[ES|QL] TS Command: Aggregation following Eval on the same field errors out

[limotova]

Query

ts k8s 
| eval s = substring(event, 1, 3)
| stats  c = count(event) by b = bucket(@timestamp,1hour)

Stack trace:

org.elasticsearch.xpack.esql.core.capabilities.UnresolvedException: Invalid call to dataType on an unresolved object ?LASTOVERTIME_$1
        at org.elasticsearch.xpack.esql.core.expression.UnresolvedAttribute.dataType(UnresolvedAttribute.java:130)
        at org.elasticsearch.xpack.esql.expression.function.aggregate.Count.surrogate(Count.java:160)
        at org.elasticsearch.xpack.esql.optimizer.rules.logical.SubstituteSurrogateAggregations.rule(SubstituteSurrogateAggregations.java:53)
        at org.elasticsearch.xpack.esql.optimizer.rules.logical.SubstituteSurrogateAggregations.rule(SubstituteSurrogateAggregations.java:35)
        at org.elasticsearch.xpack.esql.core.tree.Node.lambda$transformUp$10(Node.java:238)
        at org.elasticsearch.xpack.esql.core.tree.Node.transformUp(Node.java:233)
        at org.elasticsearch.xpack.esql.core.tree.Node.lambda$transformUp$9(Node.java:231)
        at org.elasticsearch.xpack.esql.core.tree.Node.transformChildren(Node.java:256)
        at org.elasticsearch.xpack.esql.core.tree.Node.transformUp(Node.java:231)
        at org.elasticsearch.xpack.esql.core.tree.Node.transformUp(Node.java:238)
        at org.elasticsearch.xpack.esql.optimizer.rules.logical.OptimizerRules$OptimizerRule.apply(OptimizerRules.java:38)
        at org.elasticsearch.xpack.esql.optimizer.rules.logical.OptimizerRules$OptimizerRule.apply(OptimizerRules.java:22)
        at org.elasticsearch.xpack.esql.rule.ParameterizedRuleExecutor.lambda$transform$1(ParameterizedRuleExecutor.java:29)
        at org.elasticsearch.xpack.esql.rule.RuleExecutor$Transformation.<init>(RuleExecutor.java:111)
        at org.elasticsearch.xpack.esql.rule.RuleExecutor.executeWithInfo(RuleExecutor.java:190)
        at org.elasticsearch.xpack.esql.rule.RuleExecutor.execute(RuleExecutor.java:159)
        at org.elasticsearch.xpack.esql.optimizer.LogicalPlanOptimizer.optimize(LogicalPlanOptimizer.java:116)
        at org.elasticsearch.xpack.esql.session.EsqlSession.optimizedPlan(EsqlSession.java:812)
        at org.elasticsearch.xpack.esql.session.EsqlSession$1.lambda$onResponse$1(EsqlSession.java:201)

[elasticsearchmachine]

Pinging @elastic/es-storage-engine (Team:StorageEngine)

[limotova]

I feel like this might be similar to #134994 ?

[kkrik-es]

Right I wonder if the eval masks field event so it's not available later. More so, last_over_time is expecting a numeric? This should be caught here.

[kkrik-es]

@dnhatn is the issue with the eval more general, for esql?

[dnhatn]

@kkrik-es I think the issue is that last_over_time doesn't support boolean or keyword fields; it currently only supports numeric fields. I need to strengthen #135981 to allow only metrics (or fields derived from metrics).