Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EQL: Use recognized time units for sequences #54760

Closed
rw-access opened this issue Apr 3, 2020 · 2 comments
Closed

EQL: Use recognized time units for sequences #54760

rw-access opened this issue Apr 3, 2020 · 2 comments

Comments

@rw-access
Copy link
Contributor

Relates to #54597 and #54680

The above issues raised concerns with using floating point for time units.
In a similar note, we should also consider only using known time units in ES (nanos, micros, ms, s, m, h, d).

One question with this is: what do we want the deprecation path to follow for existing EQL in the Endpoint Platform? Since these changes can be made without changing the grammar, we can raise more informative semantic error messages, instead of unhelpful syntax errors. We should catch all things that are no longer valid, and explain why, and what recommended change would help:

  • Fractions: You entered maxspan=0.5s, but fractional units are no longer supported. Try again with 500ms
  • Missing units: You entered maxspan=2 and forgot a time unit. Did you mean 2s?
  • Now invalid units: You entered maxspan=1min. Did you mean 1m?

That's one path we can take as we make necessary changes to the language, and backport them. One other thing to note, is that existing rules are already compiled, so if they make any changes that are no longer valid, they will have to fix before saving.

@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-ql (:Query Languages/EQL)

@rw-access
Copy link
Contributor Author

Minus nanos/micros, this was resolved via #55032

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants