentile est la médiane (`MEDIAN`).\n\n````\nFROM employees\n| STATS p0 = PERCENTILE(salary, 0)\n , p50 = PERCENTILE(salary, 50)\n , p99 = PERCENTILE(salary, 99)\n````\n\n**REMARQUE** : La fonction `PERCENTILE` est généralement approximative et basée sur l'algorithme TDigest. \n\n**AVERTISSEMENT :** `PERCENTILE` est aussi [non déterministe](https://en.wikipedia.org/wiki/Nondeterministic_algorithm). Cela signifie que vous pouvez obtenir des résultats légèrement différents en utilisant les mêmes données.\n\nCette expression peut utiliser des fonctions alignées. Par exemple, pour calculer un percentile des valeurs maximales d'une colonne multivaluée, il faut d'abord utiliser `MV_MAX` pour obtenir la valeur maximale par ligne et utiliser le résultat avec la fonction `PERCENTILE` :\n\n````\nFROM employees\n| STATS p80_max_salary_change = PERCENTILE(MV_MAX(salary_change), 80)\n````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pi": "PI", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pi.markdown": "\n\n ### PI\n Renvoie Pi, le rapport entre la circonférence et le diamètre d'un cercle.\n\n ````\n ROW PI()\n ````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pow": "POW", @@ -7394,14 +7366,10 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.starts_with.markdown": "\n\n ### STARTS_WITH\n Renvoie un booléen qui indique si une chaîne de mot-clés débute par une autre chaîne.\n\n ````\n FROM employees\n | KEEP last_name\n | EVAL ln_S = STARTS_WITH(last_name, \"B\")\n ````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.statsby": "STATS ... BY", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.statsby.markdown": "### STATS ... BY\nUtilisez `STATS ... BY` pour regrouper les lignes en fonction d'une valeur commune et calculer une ou plusieurs valeurs agrégées sur les lignes regroupées.\n\n**Exemples** :\n\n````\nFROM employees\n| STATS count = COUNT(emp_no) BY languages\n| SORT languages\n````\n\nSi `BY` est omis, le tableau de sortie contient exactement une ligne avec les agrégations appliquées sur l'ensemble des données :\n\n````\nFROM employees\n| STATS avg_lang = AVG(languages)\n````\n\nIl est possible de calculer plusieurs valeurs :\n\n````\nFROM employees\n| STATS avg_lang = AVG(languages), max_lang = MAX(languages)\n````\n\nIl est également possible d'effectuer des regroupements en fonction de plusieurs valeurs (uniquement pour les champs longs et les champs de la famille de mots-clés) :\n\n````\nFROM employees\n| EVAL hired = DATE_FORMAT(hire_date, \"YYYY\")\n| STATS avg_salary = AVG(salary) BY hired, languages.long\n| EVAL avg_salary = ROUND(avg_salary)\n| SORT hired, languages.long\n````\n\nConsultez la rubrique **Fonctions d'agrégation** pour obtenir la liste des fonctions pouvant être utilisées avec `STATS ... BY`.\n\nLes fonctions d'agrégation et les expressions de regroupement acceptent toutes deux d'autres fonctions. Ceci est utile pour utiliser `STATS...BY` sur des colonnes à valeur multiple. Par exemple, pour calculer l'évolution moyenne du salaire, vous pouvez utiliser `MV_AVG` pour faire la moyenne des multiples valeurs par employé, et utiliser le résultat avec la fonction `AVG` :\n\n````\nFROM employees\n| STATS avg_salary_change = AVG(MV_AVG(salary_change))\n````\n\nLe regroupement par expression est par exemple le regroupement des employés en fonction de la première lettre de leur nom de famille :\n\n````\nFROM employees\n| STATS my_count = COUNT() BY LEFT(last_name, 1)\n| SORT \"LEFT(last_name, 1)\"\n````\n\nIl n'est pas obligatoire d'indiquer le nom de la colonne de sortie. S'il n'est pas spécifié, le nouveau nom de la colonne est égal à l'expression. La requête suivante renvoie une colonne appelée `AVG(salary)` :\n\n````\nFROM employees\n| STATS AVG(salary)\n````\n\nComme ce nom contient des caractères spéciaux, il doit être placé entre deux caractères (`) lorsqu'il est utilisé dans des commandes suivantes :\n\n````\nFROM employees\n| STATS AVG(salary)\n| EVAL avg_salary_rounded = ROUND(\"AVG(salary)\")\n````\n\n**Remarque** : `STATS` sans aucun groupe est beaucoup plus rapide que l'ajout d'un groupe.\n\n**Remarque** : Le regroupement sur une seule expression est actuellement beaucoup plus optimisé que le regroupement sur plusieurs expressions.\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stCentroidFunction": "ST_CENTROID_AGG", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stCentroidFunction.markdown": "### ST_CENTROID_AGG\n**AVERTISSEMENT : Cette fonctionnalité est en version d'évaluation technique et pourra être modifiée ou supprimée dans une future version. Elastic s'efforcera de corriger tout problème éventuel, mais les fonctionnalités des versions d'évaluation technique ne sont pas soumises aux accords de niveau de service (SLA) d'assistance des fonctionnalités officielles en disponibilité générale.**\n\nCalcule le centroïde spatial sur un champ avec un type de géométrie de point spatial.\n\n````\nAéroports FROM\n| STATS centroid=ST_CENTROID_AGG(location)\n````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stringOperators": "LIKE et RLIKE", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stringOperators.markdown": "### LIKE et RLIKE\nPour comparer des chaînes en utilisant des caractères génériques ou des expressions régulières, utilisez `LIKE` ou `RLIKE` :\n\nUtilisez `LIKE` pour faire correspondre des chaînes à l'aide de caractères génériques. Les caractères génériques suivants sont pris en charge :\n\n* `*` correspond à zéro caractère ou plus.\n* `?` correspond à un seul caractère.\n\n````\nFROM employees\n| WHERE first_name LIKE \"?b*\"\n| KEEP first_name, last_name\n````\n\nUtilisez `RLIKE` pour faire correspondre des chaînes à l'aide d'expressions régulières :\n\n````\nFROM employees\n| WHERE first_name RLIKE \".leja.*\"\n| KEEP first_name, last_name\n````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.substring": "SUBSTRING", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.substring.markdown": "\n\n ### SUBSTRING\n Renvoie la sous-chaîne d'une chaîne, délimitée en fonction d'une position de départ et d'une longueur facultative\n\n ````\n FROM employees\n | KEEP last_name\n | EVAL ln_sub = SUBSTRING(last_name, 1, 3)\n ````\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sumFunction": "SUM", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sumFunction.markdown": "### SUM\nRenvoie la somme d'un champ numérique.\n\n````\nFROM employees\n| STATS SUM(languages)\n````\n\nCette expression peut utiliser des fonctions alignées. Par exemple, pour calculer la somme de l'évolution de salaire maximale de chaque employé, appliquez la fonction `MV_MAX` à chaque ligne et additionnez les résultats (`SUM`) :\n\n````\nFROM employees\n| STATS total_salary_changes = SUM(MV_MAX(salary_change))\n````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tan": "TAN", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tan.markdown": "\n\n ### TAN\n Renvoie la fonction trigonométrique Tangente d'un angle.\n\n ````\n ROW a=1.8 \n | EVAL tan=TAN(a)\n ````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tanh": "TANH", @@ -7446,8 +7414,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_version.markdown": "\n\n ### TO_VERSION\n Convertit une chaîne d'entrée en une valeur de version.\n\n ````\n ROW v = TO_VERSION(\"1.2.3\")\n ````\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.trim": "TRIM", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.trim.markdown": "\n\n ### TRIM\n Supprime les espaces de début et de fin d'une chaîne.\n\n ````\n ROW message = \" some text \", color = \" red \"\n | EVAL message = TRIM(message)\n | EVAL color = TRIM(color)\n ````\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.valuesFunction": "VALEURS", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.valuesFunction.markdown": "### VALEURS\n\n**AVERTISSEMENT : N’utilisez pas `VALUES` dans les environnements de production. Cette fonctionnalité est en version d'évaluation technique et pourra être modifiée ou supprimée dans une future version. Elastic s'efforcera de corriger tout problème éventuel, mais les fonctionnalités des versions d'évaluation technique ne sont pas soumises aux accords de niveau de service (SLA) d'assistance des fonctionnalités officielles en disponibilité générale.**\n\nRenvoie toutes les valeurs d’un groupe dans un champ multivalué. L'ordre des valeurs renvoyées n'est pas garanti. Si vous avez besoin que les valeurs renvoyées soient dans l'ordre, utilisez `MV_SORT`.\n\nAccepte une expression de n'importe quel type, sauf `geo_point`, `cartesian_point`, `geo_shape` ou `cartesian_shape`.\n\n\nExemple :\n\n````\n FROM employees\n| EVAL first_letter = SUBSTRING(first_name, 0, 1)\n| STATS first_name=MV_SORT(VALUES(first_name)) BY first_letter\n| SORT first_letter\n````\n\n> _**AVERTISSEMENT :** Ceci peut utiliser une quantité importante de mémoire et ES|QL ne développe pas encore les agrégations au-delà de la mémoire. Cette agrégation fonctionnera donc jusqu'à ce qu'elle soit utilisée pour collecter plus de valeurs que la mémoire ne peut en contenir. Lorsque le nombre de valeurs collectées est trop élevé, la requête échoue avec un message d'erreur de type [Circuit Breaker Error](https://www.elastic.co/guide/en/elasticsearch/reference/current/circuit-breaker-errors.html)._\n\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.where": "WHERE", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.where.markdown": "### WHERE\nUtilisez `WHERE` afin d'obtenir un tableau qui comprend toutes les lignes du tableau d'entrée pour lesquelles la condition fournie est évaluée à `true` :\n \n````\nFROM employees\n| KEEP first_name, last_name, still_hired\n| WHERE still_hired == true\n````\n\n#### Opérateurs\n\nPour obtenir un aperçu des opérateurs pris en charge, consultez la section **Opérateurs**.\n\n#### Fonctions\n`WHERE` prend en charge diverses fonctions de calcul des valeurs. Pour en savoir plus, consultez la section **Fonctions**.\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationLabel": "Documentation", diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json index 017ceeaa66c08..1e6b0cb9dab35 100644 --- a/x-pack/plugins/translations/translations/ja-JP.json +++ b/x-pack/plugins/translations/translations/ja-JP.json @@ -5328,7 +5328,6 @@ "kbn-esql-validation-autocomplete.esql.definitions.atan": "入力\n数値式のアークタンジェントをラジアンで表記された角度として返します。", "kbn-esql-validation-autocomplete.esql.definitions.atan2": "直交平面上の\n原点から点（x , y）に向かう光線と正のx軸のなす角（ラジアン表記）。", "kbn-esql-validation-autocomplete.esql.definitions.autoBucketDoc": "指定された範囲とバケット目標に基づいて、日付を自動的にバケット化します。", - "kbn-esql-validation-autocomplete.esql.definitions.avgDoc": "フィールドの値の平均を返します", "kbn-esql-validation-autocomplete.esql.definitions.byDoc": "グループ基準", "kbn-esql-validation-autocomplete.esql.definitions.case": "条件と値のペアを指定できます。この関数は、最初にtrueと評価された条件に属する値を返します。引数の数が奇数の場合、最後の引数は条件に一致しない場合に返されるデフォルト値になります。", "kbn-esql-validation-autocomplete.esql.definitions.cbrt": "数値の立方根を返します。入力は任意の数値で、戻り値は常にdoubleです。\n無限大の立方根はnullです。", @@ -5342,8 +5341,6 @@ "kbn-esql-validation-autocomplete.esql.definitions.concat": "2つ以上の文字列を連結します。", "kbn-esql-validation-autocomplete.esql.definitions.cos": "角度の余弦を返します。", "kbn-esql-validation-autocomplete.esql.definitions.cosh": "角度の双曲余弦を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.countDistinctDoc": "フィールド内の異なる値の数を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.countDoc": "フィールドの値の数を返します。", "kbn-esql-validation-autocomplete.esql.definitions.date_diff": "startTimestampをendTimestampから減算し、unitの乗数の差を返します。\nstartTimestampがendTimestampより後の場合は、負の値が返されます。", "kbn-esql-validation-autocomplete.esql.definitions.date_extract": "年、月、日、時間など、日付の一部を抽出します。", "kbn-esql-validation-autocomplete.esql.definitions.date_format": "指定した書式の日付の文字列表現を返します。", @@ -5388,12 +5385,8 @@ "kbn-esql-validation-autocomplete.esql.definitions.log": "基数に対する値の対数を返します。入力は任意の数値で、戻り値は常にdoubleです。\n\nゼロの対数、負数、1の基数はnullと警告を返します。", "kbn-esql-validation-autocomplete.esql.definitions.log10": "基数10に対する値の対数を返します。入力は任意の数値で、戻り値は常にdoubleです。\n\n0の対数および負数はnullと警告を返します。", "kbn-esql-validation-autocomplete.esql.definitions.ltrim": "文字列から先頭の空白を取り除きます。", - "kbn-esql-validation-autocomplete.esql.definitions.maxDoc": "フィールドの最大値を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.medianDeviationDoc": "サンプル全体の中央値からの各データポイントの偏差の中央値を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.medianDoc": "50%パーセンタイルを返します。", "kbn-esql-validation-autocomplete.esql.definitions.metadataDoc": "メタデータ", "kbn-esql-validation-autocomplete.esql.definitions.metricsDoc": "メトリック固有のソースコマンド。TSDBインデックスからデータを読み込むするには、このコマンドを使用します。STATSコマンドのように、受信検索結果セットで、平均、カウント、合計などの集約統計情報を計算できます。BY句なしで使用した場合は、1行のみが返されます。これは、受信検索結果セット全体に対する集約です。BY句を使用すると、BY句で指定したフィールドの1つの値ごとに1行が返されます。このコマンドは集約のフィールドのみを返します。statsコマンドではさまざまな統計関数を使用できます。複数の集約を実行するときには、各集約をカンマで区切ります。", - "kbn-esql-validation-autocomplete.esql.definitions.minDoc": "フィールドの最小値を返します。", "kbn-esql-validation-autocomplete.esql.definitions.mv_append": "2つの複数値フィールドの値を連結します", "kbn-esql-validation-autocomplete.esql.definitions.mv_avg": "複数値フィールドを、すべての値の平均を含む単一値フィールドに変換します。", "kbn-esql-validation-autocomplete.esql.definitions.mv_concat": "複数値文字列式を、区切り文字で区切られたすべての値を連結した単一値列に変換します。", @@ -5411,7 +5404,6 @@ "kbn-esql-validation-autocomplete.esql.definitions.mvExpandDoc": "複数値フィールドを値ごとに1行に展開し、他のフィールドを複製します", "kbn-esql-validation-autocomplete.esql.definitions.now": "現在の日付と時刻を返します。", "kbn-esql-validation-autocomplete.esql.definitions.onDoc": "オン", - "kbn-esql-validation-autocomplete.esql.definitions.percentiletDoc": "フィールドのnパーセンタイルを返します。", "kbn-esql-validation-autocomplete.esql.definitions.pi": "円の円周と直径の比率であるPiを返します。", "kbn-esql-validation-autocomplete.esql.definitions.pow": "exponentのべき乗にしたbaseの値を返します。", "kbn-esql-validation-autocomplete.esql.definitions.renameDoc": "古い列の名前を新しい列に変更", @@ -5437,9 +5429,7 @@ "kbn-esql-validation-autocomplete.esql.definitions.st_y": "指定された点からy座標を抽出します。\nこの点がgeo_pointタイプの場合は、latitude値を抽出するのと同じ結果になります。", "kbn-esql-validation-autocomplete.esql.definitions.starts_with": "キーワード文字列が他の文字列で始まるかどうかを示すブール値を返します。", "kbn-esql-validation-autocomplete.esql.definitions.statsDoc": "受信検索結果セットで、平均、カウント、合計などの集約統計情報を計算します。SQL集約と同様に、statsコマンドをBY句なしで使用した場合は、1行のみが返されます。これは、受信検索結果セット全体に対する集約です。BY句を使用すると、BY句で指定したフィールドの1つの値ごとに1行が返されます。statsコマンドは集約のフィールドのみを返します。statsコマンドではさまざまな統計関数を使用できます。複数の集約を実行するときには、各集約をカンマで区切ります。", - "kbn-esql-validation-autocomplete.esql.definitions.stCentroidDoc": "フィールド内の異なる値の数を返します。", "kbn-esql-validation-autocomplete.esql.definitions.substring": "文字列のサブ文字列を、開始位置とオプションの長さで指定して返します。", - "kbn-esql-validation-autocomplete.esql.definitions.sumDoc": "フィールドの値の合計を返します。", "kbn-esql-validation-autocomplete.esql.definitions.tan": "角度の正接三角関数を返します。", "kbn-esql-validation-autocomplete.esql.definitions.tanh": "角度の正接双曲線関数を返します。", "kbn-esql-validation-autocomplete.esql.definitions.tau": "円の円周と半径の比率を返します。", @@ -5461,10 +5451,8 @@ "kbn-esql-validation-autocomplete.esql.definitions.to_unsigned_long": "入力値を符号なしlong値に変換します。入力パラメーターが日付型の場合、\nその値はUnixのエポックからのミリ秒として解釈され、符号なしlong値に変換されます。\nブール値の*true*は符号なしlong値の*1*に、*false*は*0*に変換されます。", "kbn-esql-validation-autocomplete.esql.definitions.to_upper": "大文字に変換された入力文字列を表す新しい文字列を返します。", "kbn-esql-validation-autocomplete.esql.definitions.to_version": "入力文字列をバージョン値に変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.topListDoc": "バケットごとに上位N値を収集します。", "kbn-esql-validation-autocomplete.esql.definitions.trim": "文字列から先頭と末尾の空白を削除します。", "kbn-esql-validation-autocomplete.esql.definitions.values": "グループのすべての値を配列として返します。", - "kbn-esql-validation-autocomplete.esql.definitions.weightedAvgDoc": "集約されたドキュメントから抽出された数値の加重平均値を計算する集約。", "kbn-esql-validation-autocomplete.esql.definitions.whereDoc": "「predicate-expressions」を使用して、検索結果をフィルターします。予測式は評価時にTRUEまたはFALSEを返します。whereコマンドはTRUEに評価される結果のみを返します。たとえば、特定のフィールド値の結果をフィルターします", "kbn-esql-validation-autocomplete.esql.definitions.withDoc": "を使用して", "kbn-esql-validation-autocomplete.esql.divide.warning.divideByZero": "ゼロで除算できません：{left}/{right}", @@ -7209,8 +7197,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.atan2.markdown": "\n\n ### ATAN2\n 直交平面上の原点から点（x , y）に向かう光線と正のx軸のなす角（ラジアン表記）。\n \n\n ```\n ROW y=12.9, x=.6\n | EVAL atan2=ATAN2(y, x)\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.autoBucketFunction": "BUCKET", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.autoBucketFunction.markdown": "### バケット\n日時または数値入力から、値（バケット）のグループを作成します。バケットのサイズは直接指定するか、推奨される数と値の範囲に基づいて選択できます。\n\nBUCKETは次の2つのモードで動作します。\n\n1.バケットのサイズがバケット数の提案（4つのパラメーター）と範囲に基づいて計算される。\n2.バケットサイズが直接指定される（2つのパラメーター）。\n\n目標バケット数、開始日、終了日を使用すると、目標バケット数以下のバケットを生成するために適切なバケットサイズがBUCKETによって選択されます。\n\nたとえば、1年に最大20バケットをリクエストすると、データが1か月間隔で整理されます。\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hire_date = MV_SORT(VALUES(hire_date)) BY month = BUCKET(hire_date, 20, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT hire_date\n```\n\n**注**：ここでは、正確な目標バケット数を指定するのではなく、目標バケット数を_上限_として範囲を指定します。\n\nBUCKETを集約と組み合わせ、ヒストグラムを作成できます。\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hires_per_month = COUNT(*) BY month = BUCKET(hire_date, 20, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT month\n```\n\n**注**：BUCKETは、どのドキュメントにも一致しないバケットを作成しません。そのため、前の例では1985-03-01やその他の日付が抜けています。\n\nその他のバケットを要求すると、範囲が小さくなることがあります。たとえば、1年に最大100バケットをリクエストすると、1週間単位のバケットになります。\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 100, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT week\n```\n\n**注**：AUTO_BUCKETは行をフィルタリングしません。指定された範囲のみを使用して、適切なバケットサイズを選択します。範囲外の値の行に対しては、範囲外のバケツに対応するバケット値を返します。行をフィルタリングするには、BUCKETとWHEREを組み合わせます。\n\n事前に任意のバケットサイズがわかっている場合は、2番目の引数として指定し、範囲を除外します。\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 1 week)\n| SORT week\n```\n\n**注**：バケットサイズを2番目のパラメーターとして指定するときには、時間の期間または日付の期間を選択する必要があります。\n\nBUCKETは数値フィールドでも動作します。たとえば、給与ヒストグラムを作成します。\n\n```\nFROM employees\n| STATS COUNT(*) by bs = BUCKET(salary, 20, 25324, 74999)\n| SORT bs\n```\n\n日付範囲で意図的フィルタリングする前の例とは異なり、数値フィールドでフィルタリングすることはほとんどありません。最小値と最大値を別々に見つける必要があります。ES|QLにはそれを自動的に実行するための簡単な方法がありません。\n\n任意のバケットサイズが事前にわかっている場合は、範囲を省略できます。2番目の引数として指定します。\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS c = COUNT(1) BY b = BUCKET(salary, 5000.)\n| SORT b\n```\n\n**注**：バケットサイズを2番目のパラメーターとして指定するときには、**浮動小数点数型**でなければなりません。\n\n次の例は、過去24時間の1時間単位のバケットを作成し、1時間当たりのイベント数を計算します。\n\n```\nFROM sample_data\n| WHERE @timestamp >= NOW() - 1 day and @timestamp < NOW()\n| STATS COUNT(*) BY bucket = BUCKET(@timestamp, 25, NOW() - 1 day, NOW())\n```\n\n次の例は、1985年の1か月単位のバケットを作成し、採用月別に平均給与を計算します。\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS AVG(salary) BY bucket = BUCKET(hire_date, 20, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT bucket\n```\n\n集約部で関数が**グループ部で定義されたエイリアスによって参照されている**場合、またはまったく同じ式で呼び出されている場合、BUCKETは、 STATS …​ BY …コマンドの集約部とグループ部の両方で使用できます。\n\n例：\n\n```\nFROM employees\n| STATS s1 = b1 + 1, s2 = BUCKET(salary / 1000 + 999, 50.) + 2 BY b1 = BUCKET(salary / 100 + 99, 50.), b2 = BUCKET(salary / 1000 + 999, 50.)\n| SORT b1, b2\n| KEEP s1, b1, s2, b2\n```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.avgFunction": "AVG", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.avgFunction.markdown": "### AVG\n数値フィールドの平均を返します。\n\n```\nFROM employees\n| STATS AVG(height)\n```\n\n式はインライン関数を使用できます。たとえば、複数値列で平均を計算するには、まず、MV_AVGを使用して行ごとに複数の値の平均を求め、その結果にAVG関数を適用します。\n\n```\nFROM employees\n| STATS avg_salary_change = AVG(MV_AVG(salary_change))\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.binaryOperators": "バイナリ演算子", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.binaryOperators.markdown": "### バイナリ演算子\n次のバイナリ比較演算子がサポートされています。\n\n* 等号：`==`\n* 不等号：`!=`\n* より小さい：`<`\n* 以下：`<=`\n* より大きい：`>`\n* 以上：`>=`\n* 加算：`+`\n* 減算：`-`\n* 乗算：`*`\n* 除算：`/`\n* 係数：`%`\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.booleanOperators": "ブール演算子", @@ -7235,10 +7221,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cos.markdown": "\n\n ### COS\n 角度の余弦を返します。\n\n ```\n ROW a=1.8 \n | EVAL cos=COS(a)\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cosh": "COSH", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cosh.markdown": "\n\n ### COSH\n 角度の双曲余弦を返します。\n\n ```\n ROW a=1.8 \n | EVAL cosh=COSH(a)\n ```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countDistinctFunction": "COUNT_DISTINCT", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countDistinctFunction.markdown": "### COUNT_DISTINCT\n異なる値のおおよその数をカウントします。\n\n```\nFROM hosts\n| STATS COUNT_DISTINCT(ip0), COUNT_DISTINCT(ip1)\n```\n\nCOUNT_DISTINCT関数はHyperLogLog++アルゴリズムに基づく近似関数です。詳細については、[ドキュメント](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-cardinality-aggregation.html#_counts_are_approximate)を参照してください。精度は、オプションの2番目のパラメーターを使って設定できます。サポートされている最大値は40000です。この数値を超えたしきい値は、しきい値40000と同じ結果になります。デフォルト値は3000です。\n\n```\nFROM hosts\n| STATS COUNT_DISTINCT(ip0, 80000), COUNT_DISTINCT(ip1, 5)\n```\n\n式はインライン関数を使用できます。この例では、SPLIT関数を使用して、複数の値を分割し、一意の値をカウントします。\n\n```\nROW words=\"foo;bar;baz;qux;quux;foo\"\n| STATS distinct_word_count = COUNT_DISTINCT(SPLIT(words, \";\"))\n```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countFunction": "COUNT", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countFunction.markdown": "### COUNT\n入力値の合計数（カウント）が返されます。\n\n```\nFROM employees\n| STATS COUNT(height)\n```\n\n任意のフィールドを入力として渡すことができます。\n\n行数をカウントするには、`COUNT()`または`COUNT(*)`を使用します。\n\n```\nFROM employees\n| STATS count = COUNT(*) BY languages\n| SORT languages DESC\n```\n\n式はインライン関数を使用できます。この例では、SPLIT関数を使用して、複数の値を分割し、値をカウントします。\n\n```\nROW words=\"foo;bar;baz;qux;quux;foo\"\n| STATS word_count = COUNT(SPLIT(words, \";\"))\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_diff": "DATE_DIFF", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_diff.markdown": "\n\n ### DATE_DIFF\n startTimestampをendTimestampから減算し、unitの乗数の差を返します。\n startTimestampがendTimestampより後の場合は、負の値が返されます。\n\n ```\n ROW date1 = TO_DATETIME(\"2023-12-02T11:00:00.000Z\"), date2 = TO_DATETIME(\"2023-12-02T11:00:00.001Z\")\n | EVAL dd_ms = DATE_DIFF(\"microseconds\", date1, date2)\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_extract": "DATE_EXTRACT", @@ -7294,14 +7276,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ltrim": "LTRIM", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ltrim.markdown": "\n\n ### LTRIM\n 文字列から先頭の空白を取り除きます。\n\n ```\n ROW message = \" some text \", color = \" red \"\n | EVAL message = LTRIM(message)\n | EVAL color = LTRIM(color)\n | EVAL message = CONCAT(\"'\", message, \"'\")\n | EVAL color = CONCAT(\"'\", color, \"'\")\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.markdown": "## ES|QL\n\nES|QL（Elasticsearch クエリー言語）クエリーは、パイプ文字の|で区切られた一連のコマンドで構成されます。各クエリーは**ソースコマンド**で始まり、通常はElasticsearchのデータを使ってテーブルを生成します。\n\nソースコマンドには、1つ以上の**処理コマンド**を続けることができます。処理コマンドは、行や列を追加、削除、変更することで、前のコマンドの出力テーブルを変更することができます。\n\n```\nsource-command\n| processing-command1\n| processing-command2\n```\n\nクエリーの結果は、最終的な処理コマンドによって生成されるテーブルです。 \n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.maxFunction": "MAX", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.maxFunction.markdown": "### MAX\n数値式の最大値を返します。\n\n```\nFROM employees\n| STATS MAX(languages)\n```\n\n式はインライン関数を使用できます。たとえば、複数値列の平均に対して最大値を計算するには、まず、MV_AVGを使用して行ごとに複数の値の平均を求め、その結果にMAX関数を適用します。\n\n```\nFROM employees\n| STATS max_avg_salary_change = MAX(MV_AVG(salary_change))\n```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianAbsoluteDeviationFunction": "MEDIAN_ABSOLUTE_DEVIATION", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianAbsoluteDeviationFunction.markdown": "### MEDIAN_ABSOLUTE_DEVIATION\n絶対偏差の中央値で、ばらつきを表す指標を返します。これはロバスト統計量であり、外れ値があったり、正規分布していない可能性があるデータを説明するのに有用です。このようなデータでは、標準偏差よりもわかりやすくなります。\n\nこれは、サンプル全体の中央値からの各データポイントの偏差の中央値として計算されます。つまり、確率変数Xに対して、絶対偏差の中央値はmedian(|median(X) - X|)です。\n\n```\nFROM employees\n| STATS MEDIAN(salary), MEDIAN_ABSOLUTE_DEVIATION(salary)\n```\n\n注：PERCENTILEと同様に、通常、MEDIAN_ABSOLUTE_DEVIATIONはTDigestアルゴリズムに基づく近似値です。MEDIAN_ABSOLUTE_DEVIATIONも非決定論的です。つまり、同じデータでも微妙に異なる結果が得られる可能性があります。\n\n式はインライン関数を使用できます。たとえば、複数値列の最大値の中央絶対偏差を計算するには、まず、MV_MAXを使用して行ごとの最大値を取得し、その結果に対してMEDIAN_ABSOLUTE_DEVIATION関数を使用します。\n\n```\nFROM employees\n| STATS m_a_d_max_salary_change = MEDIAN_ABSOLUTE_DEVIATION(MV_MAX(salary_change))\n```\n\n", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianFunction": "MEDIAN", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianFunction.markdown": "### MEDIAN\n全数値の半分より大きく、全数値の半分より小さい値で、50%パーセンタイルとも呼ばれる値を返します。\n\n**注：**PERCENTILEと同様に、通常MEDIANはTDigestアルゴリズムに基づく近似値です。\n\n**警告：** MEDIANは[非決定性](https://en.wikipedia.org/wiki/Nondeterministic_algorithm)です。つまり、同じデータでも微妙に異なる結果が得られる可能性があります。\n\n例：\n\n```\nFROM employees\n| STATS MEDIAN(salary), PERCENTILE(salary, 50)\n```\n\n式はインライン関数を使用できます。たとえば、複数値列の最大値の中央値を計算するには、まず、MV_MAXを使用して行ごとに最大値を求め、その結果にMEDIAN関数を適用します。\n\n```\nFROM employees\n| STATS median_max_salary_change = MEDIAN(MV_MAX(salary_change))\n```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.minFunction": "MIN", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.minFunction.markdown": "### MIN\n数値フィールドの最小値を返します。\n\n```\nFROM employees\n| STATS MIN(languages)\n```\n\n式はインライン関数を使用できます。たとえば、複数値列の平均に対して最小値を計算するには、まず、MV_AVGを使用して行ごとに複数の値の平均を求め、その結果にMIN関数を適用します。\n\n```\nFROM employees\n| STATS min_avg_salary_change = MIN(MV_AVG(salary_change))\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_append": "MV_APPEND", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_append.markdown": "\n\n ### MV_APPEND\n 2つの複数値フィールドの値を連結します\n\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_avg": "MV_AVG", @@ -7334,8 +7308,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mvExpand.markdown": "### MV_EXPAND\nMV_EXPAND処理コマンドは、複数値フィールドを値ごとに1行に展開し、他のフィールドを複製します。 \n```\nROW a=[1,2,3], b=\"b\", j=[\"a\",\"b\"]\n| MV_EXPAND a\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.now": "NOW", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.now.markdown": "\n\n ### NOW\n 現在の日付と時刻を返します。\n\n ```\n ROW current_date = NOW()\n ```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.percentileFunction": "PERCENTILE", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.percentileFunction.markdown": "### PERCENTILE\n観測値の特定の割合で発生する値。たとえば、95パーセンタイルは観測値の95%より大きい値で、50パーセンタイルはMEDIAN`です。\n\n```\nFROM employees\n| STATS p0 = PERCENTILE(salary, 0)\n , p50 = PERCENTILE(salary, 50)\n , p99 = PERCENTILE(salary, 99)\n```\n\n**注**：PERCENTILEは通常TDigestアルゴリズムに基づく近似値です。\n\n**警告：**PERCENTILEは[非決定性](https://en.wikipedia.org/wiki/Nondeterministic_algorithm)です。つまり、同じデータでも微妙に異なる結果が得られる可能性があります。\n\n式はインライン関数を使用できます。たとえば、複数値列の最大値のパーセンタイルを計算するには、まず、MV_MAXを使用して行ごとの最大値を取得し、その結果に対してMEDIAN_ABSOLUTE_DEVIATION関数を使用します。\n\n```\nFROM employees\n| STATS p80_max_salary_change = PERCENTILE(MV_MAX(salary_change), 80)\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pi": "PI", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pi.markdown": "\n\n ### PI\n 円の円周と直径の比率であるPiを返します。\n\n ```\n ROW PI()\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pow": "POW", @@ -7388,14 +7360,10 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.starts_with.markdown": "\n\n ### STARTS_WITH\n キーワード文字列が他の文字列で始まるかどうかを示すブール値を返します。\n\n ```\n FROM employees\n | KEEP last_name\n | EVAL ln_S = STARTS_WITH(last_name, \"B\")\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.statsby": "STATS ...BY", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.statsby.markdown": "### STATS ...BY\nSTATS ...BYを使用すると、共通の値に従って行をグループ化し、グループ化された行に対する1つ以上の集約値を計算します。\n\n**例**：\n\n```\nFROM employees\n| STATS count = COUNT(emp_no) BY languages\n| SORT languages\n```\n\nBYが省略された場合、出力テーブルには、データセット全体に適用された集約が正確に1行だけ含まれます。\n\n```\nFROM employees\n| STATS avg_lang = AVG(languages)\n```\n\n複数の値を計算することができます。\n\n```\nFROM employees\n| STATS avg_lang = AVG(languages), max_lang = MAX(languages)\n```\n\n複数の値でグループ化することも可能です（longおよびkeywordファミリーフィールドでのみサポート）。\n\n```\nFROM employees\n| EVAL hired = DATE_FORMAT(hire_date, \"YYYY\")\n| STATS avg_salary = AVG(salary) BY hired, languages.long\n| EVAL avg_salary = ROUND(avg_salary)\n| SORT hired, languages.long\n```\n\nSTATS ...BYで使用できる関数の一覧については、**集計関数**を参照してください。\n\n集計関数とグループ式の両方で他の関数を使用できます。これは、複数値列でSTATS...BYを使用するときに有用です。たとえば、平均給与変動を計算するには、まず、MV_AVGを使用して従業員ごとに複数の値の平均を求め、その結果にAVG関数を適用します。\n\n```\nFROM employees\n| STATS avg_salary_change = AVG(MV_AVG(salary_change))\n```\n\n式によるグループ化の例は、姓の最初の文字で従業員をグループ化することです。\n\n```\nFROM employees\n| STATS my_count = COUNT() BY LEFT(last_name, 1)\n| SORT `LEFT(last_name, 1)`\n```\n\n出力列名の指定は任意です。指定しない場合は、新しい列名が式と等しくなります。次のクエリーは列\"AVG(salary)\"を返します。\n\n```\nFROM employees\n| STATS AVG(salary)\n```\n\nこの名前には特殊文字が含まれているため、後続のコマンドで使用するときには、バッククオート（`）で囲む必要があります。\n\n```\nFROM employees\n| STATS AVG(salary)\n| EVAL avg_salary_rounded = ROUND(`AVG(salary)`)\n```\n\n**注**：グループなしのSTATSは、グループを追加するよりも大幅に高速です。\n\n**注**：単一式でのグループは、現在、複数式でのグループよりも大幅に最適化されています。\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stCentroidFunction": "ST_CENTROID_AGG", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stCentroidFunction.markdown": "### ST_CENTROID_AGG\n**警告：この機能はテクニカルプレビュー中であり、将来のリリースでは変更されたり削除されたりする場合があります。Elasticはすべての問題の修正に努めますが、テクニカルプレビュー中の機能には正式なGA機能のサポートSLAが適用されません。**\n\n空間点ジオメトリタイプのフィールドで、空間中心を計算します。\n\n```\nFROM airports\n| STATS centroid=ST_CENTROID_AGG(location)\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stringOperators": "LIKEおよびRLIKE", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stringOperators.markdown": "### LIKEおよびRLIKE\nワイルドカードや正規表現を使った文字列比較にはLIKEまたはRLIKEを使います。\n\nワイルドカードを使って文字列を一致させるにはLIKEを使います。次のワイルドカード文字がサポートされています。\n\n* `*`は0文字以上と一致します。\n* `?`は1文字と一致します。\n\n```\nFROM employees\n| WHERE first_name LIKE \"?b*\"\n| KEEP first_name, last_name\n```\n\n正規表現を使って文字列を一致させるには、RLIKEを使います。\n\n```\nFROM employees\n| WHERE first_name RLIKE \".leja.*\"\n| KEEP first_name, last_name\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.substring": "SUBSTRING", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.substring.markdown": "\n\n ### SUBSTRING\n 文字列のサブ文字列を、開始位置とオプションの長さで指定して返します。\n\n ```\n FROM employees\n | KEEP last_name\n | EVAL ln_sub = SUBSTRING(last_name, 1, 3)\n ```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sumFunction": "SUM", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sumFunction.markdown": "### SUM\n数値フィールドの合計を返します。\n\n```\nFROM employees\n| STATS SUM(languages)\n```\n\n式はインライン関数を使用できます。たとえば、各従業員の最大給与変動の総計を計算するには、MV_MAX関数を各行に適用してから、その結果にSUMを適用します。\n\n```\nFROM employees\n| STATS total_salary_changes = SUM(MV_MAX(salary_change))\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tan": "TAN", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tan.markdown": "\n\n ### TAN\n 角度の正接三角関数を返します。\n\n ```\n ROW a=1.8 \n | EVAL tan=TAN(a)\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tanh": "TANH", @@ -7440,8 +7408,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_version.markdown": "\n\n ### TO_VERSION\n 入力文字列をバージョン値に変換します。\n\n ```\n ROW v = TO_VERSION(\"1.2.3\")\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.trim": "TRIM", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.trim.markdown": "\n\n ### TRIM\n 文字列から先頭と末尾の空白を削除します。\n\n ```\n ROW message = \" some text \", color = \" red \"\n | EVAL message = TRIM(message)\n | EVAL color = TRIM(color)\n ```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.valuesFunction": "VALUES", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.valuesFunction.markdown": "### 値\n\n**警告：本番環境ではVALUESを使用しないでください。この機能はテクニカルプレビュー中であり、将来のリリースでは変更されたり削除されたりする場合があります。Elasticはすべての問題の修正に努めますが、テクニカルプレビュー中の機能には正式なGA機能のサポートSLAが適用されません。**\n\nグループのすべての値を複数値フィールドとして返します。返された値の順序は保証されません。返された値を並べ替える必要がある場合はMV_SORTを使用します。\n\ngeo_point、cartesian_point、geo_shape、またはcartesian_shapeを除く任意のタイプの式を使用できます。\n\n\n例：\n\n```\n FROM employees\n| EVAL first_letter = SUBSTRING(first_name, 0, 1)\n| STATS first_name=MV_SORT(VALUES(first_name)) BY first_letter\n| SORT first_letter\n```\n\n> _**警告：** これはメモリの使用量が非常に大きくなるため、ES|QLはメモリを超えると、集約を拡大しません。このため、この集約は、収集する値がメモリに収まらなくなるまでは機能します。収集する値が多くなりすぎると、[回路ブレーカーエラー](https://www.elastic.co/guide/en/elasticsearch/reference/current/circuit-breaker-errors.html)でクエリが失敗します。_\n\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.where": "WHERE", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.where.markdown": "### WHERE\nWHEREを使用すると、入力テーブルから、指定した条件がtrueと評価されるすべての行を含むテーブルを作成します。\n \n```\nFROM employees\n| KEEP first_name, last_name, still_hired\n| WHERE still_hired == true\n```\n\n#### 演算子\n\nサポートされている演算子の概要については、**演算子**を参照してください。\n\n#### 関数\nWHEREは値を計算するためのさまざまな関数をサポートしています。**関数**をクリックすると詳細が表示されます。\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationLabel": "ドキュメント", diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json index 7a0121a444e71..a2dd46f2f7c18 100644 --- a/x-pack/plugins/translations/translations/zh-CN.json +++ b/x-pack/plugins/translations/translations/zh-CN.json @@ -5336,7 +5336,6 @@ "kbn-esql-validation-autocomplete.esql.definitions.atan": "返回输入数字表达式的反正切\n作为角度，以弧度表示。", "kbn-esql-validation-autocomplete.esql.definitions.atan2": "笛卡儿平面中正 x 轴\n与从原点到点 (x , y) 构成的射线之间的角度，以弧度表示。", "kbn-esql-validation-autocomplete.esql.definitions.autoBucketDoc": "根据给定范围和存储桶目标自动收集存储桶日期。", - "kbn-esql-validation-autocomplete.esql.definitions.avgDoc": "返回字段中的值的平均值", "kbn-esql-validation-autocomplete.esql.definitions.byDoc": "依据", "kbn-esql-validation-autocomplete.esql.definitions.case": "接受成对的条件和值。此函数返回属于第一个评估为 `true` 的条件的值。如果参数数量为奇数，则最后一个参数为在无条件匹配时返回的默认值。", "kbn-esql-validation-autocomplete.esql.definitions.cbrt": "返回数字的立方根。输入可以为任何数字值，返回值始终为双精度值。\n无穷大的立方根为 null。", @@ -5350,8 +5349,6 @@ "kbn-esql-validation-autocomplete.esql.definitions.concat": "串联两个或多个字符串。", "kbn-esql-validation-autocomplete.esql.definitions.cos": "返回角度的余弦。", "kbn-esql-validation-autocomplete.esql.definitions.cosh": "返回角度的双曲余弦。", - "kbn-esql-validation-autocomplete.esql.definitions.countDistinctDoc": "返回字段中不同值的计数。", - "kbn-esql-validation-autocomplete.esql.definitions.countDoc": "返回字段中的值的计数。", "kbn-esql-validation-autocomplete.esql.definitions.date_diff": "从 `endTimestamp` 中减去 `startTimestamp`，并以倍数 `unit` 返回差异。\n如果 `startTimestamp` 晚于 `endTimestamp`，则返回负值。", "kbn-esql-validation-autocomplete.esql.definitions.date_extract": "提取日期的某些部分，如年、月、日、小时。", "kbn-esql-validation-autocomplete.esql.definitions.date_format": "以提供的格式返回日期的字符串表示形式。", @@ -5396,12 +5393,8 @@ "kbn-esql-validation-autocomplete.esql.definitions.log": "以某底数返回值的对数。输入可以为任何数字值，返回值始终为双精度值。\n\n求零、负数的对数，以及底数为一时将返回 `null`，并显示警告。", "kbn-esql-validation-autocomplete.esql.definitions.log10": "以底数 10 返回值的对数。输入可以为任何数字值，返回值始终为双精度值。\n\n求 0 和负数的对数时将返回 `null`，并显示警告。", "kbn-esql-validation-autocomplete.esql.definitions.ltrim": "从字符串中移除前导空格。", - "kbn-esql-validation-autocomplete.esql.definitions.maxDoc": "返回字段中的最大值。", - "kbn-esql-validation-autocomplete.esql.definitions.medianDeviationDoc": "返回每个数据点的中位数与整个样例的中位数的偏差。", - "kbn-esql-validation-autocomplete.esql.definitions.medianDoc": "返回 50% 百分位数。", "kbn-esql-validation-autocomplete.esql.definitions.metadataDoc": "元数据", "kbn-esql-validation-autocomplete.esql.definitions.metricsDoc": "特定于指标的源命令，使用此命令可从 TSDB 索引加载数据。类似于 STATS 命令，可对传入的搜索结果集计算汇总统计信息，如平均值、计数和总和。在不含 BY 子句的情况下使用时，只返回一行内容，即聚合传入的整个搜索结果集。使用 BY 子句时，将为在 BY 子句中指定的字段中的每个不同值返回一行内容。此命令仅返回聚合中的字段，并且您可以将一系列统计函数与 stats 命令搭配在一起使用。执行多个聚合时，请用逗号分隔每个聚合。", - "kbn-esql-validation-autocomplete.esql.definitions.minDoc": "返回字段中的最小值。", "kbn-esql-validation-autocomplete.esql.definitions.mv_append": "串联两个多值字段的值。", "kbn-esql-validation-autocomplete.esql.definitions.mv_avg": "将多值字段转换为包含所有值的平均值的单值字段。", "kbn-esql-validation-autocomplete.esql.definitions.mv_concat": "将多值字符串表达式转换为单值列，其中包含由分隔符分隔的所有值的串联形式。", @@ -5419,7 +5412,6 @@ "kbn-esql-validation-autocomplete.esql.definitions.mvExpandDoc": "将多值字段扩展成每个值一行，从而复制其他字段", "kbn-esql-validation-autocomplete.esql.definitions.now": "返回当前日期和时间。", "kbn-esql-validation-autocomplete.esql.definitions.onDoc": "开启", - "kbn-esql-validation-autocomplete.esql.definitions.percentiletDoc": "返回字段的第 n 个百分位。", "kbn-esql-validation-autocomplete.esql.definitions.pi": "返回 Pi，即圆的周长与其直径的比率。", "kbn-esql-validation-autocomplete.esql.definitions.pow": "返回提升为 `exponent` 幂的 `base` 的值。", "kbn-esql-validation-autocomplete.esql.definitions.renameDoc": "将旧列重命名为新列", @@ -5445,9 +5437,7 @@ "kbn-esql-validation-autocomplete.esql.definitions.st_y": "从提供的点中提取 `y` 坐标。\n如果点的类型为 `geo_point`，则这等同于提取 `latitude` 值。", "kbn-esql-validation-autocomplete.esql.definitions.starts_with": "返回指示关键字字符串是否以另一个字符串开头的布尔值。", "kbn-esql-validation-autocomplete.esql.definitions.statsDoc": "对传入的搜索结果集计算汇总统计信息，如平均值、计数和总和。与 SQL 聚合类似，如果使用不含 BY 子句的 stats 命令，则只返回一行内容，即聚合传入的整个搜索结果集。使用 BY 子句时，将为在 BY 子句中指定的字段中的每个不同值返回一行内容。stats 命令仅返回聚合中的字段，并且您可以将一系列统计函数与 stats 命令搭配在一起使用。执行多个聚合时，请用逗号分隔每个聚合。", - "kbn-esql-validation-autocomplete.esql.definitions.stCentroidDoc": "返回字段中不同值的计数。", "kbn-esql-validation-autocomplete.esql.definitions.substring": "返回字符串的子字符串，用起始位置和可选长度指定", - "kbn-esql-validation-autocomplete.esql.definitions.sumDoc": "返回字段中的值的总和。", "kbn-esql-validation-autocomplete.esql.definitions.tan": "返回角度的正切三角函数。", "kbn-esql-validation-autocomplete.esql.definitions.tanh": "返回角度的正切双曲函数。", "kbn-esql-validation-autocomplete.esql.definitions.tau": "返回圆的圆周长与其半径的比率。", @@ -5469,10 +5459,8 @@ "kbn-esql-validation-autocomplete.esql.definitions.to_unsigned_long": "将输入值转换为无符号长整型值。如果输入参数为日期类型，\n会将其值解析为自 Unix epoch 以来的毫秒数，并转换为无符号长整型值。\n布尔值 *true* 将转换为无符号长整型值 *1*，*false* 转换为 *0*。", "kbn-esql-validation-autocomplete.esql.definitions.to_upper": "返回一个新字符串，表示已将输入字符串转为大写。", "kbn-esql-validation-autocomplete.esql.definitions.to_version": "将输入字符串转换为版本值。", - "kbn-esql-validation-autocomplete.esql.definitions.topListDoc": "收集每个存储桶的排名前 N 值。", "kbn-esql-validation-autocomplete.esql.definitions.trim": "从字符串中移除前导和尾随空格。", "kbn-esql-validation-autocomplete.esql.definitions.values": "以数组的形式返回组中的所有值。", - "kbn-esql-validation-autocomplete.esql.definitions.weightedAvgDoc": "计算从聚合文档提取的数值的加权平均值的聚合。", "kbn-esql-validation-autocomplete.esql.definitions.whereDoc": "使用“predicate-expressions”可筛选搜索结果。进行计算时，谓词表达式将返回 TRUE 或 FALSE。where 命令仅返回计算结果为 TRUE 的结果。例如，筛选特定字段值的结果", "kbn-esql-validation-autocomplete.esql.definitions.withDoc": "具有", "kbn-esql-validation-autocomplete.esql.divide.warning.divideByZero": "不能除以零：{left}/{right}", @@ -7222,8 +7210,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.atan2.markdown": "\n\n ### ATAN2\n 笛卡儿平面中正 x 轴\n 与从原点到点 (x , y) 构成的射线之间的角度，以弧度表示。\n\n ```\n ROW y=12.9, x=.6\n | EVAL atan2=ATAN2(y, x)\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.autoBucketFunction": "BUCKET", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.autoBucketFunction.markdown": "### BUCKET\n用日期时间或数字输入创建值（存储桶）的分组。存储桶的大小可以直接提供，或基于建议的计数和值范围进行选择。\n\n`BUCKET` 以两种模式运行：\n\n1.在此模式下基于存储桶计数建议（四个参数）和范围计算存储桶的大小。\n2.在此模式下直接提供存储桶大小（两个参数）。\n\n使用存储桶的目标数量、起始范围和结束范围，`BUCKET` 将选取适当的存储桶大小以生成目标数量或更小数量的存储桶。\n\n例如，一年请求多达 20 个存储桶会按每月时间间隔组织数据：\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hire_date = MV_SORT(VALUES(hire_date)) BY month = BUCKET(hire_date, 20, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT hire_date\n```\n\n**注意**：目标并不是提供存储桶的确切目标数量，而是选择一个范围，最多提供存储桶的目标数量。\n\n可以组合 `BUCKET` 与聚合以创建直方图：\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hires_per_month = COUNT(*) BY month = BUCKET(hire_date, 20, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT month\n```\n\n**注意**：`BUCKET` 不会创建未匹配任何文档的存储桶。因此，上一示例缺少 `1985-03-01` 和其他日期。\n\n如果需要更多存储桶，可能导致更小的范围。例如，如果一年内最多请求 100 个存储桶，会导致周期为周的存储桶：\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 100, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT week\n```\n\n**注意**：`AUTO_BUCKET` 不筛选任何行。它只会使用提供的范围来选取适当的存储桶大小。对于值超出范围的行，它会返回与超出范围的存储桶对应的存储桶值。组合 `BUCKET` 与 `WHERE` 可筛选行。\n\n如果提前已知所需存储桶大小，则只需提供它作为第二个参数，而忽略范围：\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS hires_per_week = COUNT(*) BY week = BUCKET(hire_date, 1 week)\n| SORT week\n```\n\n**注意**：提供存储桶大小作为第二个参数时，它必须为持续时间或日期期间。\n\n`BUCKET` 还可对数字字段执行操作。例如，要创建工资直方图：\n\n```\nFROM employees\n| STATS COUNT(*) by bs = BUCKET(salary, 20, 25324, 74999)\n| SORT bs\n```\n\n与前面的有意筛选日期范围示例不同，您极少想要筛选数值范围。您必须分别查找最小值和最大值。ES|QL 尚未提供简便方法来自动执行此操作。\n\n如果提前已知所需存储桶大小，则可以忽略该范围。只需提供它作为第二个参数即可：\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS c = COUNT(1) BY b = BUCKET(salary, 5000.)\n| SORT b\n```\n\n**注意**：提供存储桶大小作为第二个参数时，它必须为 **浮点类型**。\n\n这里提供了一个示例，用于为过去 24 小时创建小时存储桶，并计算每小时的事件数：\n\n```\nFROM sample_data\n| WHERE @timestamp >= NOW() - 1 day and @timestamp < NOW()\n| STATS COUNT(*) BY bucket = BUCKET(@timestamp, 25, NOW() - 1 day, NOW())\n```\n\n这里提供了一个示例，用于为 1985 年创建月度存储桶，并按聘用月份计算平均工资：\n\n```\nFROM employees\n| WHERE hire_date >= \"1985-01-01T00:00:00Z\" AND hire_date < \"1986-01-01T00:00:00Z\"\n| STATS AVG(salary) BY bucket = BUCKET(hire_date, 20, \"1985-01-01T00:00:00Z\", \"1986-01-01T00:00:00Z\")\n| SORT bucket\n```\n\n`BUCKET` 可用在 `STATS …​ BY …`​ 命令的聚合和分组部分， 前提是在聚合部分中，该函数 **由在分组部分中定义的别名引用**，或使用完全相同的表达式调用。\n\n例如：\n\n```\nFROM employees\n| STATS s1 = b1 + 1, s2 = BUCKET(salary / 1000 + 999, 50.) + 2 BY b1 = BUCKET(salary / 100 + 99, 50.), b2 = BUCKET(salary / 1000 + 999, 50.)\n| SORT b1, b2\n| KEEP s1, b1, s2, b2\n```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.avgFunction": "AVG", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.avgFunction.markdown": "### AVG\n返回数字字段的平均值。\n\n```\nFROM employees\n| STATS AVG(height)\n```\n\n此表达式可使用内联函数。例如，要计算一个多值列的平均值，应首先使用 `MV_AVG` 对每行的多个值求平均值，然后将结果用于 `AVG` 函数：\n\n```\nFROM employees\n| STATS avg_salary_change = AVG(MV_AVG(salary_change))\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.binaryOperators": "二进制运算符", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.binaryOperators.markdown": "### 二进制运算符\n支持这些二进制比较运算符：\n\n* 等于：`==`\n* 不等于：`!=`\n* 小于：`<`\n* 小于或等于：`<=`\n* 大于：`>`\n* 大于或等于：`>=`\n* 加：`+`\n* 减：`-`\n* 乘：`*`\n* 除：`/`\n* 取模：`%`\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.booleanOperators": "布尔运算符", @@ -7248,10 +7234,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cos.markdown": "\n\n ### COS\n 返回角度的余弦。\n\n ```\n ROW a=1.8 \n | EVAL cos=COS(a)\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cosh": "COSH", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.cosh.markdown": "\n\n ### COSH\n 返回角度的双曲余弦。\n\n ```\n ROW a=1.8 \n | EVAL cosh=COSH(a)\n ```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countDistinctFunction": "COUNT_DISTINCT", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countDistinctFunction.markdown": "### COUNT_DISTINCT\n对不同值的近似数进行计数。\n\n```\nFROM hosts\n| STATS COUNT_DISTINCT(ip0), COUNT_DISTINCT(ip1)\n```\n\n`COUNT_DISTINCT` 函数为基于 HyperLogLog++ 算法的近似计算。请参阅此[文档](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-cardinality-aggregation.html#_counts_are_approximate)了解更多信息。精确度可使用可选的第二个参数进行配置。支持的最大值为 40000。高于此数字的阈值与阈值 40000 的效果相同。默认值为 3000。\n\n```\nFROM hosts\n| STATS COUNT_DISTINCT(ip0, 80000), COUNT_DISTINCT(ip1, 5)\n```\n\n此表达式可使用内联函数。此示例会使用 `SPLIT` 函数将字符串拆分成多个值，并对唯一值进行计数：\n\n```\nROW words=\"foo;bar;baz;qux;quux;foo\"\n| STATS distinct_word_count = COUNT_DISTINCT(SPLIT(words, \";\"))\n```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countFunction": "COUNT", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.countFunction.markdown": "### COUNT\n返回输入值的总数（计数）。\n\n```\nFROM employees\n| STATS COUNT(height)\n```\n\n可接受任何字段类型作为输入。\n\n要计算行数，请使用 `COUNT()` 或 `COUNT(*)`：\n\n```\nFROM employees\n| STATS count = COUNT(*) BY languages\n| SORT languages DESC\n```\n\n此表达式可使用内联函数。此示例会使用 `SPLIT` 函数将字符串拆分成多个值，并对值进行计数：\n\n```\nROW words=\"foo;bar;baz;qux;quux;foo\"\n| STATS word_count = COUNT(SPLIT(words, \";\"))\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_diff": "DATE_DIFF", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_diff.markdown": "\n\n ### DATE_DIFF\n 从 `endTimestamp` 中减去 `startTimestamp`，并以倍数 `unit` 返回差异。\n 如果 `startTimestamp` 晚于 `endTimestamp`，则返回负值。\n\n ```\n ROW date1 = TO_DATETIME(\"2023-12-02T11:00:00.000Z\"), date2 = TO_DATETIME(\"2023-12-02T11:00:00.001Z\")\n | EVAL dd_ms = DATE_DIFF(\"microseconds\", date1, date2)\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.date_extract": "DATE_EXTRACT", @@ -7307,14 +7289,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ltrim": "LTRIM", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.ltrim.markdown": "\n\n ### LTRIM\n 从字符串中移除前导空格。\n\n ```\n ROW message = \" some text \", color = \" red \"\n | EVAL message = LTRIM(message)\n | EVAL color = LTRIM(color)\n | EVAL message = CONCAT(\"'\", message, \"'\")\n | EVAL color = CONCAT(\"'\", color, \"'\")\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.markdown": "## ES|QL\n\nES|QL（Elasticsearch 查询语言）查询包含一系列命令，它们用管道字符分隔：`|`。每个查询以**源命令**开头，它会生成一个表，其中通常包含来自 Elasticsearch 的数据。\n\n源命令可后接一个或多个**处理命令**。处理命令可通过添加、移除以及更改行和列来更改前一个命令的输出表。\n\n```\nsource-command\n| processing-command1\n| processing-command2\n```\n\n查询的结果为由最后的处理命令生成的表。 \n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.maxFunction": "MAX", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.maxFunction.markdown": "### MAX\n返回数字表达式的最大值。\n\n```\nFROM employees\n| STATS MAX(languages)\n```\n\n此表达式可使用内联函数。例如，要计算一个多值列的平均值的最大值，应首先使用 `MV_AVG` 对每行的多个值求平均值，然后将结果用于 `MAX` 函数：\n\n```\nFROM employees\n| STATS max_avg_salary_change = MAX(MV_AVG(salary_change))\n```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianAbsoluteDeviationFunction": "MEDIAN_ABSOLUTE_DEVIATION", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianAbsoluteDeviationFunction.markdown": "### MEDIAN_ABSOLUTE_DEVIATION\n返回中位数绝对偏差，衡量可变性。这是一种稳健统计，意味着它可用于描述可能包含离群值，或可能不是正态分布的数据。对于此类数据，它比标准偏差更具描述性。\n\n它计算为每个数据点的中位数与整个样例的中位数的偏差。也就是说，对于随机变量 X，中位数绝对偏差为 `median(|median(X) - X|)`。\n\n```\nFROM employees\n| STATS MEDIAN(salary), MEDIAN_ABSOLUTE_DEVIATION(salary)\n```\n\n注意：与 `PERCENTILE` 一样，`MEDIAN_ABSOLUTE_DEVIATION` 通常为基于 TDigest 算法的近似计算。`MEDIAN_ABSOLUTE_DEVIATION` 也具有非确定性。这意味着，即使使用相同的数据，但您得到的结果可能会略有不同。\n\n此表达式可使用内联函数。例如，要计算一个多值列的最大值的中位数绝对偏差，应首先使用 `MV_MAX` 获取每行的最大值，然后将结果用于 `MEDIAN_ABSOLUTE_DEVIATION` 函数：\n\n```\nFROM employees\n| STATS m_a_d_max_salary_change = MEDIAN_ABSOLUTE_DEVIATION(MV_MAX(salary_change))\n```\n\n", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianFunction": "MEDIAN", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.medianFunction.markdown": "### MEDIAN\n返回大于所有值的一半且小于所有值的一半的值，也称为 50% `PERCENTILE`。\n\n**注意：**与 `PERCENTILE` 一样，`MEDIAN` 通常为基于 TDigest 算法的近似计算。\n\n**警告：** `MEDIAN` 也具有[非确定性](https://en.wikipedia.org/wiki/Nondeterministic_algorithm)。这意味着，即使使用相同的数据，但您得到的结果可能会略有不同。\n\n例如：\n\n```\nFROM employees\n| STATS MEDIAN(salary), PERCENTILE(salary, 50)\n```\n\n此表达式可使用内联函数。例如，要计算一个多值列的最大值的中位数，应首先使用 `MV_MAX` 获取每行的最大值，然后将结果用于 `MEDIAN` 函数：\n\n```\nFROM employees\n| STATS median_max_salary_change = MEDIAN(MV_MAX(salary_change))\n```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.minFunction": "MIN", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.minFunction.markdown": "### MIN\n返回数字字段的最小值。\n\n```\nFROM employees\n| STATS MIN(languages)\n```\n\n此表达式可使用内联函数。例如，要计算一个多值列的平均值的最小值，应首先使用 `MV_AVG` 对每行的多个值求平均值，然后将结果用于 `MIN` 函数：\n\n```\nFROM employees\n| STATS min_avg_salary_change = MIN(MV_AVG(salary_change))\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_append": "MV_APPEND", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_append.markdown": "\n\n ### MV_APPEND\n 串联两个多值字段的值。\n\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mv_avg": "MV_AVG", @@ -7347,8 +7321,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.mvExpand.markdown": "### MV_EXPAND\n`MV_EXPAND` 处理命令将多值字段扩展成每个值一行，从而复制其他字段： \n```\nROW a=[1,2,3], b=\"b\", j=[\"a\",\"b\"]\n| MV_EXPAND a\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.now": "NOW", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.now.markdown": "\n\n ### NOW\n 返回当前日期和时间。\n\n ```\n ROW current_date = NOW()\n ```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.percentileFunction": "PERCENTILE", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.percentileFunction.markdown": "### PERCENTILE\n出现某个百分比的观察值时的值。例如，第 95 个百分位是大于 95% 的观察值的值，第 50 个百分位是 `MEDIAN`。\n\n```\nFROM employees\n| STATS p0 = PERCENTILE(salary, 0)\n , p50 = PERCENTILE(salary, 50)\n , p99 = PERCENTILE(salary, 99)\n```\n\n**注意：** `PERCENTILE` 通常为基于 TDigest 算法的近似计算。\n\n**警告：** `PERCENTILE` 也具有[非确定性](https://en.wikipedia.org/wiki/Nondeterministic_algorithm)。这意味着，即使使用相同的数据，但您得到的结果可能会略有不同。\n\n此表达式可使用内联函数。例如，要计算一个多值列的最大值的百分位数，应首先使用 `MV_MAX` 获取每行的最大值，然后将结果用于 `PERCENTILE` 函数：\n\n```\nFROM employees\n| STATS p80_max_salary_change = PERCENTILE(MV_MAX(salary_change), 80)\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pi": "PI", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pi.markdown": "\n\n ### PI\n 返回 Pi，即圆的周长与其直径的比率。\n\n ```\n ROW PI()\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.pow": "POW", @@ -7401,14 +7373,10 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.starts_with.markdown": "\n\n ### STARTS_WITH\n 返回指示关键字字符串是否以另一个字符串开头的布尔值。\n\n ```\n FROM employees\n | KEEP last_name\n | EVAL ln_S = STARTS_WITH(last_name, \"B\")\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.statsby": "STATS ...BY", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.statsby.markdown": "### STATS ...BY\n使用 `STATS ...BY` 可根据公共值对行分组，并计算已分组行中的一个或多个聚合值。\n\n**示例**：\n\n```\nFROM employees\n| STATS count = COUNT(emp_no) BY languages\n| SORT languages\n```\n\n如果省略 `BY`，输出表实际将包含一行，其中为应用于整个数据集的聚合：\n\n```\nFROM employees\n| STATS avg_lang = AVG(languages)\n```\n\n可以计算多个值：\n\n```\nFROM employees\n| STATS avg_lang = AVG(languages), max_lang = MAX(languages)\n```\n\n也可以按多个值分组（仅长整型和关键字家族字段支持）：\n\n```\nFROM employees\n| EVAL hired = DATE_FORMAT(hire_date, \"YYYY\")\n| STATS avg_salary = AVG(salary) BY hired, languages.long\n| EVAL avg_salary = ROUND(avg_salary)\n| SORT hired, languages.long\n```\n\n请参阅**聚合函数**获取可与 `STATS ...BY` 搭配使用的函数列表。\n\n聚合函数和分组表达式均接受其他函数。这在对多值列使用 `STATS...BY` 时有用。例如，要计算平均工资变动，可以首先使用 `MV_AVG` 对每名员工的多个值求平均值，然后将结果用于 `AVG` 函数：\n\n```\nFROM employees\n| STATS avg_salary_change = AVG(MV_AVG(salary_change))\n```\n\n按表达式分组的示例为根据员工姓氏的第一个字母对其进行分组：\n\n```\nFROM employees\n| STATS my_count = COUNT() BY LEFT(last_name, 1)\n| SORT `LEFT(last_name, 1)`\n```\n\n指定输出列名称为可选操作。如果未指定，新列名称等于该表达式。以下查询将返回名为 `AVG(salary)` 的列：\n\n```\nFROM employees\n| STATS AVG(salary)\n```\n\n由于此名称包含特殊字符，在后续命令中使用该名称时，需要用反撇号 (`) 引用它：\n\n```\nFROM employees\n| STATS AVG(salary)\n| EVAL avg_salary_rounded = ROUND(`AVG(salary)`)\n```\n\n**注意**：不包含任何组的 `STATS` 比添加组更快。\n\n**注意**：当前，根据单一表达式进行分组比根据许多表达式进行分组更为优化。\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stCentroidFunction": "ST_CENTROID_AGG", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stCentroidFunction.markdown": "### ST_CENTROID_AGG\n**警告：此功能处于技术预览状态，在未来版本中可能会更改或移除。Elastic 将努力修复任何问题，但处于技术预览状态的功能不受正式 GA 功能支持 SLA 的约束。**\n\n对包含空间点几何图形类型的字段计算空间重心。\n\n```\nFROM airports\n| STATS centroid=ST_CENTROID_AGG(location)\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stringOperators": "LIKE 和 RLIKE", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.stringOperators.markdown": "### LIKE 和 RLIKE\n使用通配符或正则表达式比较字符串时，请使用 `LIKE` 或 `RLIKE`：\n\n使用 `LIKE` 时，可使用通配符来匹配字符串。支持以下通配符字符：\n\n* `*` 匹配零个或更多字符。\n* `?` 匹配一个字符。\n\n```\nFROM employees\n| WHERE first_name LIKE \"?b*\"\n| KEEP first_name, last_name\n```\n\n使用 `RLIKE` 时，可使用正则表达式来匹配字符串：\n\n```\nFROM employees\n| WHERE first_name RLIKE \".leja.*\"\n| KEEP first_name, last_name\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.substring": "SUBSTRING", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.substring.markdown": "\n\n ### SUBSTRING\n 返回字符串的子字符串，用起始位置和可选长度指定\n\n ```\n FROM employees\n | KEEP last_name\n | EVAL ln_sub = SUBSTRING(last_name, 1, 3)\n ```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sumFunction": "SUM", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.sumFunction.markdown": "### SUM\n返回数字字段的总和。\n\n```\nFROM employees\n| STATS SUM(languages)\n```\n\n此表达式可使用内联函数。例如，要计算每名员工的最大工资变动的总和，请对每行应用 `MV_MAX` 函数，然后对结果使用 `SUM`：\n\n```\nFROM employees\n| STATS total_salary_changes = SUM(MV_MAX(salary_change))\n```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tan": "TAN", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tan.markdown": "\n\n ### TAN\n 返回角度的正切三角函数。\n\n ```\n ROW a=1.8 \n | EVAL tan=TAN(a)\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.tanh": "TANH", @@ -7453,8 +7421,6 @@ "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.to_version.markdown": "\n\n ### TO_VERSION\n 将输入字符串转换为版本值。\n\n ```\n ROW v = TO_VERSION(\"1.2.3\")\n ```\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.trim": "TRIM", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.trim.markdown": "\n\n ### TRIM\n 从字符串中移除前导和尾随空格。\n\n ```\n ROW message = \" some text \", color = \" red \"\n | EVAL message = TRIM(message)\n | EVAL color = TRIM(color)\n ```\n ", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.valuesFunction": "VALUES", - "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.valuesFunction.markdown": "### VALUES\n\n**警告：请勿在生产环境中使用 `VALUES`。此功能处于技术预览状态，在未来版本中可能会更改或移除。Elastic 将努力修复任何问题，但处于技术预览状态的功能不受正式 GA 功能支持 SLA 的约束。**\n\n以多值字段的形式返回组中的所有值。无法保证返回值的顺序。如果需要按顺序返回值，请使用 `MV_SORT`。\n\n接受任何类型的表达式，但 `geo_point`、`cartesian_point`、`geo_shape` 或 `cartesian_shape` 除外。\n\n\n例如：\n\n```\n FROM employees\n| EVAL first_letter = SUBSTRING(first_name, 0, 1)\n| STATS first_name=MV_SORT(VALUES(first_name)) BY first_letter\n| SORT first_letter\n```\n\n> _**警告：**这可能会占用大量内存，但除内存以外，ES|QL 尚不会增长聚合。因此，此聚合会正常工作，直到将其用于收集的值超出内存装载量。一旦收集的值过多，查询将会失败，并出现[断路器错误](https://www.elastic.co/guide/en/elasticsearch/reference/current/circuit-breaker-errors.html)。_\n\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.where": "WHERE", "textBasedEditor.query.textBasedLanguagesEditor.documentationESQL.where.markdown": "### WHERE\n使用 `WHERE` 可生成一个表，其中包含输入表中所提供的条件评估为 `true` 的所有行：\n \n```\nFROM employees\n| KEEP first_name, last_name, still_hired\n| WHERE still_hired == true\n```\n\n#### 运算符\n\n请参阅**运算符**了解所支持的运算符的概览。\n\n#### 函数\n`WHERE` 支持各种用于计算值的函数。请参阅**函数**了解更多信息。\n ", "textBasedEditor.query.textBasedLanguagesEditor.documentationLabel": "文档", diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.test.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.test.tsx index 1445ae36debf1..d55dcee2843e0 100644 --- a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.test.tsx @@ -219,7 +219,7 @@ describe('group by expression', () => { expect(onChangeSelectedTermField).toHaveBeenCalledWith(['field1', 'field2']); }); - it('do NOT clears selected agg field if fields is undefined', async () => { + it('do NOT clear selected agg field if fields is undefined', async () => { const onChangeSelectedTermField = jest.fn(); render( @@ -236,4 +236,22 @@ describe('group by expression', () => { ); expect(onChangeSelectedTermField).toHaveBeenCalledTimes(0); }); + + it('do NOT clear selected agg field if fields is an empty array', async () => { + const onChangeSelectedTermField = jest.fn(); + render( + + {}} + onChangeSelectedTermSize={() => {}} + onChangeSelectedTermField={onChangeSelectedTermField} + /> + + ); + expect(onChangeSelectedTermField).toHaveBeenCalledTimes(0); + }); }); diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.tsx index ea59df8eb40ac..be226d8959c78 100644 --- a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.tsx @@ -109,7 +109,7 @@ export const GroupByExpression = ({ }, [selectedTermsFieldsOptions, groupBy, onChangeSelectedTermField]); useEffect(() => { - if (fields) { + if (fields && fields.length > 0) { // if current field set doesn't contain selected field, clear selection const hasUnknownField = selectedTermsFieldsOptions.some( (fieldOption) => !fields.some((field) => field.name === fieldOption.label) diff --git a/x-pack/test_serverless/functional/test_suites/security/ftr/cases/list_view.ts b/x-pack/test_serverless/functional/test_suites/security/ftr/cases/list_view.ts index 4cb9c58a70b94..673dca32d9fd1 100644 --- a/x-pack/test_serverless/functional/test_suites/security/ftr/cases/list_view.ts +++ b/x-pack/test_serverless/functional/test_suites/security/ftr/cases/list_view.ts @@ -20,6 +20,7 @@ export default ({ getPageObject, getService }: FtrProviderContext) => { const svlCases = getService('svlCases'); const svlSecNavigation = getService('svlSecNavigation'); const svlCommonPage = getPageObject('svlCommonPage'); + const toasts = getService('toasts'); describe('Cases List', function () { before(async () => { @@ -217,6 +218,10 @@ export default ({ getPageObject, getService }: FtrProviderContext) => { }); describe('row actions', () => { + afterEach(async () => { + await toasts.dismissAll(); + }); + describe('Status', () => { createNCasesBeforeDeleteAllAfter(1, getPageObject, getService);