From 7dca2aa7126128dabb9a390071e39b1d261d9086 Mon Sep 17 00:00:00 2001 From: "Quynh Nguyen (Quinn)" <43350163+qn895@users.noreply.github.com> Date: Thu, 1 Aug 2024 11:04:21 -0500 Subject: [PATCH] [ES|QL] Improved support for Elasticsearch sub-types in AST for both validation and autocomplete (#189689) ## Summary Fixed version of https://github.com/elastic/kibana/pull/188600 that updates the failed tests [caused by clash with the visitor API tests](https://github.com/elastic/kibana/pull/189516). ### Checklist Delete any items that are not applicable to this PR. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/)) - [ ] Any UI touched in this PR does not create any new axe failures (run axe in browser: [FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/), [Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US)) - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server)) - [ ] This was checked for [cross-browser compatibility](https://www.elastic.co/support/matrix#matrix_browsers) ### Risk Matrix Delete this section if it is not applicable to this PR. Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release. When forming the risk matrix, consider some of the following examples and how they may potentially impact the change: | Risk | Probability | Severity | Mitigation/Notes | |---------------------------|-------------|----------|-------------------------| | Multiple Spaces—unexpected behavior in non-default Kibana Space. | Low | High | Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces. | | Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks. | High | Low | Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure. | | Code should gracefully handle cases when feature X or plugin Y are disabled. | Medium | High | Unit tests will verify that any feature flag or plugin combination still results in our service operational. | | [See more potential risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) | ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine --- .../src/__tests__/ast_parser.literal.test.ts | 2 +- packages/kbn-esql-ast/src/ast_factory.ts | 2 +- packages/kbn-esql-ast/src/ast_helpers.ts | 23 +- packages/kbn-esql-ast/src/ast_walker.ts | 19 +- .../kbn-esql-ast/src/builder/index.test.ts | 2 +- packages/kbn-esql-ast/src/builder/index.ts | 16 +- packages/kbn-esql-ast/src/types.ts | 17 +- packages/kbn-esql-ast/src/visitor/contexts.ts | 11 +- .../kbn-esql-ast/src/walker/walker.test.ts | 28 +- .../scripts/generate_function_definitions.ts | 5 +- .../generate_function_validation_tests.ts | 92 +- .../src/__tests__/helpers.ts | 10 +- .../autocomplete.command.stats.test.ts | 107 +- .../src/autocomplete/__tests__/helpers.ts | 6 +- .../src/autocomplete/autocomplete.test.ts | 379 +- .../src/autocomplete/autocomplete.ts | 27 +- .../src/autocomplete/factories.ts | 5 +- .../src/autocomplete/helper.ts | 12 + .../src/definitions/aggs.ts | 140 +- .../src/definitions/builtin.ts | 220 +- .../src/definitions/commands.ts | 4 +- .../src/definitions/functions.ts | 6294 +++- .../src/definitions/grouping.ts | 118 +- .../src/definitions/types.ts | 42 +- .../src/shared/esql_to_kibana_type.ts | 44 - .../src/shared/esql_types.ts | 49 + .../src/shared/helpers.ts | 57 +- .../src/shared/variables.ts | 6 +- .../src/validation/__tests__/helpers.ts | 17 +- .../test_suites/validation.command.metrics.ts | 80 +- .../test_suites/validation.command.stats.ts | 153 +- .../validation.eval.date_diff.test.ts | 56 + .../__tests__/validation.params.test.ts | 14 +- .../esql_validation_meta_tests.json | 24350 +++++++++++----- .../src/validation/validation.test.ts | 14895 ++++++---- .../src/validation/validation.ts | 2 + .../src/ecs_metadata_helper.test.ts | 28 +- .../src/ecs_metadata_helper.ts | 7 +- .../src/text_based_languages_editor.tsx | 9 +- packages/kbn-text-based-editor/tsconfig.json | 1 - test/api_integration/apis/esql/errors.ts | 12 +- 41 files changed, 31848 insertions(+), 15513 deletions(-) delete mode 100644 packages/kbn-esql-validation-autocomplete/src/shared/esql_to_kibana_type.ts create mode 100644 packages/kbn-esql-validation-autocomplete/src/shared/esql_types.ts create mode 100644 packages/kbn-esql-validation-autocomplete/src/validation/__tests__/validation.eval.date_diff.test.ts diff --git a/packages/kbn-esql-ast/src/__tests__/ast_parser.literal.test.ts b/packages/kbn-esql-ast/src/__tests__/ast_parser.literal.test.ts index 9b966905308d7..1f941c49f0fbe 100644 --- a/packages/kbn-esql-ast/src/__tests__/ast_parser.literal.test.ts +++ b/packages/kbn-esql-ast/src/__tests__/ast_parser.literal.test.ts @@ -17,7 +17,7 @@ describe('literal expression', () => { expect(literal).toMatchObject({ type: 'literal', - literalType: 'number', + literalType: 'integer', name: '1', value: 1, }); diff --git a/packages/kbn-esql-ast/src/ast_factory.ts b/packages/kbn-esql-ast/src/ast_factory.ts index f389be63b3afd..cd73bc79a3887 100644 --- a/packages/kbn-esql-ast/src/ast_factory.ts +++ b/packages/kbn-esql-ast/src/ast_factory.ts @@ -205,7 +205,7 @@ export class AstListener implements ESQLParserListener { const command = createCommand('limit', ctx); this.ast.push(command); if (ctx.getToken(esql_parser.INTEGER_LITERAL, 0)) { - const literal = createLiteral('number', ctx.INTEGER_LITERAL()); + const literal = createLiteral('integer', ctx.INTEGER_LITERAL()); if (literal) { command.args.push(literal); } diff --git a/packages/kbn-esql-ast/src/ast_helpers.ts b/packages/kbn-esql-ast/src/ast_helpers.ts index cc6488d5bbc0c..6ebb3fb9c4490 100644 --- a/packages/kbn-esql-ast/src/ast_helpers.ts +++ b/packages/kbn-esql-ast/src/ast_helpers.ts @@ -35,7 +35,9 @@ import type { ESQLCommandMode, ESQLInlineCast, ESQLUnknownItem, + ESQLNumericLiteralType, FunctionSubtype, + ESQLNumericLiteral, } from './types'; export function nonNullable(v: T): v is NonNullable { @@ -87,11 +89,14 @@ export function createList(ctx: ParserRuleContext, values: ESQLLiteral[]): ESQLL }; } -export function createNumericLiteral(ctx: DecimalValueContext | IntegerValueContext): ESQLLiteral { +export function createNumericLiteral( + ctx: DecimalValueContext | IntegerValueContext, + literalType: ESQLNumericLiteralType +): ESQLLiteral { const text = ctx.getText(); return { type: 'literal', - literalType: 'number', + literalType, text, name: text, value: Number(text), @@ -100,10 +105,13 @@ export function createNumericLiteral(ctx: DecimalValueContext | IntegerValueCont }; } -export function createFakeMultiplyLiteral(ctx: ArithmeticUnaryContext): ESQLLiteral { +export function createFakeMultiplyLiteral( + ctx: ArithmeticUnaryContext, + literalType: ESQLNumericLiteralType +): ESQLLiteral { return { type: 'literal', - literalType: 'number', + literalType, text: ctx.getText(), name: ctx.getText(), value: ctx.PLUS() ? 1 : -1, @@ -158,12 +166,13 @@ export function createLiteral( location: getPosition(node.symbol), incomplete: isMissingText(text), }; - if (type === 'number') { + if (type === 'decimal' || type === 'integer') { return { ...partialLiteral, literalType: type, value: Number(text), - }; + paramType: 'number', + } as ESQLNumericLiteral<'decimal'> | ESQLNumericLiteral<'integer'>; } else if (type === 'param') { throw new Error('Should never happen'); } @@ -171,7 +180,7 @@ export function createLiteral( ...partialLiteral, literalType: type, value: text, - }; + } as ESQLLiteral; } export function createTimeUnit(ctx: QualifiedIntegerLiteralContext): ESQLTimeInterval { diff --git a/packages/kbn-esql-ast/src/ast_walker.ts b/packages/kbn-esql-ast/src/ast_walker.ts index 1b603975cf68f..3a0f182215c3e 100644 --- a/packages/kbn-esql-ast/src/ast_walker.ts +++ b/packages/kbn-esql-ast/src/ast_walker.ts @@ -84,7 +84,7 @@ import { createUnknownItem, } from './ast_helpers'; import { getPosition } from './ast_position_utils'; -import type { +import { ESQLLiteral, ESQLColumn, ESQLFunction, @@ -289,7 +289,7 @@ function visitOperatorExpression( const arg = visitOperatorExpression(ctx.operatorExpression()); // this is a number sign thing const fn = createFunction('*', ctx, undefined, 'binary-expression'); - fn.args.push(createFakeMultiplyLiteral(ctx)); + fn.args.push(createFakeMultiplyLiteral(ctx, 'integer')); if (arg) { fn.args.push(arg); } @@ -328,16 +328,21 @@ function getConstant(ctx: ConstantContext): ESQLAstItem { // e.g. 1 year, 15 months return createTimeUnit(ctx); } + + // Decimal type covers multiple ES|QL types: long, double, etc. if (ctx instanceof DecimalLiteralContext) { - return createNumericLiteral(ctx.decimalValue()); + return createNumericLiteral(ctx.decimalValue(), 'decimal'); } + + // Integer type encompasses integer if (ctx instanceof IntegerLiteralContext) { - return createNumericLiteral(ctx.integerValue()); + return createNumericLiteral(ctx.integerValue(), 'integer'); } if (ctx instanceof BooleanLiteralContext) { return getBooleanValue(ctx); } if (ctx instanceof StringLiteralContext) { + // String literal covers multiple ES|QL types: text and keyword types return createLiteral('string', ctx.string_().QUOTED_STRING()); } if ( @@ -346,14 +351,18 @@ function getConstant(ctx: ConstantContext): ESQLAstItem { ctx instanceof StringArrayLiteralContext ) { const values: ESQLLiteral[] = []; + for (const numericValue of ctx.getTypedRuleContexts(NumericValueContext)) { + const isDecimal = + numericValue.decimalValue() !== null && numericValue.decimalValue() !== undefined; const value = numericValue.decimalValue() || numericValue.integerValue(); - values.push(createNumericLiteral(value!)); + values.push(createNumericLiteral(value!, isDecimal ? 'decimal' : 'integer')); } for (const booleanValue of ctx.getTypedRuleContexts(BooleanValueContext)) { values.push(getBooleanValue(booleanValue)!); } for (const string of ctx.getTypedRuleContexts(StringContext)) { + // String literal covers multiple ES|QL types: text and keyword types const literal = createLiteral('string', string.QUOTED_STRING()); if (literal) { values.push(literal); diff --git a/packages/kbn-esql-ast/src/builder/index.test.ts b/packages/kbn-esql-ast/src/builder/index.test.ts index f54ab2f90a9ca..d8199027ea1c8 100644 --- a/packages/kbn-esql-ast/src/builder/index.test.ts +++ b/packages/kbn-esql-ast/src/builder/index.test.ts @@ -13,7 +13,7 @@ test('can mint a numeric literal', () => { expect(node).toMatchObject({ type: 'literal', - literalType: 'number', + literalType: 'integer', name: '42', value: 42, }); diff --git a/packages/kbn-esql-ast/src/builder/index.ts b/packages/kbn-esql-ast/src/builder/index.ts index d389caf40fab2..524301111ed4d 100644 --- a/packages/kbn-esql-ast/src/builder/index.ts +++ b/packages/kbn-esql-ast/src/builder/index.ts @@ -6,7 +6,7 @@ * Side Public License, v 1. */ -import { ESQLNumberLiteral } from '../types'; +import { ESQLDecimalLiteral, ESQLIntegerLiteral, ESQLNumericLiteralType } from '../types'; import { AstNodeParserFields, AstNodeTemplate } from './types'; export class Builder { @@ -25,16 +25,20 @@ export class Builder { }); /** - * Constructs a number literal node. + * Constructs a integer literal node. */ public static readonly numericLiteral = ( - template: Omit, 'literalType' | 'name'> - ): ESQLNumberLiteral => { - const node: ESQLNumberLiteral = { + template: Omit< + AstNodeTemplate, + 'literalType' | 'name' + >, + type: ESQLNumericLiteralType = 'integer' + ): ESQLIntegerLiteral | ESQLDecimalLiteral => { + const node: ESQLIntegerLiteral | ESQLDecimalLiteral = { ...template, ...Builder.parserFields(template), type: 'literal', - literalType: 'number', + literalType: type, name: template.value.toString(), }; diff --git a/packages/kbn-esql-ast/src/types.ts b/packages/kbn-esql-ast/src/types.ts index 5bc1a02ffd2ae..12496835ea12b 100644 --- a/packages/kbn-esql-ast/src/types.ts +++ b/packages/kbn-esql-ast/src/types.ts @@ -179,19 +179,30 @@ export interface ESQLList extends ESQLAstBaseItem { values: ESQLLiteral[]; } +export type ESQLNumericLiteralType = 'decimal' | 'integer'; + export type ESQLLiteral = - | ESQLNumberLiteral + | ESQLDecimalLiteral + | ESQLIntegerLiteral | ESQLBooleanLiteral | ESQLNullLiteral | ESQLStringLiteral | ESQLParamLiteral; +// Exporting here to prevent TypeScript error TS4058 +// Return type of exported function has or is using name 'ESQLNumericLiteral' from external module // @internal -export interface ESQLNumberLiteral extends ESQLAstBaseItem { +export interface ESQLNumericLiteral extends ESQLAstBaseItem { type: 'literal'; - literalType: 'number'; + literalType: T; value: number; } +// We cast anything as decimal (e.g. 32.12) as generic decimal numeric type here +// @internal +export type ESQLDecimalLiteral = ESQLNumericLiteral<'decimal'>; + +// @internal +export type ESQLIntegerLiteral = ESQLNumericLiteral<'integer'>; // @internal export interface ESQLBooleanLiteral extends ESQLAstBaseItem { diff --git a/packages/kbn-esql-ast/src/visitor/contexts.ts b/packages/kbn-esql-ast/src/visitor/contexts.ts index ca6044c017aa6..a7920358e1bab 100644 --- a/packages/kbn-esql-ast/src/visitor/contexts.ts +++ b/packages/kbn-esql-ast/src/visitor/contexts.ts @@ -18,11 +18,12 @@ import type { ESQLAstNodeWithArgs, ESQLColumn, ESQLCommandOption, + ESQLDecimalLiteral, ESQLFunction, ESQLInlineCast, + ESQLIntegerLiteral, ESQLList, ESQLLiteral, - ESQLNumberLiteral, ESQLSource, ESQLTimeInterval, } from '../types'; @@ -260,10 +261,14 @@ export class LimitCommandVisitorContext< /** * @returns The first numeric literal argument of the command. */ - public numericLiteral(): ESQLNumberLiteral | undefined { + public numericLiteral(): ESQLIntegerLiteral | ESQLDecimalLiteral | undefined { const arg = firstItem(this.node.args); - if (arg && arg.type === 'literal' && arg.literalType === 'number') { + if ( + arg && + arg.type === 'literal' && + (arg.literalType === 'integer' || arg.literalType === 'decimal') + ) { return arg; } } diff --git a/packages/kbn-esql-ast/src/walker/walker.test.ts b/packages/kbn-esql-ast/src/walker/walker.test.ts index 2bc666a1e0421..9f62c2f07d200 100644 --- a/packages/kbn-esql-ast/src/walker/walker.test.ts +++ b/packages/kbn-esql-ast/src/walker/walker.test.ts @@ -211,7 +211,7 @@ describe('structurally can walk all nodes', () => { expect(columns).toMatchObject([ { type: 'literal', - literalType: 'number', + literalType: 'integer', name: '123', }, { @@ -244,7 +244,7 @@ describe('structurally can walk all nodes', () => { expect(columns).toMatchObject([ { type: 'literal', - literalType: 'number', + literalType: 'integer', name: '1', }, { @@ -264,7 +264,7 @@ describe('structurally can walk all nodes', () => { }, { type: 'literal', - literalType: 'number', + literalType: 'decimal', name: '3.14', }, ]); @@ -288,12 +288,12 @@ describe('structurally can walk all nodes', () => { values: [ { type: 'literal', - literalType: 'number', + literalType: 'integer', name: '1', }, { type: 'literal', - literalType: 'number', + literalType: 'integer', name: '2', }, ], @@ -318,12 +318,12 @@ describe('structurally can walk all nodes', () => { values: [ { type: 'literal', - literalType: 'number', + literalType: 'integer', name: '1', }, { type: 'literal', - literalType: 'number', + literalType: 'integer', name: '2', }, ], @@ -333,7 +333,7 @@ describe('structurally can walk all nodes', () => { values: [ { type: 'literal', - literalType: 'number', + literalType: 'decimal', name: '3.3', }, ], @@ -342,17 +342,17 @@ describe('structurally can walk all nodes', () => { expect(literals).toMatchObject([ { type: 'literal', - literalType: 'number', + literalType: 'integer', name: '1', }, { type: 'literal', - literalType: 'number', + literalType: 'integer', name: '2', }, { type: 'literal', - literalType: 'number', + literalType: 'decimal', name: '3.3', }, ]); @@ -511,7 +511,7 @@ describe('structurally can walk all nodes', () => { describe('cast expression', () => { test('can visit cast expression', () => { - const query = 'FROM index | STATS a = 123::number'; + const query = 'FROM index | STATS a = 123::integer'; const { ast } = getAstAndSyntaxErrors(query); const casts: ESQLInlineCast[] = []; @@ -523,10 +523,10 @@ describe('structurally can walk all nodes', () => { expect(casts).toMatchObject([ { type: 'inlineCast', - castType: 'number', + castType: 'integer', value: { type: 'literal', - literalType: 'number', + literalType: 'integer', value: 123, }, }, diff --git a/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts b/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts index aa92c7bd024d5..cbee9d00e8928 100644 --- a/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts +++ b/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts @@ -12,7 +12,6 @@ import { join } from 'path'; import _ from 'lodash'; import type { RecursivePartial } from '@kbn/utility-types'; import { FunctionDefinition } from '../src/definitions/types'; -import { esqlToKibanaType } from '../src/shared/esql_to_kibana_type'; const aliasTable: Record = { to_version: ['to_ver'], @@ -240,10 +239,10 @@ function getFunctionDefinition(ESFunctionDefinition: Record): Funct ...signature, params: signature.params.map((param: any) => ({ ...param, - type: esqlToKibanaType(param.type), + type: param.type, description: undefined, })), - returnType: esqlToKibanaType(signature.returnType), + returnType: signature.returnType, variadic: undefined, // we don't support variadic property minParams: signature.variadic ? signature.params.filter((param: any) => !param.optional).length diff --git a/packages/kbn-esql-validation-autocomplete/scripts/generate_function_validation_tests.ts b/packages/kbn-esql-validation-autocomplete/scripts/generate_function_validation_tests.ts index 8d6394fe96af6..d3497115aecf9 100644 --- a/packages/kbn-esql-validation-autocomplete/scripts/generate_function_validation_tests.ts +++ b/packages/kbn-esql-validation-autocomplete/scripts/generate_function_validation_tests.ts @@ -25,6 +25,7 @@ import { } from '../src/definitions/types'; import { FUNCTION_DESCRIBE_BLOCK_NAME } from '../src/validation/function_describe_block_name'; import { getMaxMinNumberOfParams } from '../src/validation/helpers'; +import { ESQL_NUMBER_TYPES, isNumericType, isStringType } from '../src/shared/esql_types'; export const fieldNameFromType = (type: SupportedFieldType) => `${camelCase(type)}Field`; @@ -141,8 +142,8 @@ function generateImplicitDateCastingTestsForFunction( const allSignaturesWithDateParams = definition.signatures.filter((signature) => signature.params.some( (param, i) => - param.type === 'date' && - !definition.signatures.some((def) => getParamAtPosition(def, i)?.type === 'string') // don't count parameters that already accept a string + (param.type === 'date' || param.type === 'date_period') && + !definition.signatures.some((def) => isStringType(getParamAtPosition(def, i)?.type)) // don't count parameters that already accept a string ) ); @@ -300,8 +301,8 @@ function generateWhereCommandTestsForEvalFunction( // TODO: not sure why there's this constraint... const supportedFunction = signatures.some( ({ returnType, params }) => - ['number', 'string'].includes(returnType) && - params.every(({ type }) => ['number', 'string'].includes(type)) + [...ESQL_NUMBER_TYPES, 'string'].includes(returnType) && + params.every(({ type }) => [...ESQL_NUMBER_TYPES, 'string'].includes(type)) ); if (!supportedFunction) { @@ -311,12 +312,12 @@ function generateWhereCommandTestsForEvalFunction( const supportedSignatures = signatures.filter(({ returnType }) => // TODO — not sure why the tests have this limitation... seems like any type // that can be part of a boolean expression should be allowed in a where clause - ['number', 'string'].includes(returnType) + [...ESQL_NUMBER_TYPES, 'string'].includes(returnType) ); for (const { params, returnType, ...restSign } of supportedSignatures) { const correctMapping = getFieldMapping(params); testCases.set( - `from a_index | where ${returnType !== 'number' ? 'length(' : ''}${ + `from a_index | where ${!isNumericType(returnType) ? 'length(' : ''}${ // hijacking a bit this function to produce a function call getFunctionSignatures( { @@ -326,7 +327,7 @@ function generateWhereCommandTestsForEvalFunction( }, { withTypes: false } )[0].declaration - }${returnType !== 'number' ? ')' : ''} > 0`, + }${!isNumericType(returnType) ? ')' : ''} > 0`, [] ); @@ -337,7 +338,7 @@ function generateWhereCommandTestsForEvalFunction( supportedTypesAndFieldNames ); testCases.set( - `from a_index | where ${returnType !== 'number' ? 'length(' : ''}${ + `from a_index | where ${!isNumericType(returnType) ? 'length(' : ''}${ // hijacking a bit this function to produce a function call getFunctionSignatures( { @@ -347,7 +348,7 @@ function generateWhereCommandTestsForEvalFunction( }, { withTypes: false } )[0].declaration - }${returnType !== 'number' ? ')' : ''} > 0`, + }${!isNumericType(returnType) ? ')' : ''} > 0`, expectedErrors ); } @@ -357,7 +358,7 @@ function generateWhereCommandTestsForAggFunction( { name, alias, signatures, ...defRest }: FunctionDefinition, testCases: Map ) { - // statsSignatures.some(({ returnType, params }) => ['number'].includes(returnType)) + // statsSignatures.some(({ returnType, params }) => [...ESQL_NUMBER_TYPES].includes(returnType)) for (const { params, ...signRest } of signatures) { const fieldMapping = getFieldMapping(params); @@ -542,7 +543,7 @@ function generateEvalCommandTestsForEvalFunction( signatureWithGreatestNumberOfParams.params ).concat({ name: 'extraArg', - type: 'number', + type: 'integer', }); // get the expected args from the first signature in case of errors @@ -660,7 +661,7 @@ function generateStatsCommandTestsForAggFunction( testCases.set(`from a_index | stats var = ${correctSignature}`, []); testCases.set(`from a_index | stats ${correctSignature}`, []); - if (signRest.returnType === 'number') { + if (isNumericType(signRest.returnType)) { testCases.set(`from a_index | stats var = round(${correctSignature})`, []); testCases.set(`from a_index | stats round(${correctSignature})`, []); testCases.set( @@ -713,8 +714,8 @@ function generateStatsCommandTestsForAggFunction( } // test only numeric functions for now - if (params[0].type === 'number') { - const nestedBuiltin = 'numberField / 2'; + if (isNumericType(params[0].type)) { + const nestedBuiltin = 'doubleField / 2'; const fieldMappingWithNestedBuiltinFunctions = getFieldMapping(params); fieldMappingWithNestedBuiltinFunctions[0].name = nestedBuiltin; @@ -726,16 +727,16 @@ function generateStatsCommandTestsForAggFunction( }, { withTypes: false } )[0].declaration; - // from a_index | STATS aggFn( numberField / 2 ) + // from a_index | STATS aggFn( doubleField / 2 ) testCases.set(`from a_index | stats ${fnSignatureWithBuiltinString}`, []); testCases.set(`from a_index | stats var0 = ${fnSignatureWithBuiltinString}`, []); - testCases.set(`from a_index | stats avg(numberField), ${fnSignatureWithBuiltinString}`, []); + testCases.set(`from a_index | stats avg(doubleField), ${fnSignatureWithBuiltinString}`, []); testCases.set( - `from a_index | stats avg(numberField), var0 = ${fnSignatureWithBuiltinString}`, + `from a_index | stats avg(doubleField), var0 = ${fnSignatureWithBuiltinString}`, [] ); - const nestedEvalAndBuiltin = 'round(numberField / 2)'; + const nestedEvalAndBuiltin = 'round(doubleField / 2)'; const fieldMappingWithNestedEvalAndBuiltinFunctions = getFieldMapping(params); fieldMappingWithNestedBuiltinFunctions[0].name = nestedEvalAndBuiltin; @@ -747,18 +748,18 @@ function generateStatsCommandTestsForAggFunction( }, { withTypes: false } )[0].declaration; - // from a_index | STATS aggFn( round(numberField / 2) ) + // from a_index | STATS aggFn( round(doubleField / 2) ) testCases.set(`from a_index | stats ${fnSignatureWithEvalAndBuiltinString}`, []); testCases.set(`from a_index | stats var0 = ${fnSignatureWithEvalAndBuiltinString}`, []); testCases.set( - `from a_index | stats avg(numberField), ${fnSignatureWithEvalAndBuiltinString}`, + `from a_index | stats avg(doubleField), ${fnSignatureWithEvalAndBuiltinString}`, [] ); testCases.set( - `from a_index | stats avg(numberField), var0 = ${fnSignatureWithEvalAndBuiltinString}`, + `from a_index | stats avg(doubleField), var0 = ${fnSignatureWithEvalAndBuiltinString}`, [] ); - // from a_index | STATS aggFn(round(numberField / 2) ) BY round(numberField / 2) + // from a_index | STATS aggFn(round(doubleField / 2) ) BY round(doubleField / 2) testCases.set( `from a_index | stats ${fnSignatureWithEvalAndBuiltinString} by ${nestedEvalAndBuiltin}`, [] @@ -768,19 +769,19 @@ function generateStatsCommandTestsForAggFunction( [] ); testCases.set( - `from a_index | stats avg(numberField), ${fnSignatureWithEvalAndBuiltinString} by ${nestedEvalAndBuiltin}, ipField`, + `from a_index | stats avg(doubleField), ${fnSignatureWithEvalAndBuiltinString} by ${nestedEvalAndBuiltin}, ipField`, [] ); testCases.set( - `from a_index | stats avg(numberField), var0 = ${fnSignatureWithEvalAndBuiltinString} by var1 = ${nestedEvalAndBuiltin}, ipField`, + `from a_index | stats avg(doubleField), var0 = ${fnSignatureWithEvalAndBuiltinString} by var1 = ${nestedEvalAndBuiltin}, ipField`, [] ); testCases.set( - `from a_index | stats avg(numberField), ${fnSignatureWithEvalAndBuiltinString} by ${nestedEvalAndBuiltin}, ${nestedBuiltin}`, + `from a_index | stats avg(doubleField), ${fnSignatureWithEvalAndBuiltinString} by ${nestedEvalAndBuiltin}, ${nestedBuiltin}`, [] ); testCases.set( - `from a_index | stats avg(numberField), var0 = ${fnSignatureWithEvalAndBuiltinString} by var1 = ${nestedEvalAndBuiltin}, ${nestedBuiltin}`, + `from a_index | stats avg(doubleField), var0 = ${fnSignatureWithEvalAndBuiltinString} by var1 = ${nestedEvalAndBuiltin}, ${nestedBuiltin}`, [] ); } @@ -798,7 +799,7 @@ function generateStatsCommandTestsForAggFunction( .filter(({ constantOnly }) => !constantOnly) .map( (_) => - `Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]` + `Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(doubleField)] of type [double]` ); testCases.set( `from a_index | stats var = ${ @@ -965,9 +966,17 @@ function generateSortCommandTestsForAggFunction( const generateSortCommandTestsForGroupingFunction = generateSortCommandTestsForAggFunction; const fieldTypesToConstants: Record = { - string: '"a"', - number: '5', - date: 'now()', + text: '"a"', + keyword: '"a"', + double: '5.5', + integer: '5', + long: '5', + unsigned_long: '5', + counter_integer: '5', + counter_long: '5', + counter_double: '5.5', + date: 'to_datetime("2021-01-01T00:00:00Z")', + date_period: 'to_date_period("2021-01-01/2021-01-02")', boolean: 'true', version: 'to_version("1.0.0")', ip: 'to_ip("127.0.0.1")', @@ -1003,8 +1012,8 @@ function prepareNestedFunction(fnSignature: FunctionDefinition): string { } const toAvgSignature = statsAggregationFunctionDefinitions.find(({ name }) => name === 'avg')!; - const toInteger = evalFunctionDefinitions.find(({ name }) => name === 'to_integer')!; +const toDoubleSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_double')!; const toStringSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_string')!; const toDateSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_datetime')!; const toBooleanSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_boolean')!; @@ -1019,10 +1028,12 @@ const toCartesianShapeSignature = evalFunctionDefinitions.find( )!; const toVersionSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_version')!; +// We don't have full list for long, unsigned_long, etc. const nestedFunctions: Record = { - number: prepareNestedFunction(toInteger), - string: prepareNestedFunction(toStringSignature), - date: prepareNestedFunction(toDateSignature), + double: prepareNestedFunction(toDoubleSignature), + integer: prepareNestedFunction(toInteger), + text: prepareNestedFunction(toStringSignature), + keyword: prepareNestedFunction(toStringSignature), boolean: prepareNestedFunction(toBooleanSignature), ip: prepareNestedFunction(toIpSignature), version: prepareNestedFunction(toVersionSignature), @@ -1030,6 +1041,8 @@ const nestedFunctions: Record = { geo_shape: prepareNestedFunction(toGeoShapeSignature), cartesian_point: prepareNestedFunction(toCartesianPointSignature), cartesian_shape: prepareNestedFunction(toCartesianShapeSignature), + // @ts-expect-error + datetime: prepareNestedFunction(toDateSignature), }; function getFieldName( @@ -1086,6 +1099,7 @@ function getFieldMapping( number: '5', date: 'now()', }; + return params.map(({ name: _name, type, constantOnly, literalOptions, ...rest }) => { const typeString: string = type; if (isSupportedFieldType(typeString)) { @@ -1124,7 +1138,7 @@ function getFieldMapping( ...rest, }; } - return { name: 'stringField', type, ...rest }; + return { name: 'textField', type, ...rest }; }); } @@ -1225,8 +1239,12 @@ function generateIncorrectlyTypedParameters( } const fieldName = wrongFieldMapping[i].name; if ( - fieldName === 'numberField' && - signatures.every((signature) => getParamAtPosition(signature, i)?.type !== 'string') + fieldName === 'doubleField' && + signatures.every( + (signature) => + getParamAtPosition(signature, i)?.type !== 'keyword' || + getParamAtPosition(signature, i)?.type !== 'text' + ) ) { return; } diff --git a/packages/kbn-esql-validation-autocomplete/src/__tests__/helpers.ts b/packages/kbn-esql-validation-autocomplete/src/__tests__/helpers.ts index f3c159247e260..5f24d86e718bc 100644 --- a/packages/kbn-esql-validation-autocomplete/src/__tests__/helpers.ts +++ b/packages/kbn-esql-validation-autocomplete/src/__tests__/helpers.ts @@ -11,14 +11,14 @@ import { supportedFieldTypes } from '../definitions/types'; export const fields = [ ...supportedFieldTypes.map((type) => ({ name: `${camelCase(type)}Field`, type })), - { name: 'any#Char$Field', type: 'number' }, - { name: 'kubernetes.something.something', type: 'number' }, + { name: 'any#Char$Field', type: 'double' }, + { name: 'kubernetes.something.something', type: 'double' }, { name: '@timestamp', type: 'date' }, ]; export const enrichFields = [ - { name: 'otherField', type: 'string' }, - { name: 'yetAnotherField', type: 'number' }, + { name: 'otherField', type: 'text' }, + { name: 'yetAnotherField', type: 'double' }, ]; // eslint-disable-next-line @typescript-eslint/naming-convention @@ -58,7 +58,7 @@ export function getCallbackMocks() { return unsupported_field; } if (/dissect|grok/.test(query)) { - return [{ name: 'firstWord', type: 'string' }]; + return [{ name: 'firstWord', type: 'text' }]; } return fields; }), diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.command.stats.test.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.command.stats.test.ts index 58d4698974089..88fd654a83453 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.command.stats.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/autocomplete.command.stats.test.ts @@ -6,8 +6,11 @@ * Side Public License, v 1. */ +import { ESQL_COMMON_NUMERIC_TYPES, ESQL_NUMBER_TYPES } from '../../shared/esql_types'; import { setup, getFunctionSignaturesByReturnType, getFieldNamesByType } from './helpers'; +const ESQL_NUMERIC_TYPES = ESQL_NUMBER_TYPES as unknown as string[]; + const allAggFunctions = getFunctionSignaturesByReturnType('stats', 'any', { agg: true, }); @@ -74,51 +77,76 @@ describe('autocomplete.suggest', () => { const { assertSuggestions } = await setup(); await assertSuggestions('from a | stats by bucket(/', [ - ...getFieldNamesByType(['number', 'date']).map((field) => `${field},`), - ...getFunctionSignaturesByReturnType('eval', ['date', 'number'], { scalar: true }).map( - (s) => ({ ...s, text: `${s.text},` }) + ...getFieldNamesByType([...ESQL_COMMON_NUMERIC_TYPES, 'date']).map( + (field) => `${field},` ), + ...getFunctionSignaturesByReturnType('eval', ['date', ...ESQL_COMMON_NUMERIC_TYPES], { + scalar: true, + }).map((s) => ({ ...s, text: `${s.text},` })), ]); await assertSuggestions('from a | stats round(/', [ - ...getFunctionSignaturesByReturnType('stats', 'number', { agg: true, grouping: true }), - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }, undefined, [ - 'round', - ]), + ...getFunctionSignaturesByReturnType('stats', ESQL_NUMERIC_TYPES, { + agg: true, + grouping: true, + }), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType( + 'eval', + ESQL_NUMERIC_TYPES, + { scalar: true }, + undefined, + ['round'] + ), ]); await assertSuggestions('from a | stats round(round(/', [ - ...getFunctionSignaturesByReturnType('stats', 'number', { agg: true }), - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }, undefined, [ - 'round', - ]), + ...getFunctionSignaturesByReturnType('stats', ESQL_NUMERIC_TYPES, { agg: true }), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType( + 'eval', + ESQL_NUMERIC_TYPES, + { scalar: true }, + undefined, + ['round'] + ), ]); await assertSuggestions('from a | stats avg(round(/', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }, undefined, [ - 'round', - ]), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType( + 'eval', + ESQL_NUMERIC_TYPES, + { scalar: true }, + undefined, + ['round'] + ), ]); await assertSuggestions('from a | stats avg(/', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType('eval', ESQL_NUMERIC_TYPES, { scalar: true }), ]); await assertSuggestions('from a | stats round(avg(/', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }, undefined, [ - 'round', - ]), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType( + 'eval', + ESQL_NUMERIC_TYPES, + { scalar: true }, + undefined, + ['round'] + ), ]); }); test('when typing inside function left paren', async () => { const { assertSuggestions } = await setup(); const expected = [ - ...getFieldNamesByType(['number', 'date', 'boolean', 'ip']), - ...getFunctionSignaturesByReturnType('stats', ['number', 'date', 'boolean', 'ip'], { - scalar: true, - }), + ...getFieldNamesByType([...ESQL_COMMON_NUMERIC_TYPES, 'date', 'boolean', 'ip']), + ...getFunctionSignaturesByReturnType( + 'stats', + [...ESQL_COMMON_NUMERIC_TYPES, 'date', 'boolean', 'ip'], + { + scalar: true, + } + ), ]; await assertSuggestions('from a | stats a=min(/)', expected); @@ -130,8 +158,14 @@ describe('autocomplete.suggest', () => { const { assertSuggestions } = await setup(); await assertSuggestions('from a | stats avg(b/) by stringField', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }), + ...getFieldNamesByType('double'), + ...getFunctionSignaturesByReturnType( + 'eval', + ['double', 'integer', 'long', 'unsigned_long'], + { + scalar: true, + } + ), ]); }); @@ -205,10 +239,15 @@ describe('autocomplete.suggest', () => { test('on space before expression right hand side operand', async () => { const { assertSuggestions } = await setup(); - await assertSuggestions('from a | stats avg(b) by numberField % /', [ - ...getFieldNamesByType('number'), + await assertSuggestions('from a | stats avg(b) by integerField % /', [ + ...getFieldNamesByType('integer'), + ...getFieldNamesByType('double'), + ...getFieldNamesByType('long'), '`avg(b)`', - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }), + ...getFunctionSignaturesByReturnType('eval', ['integer', 'double', 'long'], { + scalar: true, + }), + ...allGroupingFunctions, ]); await assertSuggestions('from a | stats avg(b) by var0 = /', [ @@ -226,10 +265,10 @@ describe('autocomplete.suggest', () => { test('on space after expression right hand side operand', async () => { const { assertSuggestions } = await setup(); - await assertSuggestions('from a | stats avg(b) by numberField % 2 /', [',', '|']); + await assertSuggestions('from a | stats avg(b) by doubleField % 2 /', [',', '|']); await assertSuggestions( - 'from a | stats var0 = AVG(products.base_price) BY var1 = BUCKET(order_date, 1 day)/', + 'from a | stats var0 = AVG(doubleField) BY var1 = BUCKET(dateField, 1 day)/', [',', '|', '+ $0', '- $0'] ); }); diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/helpers.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/helpers.ts index 3d9ed7058a4a8..6600ffdbaf1d8 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/helpers.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/helpers.ts @@ -41,7 +41,7 @@ export const triggerCharacters = [',', '(', '=', ' ']; export const fields: Array<{ name: string; type: string; suggestedAs?: string }> = [ ...[ 'string', - 'number', + 'double', 'date', 'boolean', 'ip', @@ -53,8 +53,8 @@ export const fields: Array<{ name: string; type: string; suggestedAs?: string }> name: `${camelCase(type)}Field`, type, })), - { name: 'any#Char$Field', type: 'number', suggestedAs: '`any#Char$Field`' }, - { name: 'kubernetes.something.something', type: 'number' }, + { name: 'any#Char$Field', type: 'double', suggestedAs: '`any#Char$Field`' }, + { name: 'kubernetes.something.something', type: 'double' }, ]; export const indexes = ( diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts index d4ad5157d979a..d9c958b5bd4f7 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts @@ -10,15 +10,10 @@ import { suggest } from './autocomplete'; import { evalFunctionDefinitions } from '../definitions/functions'; import { timeUnitsToSuggest } from '../definitions/literals'; import { commandDefinitions } from '../definitions/commands'; -import { - getSafeInsertText, - getUnitDuration, - TRIGGER_SUGGESTION_COMMAND, - TIME_SYSTEM_PARAMS, -} from './factories'; +import { getSafeInsertText, getUnitDuration, TRIGGER_SUGGESTION_COMMAND } from './factories'; import { camelCase, partition } from 'lodash'; import { getAstAndSyntaxErrors } from '@kbn/esql-ast'; -import { FunctionParameter } from '../definitions/types'; +import { FunctionParameter, FunctionReturnType } from '../definitions/types'; import { getParamAtPosition } from './helper'; import { nonNullable } from '../shared/helpers'; import { @@ -31,9 +26,16 @@ import { createCompletionContext, getPolicyFields, PartialSuggestionWithText, - TIME_PICKER_SUGGESTION, } from './__tests__/helpers'; import { METADATA_FIELDS } from '../shared/constants'; +import { + ESQL_COMMON_NUMERIC_TYPES as UNCASTED_ESQL_COMMON_NUMERIC_TYPES, + ESQL_NUMBER_TYPES, +} from '../shared/esql_types'; + +const ESQL_NUMERIC_TYPES = ESQL_NUMBER_TYPES as unknown as string[]; +const ESQL_COMMON_NUMERIC_TYPES = + UNCASTED_ESQL_COMMON_NUMERIC_TYPES as unknown as FunctionReturnType[]; describe('autocomplete', () => { type TestArgs = [ @@ -166,25 +168,18 @@ describe('autocomplete', () => { ['string'] ), ]); - testSuggestions('from a | where stringField >= ', [ - ...getFieldNamesByType('string'), - ...getFunctionSignaturesByReturnType('where', 'string', { scalar: true }), + testSuggestions('from a | where textField >= ', [ + ...getFieldNamesByType('any'), + ...getFunctionSignaturesByReturnType('where', ['any'], { scalar: true }), ]); // Skip these tests until the insensitive case equality gets restored back testSuggestions.skip('from a | where stringField =~ ', [ ...getFieldNamesByType('string'), ...getFunctionSignaturesByReturnType('where', 'string', { scalar: true }), ]); - testSuggestions('from a | where stringField >= stringField ', [ - '|', - ...getFunctionSignaturesByReturnType( - 'where', - 'boolean', - { - builtin: true, - }, - ['boolean'] - ), + testSuggestions('from a | where textField >= textField', [ + ...getFieldNamesByType('any'), + ...getFunctionSignaturesByReturnType('where', 'any', { scalar: true }), ]); testSuggestions.skip('from a | where stringField =~ stringField ', [ '|', @@ -202,52 +197,60 @@ describe('autocomplete', () => { ...getFieldNamesByType('any'), ...getFunctionSignaturesByReturnType('where', 'any', { scalar: true }), ]); - testSuggestions(`from a | where stringField >= stringField ${op} numberField `, [ - ...getFunctionSignaturesByReturnType('where', 'boolean', { builtin: true }, ['number']), + testSuggestions(`from a | where stringField >= stringField ${op} doubleField `, [ + ...getFunctionSignaturesByReturnType('where', 'boolean', { builtin: true }, ['double']), ]); - testSuggestions(`from a | where stringField >= stringField ${op} numberField == `, [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('where', 'number', { scalar: true }), + testSuggestions(`from a | where stringField >= stringField ${op} doubleField == `, [ + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType('where', ESQL_COMMON_NUMERIC_TYPES, { scalar: true }), ]); } - testSuggestions('from a | stats a=avg(numberField) | where a ', [ + testSuggestions('from a | stats a=avg(doubleField) | where a ', [ ...getFunctionSignaturesByReturnType('where', 'any', { builtin: true, skipAssign: true }, [ - 'number', + 'double', ]), ]); // Mind this test: suggestion is aware of previous commands when checking for fields - // in this case the numberField has been wiped by the STATS command and suggest cannot find it's type + // in this case the doubleField has been wiped by the STATS command and suggest cannot find it's type // @TODO: verify this is the correct behaviour in this case or if we want a "generic" suggestion anyway testSuggestions( - 'from a | stats a=avg(numberField) | where numberField ', + 'from a | stats a=avg(doubleField) | where doubleField ', [], undefined, undefined, // make the fields suggest aware of the previous STATS, leave the other callbacks untouched - [[{ name: 'a', type: 'number' }], undefined, undefined] + [[{ name: 'a', type: 'double' }], undefined, undefined] ); // The editor automatically inject the final bracket, so it is not useful to test with just open bracket testSuggestions( 'from a | where log10()', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('where', 'number', { scalar: true }, undefined, [ - 'log10', - ]), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType( + 'where', + ESQL_NUMERIC_TYPES, + { scalar: true }, + undefined, + ['log10'] + ), ], '(' ); - testSuggestions('from a | where log10(numberField) ', [ - ...getFunctionSignaturesByReturnType('where', 'number', { builtin: true }, ['number']), - ...getFunctionSignaturesByReturnType('where', 'boolean', { builtin: true }, ['number']), + testSuggestions('from a | where log10(doubleField) ', [ + ...getFunctionSignaturesByReturnType('where', 'double', { builtin: true }, ['double']), + ...getFunctionSignaturesByReturnType('where', 'boolean', { builtin: true }, ['double']), ]); testSuggestions( - 'from a | WHERE pow(numberField, )', + 'from a | WHERE pow(doubleField, )', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('where', 'number', { scalar: true }, undefined, [ - 'pow', - ]), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType( + 'where', + ESQL_NUMERIC_TYPES, + { scalar: true }, + undefined, + ['pow'] + ), ], ',' ); @@ -258,34 +261,34 @@ describe('autocomplete', () => { ...getFieldNamesByType('boolean'), ...getFunctionSignaturesByReturnType('eval', 'boolean', { scalar: true }), ]); - testSuggestions('from index | WHERE numberField in ', ['( $0 )']); - testSuggestions('from index | WHERE numberField not in ', ['( $0 )']); + testSuggestions('from index | WHERE doubleField in ', ['( $0 )']); + testSuggestions('from index | WHERE doubleField not in ', ['( $0 )']); testSuggestions( - 'from index | WHERE numberField not in ( )', + 'from index | WHERE doubleField not in ( )', [ - ...getFieldNamesByType('number').filter((name) => name !== 'numberField'), - ...getFunctionSignaturesByReturnType('where', 'number', { scalar: true }), + ...getFieldNamesByType('double').filter((name) => name !== 'doubleField'), + ...getFunctionSignaturesByReturnType('where', 'double', { scalar: true }), ], '(' ); testSuggestions( - 'from index | WHERE numberField in ( `any#Char$Field`, )', + 'from index | WHERE doubleField in ( `any#Char$Field`, )', [ - ...getFieldNamesByType('number').filter( - (name) => name !== '`any#Char$Field`' && name !== 'numberField' + ...getFieldNamesByType('double').filter( + (name) => name !== '`any#Char$Field`' && name !== 'doubleField' ), - ...getFunctionSignaturesByReturnType('where', 'number', { scalar: true }), + ...getFunctionSignaturesByReturnType('where', 'double', { scalar: true }), ], undefined, 54 // after the first suggestions ); testSuggestions( - 'from index | WHERE numberField not in ( `any#Char$Field`, )', + 'from index | WHERE doubleField not in ( `any#Char$Field`, )', [ - ...getFieldNamesByType('number').filter( - (name) => name !== '`any#Char$Field`' && name !== 'numberField' + ...getFieldNamesByType('double').filter( + (name) => name !== '`any#Char$Field`' && name !== 'doubleField' ), - ...getFunctionSignaturesByReturnType('where', 'number', { scalar: true }), + ...getFunctionSignaturesByReturnType('where', 'double', { scalar: true }), ], undefined, 58 // after the first suggestions @@ -377,14 +380,14 @@ describe('autocomplete', () => { ); testSuggestions( - `from a_index | eval round(numberField) + 1 | eval \`round(numberField) + 1\` + 1 | eval \`\`\`round(numberField) + 1\`\` + 1\` + 1 | eval \`\`\`\`\`\`\`round(numberField) + 1\`\`\`\` + 1\`\` + 1\` + 1 | eval \`\`\`\`\`\`\`\`\`\`\`\`\`\`\`round(numberField) + 1\`\`\`\`\`\`\`\` + 1\`\`\`\` + 1\`\` + 1\` + 1 | ${command} `, + `from a_index | eval round(doubleField) + 1 | eval \`round(doubleField) + 1\` + 1 | eval \`\`\`round(doubleField) + 1\`\` + 1\` + 1 | eval \`\`\`\`\`\`\`round(doubleField) + 1\`\`\`\` + 1\`\` + 1\` + 1 | eval \`\`\`\`\`\`\`\`\`\`\`\`\`\`\`round(doubleField) + 1\`\`\`\`\`\`\`\` + 1\`\`\`\` + 1\`\` + 1\` + 1 | ${command} `, [ ...getFieldNamesByType('any'), - '`round(numberField) + 1`', - '```round(numberField) + 1`` + 1`', - '```````round(numberField) + 1```` + 1`` + 1`', - '```````````````round(numberField) + 1```````` + 1```` + 1`` + 1`', - '```````````````````````````````round(numberField) + 1```````````````` + 1```````` + 1```` + 1`` + 1`', + '`round(doubleField) + 1`', + '```round(doubleField) + 1`` + 1`', + '```````round(doubleField) + 1```` + 1`` + 1`', + '```````````````round(doubleField) + 1```````` + 1```` + 1`` + 1`', + '```````````````````````````````round(doubleField) + 1```````````````` + 1```````` + 1```` + 1`` + 1`', ] ); }); @@ -413,7 +416,7 @@ describe('autocomplete', () => { testSuggestions(`from a ${prevCommand}| enrich policy `, ['ON $0', 'WITH $0', '|']); testSuggestions(`from a ${prevCommand}| enrich policy on `, [ 'stringField', - 'numberField', + 'doubleField', 'dateField', 'booleanField', 'ipField', @@ -466,25 +469,25 @@ describe('autocomplete', () => { ...getFieldNamesByType('any'), ...getFunctionSignaturesByReturnType('eval', 'any', { scalar: true }), ]); - testSuggestions('from a | eval numberField ', [ + testSuggestions('from a | eval doubleField ', [ ...getFunctionSignaturesByReturnType('eval', 'any', { builtin: true, skipAssign: true }, [ - 'number', + 'double', ]), ',', '|', ]); testSuggestions('from index | EVAL stringField not ', ['LIKE $0', 'RLIKE $0', 'IN $0']); testSuggestions('from index | EVAL stringField NOT ', ['LIKE $0', 'RLIKE $0', 'IN $0']); - testSuggestions('from index | EVAL numberField in ', ['( $0 )']); + testSuggestions('from index | EVAL doubleField in ', ['( $0 )']); testSuggestions( - 'from index | EVAL numberField in ( )', + 'from index | EVAL doubleField in ( )', [ - ...getFieldNamesByType('number').filter((name) => name !== 'numberField'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }), + ...getFieldNamesByType('double').filter((name) => name !== 'doubleField'), + ...getFunctionSignaturesByReturnType('eval', 'double', { scalar: true }), ], '(' ); - testSuggestions('from index | EVAL numberField not in ', ['( $0 )']); + testSuggestions('from index | EVAL doubleField not in ', ['( $0 )']); testSuggestions('from index | EVAL not ', [ ...getFieldNamesByType('boolean'), ...getFunctionSignaturesByReturnType('eval', 'boolean', { scalar: true }), @@ -492,10 +495,10 @@ describe('autocomplete', () => { testSuggestions('from a | eval a=', [ ...getFunctionSignaturesByReturnType('eval', 'any', { scalar: true }), ]); - testSuggestions('from a | eval a=abs(numberField), b= ', [ + testSuggestions('from a | eval a=abs(doubleField), b= ', [ ...getFunctionSignaturesByReturnType('eval', 'any', { scalar: true }), ]); - testSuggestions('from a | eval a=numberField, ', [ + testSuggestions('from a | eval a=doubleField, ', [ 'var0 =', ...getFieldNamesByType('any'), 'a', @@ -509,10 +512,14 @@ describe('autocomplete', () => { testSuggestions( 'from a | eval a=round()', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }, undefined, [ - 'round', - ]), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType( + 'eval', + ESQL_NUMERIC_TYPES, + { scalar: true }, + undefined, + ['round'] + ), ], '(' ); @@ -539,64 +546,59 @@ describe('autocomplete', () => { [], ' ' ); - testSuggestions('from a | eval a=round(numberField) ', [ + testSuggestions('from a | eval a=round(doubleField) ', [ ',', '|', ...getFunctionSignaturesByReturnType('eval', 'any', { builtin: true, skipAssign: true }, [ - 'number', + 'double', ]), ]); testSuggestions( - 'from a | eval a=round(numberField, ', + 'from a | eval a=round(doubleField, ', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }, undefined, [ + ...getFieldNamesByType('integer'), + ...getFunctionSignaturesByReturnType('eval', 'integer', { scalar: true }, undefined, [ 'round', ]), ], ' ' ); testSuggestions( - 'from a | eval round(numberField, ', + 'from a | eval round(doubleField, ', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }, undefined, [ + ...getFunctionSignaturesByReturnType('eval', 'integer', { scalar: true }, undefined, [ 'round', ]), ], ' ' ); - testSuggestions('from a | eval a=round(numberField),', [ + testSuggestions('from a | eval a=round(doubleField),', [ 'var0 =', ...getFieldNamesByType('any'), 'a', ...getFunctionSignaturesByReturnType('eval', 'any', { scalar: true }), ]); - testSuggestions('from a | eval a=round(numberField) + ', [ - ...getFieldNamesByType('number'), - 'a', // @TODO remove this - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }), + testSuggestions('from a | eval a=round(doubleField) + ', [ + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType('eval', ESQL_COMMON_NUMERIC_TYPES, { scalar: true }), ]); - testSuggestions('from a | eval a=round(numberField)+ ', [ - ...getFieldNamesByType('number'), - 'a', // @TODO remove this - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }), + testSuggestions('from a | eval a=round(doubleField)+ ', [ + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType('eval', ESQL_COMMON_NUMERIC_TYPES, { scalar: true }), ]); - testSuggestions('from a | eval a=numberField+ ', [ - ...getFieldNamesByType('number'), - 'a', // @TODO remove this - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }), + testSuggestions('from a | eval a=doubleField+ ', [ + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType('eval', ESQL_COMMON_NUMERIC_TYPES, { scalar: true }), ]); testSuggestions('from a | eval a=`any#Char$Field`+ ', [ - ...getFieldNamesByType('number'), - 'a', // @TODO remove this - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType('eval', ESQL_COMMON_NUMERIC_TYPES, { scalar: true }), ]); testSuggestions( - 'from a | stats avg(numberField) by stringField | eval ', + 'from a | stats avg(doubleField) by stringField | eval ', [ 'var0 =', - '`avg(numberField)`', + '`avg(doubleField)`', ...getFunctionSignaturesByReturnType('eval', 'any', { scalar: true }), ], ' ', @@ -605,32 +607,32 @@ describe('autocomplete', () => { [[], undefined, undefined] ); testSuggestions( - 'from a | eval abs(numberField) + 1 | eval ', + 'from a | eval abs(doubleField) + 1 | eval ', [ 'var0 =', ...getFieldNamesByType('any'), - '`abs(numberField) + 1`', + '`abs(doubleField) + 1`', ...getFunctionSignaturesByReturnType('eval', 'any', { scalar: true }), ], ' ' ); testSuggestions( - 'from a | stats avg(numberField) by stringField | eval ', + 'from a | stats avg(doubleField) by stringField | eval ', [ 'var0 =', - '`avg(numberField)`', + '`avg(doubleField)`', ...getFunctionSignaturesByReturnType('eval', 'any', { scalar: true }), ], ' ', undefined, // make aware EVAL of the previous STATS command with the buggy field name from expression - [[{ name: 'avg_numberField_', type: 'number' }], undefined, undefined] + [[{ name: 'avg_doubleField_', type: 'double' }], undefined, undefined] ); testSuggestions( - 'from a | stats avg(numberField), avg(kubernetes.something.something) by stringField | eval ', + 'from a | stats avg(doubleField), avg(kubernetes.something.something) by stringField | eval ', [ 'var0 =', - '`avg(numberField)`', + '`avg(doubleField)`', '`avg(kubernetes.something.something)`', ...getFunctionSignaturesByReturnType('eval', 'any', { scalar: true }), ], @@ -639,48 +641,64 @@ describe('autocomplete', () => { // make aware EVAL of the previous STATS command with the buggy field name from expression [ [ - { name: 'avg_numberField_', type: 'number' }, - { name: 'avg_kubernetes.something.something_', type: 'number' }, + { name: 'avg_doubleField_', type: 'double' }, + { name: 'avg_kubernetes.something.something_', type: 'double' }, ], undefined, undefined, ] ); testSuggestions( - 'from a | eval a=round(numberField), b=round()', + 'from a | eval a=round(doubleField), b=round()', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }, undefined, [ - 'round', - ]), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType( + 'eval', + ESQL_NUMERIC_TYPES, + { scalar: true }, + undefined, + ['round'] + ), ], '(' ); // test that comma is correctly added to the suggestions if minParams is not reached yet testSuggestions('from a | eval a=concat( ', [ - ...getFieldNamesByType('string').map((v) => `${v},`), - ...getFunctionSignaturesByReturnType('eval', 'string', { scalar: true }, undefined, [ - 'concat', - ]).map((v) => ({ ...v, text: `${v.text},` })), + ...getFieldNamesByType(['text', 'keyword']).map((v) => `${v},`), + ...getFunctionSignaturesByReturnType( + 'eval', + ['text', 'keyword'], + { scalar: true }, + undefined, + ['concat'] + ).map((v) => ({ ...v, text: `${v.text},` })), ]); testSuggestions( - 'from a | eval a=concat(stringField, ', + 'from a | eval a=concat(textField, ', [ - ...getFieldNamesByType('string'), - ...getFunctionSignaturesByReturnType('eval', 'string', { scalar: true }, undefined, [ - 'concat', - ]), + ...getFieldNamesByType(['text', 'keyword']), + ...getFunctionSignaturesByReturnType( + 'eval', + ['text', 'keyword'], + { scalar: true }, + undefined, + ['concat'] + ), ], ' ' ); // test that the arg type is correct after minParams testSuggestions( - 'from a | eval a=cidr_match(ipField, stringField, ', + 'from a | eval a=cidr_match(ipField, textField, ', [ - ...getFieldNamesByType('string'), - ...getFunctionSignaturesByReturnType('eval', 'string', { scalar: true }, undefined, [ - 'cidr_match', - ]), + ...getFieldNamesByType('text'), + ...getFunctionSignaturesByReturnType( + 'eval', + ['text', 'keyword'], + { scalar: true }, + undefined, + ['cidr_match'] + ), ], ' ' ); @@ -694,10 +712,14 @@ describe('autocomplete', () => { testSuggestions( 'from a | eval a=cidr_match(ipField, ', [ - ...getFieldNamesByType('string'), - ...getFunctionSignaturesByReturnType('eval', 'string', { scalar: true }, undefined, [ - 'cidr_match', - ]), + ...getFieldNamesByType(['text', 'keyword']), + ...getFunctionSignaturesByReturnType( + 'eval', + ['text', 'keyword'], + { scalar: true }, + undefined, + ['cidr_match'] + ), ], ' ' ); @@ -709,10 +731,14 @@ describe('autocomplete', () => { testSuggestions( `from a | eval a=${Array(nesting).fill('round(').join('')}`, [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }, undefined, [ - 'round', - ]), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType( + 'eval', + ESQL_NUMERIC_TYPES, + { scalar: true }, + undefined, + ['round'] + ), ], '(' ); @@ -720,12 +746,12 @@ describe('autocomplete', () => { // Smoke testing for suggestions in previous position than the end of the statement testSuggestions( - 'from a | eval var0 = abs(numberField) | eval abs(var0)', + 'from a | eval var0 = abs(doubleField) | eval abs(var0)', [ ',', '|', ...getFunctionSignaturesByReturnType('eval', 'any', { builtin: true, skipAssign: true }, [ - 'number', + 'double', ]), ], undefined, @@ -734,10 +760,14 @@ describe('autocomplete', () => { testSuggestions( 'from a | eval var0 = abs(b) | eval abs(var0)', [ - ...getFieldNamesByType('number'), - ...getFunctionSignaturesByReturnType('eval', 'number', { scalar: true }, undefined, [ - 'abs', - ]), + ...getFieldNamesByType(ESQL_NUMERIC_TYPES), + ...getFunctionSignaturesByReturnType( + 'eval', + ESQL_NUMERIC_TYPES, + { scalar: true }, + undefined, + ['abs'] + ), ], undefined, 26 /* b column in abs */ @@ -746,7 +776,7 @@ describe('autocomplete', () => { // Test suggestions for each possible param, within each signature variation, for each function for (const fn of evalFunctionDefinitions) { // skip this fn for the moment as it's quite hard to test - if (fn.name !== 'bucket') { + if (!['bucket', 'date_extract', 'date_diff'].includes(fn.name)) { for (const signature of fn.signatures) { signature.params.forEach((param, i) => { if (i < signature.params.length) { @@ -822,6 +852,23 @@ describe('autocomplete', () => { }); } } + + // The above test fails cause it expects nested functions like + // DATE_EXTRACT(concat("aligned_day_","of_week_in_month"), date) to also be suggested + // which is actually valid according to func signature + // but currently, our autocomplete only suggests the literal suggestions + if (['date_extract', 'date_diff'].includes(fn.name)) { + const firstParam = fn.signatures[0].params[0]; + const suggestedConstants = firstParam?.literalSuggestions || firstParam?.literalOptions; + const requiresMoreArgs = true; + + testSuggestions( + `from a | eval ${fn.name}(`, + suggestedConstants?.length + ? [...suggestedConstants.map((option) => `"${option}"${requiresMoreArgs ? ',' : ''}`)] + : [] + ); + } } testSuggestions('from a | eval var0 = bucket(@timestamp, ', getUnitDuration(1), ' '); @@ -836,7 +883,7 @@ describe('autocomplete', () => { ',', '|', ...getFunctionSignaturesByReturnType('eval', 'any', { builtin: true, skipAssign: true }, [ - 'number', + 'integer', ]), ], ' ' @@ -848,39 +895,20 @@ describe('autocomplete', () => { 'time_interval', ]), ]); - testSuggestions( - 'from a | eval a = 1 day + 2 ', - [ - ...dateSuggestions, - ',', - '|', - ...getFunctionSignaturesByReturnType('eval', 'any', { builtin: true, skipAssign: true }, [ - 'number', - ]), - ], - ' ' - ); + testSuggestions('from a | eval a = 1 day + 2 ', [',', '|']); testSuggestions( 'from a | eval 1 day + 2 ', [ ...dateSuggestions, ...getFunctionSignaturesByReturnType('eval', 'any', { builtin: true, skipAssign: true }, [ - 'number', + 'integer', ]), ], ' ' ); testSuggestions( 'from a | eval var0=date_trunc()', - [ - ...[...TIME_SYSTEM_PARAMS].map((t) => `${t},`), - ...getLiteralsByType('time_literal').map((t) => `${t},`), - ...getFunctionSignaturesByReturnType('eval', 'date', { scalar: true }, undefined, [ - 'date_trunc', - ]).map((t) => ({ ...t, text: `${t.text},` })), - ...getFieldNamesByType('date').map((t) => `${t},`), - TIME_PICKER_SUGGESTION, - ], + [...getLiteralsByType('time_literal').map((t) => `${t},`)], '(' ); testSuggestions( @@ -917,7 +945,7 @@ describe('autocomplete', () => { describe('callbacks', () => { it('should send the fields query without the last command', async () => { const callbackMocks = createCustomCallbackMocks(undefined, undefined, undefined); - const statement = 'from a | drop stringField | eval var0 = abs(numberField) '; + const statement = 'from a | drop stringField | eval var0 = abs(doubleField) '; const triggerOffset = statement.lastIndexOf(' '); const context = createCompletionContext(statement[triggerOffset]); await suggest( @@ -933,7 +961,7 @@ describe('autocomplete', () => { }); it('should send the fields query aware of the location', async () => { const callbackMocks = createCustomCallbackMocks(undefined, undefined, undefined); - const statement = 'from a | drop | eval var0 = abs(numberField) '; + const statement = 'from a | drop | eval var0 = abs(doubleField) '; const triggerOffset = statement.lastIndexOf('p') + 1; // drop const context = createCompletionContext(statement[triggerOffset]); await suggest( @@ -1025,10 +1053,13 @@ describe('autocomplete', () => { testSuggestions( 'FROM kibana_sample_data_logs | EVAL TRIM(e)', [ - ...getFieldNamesByType('string'), - ...getFunctionSignaturesByReturnType('eval', 'string', { scalar: true }, undefined, [ - 'trim', - ]), + ...getFunctionSignaturesByReturnType( + 'eval', + ['text', 'keyword'], + { scalar: true }, + undefined, + ['trim'] + ), ], undefined, 42 diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts index 42e82662e7110..d2d617aac4315 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts @@ -16,6 +16,7 @@ import type { ESQLSingleAstItem, } from '@kbn/esql-ast'; import { partition } from 'lodash'; +import { ESQL_NUMBER_TYPES, isNumericType } from '../shared/esql_types'; import type { EditorContext, SuggestionRawDefinition } from './types'; import { lookupColumn, @@ -88,6 +89,7 @@ import { getParamAtPosition, getQueryForFields, getSourcesFromCommands, + getSupportedTypesForBinaryOperators, isAggFunctionUsedAlready, removeQuoteForSuggestedSources, } from './helper'; @@ -124,7 +126,7 @@ function appendEnrichFields( // @TODO: improve this const newMap: Map = new Map(fieldsMap); for (const field of policyMetadata.enrichFields) { - newMap.set(field, { name: field, type: 'number' }); + newMap.set(field, { name: field, type: 'double' }); } return newMap; } @@ -732,7 +734,7 @@ async function getExpressionSuggestionsByType( workoutBuiltinOptions(rightArg, references) ) ); - if (nodeArgType === 'number' && isLiteralItem(rightArg)) { + if (isNumericType(nodeArgType) && isLiteralItem(rightArg)) { // ... EVAL var = 1 suggestions.push(...getCompatibleLiterals(command.name, ['time_literal_unit'])); } @@ -740,7 +742,7 @@ async function getExpressionSuggestionsByType( if (rightArg.args.some(isTimeIntervalItem)) { const lastFnArg = rightArg.args[rightArg.args.length - 1]; const lastFnArgType = extractFinalTypeFromArg(lastFnArg, references); - if (lastFnArgType === 'number' && isLiteralItem(lastFnArg)) + if (isNumericType(lastFnArgType) && isLiteralItem(lastFnArg)) // ... EVAL var = 1 year + 2 suggestions.push(...getCompatibleLiterals(command.name, ['time_literal_unit'])); } @@ -777,7 +779,7 @@ async function getExpressionSuggestionsByType( if (nodeArg.args.some(isTimeIntervalItem)) { const lastFnArg = nodeArg.args[nodeArg.args.length - 1]; const lastFnArgType = extractFinalTypeFromArg(lastFnArg, references); - if (lastFnArgType === 'number' && isLiteralItem(lastFnArg)) + if (isNumericType(lastFnArgType) && isLiteralItem(lastFnArg)) // ... EVAL var = 1 year + 2 suggestions.push(...getCompatibleLiterals(command.name, ['time_literal_unit'])); } @@ -793,7 +795,10 @@ async function getExpressionSuggestionsByType( suggestions.push(...buildConstantsDefinitions(argDef.values)); } // If the type is specified try to dig deeper in the definition to suggest the best candidate - if (['string', 'number', 'boolean'].includes(argDef.type) && !argDef.values) { + if ( + ['string', 'text', 'keyword', 'boolean', ...ESQL_NUMBER_TYPES].includes(argDef.type) && + !argDef.values + ) { // it can be just literal values (i.e. "string") if (argDef.constantOnly) { // ... | ... @@ -971,6 +976,7 @@ async function getBuiltinFunctionNextArgument( ) { const suggestions = []; const isFnComplete = isFunctionArgComplete(nodeArg, references); + if (isFnComplete.complete) { // i.e. ... | field > 0 // i.e. ... | field + otherN @@ -1001,17 +1007,16 @@ async function getBuiltinFunctionNextArgument( suggestions.push(listCompleteItem); } else { const finalType = nestedType || nodeArgType || 'any'; + const supportedTypes = getSupportedTypesForBinaryOperators(fnDef, finalType); suggestions.push( ...(await getFieldsOrFunctionsSuggestions( // this is a special case with AND/OR // expression AND/OR // technically another boolean value should be suggested, but it is a better experience // to actually suggest a wider set of fields/functions - [ - finalType === 'boolean' && getFunctionDefinition(nodeArg.name)?.type === 'builtin' - ? 'any' - : finalType, - ], + finalType === 'boolean' && getFunctionDefinition(nodeArg.name)?.type === 'builtin' + ? ['any'] + : supportedTypes, command.name, option?.name, getFieldsByType, @@ -1321,7 +1326,7 @@ async function getFunctionArgsSuggestions( // for eval and row commands try also to complete numeric literals with time intervals where possible if (arg) { if (command.name !== 'stats') { - if (isLiteralItem(arg) && arg.literalType === 'number') { + if (isLiteralItem(arg) && isNumericType(arg.literalType)) { // ... | EVAL fn(2 ) suggestions.push( ...(await getFieldsOrFunctionsSuggestions( diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts index f54511c8e304d..cb56f40a6d6f4 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts @@ -22,7 +22,8 @@ import { import { shouldBeQuotedSource, getCommandDefinition, shouldBeQuotedText } from '../shared/helpers'; import { buildDocumentation, buildFunctionDocumentation } from './documentation_util'; import { DOUBLE_BACKTICK, SINGLE_TICK_REGEX } from '../shared/constants'; -import type { ESQLRealField } from '../validation/types'; +import { ESQLRealField } from '../validation/types'; +import { isNumericType } from '../shared/esql_types'; const allFunctions = statsAggregationFunctionDefinitions .concat(evalFunctionDefinitions) @@ -359,7 +360,7 @@ export function getUnitDuration(unit: number = 1) { */ export function getCompatibleLiterals(commandName: string, types: string[], names?: string[]) { const suggestions: SuggestionRawDefinition[] = []; - if (types.includes('number')) { + if (types.some(isNumericType)) { if (commandName === 'limit') { // suggest 10/100/1000 for limit suggestions.push(...buildConstantsDefinitions(['10', '100', '1000'], '')); diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/helper.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/helper.ts index f9586670b29e6..65f6601c51c13 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/helper.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/helper.ts @@ -80,3 +80,15 @@ export function removeQuoteForSuggestedSources(suggestions: SuggestionRawDefinit text: d.text.startsWith('"') && d.text.endsWith('"') ? d.text.slice(1, -1) : d.text, })); } + +export function getSupportedTypesForBinaryOperators( + fnDef: FunctionDefinition | undefined, + previousType: string +) { + // Retrieve list of all 'right' supported types that match the left hand side of the function + return fnDef && Array.isArray(fnDef?.signatures) + ? fnDef.signatures + .filter(({ params }) => params.find((p) => p.name === 'left' && p.type === previousType)) + .map(({ params }) => params[1].type) + : [previousType]; +} diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts index a27b8a68a9be0..97dc654f525ce 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts @@ -7,15 +7,18 @@ */ import { i18n } from '@kbn/i18n'; -import type { FunctionDefinition, FunctionParameterType } from './types'; +import { ESQL_COMMON_NUMERIC_TYPES, ESQL_NUMBER_TYPES } from '../shared/esql_types'; +import type { FunctionDefinition, FunctionParameterType, FunctionReturnType } from './types'; function createNumericAggDefinition({ name, description, + returnType, args = [], }: { name: string; description: string; + returnType?: (numericType: FunctionParameterType) => FunctionReturnType; args?: Array<{ name: string; type: FunctionParameterType; @@ -30,9 +33,9 @@ function createNumericAggDefinition({ description, supportedCommands: ['stats', 'metrics'], signatures: [ - { + ...ESQL_NUMBER_TYPES.map((numericType) => ({ params: [ - { name: 'column', type: 'number', noNestingFunctions: true }, + { name: 'column', type: numericType, noNestingFunctions: true }, ...args.map(({ name: paramName, type, constantOnly }) => ({ name: paramName, type, @@ -40,8 +43,8 @@ function createNumericAggDefinition({ constantOnly, })), ], - returnType: 'number', - }, + returnType: returnType ? returnType(numericType) : numericType, + })), ], examples: [ `from index | stats result = ${name}(field${extraParamsExample})`, @@ -56,18 +59,28 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.avgDoc', { defaultMessage: 'Returns the average of the values in a field', }), + returnType: () => 'double' as FunctionReturnType, }, { name: 'sum', description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sumDoc', { defaultMessage: 'Returns the sum of the values in a field.', }), + returnType: (numericType: FunctionParameterType): FunctionReturnType => { + switch (numericType) { + case 'double': + return 'double'; + default: + return 'long'; + } + }, }, { name: 'median', description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.medianDoc', { defaultMessage: 'Returns the 50% percentile.', }), + returnType: () => 'double' as FunctionReturnType, }, { name: 'median_absolute_deviation', @@ -78,20 +91,42 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ 'Returns the median of each data point’s deviation from the median of the entire sample.', } ), - }, - { - name: 'percentile', - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.percentiletDoc', - { - defaultMessage: 'Returns the n percentile of a field.', - } - ), - args: [{ name: 'percentile', type: 'number' as const, value: '90', constantOnly: true }], + returnType: () => 'double' as FunctionReturnType, }, ] .map(createNumericAggDefinition) .concat([ + { + name: 'percentile', + description: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.definitions.percentiletDoc', + { + defaultMessage: 'Returns the n percentile of a field.', + } + ), + type: 'agg', + supportedCommands: ['stats', 'metrics'], + signatures: [ + ...ESQL_COMMON_NUMERIC_TYPES.map((numericType: FunctionParameterType) => { + return ESQL_COMMON_NUMERIC_TYPES.map((weightType: FunctionParameterType) => ({ + params: [ + { + name: 'column', + type: numericType, + noNestingFunctions: true, + }, + { + name: 'percentile', + type: weightType, + noNestingFunctions: true, + constantOnly: true, + }, + ], + returnType: 'double' as FunctionReturnType, + })); + }).flat(), + ], + }, { name: 'max', description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.maxDoc', { @@ -100,13 +135,17 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ type: 'agg', supportedCommands: ['stats', 'metrics'], signatures: [ + ...ESQL_COMMON_NUMERIC_TYPES.map((type) => ({ + params: [{ name: 'column', type, noNestingFunctions: true }], + returnType: type, + })), { - params: [{ name: 'column', type: 'number', noNestingFunctions: true }], - returnType: 'number', + params: [{ name: 'column', type: 'date', noNestingFunctions: true }], + returnType: 'date', }, { - params: [{ name: 'column', type: 'date', noNestingFunctions: true }], - returnType: 'number', + params: [{ name: 'column', type: 'date_period', noNestingFunctions: true }], + returnType: 'date_period', }, { params: [{ name: 'column', type: 'boolean', noNestingFunctions: true }], @@ -127,13 +166,17 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ type: 'agg', supportedCommands: ['stats', 'metrics'], signatures: [ + ...ESQL_COMMON_NUMERIC_TYPES.map((type) => ({ + params: [{ name: 'column', type, noNestingFunctions: true }], + returnType: type, + })), { - params: [{ name: 'column', type: 'number', noNestingFunctions: true }], - returnType: 'number', + params: [{ name: 'column', type: 'date', noNestingFunctions: true }], + returnType: 'date', }, { - params: [{ name: 'column', type: 'date', noNestingFunctions: true }], - returnType: 'number', + params: [{ name: 'column', type: 'date_period', noNestingFunctions: true }], + returnType: 'date_period', }, { params: [{ name: 'column', type: 'boolean', noNestingFunctions: true }], @@ -166,7 +209,7 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ optional: true, }, ], - returnType: 'number', + returnType: 'long', }, ], examples: [`from index | stats result = count(field)`, `from index | stats count(field)`], @@ -185,9 +228,14 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ { params: [ { name: 'column', type: 'any', noNestingFunctions: true }, - { name: 'precision', type: 'number', noNestingFunctions: true, optional: true }, + ...ESQL_NUMBER_TYPES.map((type) => ({ + name: 'precision', + type, + noNestingFunctions: true, + optional: true, + })), ], - returnType: 'number', + returnType: 'long', }, ], examples: [ @@ -258,14 +306,14 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ }, { name: 'limit', - type: 'number', + type: 'integer', noNestingFunctions: true, optional: false, constantOnly: true, }, { name: 'order', - type: 'string', + type: 'keyword', noNestingFunctions: true, optional: false, constantOnly: true, @@ -292,23 +340,25 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ ), supportedCommands: ['stats', 'metrics'], signatures: [ - { - params: [ - { - name: 'number', - type: 'number', - noNestingFunctions: true, - optional: false, - }, - { - name: 'weight', - type: 'number', - noNestingFunctions: true, - optional: false, - }, - ], - returnType: 'number', - }, + ...ESQL_COMMON_NUMERIC_TYPES.map((numericType: FunctionParameterType) => { + return ESQL_COMMON_NUMERIC_TYPES.map((weightType: FunctionParameterType) => ({ + params: [ + { + name: 'number', + type: numericType, + noNestingFunctions: true, + optional: false, + }, + { + name: 'weight', + type: weightType, + noNestingFunctions: true, + optional: false, + }, + ], + returnType: 'double' as FunctionReturnType, + })); + }).flat(), ], examples: [ `from employees | stats w_avg = weighted_avg(salary, height) by languages | eval w_avg = round(w_avg)`, diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts index a32cba3d191c3..10945d1c6b135 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts @@ -7,14 +7,14 @@ */ import { i18n } from '@kbn/i18n'; +import { ESQL_NUMBER_TYPES, isNumericType } from '../shared/esql_types'; import type { FunctionDefinition, FunctionParameterType, FunctionReturnType } from './types'; +type MathFunctionSignature = [FunctionParameterType, FunctionParameterType, FunctionReturnType]; + function createMathDefinition( name: string, - types: Array< - | (FunctionParameterType & FunctionReturnType) - | [FunctionParameterType, FunctionParameterType, FunctionReturnType] - >, + functionSignatures: MathFunctionSignature[], description: string, validate?: FunctionDefinition['validate'] ): FunctionDefinition { @@ -24,28 +24,41 @@ function createMathDefinition( description, supportedCommands: ['eval', 'where', 'row', 'stats', 'metrics', 'sort'], supportedOptions: ['by'], - signatures: types.map((type) => { - if (Array.isArray(type)) { - return { - params: [ - { name: 'left', type: type[0] }, - { name: 'right', type: type[1] }, - ], - returnType: type[2], - }; - } + signatures: functionSignatures.map((functionSignature) => { + const [lhs, rhs, result] = functionSignature; return { params: [ - { name: 'left', type }, - { name: 'right', type }, + { name: 'left', type: lhs }, + { name: 'right', type: rhs }, ], - returnType: type, + returnType: result, }; }), validate, }; } +// https://www.elastic.co/guide/en/elasticsearch/reference/master/esql-functions-operators.html#_less_than +const baseComparisonTypeTable: MathFunctionSignature[] = [ + ['date', 'date', 'boolean'], + ['double', 'double', 'boolean'], + ['double', 'integer', 'boolean'], + ['double', 'long', 'boolean'], + ['integer', 'double', 'boolean'], + ['integer', 'integer', 'boolean'], + ['integer', 'long', 'boolean'], + ['ip', 'ip', 'boolean'], + ['keyword', 'keyword', 'boolean'], + ['keyword', 'text', 'boolean'], + ['long', 'double', 'boolean'], + ['long', 'integer', 'boolean'], + ['long', 'long', 'boolean'], + ['text', 'keyword', 'boolean'], + ['text', 'text', 'boolean'], + ['unsigned_long', 'unsigned_long', 'boolean'], + ['version', 'version', 'boolean'], +]; + function createComparisonDefinition( { name, @@ -58,6 +71,17 @@ function createComparisonDefinition( }, validate?: FunctionDefinition['validate'] ): FunctionDefinition { + const commonSignatures = baseComparisonTypeTable.map((functionSignature) => { + const [lhs, rhs, result] = functionSignature; + return { + params: [ + { name: 'left', type: lhs }, + { name: 'right', type: rhs }, + ], + returnType: result, + }; + }); + return { type: 'builtin' as const, name, @@ -66,41 +90,7 @@ function createComparisonDefinition( supportedOptions: ['by'], validate, signatures: [ - { - params: [ - { name: 'left', type: 'number' }, - { name: 'right', type: 'number' }, - ], - returnType: 'boolean', - }, - { - params: [ - { name: 'left', type: 'string' }, - { name: 'right', type: 'string' }, - ], - returnType: 'boolean', - }, - { - params: [ - { name: 'left', type: 'date' }, - { name: 'right', type: 'date' }, - ], - returnType: 'boolean', - }, - { - params: [ - { name: 'left', type: 'ip' }, - { name: 'right', type: 'ip' }, - ], - returnType: 'boolean', - }, - { - params: [ - { name: 'left', type: 'version' }, - { name: 'right', type: 'version' }, - ], - returnType: 'boolean', - }, + ...commonSignatures, // constant strings okay because of implicit casting for // string to version and ip // @@ -113,13 +103,13 @@ function createComparisonDefinition( { params: [ { name: 'left', type }, - { name: 'right', type: 'string' as const, constantOnly: true }, + { name: 'right', type: 'text' as const, constantOnly: true }, ], returnType: 'boolean' as const, }, { params: [ - { name: 'right', type: 'string' as const, constantOnly: true }, + { name: 'left', type: 'text' as const, constantOnly: true }, { name: 'right', type }, ], returnType: 'boolean' as const, @@ -130,31 +120,111 @@ function createComparisonDefinition( }; } +const addTypeTable: MathFunctionSignature[] = [ + ['date_period', 'date_period', 'date_period'], + ['date_period', 'date', 'date'], + ['date', 'date_period', 'date'], + ['date', 'time_duration', 'date'], + ['date', 'time_literal', 'date'], + ['double', 'double', 'double'], + ['double', 'integer', 'double'], + ['double', 'long', 'double'], + ['integer', 'double', 'double'], + ['integer', 'integer', 'integer'], + ['integer', 'long', 'long'], + ['long', 'double', 'double'], + ['long', 'integer', 'long'], + ['long', 'long', 'long'], + ['time_duration', 'date', 'date'], + ['time_duration', 'time_duration', 'time_duration'], + ['unsigned_long', 'unsigned_long', 'unsigned_long'], + ['time_literal', 'date', 'date'], +]; + +const subtractTypeTable: MathFunctionSignature[] = [ + ['date_period', 'date_period', 'date_period'], + ['date', 'date_period', 'date'], + ['date', 'time_duration', 'date'], + ['date', 'time_literal', 'date'], + ['double', 'double', 'double'], + ['double', 'integer', 'double'], + ['double', 'long', 'double'], + ['integer', 'double', 'double'], + ['integer', 'integer', 'integer'], + ['integer', 'long', 'long'], + ['long', 'double', 'double'], + ['long', 'integer', 'long'], + ['long', 'long', 'long'], + ['time_duration', 'date', 'date'], + ['time_duration', 'time_duration', 'time_duration'], + ['unsigned_long', 'unsigned_long', 'unsigned_long'], + ['time_literal', 'date', 'date'], +]; + +const multiplyTypeTable: MathFunctionSignature[] = [ + ['double', 'double', 'double'], + ['double', 'integer', 'double'], + ['double', 'long', 'double'], + ['integer', 'double', 'double'], + ['integer', 'integer', 'integer'], + ['integer', 'long', 'long'], + ['long', 'double', 'double'], + ['long', 'integer', 'long'], + ['long', 'long', 'long'], + ['unsigned_long', 'unsigned_long', 'unsigned_long'], +]; + +const divideTypeTable: MathFunctionSignature[] = [ + ['double', 'double', 'double'], + ['double', 'integer', 'double'], + ['double', 'long', 'double'], + ['integer', 'double', 'double'], + ['integer', 'integer', 'integer'], + ['integer', 'long', 'long'], + ['long', 'double', 'double'], + ['long', 'integer', 'long'], + ['long', 'long', 'long'], + ['unsigned_long', 'unsigned_long', 'unsigned_long'], +]; + +const modulusTypeTable: MathFunctionSignature[] = [ + ['double', 'double', 'double'], + ['double', 'integer', 'double'], + ['double', 'long', 'double'], + ['integer', 'double', 'double'], + ['integer', 'integer', 'integer'], + ['integer', 'long', 'long'], + ['long', 'double', 'double'], + ['long', 'integer', 'long'], + ['long', 'long', 'long'], + ['unsigned_long', 'unsigned_long', 'unsigned_long'], +]; + export const mathFunctions: FunctionDefinition[] = [ createMathDefinition( '+', - ['number', ['date', 'time_literal', 'date'], ['time_literal', 'date', 'date']], + addTypeTable, i18n.translate('kbn-esql-validation-autocomplete.esql.definition.addDoc', { defaultMessage: 'Add (+)', }) ), createMathDefinition( '-', - ['number', ['date', 'time_literal', 'date'], ['time_literal', 'date', 'date']], + subtractTypeTable, i18n.translate('kbn-esql-validation-autocomplete.esql.definition.subtractDoc', { defaultMessage: 'Subtract (-)', }) ), createMathDefinition( '*', - ['number'], + multiplyTypeTable, i18n.translate('kbn-esql-validation-autocomplete.esql.definition.multiplyDoc', { defaultMessage: 'Multiply (*)', }) ), createMathDefinition( '/', - ['number'], + divideTypeTable, i18n.translate('kbn-esql-validation-autocomplete.esql.definition.divideDoc', { defaultMessage: 'Divide (/)', }), @@ -162,7 +232,7 @@ export const mathFunctions: FunctionDefinition[] = [ const [left, right] = fnDef.args; const messages = []; if (!Array.isArray(left) && !Array.isArray(right)) { - if (right.type === 'literal' && right.literalType === 'number') { + if (right.type === 'literal' && isNumericType(right.literalType)) { if (right.value === 0) { messages.push({ type: 'warning' as const, @@ -187,7 +257,7 @@ export const mathFunctions: FunctionDefinition[] = [ ), createMathDefinition( '%', - ['number'], + modulusTypeTable, i18n.translate('kbn-esql-validation-autocomplete.esql.definition.moduleDoc', { defaultMessage: 'Module (%)', }), @@ -195,7 +265,7 @@ export const mathFunctions: FunctionDefinition[] = [ const [left, right] = fnDef.args; const messages = []; if (!Array.isArray(left) && !Array.isArray(right)) { - if (right.type === 'literal' && right.literalType === 'number') { + if (right.type === 'literal' && isNumericType(right.literalType)) { if (right.value === 0) { messages.push({ type: 'warning' as const, @@ -244,7 +314,7 @@ const comparisonFunctions: FunctionDefinition[] = [ }, { params: [ - { name: 'right', type: 'string' as const, constantOnly: true }, + { name: 'left', type: 'string' as const, constantOnly: true }, { name: 'right', type: 'boolean' as const }, ], returnType: 'boolean' as const, @@ -274,7 +344,7 @@ const comparisonFunctions: FunctionDefinition[] = [ }, { params: [ - { name: 'right', type: 'string' as const, constantOnly: true }, + { name: 'left', type: 'string' as const, constantOnly: true }, { name: 'right', type: 'boolean' as const }, ], returnType: 'boolean' as const, @@ -347,8 +417,15 @@ const likeFunctions: FunctionDefinition[] = [ signatures: [ { params: [ - { name: 'left', type: 'string' as const }, - { name: 'right', type: 'string' as const }, + { name: 'left', type: 'text' as const }, + { name: 'right', type: 'text' as const }, + ], + returnType: 'boolean', + }, + { + params: [ + { name: 'left', type: 'keyword' as const }, + { name: 'right', type: 'keyword' as const }, ], returnType: 'boolean', }, @@ -383,17 +460,24 @@ const inFunctions: FunctionDefinition[] = [ description, supportedCommands: ['eval', 'where', 'row', 'sort'], signatures: [ - { + ...ESQL_NUMBER_TYPES.map((type) => ({ params: [ - { name: 'left', type: 'number' }, + { name: 'left', type: type as FunctionParameterType }, + { name: 'right', type: 'any[]' as FunctionParameterType }, + ], + returnType: 'boolean' as FunctionReturnType, + })), + { + params: [ + { name: 'left', type: 'keyword' }, { name: 'right', type: 'any[]' }, ], returnType: 'boolean', }, { params: [ - { name: 'left', type: 'string' }, + { name: 'left', type: 'text' }, { name: 'right', type: 'any[]' }, ], returnType: 'boolean', diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/commands.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/commands.ts index 033518ac16c37..df0d5f02f8cf0 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/commands.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/commands.ts @@ -273,7 +273,7 @@ export const commandDefinitions: CommandDefinition[] = [ examples: ['… | limit 100', '… | limit 0'], signature: { multipleParams: false, - params: [{ name: 'size', type: 'number', constantOnly: true }], + params: [{ name: 'size', type: 'integer', constantOnly: true }], }, options: [], modes: [], @@ -390,6 +390,7 @@ export const commandDefinitions: CommandDefinition[] = [ signature: { multipleParams: false, params: [ + // innerType: 'string' is interpreted as keyword and text (see columnParamsWithInnerTypes) { name: 'column', type: 'column', innerType: 'string' }, { name: 'pattern', type: 'string', constantOnly: true }, ], @@ -407,6 +408,7 @@ export const commandDefinitions: CommandDefinition[] = [ signature: { multipleParams: false, params: [ + // innerType: 'string' is interpreted as keyword and text (see columnParamsWithInnerTypes) { name: 'column', type: 'column', innerType: 'string' }, { name: 'pattern', type: 'string', constantOnly: true }, ], diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts index a02a09757d033..3b9d9131e7643 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts @@ -43,11 +43,41 @@ const absDefinition: FunctionDefinition = { params: [ { name: 'number', - type: 'number', + type: 'double', optional: false, }, ], - returnType: 'number', + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'unsigned_long', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -72,11 +102,41 @@ const acosDefinition: FunctionDefinition = { params: [ { name: 'number', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', optional: false, }, ], - returnType: 'number', + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -99,85 +159,56 @@ const asinDefinition: FunctionDefinition = { params: [ { name: 'number', - type: 'number', + type: 'double', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW a=.9\n| EVAL asin=ASIN(a)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const atanDefinition: FunctionDefinition = { - type: 'eval', - name: 'atan', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.atan', { - defaultMessage: - 'Returns the arctangent of the input\nnumeric expression as an angle, expressed in radians.', - }), - alias: undefined, - signatures: [ { params: [ { name: 'number', - type: 'number', + type: 'integer', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW a=12.9\n| EVAL atan=ATAN(a)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const atan2Definition: FunctionDefinition = { - type: 'eval', - name: 'atan2', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.atan2', { - defaultMessage: - 'The angle between the positive x-axis and the ray from the\norigin to the point (x , y) in the Cartesian plane, expressed in radians.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'y_coordinate', - type: 'number', + name: 'number', + type: 'long', optional: false, }, + ], + returnType: 'double', + }, + { + params: [ { - name: 'x_coordinate', - type: 'number', + name: 'number', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW y=12.9, x=.6\n| EVAL atan2=ATAN2(y, x)'], + examples: ['ROW a=.9\n| EVAL asin=ASIN(a)'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const cbrtDefinition: FunctionDefinition = { +const atanDefinition: FunctionDefinition = { type: 'eval', - name: 'cbrt', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cbrt', { + name: 'atan', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.atan', { defaultMessage: - 'Returns the cube root of a number. The input can be any numeric value, the return value is always a double.\nCube roots of infinities are null.', + 'Returns the arctangent of the input\nnumeric expression as an angle, expressed in radians.', }), alias: undefined, signatures: [ @@ -185,503 +216,1075 @@ const cbrtDefinition: FunctionDefinition = { params: [ { name: 'number', - type: 'number', + type: 'double', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW d = 1000.0\n| EVAL c = cbrt(d)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const ceilDefinition: FunctionDefinition = { - type: 'eval', - name: 'ceil', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ceil', { - defaultMessage: 'Round a number up to the nearest integer.', - }), - alias: undefined, - signatures: [ { params: [ { name: 'number', - type: 'number', + type: 'integer', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW a=1.8\n| EVAL a=CEIL(a)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const cidrMatchDefinition: FunctionDefinition = { - type: 'eval', - name: 'cidr_match', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cidr_match', { - defaultMessage: - 'Returns true if the provided IP is contained in one of the provided CIDR blocks.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'ip', - type: 'ip', + name: 'number', + type: 'long', optional: false, }, + ], + returnType: 'double', + }, + { + params: [ { - name: 'blockX', - type: 'string', + name: 'number', + type: 'unsigned_long', optional: false, }, ], - returnType: 'boolean', - minParams: 2, + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: [ - 'FROM hosts \n| WHERE CIDR_MATCH(ip1, "127.0.0.2/32", "127.0.0.3/32") \n| KEEP card, host, ip0, ip1', - ], + examples: ['ROW a=12.9\n| EVAL atan=ATAN(a)'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const coalesceDefinition: FunctionDefinition = { +const atan2Definition: FunctionDefinition = { type: 'eval', - name: 'coalesce', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.coalesce', { + name: 'atan2', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.atan2', { defaultMessage: - 'Returns the first of its arguments that is not null. If all arguments are null, it returns `null`.', + 'The angle between the positive x-axis and the ray from the\norigin to the point (x , y) in the Cartesian plane, expressed in radians.', }), alias: undefined, signatures: [ { params: [ { - name: 'first', - type: 'boolean', + name: 'y_coordinate', + type: 'double', + optional: false, + }, + { + name: 'x_coordinate', + type: 'double', optional: false, }, ], - returnType: 'boolean', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'boolean', + name: 'y_coordinate', + type: 'double', optional: false, }, { - name: 'rest', - type: 'boolean', - optional: true, + name: 'x_coordinate', + type: 'integer', + optional: false, }, ], - returnType: 'boolean', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'cartesian_point', + name: 'y_coordinate', + type: 'double', optional: false, }, { - name: 'rest', - type: 'cartesian_point', - optional: true, + name: 'x_coordinate', + type: 'long', + optional: false, }, ], - returnType: 'cartesian_point', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'cartesian_shape', + name: 'y_coordinate', + type: 'double', optional: false, }, { - name: 'rest', - type: 'cartesian_shape', - optional: true, + name: 'x_coordinate', + type: 'unsigned_long', + optional: false, }, ], - returnType: 'cartesian_shape', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'date', + name: 'y_coordinate', + type: 'integer', optional: false, }, { - name: 'rest', - type: 'date', - optional: true, + name: 'x_coordinate', + type: 'double', + optional: false, }, ], - returnType: 'date', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'geo_point', + name: 'y_coordinate', + type: 'integer', optional: false, }, { - name: 'rest', - type: 'geo_point', - optional: true, + name: 'x_coordinate', + type: 'integer', + optional: false, }, ], - returnType: 'geo_point', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'geo_shape', + name: 'y_coordinate', + type: 'integer', optional: false, }, { - name: 'rest', - type: 'geo_shape', - optional: true, + name: 'x_coordinate', + type: 'long', + optional: false, }, ], - returnType: 'geo_shape', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'number', + name: 'y_coordinate', + type: 'integer', + optional: false, + }, + { + name: 'x_coordinate', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'number', + name: 'y_coordinate', + type: 'long', optional: false, }, { - name: 'rest', - type: 'number', - optional: true, + name: 'x_coordinate', + type: 'double', + optional: false, }, ], - returnType: 'number', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'ip', + name: 'y_coordinate', + type: 'long', optional: false, }, { - name: 'rest', - type: 'ip', - optional: true, + name: 'x_coordinate', + type: 'integer', + optional: false, }, ], - returnType: 'ip', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'string', + name: 'y_coordinate', + type: 'long', + optional: false, + }, + { + name: 'x_coordinate', + type: 'long', optional: false, }, ], - returnType: 'string', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'string', + name: 'y_coordinate', + type: 'long', optional: false, }, { - name: 'rest', - type: 'string', - optional: true, + name: 'x_coordinate', + type: 'unsigned_long', + optional: false, }, ], - returnType: 'string', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'version', + name: 'y_coordinate', + type: 'unsigned_long', optional: false, }, { - name: 'rest', - type: 'version', - optional: true, + name: 'x_coordinate', + type: 'double', + optional: false, }, ], - returnType: 'version', - minParams: 1, + returnType: 'double', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW a=null, b="b"\n| EVAL COALESCE(a, b)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const concatDefinition: FunctionDefinition = { - type: 'eval', - name: 'concat', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.concat', { - defaultMessage: 'Concatenates two or more strings.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'string1', - type: 'string', + name: 'y_coordinate', + type: 'unsigned_long', optional: false, }, { - name: 'string2', - type: 'string', + name: 'x_coordinate', + type: 'integer', optional: false, }, ], - returnType: 'string', - minParams: 2, + returnType: 'double', + }, + { + params: [ + { + name: 'y_coordinate', + type: 'unsigned_long', + optional: false, + }, + { + name: 'x_coordinate', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'y_coordinate', + type: 'unsigned_long', + optional: false, + }, + { + name: 'x_coordinate', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: [ - 'FROM employees\n| KEEP first_name, last_name\n| EVAL fullname = CONCAT(first_name, " ", last_name)', - ], + examples: ['ROW y=12.9, x=.6\n| EVAL atan2=ATAN2(y, x)'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const cosDefinition: FunctionDefinition = { +const cbrtDefinition: FunctionDefinition = { type: 'eval', - name: 'cos', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cos', { - defaultMessage: 'Returns the cosine of an angle.', + name: 'cbrt', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cbrt', { + defaultMessage: + 'Returns the cube root of a number. The input can be any numeric value, the return value is always a double.\nCube roots of infinities are null.', }), alias: undefined, signatures: [ { params: [ { - name: 'angle', - type: 'number', + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW a=1.8 \n| EVAL cos=COS(a)'], + examples: ['ROW d = 1000.0\n| EVAL c = cbrt(d)'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const coshDefinition: FunctionDefinition = { +const ceilDefinition: FunctionDefinition = { type: 'eval', - name: 'cosh', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cosh', { - defaultMessage: 'Returns the hyperbolic cosine of an angle.', + name: 'ceil', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ceil', { + defaultMessage: 'Round a number up to the nearest integer.', }), alias: undefined, signatures: [ { params: [ { - name: 'angle', - type: 'number', + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'unsigned_long', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW a=1.8 \n| EVAL cosh=COSH(a)'], + examples: ['ROW a=1.8\n| EVAL a=CEIL(a)'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const dateDiffDefinition: FunctionDefinition = { +const cidrMatchDefinition: FunctionDefinition = { type: 'eval', - name: 'date_diff', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_diff', { + name: 'cidr_match', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cidr_match', { defaultMessage: - 'Subtracts the `startTimestamp` from the `endTimestamp` and returns the difference in multiples of `unit`.\nIf `startTimestamp` is later than the `endTimestamp`, negative values are returned.', + 'Returns true if the provided IP is contained in one of the provided CIDR blocks.', }), alias: undefined, signatures: [ { params: [ { - name: 'unit', - type: 'string', + name: 'ip', + type: 'ip', optional: false, - literalOptions: [ - 'year', - 'years', - 'yy', - 'yyyy', - 'quarter', - 'quarters', - 'qq', - 'q', - 'month', - 'months', - 'mm', - 'm', - 'dayofyear', - 'dy', - 'y', - 'day', - 'days', - 'dd', - 'd', - 'week', - 'weeks', - 'wk', - 'ww', - 'weekday', - 'weekdays', - 'dw', - 'hour', - 'hours', - 'hh', - 'minute', - 'minutes', - 'mi', - 'n', - 'second', - 'seconds', - 'ss', - 's', - 'millisecond', - 'milliseconds', - 'ms', - 'microsecond', - 'microseconds', - 'mcs', - 'nanosecond', - 'nanoseconds', - 'ns', - ], - literalSuggestions: [ - 'year', - 'quarter', - 'month', - 'week', - 'day', - 'hour', - 'minute', - 'second', - 'millisecond', - 'microsecond', - 'nanosecond', - ], }, { - name: 'startTimestamp', - type: 'date', + name: 'blockX', + type: 'keyword', optional: false, }, + ], + returnType: 'boolean', + minParams: 2, + }, + { + params: [ { - name: 'endTimestamp', - type: 'date', + name: 'ip', + type: 'ip', + optional: false, + }, + { + name: 'blockX', + type: 'text', optional: false, }, ], - returnType: 'number', + returnType: 'boolean', + minParams: 2, }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, examples: [ - 'ROW date1 = TO_DATETIME("2023-12-02T11:00:00.000Z"), date2 = TO_DATETIME("2023-12-02T11:00:00.001Z")\n| EVAL dd_ms = DATE_DIFF("microseconds", date1, date2)', + 'FROM hosts \n| WHERE CIDR_MATCH(ip1, "127.0.0.2/32", "127.0.0.3/32") \n| KEEP card, host, ip0, ip1', ], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const dateExtractDefinition: FunctionDefinition = { +const coalesceDefinition: FunctionDefinition = { type: 'eval', - name: 'date_extract', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_extract', { - defaultMessage: 'Extracts parts of a date, like year, month, day, hour.', + name: 'coalesce', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.coalesce', { + defaultMessage: + 'Returns the first of its arguments that is not null. If all arguments are null, it returns `null`.', }), alias: undefined, signatures: [ { params: [ { - name: 'datePart', - type: 'string', + name: 'first', + type: 'boolean', optional: false, - literalOptions: [ - 'ALIGNED_DAY_OF_WEEK_IN_MONTH', - 'ALIGNED_DAY_OF_WEEK_IN_YEAR', - 'ALIGNED_WEEK_OF_MONTH', - 'ALIGNED_WEEK_OF_YEAR', - 'AMPM_OF_DAY', - 'CLOCK_HOUR_OF_AMPM', - 'CLOCK_HOUR_OF_DAY', - 'DAY_OF_MONTH', - 'DAY_OF_WEEK', - 'DAY_OF_YEAR', - 'EPOCH_DAY', + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'cartesian_point', + optional: false, + }, + { + name: 'rest', + type: 'cartesian_point', + optional: true, + }, + ], + returnType: 'cartesian_point', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'rest', + type: 'cartesian_shape', + optional: true, + }, + ], + returnType: 'cartesian_shape', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'date', + optional: false, + }, + { + name: 'rest', + type: 'date', + optional: true, + }, + ], + returnType: 'date', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'geo_point', + optional: false, + }, + { + name: 'rest', + type: 'geo_point', + optional: true, + }, + ], + returnType: 'geo_point', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'geo_shape', + optional: false, + }, + { + name: 'rest', + type: 'geo_shape', + optional: true, + }, + ], + returnType: 'geo_shape', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'integer', + optional: false, + }, + { + name: 'rest', + type: 'integer', + optional: true, + }, + ], + returnType: 'integer', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'ip', + optional: false, + }, + { + name: 'rest', + type: 'ip', + optional: true, + }, + ], + returnType: 'ip', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'keyword', + optional: false, + }, + { + name: 'rest', + type: 'keyword', + optional: true, + }, + ], + returnType: 'keyword', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'long', + optional: false, + }, + { + name: 'rest', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'text', + optional: false, + }, + ], + returnType: 'text', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'text', + optional: false, + }, + { + name: 'rest', + type: 'text', + optional: true, + }, + ], + returnType: 'text', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'version', + optional: false, + }, + { + name: 'rest', + type: 'version', + optional: true, + }, + ], + returnType: 'version', + minParams: 1, + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=null, b="b"\n| EVAL COALESCE(a, b)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const concatDefinition: FunctionDefinition = { + type: 'eval', + name: 'concat', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.concat', { + defaultMessage: 'Concatenates two or more strings.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string1', + type: 'keyword', + optional: false, + }, + { + name: 'string2', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + minParams: 2, + }, + { + params: [ + { + name: 'string1', + type: 'keyword', + optional: false, + }, + { + name: 'string2', + type: 'text', + optional: false, + }, + ], + returnType: 'keyword', + minParams: 2, + }, + { + params: [ + { + name: 'string1', + type: 'text', + optional: false, + }, + { + name: 'string2', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + minParams: 2, + }, + { + params: [ + { + name: 'string1', + type: 'text', + optional: false, + }, + { + name: 'string2', + type: 'text', + optional: false, + }, + ], + returnType: 'keyword', + minParams: 2, + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP first_name, last_name\n| EVAL fullname = CONCAT(first_name, " ", last_name)', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const cosDefinition: FunctionDefinition = { + type: 'eval', + name: 'cos', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cos', { + defaultMessage: 'Returns the cosine of an angle.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'angle', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8 \n| EVAL cos=COS(a)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const coshDefinition: FunctionDefinition = { + type: 'eval', + name: 'cosh', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cosh', { + defaultMessage: 'Returns the hyperbolic cosine of an angle.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'angle', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8 \n| EVAL cosh=COSH(a)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const dateDiffDefinition: FunctionDefinition = { + type: 'eval', + name: 'date_diff', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_diff', { + defaultMessage: + 'Subtracts the `startTimestamp` from the `endTimestamp` and returns the difference in multiples of `unit`.\nIf `startTimestamp` is later than the `endTimestamp`, negative values are returned.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'unit', + type: 'keyword', + optional: false, + literalOptions: [ + 'year', + 'years', + 'yy', + 'yyyy', + 'quarter', + 'quarters', + 'qq', + 'q', + 'month', + 'months', + 'mm', + 'm', + 'dayofyear', + 'dy', + 'y', + 'day', + 'days', + 'dd', + 'd', + 'week', + 'weeks', + 'wk', + 'ww', + 'weekday', + 'weekdays', + 'dw', + 'hour', + 'hours', + 'hh', + 'minute', + 'minutes', + 'mi', + 'n', + 'second', + 'seconds', + 'ss', + 's', + 'millisecond', + 'milliseconds', + 'ms', + 'microsecond', + 'microseconds', + 'mcs', + 'nanosecond', + 'nanoseconds', + 'ns', + ], + literalSuggestions: [ + 'year', + 'quarter', + 'month', + 'week', + 'day', + 'hour', + 'minute', + 'second', + 'millisecond', + 'microsecond', + 'nanosecond', + ], + }, + { + name: 'startTimestamp', + type: 'date', + optional: false, + }, + { + name: 'endTimestamp', + type: 'date', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'unit', + type: 'text', + optional: false, + }, + { + name: 'startTimestamp', + type: 'date', + optional: false, + }, + { + name: 'endTimestamp', + type: 'date', + optional: false, + }, + ], + returnType: 'integer', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW date1 = TO_DATETIME("2023-12-02T11:00:00.000Z"), date2 = TO_DATETIME("2023-12-02T11:00:00.001Z")\n| EVAL dd_ms = DATE_DIFF("microseconds", date1, date2)', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const dateExtractDefinition: FunctionDefinition = { + type: 'eval', + name: 'date_extract', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_extract', { + defaultMessage: 'Extracts parts of a date, like year, month, day, hour.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'datePart', + type: 'keyword', + optional: false, + literalOptions: [ + 'ALIGNED_DAY_OF_WEEK_IN_MONTH', + 'ALIGNED_DAY_OF_WEEK_IN_YEAR', + 'ALIGNED_WEEK_OF_MONTH', + 'ALIGNED_WEEK_OF_YEAR', + 'AMPM_OF_DAY', + 'CLOCK_HOUR_OF_AMPM', + 'CLOCK_HOUR_OF_DAY', + 'DAY_OF_MONTH', + 'DAY_OF_WEEK', + 'DAY_OF_YEAR', + 'EPOCH_DAY', 'ERA', 'HOUR_OF_AMPM', 'HOUR_OF_DAY', @@ -704,842 +1307,2528 @@ const dateExtractDefinition: FunctionDefinition = { ], }, { - name: 'date', - type: 'date', + name: 'date', + type: 'date', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'datePart', + type: 'text', + optional: false, + }, + { + name: 'date', + type: 'date', + optional: false, + }, + ], + returnType: 'long', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW date = DATE_PARSE("yyyy-MM-dd", "2022-05-06")\n| EVAL year = DATE_EXTRACT("year", date)', + 'FROM sample_data\n| WHERE DATE_EXTRACT("hour_of_day", @timestamp) < 9 AND DATE_EXTRACT("hour_of_day", @timestamp) >= 17', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const dateFormatDefinition: FunctionDefinition = { + type: 'eval', + name: 'date_format', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_format', { + defaultMessage: 'Returns a string representation of a date, in the provided format.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'dateFormat', + type: 'keyword', + optional: true, + }, + { + name: 'date', + type: 'date', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'dateFormat', + type: 'text', + optional: true, + }, + { + name: 'date', + type: 'date', + optional: false, + }, + ], + returnType: 'keyword', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP first_name, last_name, hire_date\n| EVAL hired = DATE_FORMAT("YYYY-MM-dd", hire_date)', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const dateParseDefinition: FunctionDefinition = { + type: 'eval', + name: 'date_parse', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_parse', { + defaultMessage: + 'Returns a date by parsing the second argument using the format specified in the first argument.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'datePattern', + type: 'keyword', + optional: true, + }, + { + name: 'dateString', + type: 'keyword', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'datePattern', + type: 'keyword', + optional: true, + }, + { + name: 'dateString', + type: 'text', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'datePattern', + type: 'text', + optional: true, + }, + { + name: 'dateString', + type: 'keyword', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'datePattern', + type: 'text', + optional: true, + }, + { + name: 'dateString', + type: 'text', + optional: false, + }, + ], + returnType: 'date', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW date_string = "2022-05-06"\n| EVAL date = DATE_PARSE("yyyy-MM-dd", date_string)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const dateTruncDefinition: FunctionDefinition = { + type: 'eval', + name: 'date_trunc', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_trunc', { + defaultMessage: 'Rounds down a date to the closest interval.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'interval', + type: 'time_literal', + optional: false, + }, + { + name: 'date', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'interval', + type: 'time_duration', + optional: false, + }, + { + name: 'date', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP first_name, last_name, hire_date\n| EVAL year_hired = DATE_TRUNC(1 year, hire_date)', + 'FROM employees\n| EVAL year = DATE_TRUNC(1 year, hire_date)\n| STATS hires = COUNT(emp_no) BY year\n| SORT year', + 'FROM sample_data\n| EVAL error = CASE(message LIKE "*error*", 1, 0)\n| EVAL hour = DATE_TRUNC(1 hour, @timestamp)\n| STATS error_rate = AVG(error) by hour\n| SORT hour', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const eDefinition: FunctionDefinition = { + type: 'eval', + name: 'e', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.e', { + defaultMessage: "Returns Euler's number.", + }), + alias: undefined, + signatures: [ + { + params: [], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW E()'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const endsWithDefinition: FunctionDefinition = { + type: 'eval', + name: 'ends_with', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ends_with', { + defaultMessage: + 'Returns a boolean that indicates whether a keyword string ends with another string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'str', + type: 'keyword', + optional: false, + }, + { + name: 'suffix', + type: 'keyword', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'str', + type: 'text', + optional: false, + }, + { + name: 'suffix', + type: 'text', + optional: false, + }, + ], + returnType: 'boolean', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['FROM employees\n| KEEP last_name\n| EVAL ln_E = ENDS_WITH(last_name, "d")'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const expDefinition: FunctionDefinition = { + type: 'eval', + name: 'exp', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.exp', { + defaultMessage: 'Returns the value of e raised to the power of the given number.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW d = 5.0\n| EVAL s = EXP(d)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const floorDefinition: FunctionDefinition = { + type: 'eval', + name: 'floor', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.floor', { + defaultMessage: 'Round a number down to the nearest integer.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'unsigned_long', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8\n| EVAL a=FLOOR(a)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const fromBase64Definition: FunctionDefinition = { + type: 'eval', + name: 'from_base64', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.from_base64', { + defaultMessage: 'Decode a base64 string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + ], + returnType: 'keyword', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['row a = "ZWxhc3RpYw==" \n| eval d = from_base64(a)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const greatestDefinition: FunctionDefinition = { + type: 'eval', + name: 'greatest', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.greatest', { + defaultMessage: + 'Returns the maximum value from multiple columns. This is similar to `MV_MAX`\nexcept it is intended to run on multiple columns at once.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'double', + optional: false, + }, + { + name: 'rest', + type: 'double', + optional: true, + }, + ], + returnType: 'double', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'integer', + optional: false, + }, + { + name: 'rest', + type: 'integer', + optional: true, + }, + ], + returnType: 'integer', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'ip', + optional: false, + }, + { + name: 'rest', + type: 'ip', + optional: true, + }, + ], + returnType: 'ip', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'keyword', + optional: false, + }, + { + name: 'rest', + type: 'keyword', + optional: true, + }, + ], + returnType: 'keyword', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'long', + optional: false, + }, + { + name: 'rest', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'text', + optional: false, + }, + ], + returnType: 'text', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'text', + optional: false, + }, + { + name: 'rest', + type: 'text', + optional: true, + }, + ], + returnType: 'text', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'version', + optional: false, + }, + { + name: 'rest', + type: 'version', + optional: true, + }, + ], + returnType: 'version', + minParams: 1, + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a = 10, b = 20\n| EVAL g = GREATEST(a, b)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const ipPrefixDefinition: FunctionDefinition = { + type: 'eval', + name: 'ip_prefix', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ip_prefix', { + defaultMessage: 'Truncates an IP to a given prefix length.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'ip', + type: 'ip', + optional: false, + }, + { + name: 'prefixLengthV4', + type: 'integer', + optional: false, + }, + { + name: 'prefixLengthV6', + type: 'integer', + optional: false, + }, + ], + returnType: 'ip', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'row ip4 = to_ip("1.2.3.4"), ip6 = to_ip("fe80::cae2:65ff:fece:feb9")\n| eval ip4_prefix = ip_prefix(ip4, 24, 0), ip6_prefix = ip_prefix(ip6, 0, 112);', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const leastDefinition: FunctionDefinition = { + type: 'eval', + name: 'least', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.least', { + defaultMessage: + 'Returns the minimum value from multiple columns. This is similar to `MV_MIN` except it is intended to run on multiple columns at once.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'double', + optional: false, + }, + { + name: 'rest', + type: 'double', + optional: true, + }, + ], + returnType: 'double', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'integer', + optional: false, + }, + { + name: 'rest', + type: 'integer', + optional: true, + }, + ], + returnType: 'integer', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'ip', + optional: false, + }, + { + name: 'rest', + type: 'ip', + optional: true, + }, + ], + returnType: 'ip', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'keyword', + optional: false, + }, + { + name: 'rest', + type: 'keyword', + optional: true, + }, + ], + returnType: 'keyword', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'long', + optional: false, + }, + { + name: 'rest', + type: 'long', + optional: true, + }, + ], + returnType: 'long', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'text', + optional: false, + }, + ], + returnType: 'text', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'text', + optional: false, + }, + { + name: 'rest', + type: 'text', + optional: true, + }, + ], + returnType: 'text', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'version', + optional: false, + }, + { + name: 'rest', + type: 'version', + optional: true, + }, + ], + returnType: 'version', + minParams: 1, + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a = 10, b = 20\n| EVAL l = LEAST(a, b)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const leftDefinition: FunctionDefinition = { + type: 'eval', + name: 'left', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.left', { + defaultMessage: + "Returns the substring that extracts 'length' chars from 'string' starting from the left.", + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'length', + type: 'integer', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + { + name: 'length', + type: 'integer', + optional: false, + }, + ], + returnType: 'keyword', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP last_name\n| EVAL left = LEFT(last_name, 3)\n| SORT last_name ASC\n| LIMIT 5', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const lengthDefinition: FunctionDefinition = { + type: 'eval', + name: 'length', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.length', { + defaultMessage: 'Returns the character length of a string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + ], + returnType: 'integer', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['FROM employees\n| KEEP first_name, last_name\n| EVAL fn_length = LENGTH(first_name)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const locateDefinition: FunctionDefinition = { + type: 'eval', + name: 'locate', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.locate', { + defaultMessage: + 'Returns an integer that indicates the position of a keyword substring within another string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'substring', + type: 'keyword', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'substring', + type: 'keyword', + optional: false, + }, + { + name: 'start', + type: 'integer', + optional: true, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'substring', + type: 'text', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'substring', + type: 'text', + optional: false, + }, + { + name: 'start', + type: 'integer', + optional: true, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + { + name: 'substring', + type: 'keyword', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + { + name: 'substring', + type: 'keyword', + optional: false, + }, + { + name: 'start', + type: 'integer', + optional: true, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + { + name: 'substring', + type: 'text', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + { + name: 'substring', + type: 'text', + optional: false, + }, + { + name: 'start', + type: 'integer', + optional: true, + }, + ], + returnType: 'integer', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['row a = "hello"\n| eval a_ll = locate(a, "ll")'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const logDefinition: FunctionDefinition = { + type: 'eval', + name: 'log', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.log', { + defaultMessage: + 'Returns the logarithm of a value to a base. The input can be any numeric value, the return value is always a double.\n\nLogs of zero, negative numbers, and base of one return `null` as well as a warning.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'base', + type: 'double', + optional: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'double', + optional: true, + }, + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'double', + optional: true, + }, + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'double', + optional: true, + }, + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'double', + optional: true, + }, + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'integer', + optional: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'integer', + optional: true, + }, + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'integer', + optional: true, + }, + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'integer', + optional: true, + }, + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'integer', + optional: true, + }, + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'long', + optional: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'long', + optional: true, + }, + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'long', + optional: true, + }, + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'long', + optional: true, + }, + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'long', + optional: true, + }, + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'unsigned_long', + optional: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'unsigned_long', + optional: true, + }, + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'unsigned_long', + optional: true, + }, + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'unsigned_long', + optional: true, + }, + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'base', + type: 'unsigned_long', + optional: true, + }, + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: (fnDef: ESQLFunction) => { + const messages = []; + // do not really care here about the base and field + // just need to check both values are not negative + for (const arg of fnDef.args) { + if (isLiteralItem(arg) && Number(arg.value) < 0) { + messages.push({ + type: 'warning' as const, + code: 'logOfNegativeValue', + text: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.divide.warning.logOfNegativeValue', + { + defaultMessage: 'Log of a negative number results in null: {value}', + values: { + value: arg.value, + }, + } + ), + location: arg.location, + }); + } + } + return messages; + }, + examples: [ + 'ROW base = 2.0, value = 8.0\n| EVAL s = LOG(base, value)', + 'row value = 100\n| EVAL s = LOG(value);', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const log10Definition: FunctionDefinition = { + type: 'eval', + name: 'log10', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.log10', { + defaultMessage: + 'Returns the logarithm of a value to base 10. The input can be any numeric value, the return value is always a double.\n\nLogs of 0 and negative numbers return `null` as well as a warning.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: (fnDef: ESQLFunction) => { + const messages = []; + // do not really care here about the base and field + // just need to check both values are not negative + for (const arg of fnDef.args) { + if (isLiteralItem(arg) && Number(arg.value) < 0) { + messages.push({ + type: 'warning' as const, + code: 'logOfNegativeValue', + text: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.divide.warning.logOfNegativeValue', + { + defaultMessage: 'Log of a negative number results in null: {value}', + values: { + value: arg.value, + }, + } + ), + location: arg.location, + }); + } + } + return messages; + }, + examples: ['ROW d = 1000.0 \n| EVAL s = LOG10(d)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const ltrimDefinition: FunctionDefinition = { + type: 'eval', + name: 'ltrim', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ltrim', { + defaultMessage: 'Removes leading whitespaces from a string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + ], + returnType: 'text', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW message = " some text ", color = " red "\n| EVAL message = LTRIM(message)\n| EVAL color = LTRIM(color)\n| EVAL message = CONCAT("\'", message, "\'")\n| EVAL color = CONCAT("\'", color, "\'")', + ], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const mvAppendDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_append', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_append', { + defaultMessage: 'Concatenates values of two multi-value fields.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field1', + type: 'boolean', + optional: false, + }, + { + name: 'field2', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field1', + type: 'cartesian_point', + optional: false, + }, + { + name: 'field2', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'cartesian_point', + }, + { + params: [ + { + name: 'field1', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'field2', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'cartesian_shape', + }, + { + params: [ + { + name: 'field1', + type: 'date', + optional: false, + }, + { + name: 'field2', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field1', + type: 'double', + optional: false, + }, + { + name: 'field2', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field1', + type: 'geo_point', + optional: false, + }, + { + name: 'field2', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'geo_point', + }, + { + params: [ + { + name: 'field1', + type: 'geo_shape', + optional: false, + }, + { + name: 'field2', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'geo_shape', + }, + { + params: [ + { + name: 'field1', + type: 'integer', + optional: false, + }, + { + name: 'field2', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field1', + type: 'ip', + optional: false, + }, + { + name: 'field2', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field1', + type: 'keyword', + optional: false, + }, + { + name: 'field2', + type: 'keyword', optional: false, }, ], - returnType: 'number', + returnType: 'keyword', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: [ - 'ROW date = DATE_PARSE("yyyy-MM-dd", "2022-05-06")\n| EVAL year = DATE_EXTRACT("year", date)', - 'FROM sample_data\n| WHERE DATE_EXTRACT("hour_of_day", @timestamp) < 9 AND DATE_EXTRACT("hour_of_day", @timestamp) >= 17', - ], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const dateFormatDefinition: FunctionDefinition = { - type: 'eval', - name: 'date_format', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_format', { - defaultMessage: 'Returns a string representation of a date, in the provided format.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'dateFormat', - type: 'string', - optional: true, + name: 'field1', + type: 'long', + optional: false, }, { - name: 'date', - type: 'date', + name: 'field2', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field1', + type: 'text', + optional: false, + }, + { + name: 'field2', + type: 'text', + optional: false, + }, + ], + returnType: 'text', + }, + { + params: [ + { + name: 'field1', + type: 'version', + optional: false, + }, + { + name: 'field2', + type: 'version', optional: false, }, ], - returnType: 'string', + returnType: 'version', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: [ - 'FROM employees\n| KEEP first_name, last_name, hire_date\n| EVAL hired = DATE_FORMAT("YYYY-MM-dd", hire_date)', - ], + examples: [], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const dateParseDefinition: FunctionDefinition = { +const mvAvgDefinition: FunctionDefinition = { type: 'eval', - name: 'date_parse', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_parse', { + name: 'mv_avg', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_avg', { defaultMessage: - 'Returns a date by parsing the second argument using the format specified in the first argument.', + 'Converts a multivalued field into a single valued field containing the average of all of the values.', }), alias: undefined, signatures: [ { params: [ { - name: 'datePattern', - type: 'string', - optional: true, + name: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, }, + ], + returnType: 'double', + }, + { + params: [ { - name: 'dateString', - type: 'string', + name: 'number', + type: 'long', optional: false, }, ], - returnType: 'date', + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW date_string = "2022-05-06"\n| EVAL date = DATE_PARSE("yyyy-MM-dd", date_string)'], + examples: ['ROW a=[3, 5, 1, 6]\n| EVAL avg_a = MV_AVG(a)'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const dateTruncDefinition: FunctionDefinition = { +const mvConcatDefinition: FunctionDefinition = { type: 'eval', - name: 'date_trunc', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_trunc', { - defaultMessage: 'Rounds down a date to the closest interval.', + name: 'mv_concat', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_concat', { + defaultMessage: + 'Converts a multivalued string expression into a single valued column containing the concatenation of all values separated by a delimiter.', }), alias: undefined, signatures: [ { params: [ { - name: 'interval', - type: 'time_literal', + name: 'string', + type: 'keyword', optional: false, }, { - name: 'date', - type: 'date', + name: 'delim', + type: 'keyword', optional: false, }, ], - returnType: 'date', + returnType: 'keyword', }, { params: [ { - name: 'interval', - type: 'date', + name: 'string', + type: 'keyword', optional: false, }, { - name: 'date', - type: 'date', + name: 'delim', + type: 'text', optional: false, }, ], - returnType: 'date', + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + { + name: 'delim', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + { + name: 'delim', + type: 'text', + optional: false, + }, + ], + returnType: 'keyword', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, examples: [ - 'FROM employees\n| KEEP first_name, last_name, hire_date\n| EVAL year_hired = DATE_TRUNC(1 year, hire_date)', - 'FROM employees\n| EVAL year = DATE_TRUNC(1 year, hire_date)\n| STATS hires = COUNT(emp_no) BY year\n| SORT year', - 'FROM sample_data\n| EVAL error = CASE(message LIKE "*error*", 1, 0)\n| EVAL hour = DATE_TRUNC(1 hour, @timestamp)\n| STATS error_rate = AVG(error) by hour\n| SORT hour', + 'ROW a=["foo", "zoo", "bar"]\n| EVAL j = MV_CONCAT(a, ", ")', + 'ROW a=[10, 9, 8]\n| EVAL j = MV_CONCAT(TO_STRING(a), ", ")', ], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const eDefinition: FunctionDefinition = { +const mvCountDefinition: FunctionDefinition = { type: 'eval', - name: 'e', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.e', { - defaultMessage: "Returns Euler's number.", + name: 'mv_count', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_count', { + defaultMessage: + 'Converts a multivalued expression into a single valued column containing a count of the number of values.', }), alias: undefined, signatures: [ { - params: [], - returnType: 'number', + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'integer', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW E()'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const endsWithDefinition: FunctionDefinition = { - type: 'eval', - name: 'ends_with', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ends_with', { - defaultMessage: - 'Returns a boolean that indicates whether a keyword string ends with another string.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'str', - type: 'string', + name: 'field', + type: 'keyword', optional: false, }, + ], + returnType: 'integer', + }, + { + params: [ { - name: 'suffix', - type: 'string', + name: 'field', + type: 'long', optional: false, }, ], - returnType: 'boolean', + returnType: 'integer', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['FROM employees\n| KEEP last_name\n| EVAL ln_E = ENDS_WITH(last_name, "d")'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const expDefinition: FunctionDefinition = { - type: 'eval', - name: 'exp', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.exp', { - defaultMessage: 'Returns the value of e raised to the power of the given number.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'number', - type: 'number', + name: 'field', + type: 'text', optional: false, }, ], - returnType: 'number', + returnType: 'integer', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW d = 5.0\n| EVAL s = EXP(d)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const floorDefinition: FunctionDefinition = { - type: 'eval', - name: 'floor', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.floor', { - defaultMessage: 'Round a number down to the nearest integer.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'number', - type: 'number', + name: 'field', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'integer', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW a=1.8\n| EVAL a=FLOOR(a)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const fromBase64Definition: FunctionDefinition = { - type: 'eval', - name: 'from_base64', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.from_base64', { - defaultMessage: 'Decode a base64 string.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'string', - type: 'string', + name: 'field', + type: 'version', optional: false, }, ], - returnType: 'string', + returnType: 'integer', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['row a = "ZWxhc3RpYw==" \n| eval d = from_base64(a)'], + examples: ['ROW a=["foo", "zoo", "bar"]\n| EVAL count_a = MV_COUNT(a)'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const greatestDefinition: FunctionDefinition = { +const mvDedupeDefinition: FunctionDefinition = { type: 'eval', - name: 'greatest', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.greatest', { - defaultMessage: - 'Returns the maximum value from multiple columns. This is similar to `MV_MAX`\nexcept it is intended to run on multiple columns at once.', + name: 'mv_dedupe', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_dedupe', { + defaultMessage: 'Remove duplicate values from a multivalued field.', }), alias: undefined, signatures: [ { params: [ { - name: 'first', + name: 'field', type: 'boolean', optional: false, }, ], returnType: 'boolean', - minParams: 1, }, { params: [ { - name: 'first', - type: 'boolean', + name: 'field', + type: 'cartesian_point', optional: false, }, + ], + returnType: 'cartesian_point', + }, + { + params: [ { - name: 'rest', - type: 'boolean', - optional: true, + name: 'field', + type: 'cartesian_shape', + optional: false, }, ], - returnType: 'boolean', - minParams: 1, + returnType: 'cartesian_shape', }, { params: [ { - name: 'first', - type: 'number', + name: 'field', + type: 'date', optional: false, }, + ], + returnType: 'date', + }, + { + params: [ { - name: 'rest', - type: 'number', - optional: true, + name: 'field', + type: 'double', + optional: false, }, ], - returnType: 'number', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'number', + name: 'field', + type: 'geo_point', optional: false, }, ], - returnType: 'number', - minParams: 1, + returnType: 'geo_point', }, { params: [ { - name: 'first', - type: 'ip', + name: 'field', + type: 'geo_shape', optional: false, }, + ], + returnType: 'geo_shape', + }, + { + params: [ { - name: 'rest', - type: 'ip', - optional: true, + name: 'field', + type: 'integer', + optional: false, }, ], - returnType: 'ip', - minParams: 1, + returnType: 'integer', }, { params: [ { - name: 'first', - type: 'string', + name: 'field', + type: 'ip', optional: false, }, ], - returnType: 'string', - minParams: 1, + returnType: 'ip', }, { params: [ { - name: 'first', - type: 'string', + name: 'field', + type: 'keyword', optional: false, }, + ], + returnType: 'keyword', + }, + { + params: [ { - name: 'rest', - type: 'string', - optional: true, + name: 'field', + type: 'long', + optional: false, }, ], - returnType: 'string', - minParams: 1, + returnType: 'long', }, { params: [ { - name: 'first', - type: 'version', + name: 'field', + type: 'text', optional: false, }, + ], + returnType: 'text', + }, + { + params: [ { - name: 'rest', + name: 'field', type: 'version', - optional: true, + optional: false, }, ], returnType: 'version', - minParams: 1, }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW a = 10, b = 20\n| EVAL g = GREATEST(a, b)'], + examples: ['ROW a=["foo", "foo", "bar", "foo"]\n| EVAL dedupe_a = MV_DEDUPE(a)'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const ipPrefixDefinition: FunctionDefinition = { +const mvFirstDefinition: FunctionDefinition = { type: 'eval', - name: 'ip_prefix', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ip_prefix', { - defaultMessage: 'Truncates an IP to a given prefix length.', + name: 'mv_first', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_first', { + defaultMessage: + "Converts a multivalued expression into a single valued column containing the\nfirst value. This is most useful when reading from a function that emits\nmultivalued columns in a known order like `SPLIT`.\n\nThe order that multivalued fields are read from\nunderlying storage is not guaranteed. It is *frequently* ascending, but don't\nrely on that. If you need the minimum value use `MV_MIN` instead of\n`MV_FIRST`. `MV_MIN` has optimizations for sorted values so there isn't a\nperformance benefit to `MV_FIRST`.", }), alias: undefined, signatures: [ { params: [ { - name: 'ip', - type: 'ip', + name: 'field', + type: 'boolean', optional: false, }, + ], + returnType: 'boolean', + }, + { + params: [ { - name: 'prefixLengthV4', - type: 'number', + name: 'field', + type: 'cartesian_point', optional: false, }, + ], + returnType: 'cartesian_point', + }, + { + params: [ { - name: 'prefixLengthV6', - type: 'number', + name: 'field', + type: 'cartesian_shape', optional: false, }, ], - returnType: 'ip', + returnType: 'cartesian_shape', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: [ - 'row ip4 = to_ip("1.2.3.4"), ip6 = to_ip("fe80::cae2:65ff:fece:feb9")\n| eval ip4_prefix = ip_prefix(ip4, 24, 0), ip6_prefix = ip_prefix(ip6, 0, 112);', - ], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const leastDefinition: FunctionDefinition = { - type: 'eval', - name: 'least', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.least', { - defaultMessage: - 'Returns the minimum value from multiple columns. This is similar to `MV_MIN` except it is intended to run on multiple columns at once.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'first', - type: 'boolean', + name: 'field', + type: 'date', optional: false, }, ], - returnType: 'boolean', - minParams: 1, + returnType: 'date', }, { params: [ { - name: 'first', - type: 'boolean', + name: 'field', + type: 'double', optional: false, }, - { - name: 'rest', - type: 'boolean', - optional: true, - }, ], - returnType: 'boolean', - minParams: 1, + returnType: 'double', }, { params: [ { - name: 'first', - type: 'number', + name: 'field', + type: 'geo_point', optional: false, }, - { - name: 'rest', - type: 'number', - optional: true, - }, ], - returnType: 'number', - minParams: 1, + returnType: 'geo_point', }, { params: [ { - name: 'first', - type: 'number', + name: 'field', + type: 'geo_shape', optional: false, }, ], - returnType: 'number', - minParams: 1, + returnType: 'geo_shape', }, { params: [ { - name: 'first', - type: 'ip', + name: 'field', + type: 'integer', optional: false, }, + ], + returnType: 'integer', + }, + { + params: [ { - name: 'rest', + name: 'field', type: 'ip', - optional: true, + optional: false, }, ], returnType: 'ip', - minParams: 1, }, { params: [ { - name: 'first', - type: 'string', + name: 'field', + type: 'keyword', optional: false, }, ], - returnType: 'string', - minParams: 1, + returnType: 'keyword', }, { params: [ { - name: 'first', - type: 'string', + name: 'field', + type: 'long', optional: false, }, + ], + returnType: 'long', + }, + { + params: [ { - name: 'rest', - type: 'string', - optional: true, + name: 'field', + type: 'text', + optional: false, }, ], - returnType: 'string', - minParams: 1, + returnType: 'text', }, { params: [ { - name: 'first', - type: 'version', + name: 'field', + type: 'unsigned_long', optional: false, }, + ], + returnType: 'unsigned_long', + }, + { + params: [ { - name: 'rest', + name: 'field', type: 'version', - optional: true, + optional: false, }, ], returnType: 'version', - minParams: 1, }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW a = 10, b = 20\n| EVAL l = LEAST(a, b)'], + examples: ['ROW a="foo;bar;baz"\n| EVAL first_a = MV_FIRST(SPLIT(a, ";"))'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const leftDefinition: FunctionDefinition = { +const mvLastDefinition: FunctionDefinition = { type: 'eval', - name: 'left', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.left', { + name: 'mv_last', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_last', { defaultMessage: - "Returns the substring that extracts 'length' chars from 'string' starting from the left.", + "Converts a multivalue expression into a single valued column containing the last\nvalue. This is most useful when reading from a function that emits multivalued\ncolumns in a known order like `SPLIT`.\n\nThe order that multivalued fields are read from\nunderlying storage is not guaranteed. It is *frequently* ascending, but don't\nrely on that. If you need the maximum value use `MV_MAX` instead of\n`MV_LAST`. `MV_MAX` has optimizations for sorted values so there isn't a\nperformance benefit to `MV_LAST`.", }), alias: undefined, signatures: [ { params: [ { - name: 'string', - type: 'string', + name: 'field', + type: 'boolean', optional: false, }, + ], + returnType: 'boolean', + }, + { + params: [ { - name: 'length', - type: 'number', + name: 'field', + type: 'cartesian_point', optional: false, }, ], - returnType: 'string', + returnType: 'cartesian_point', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: [ - 'FROM employees\n| KEEP last_name\n| EVAL left = LEFT(last_name, 3)\n| SORT last_name ASC\n| LIMIT 5', - ], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const lengthDefinition: FunctionDefinition = { - type: 'eval', - name: 'length', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.length', { - defaultMessage: 'Returns the character length of a string.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'string', - type: 'string', + name: 'field', + type: 'cartesian_shape', optional: false, }, ], - returnType: 'number', + returnType: 'cartesian_shape', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['FROM employees\n| KEEP first_name, last_name\n| EVAL fn_length = LENGTH(first_name)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const locateDefinition: FunctionDefinition = { - type: 'eval', - name: 'locate', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.locate', { - defaultMessage: - 'Returns an integer that indicates the position of a keyword substring within another string.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'string', - type: 'string', + name: 'field', + type: 'date', optional: false, }, + ], + returnType: 'date', + }, + { + params: [ { - name: 'substring', - type: 'string', + name: 'field', + type: 'double', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, { params: [ { - name: 'string', - type: 'string', + name: 'field', + type: 'geo_point', optional: false, }, + ], + returnType: 'geo_point', + }, + { + params: [ { - name: 'substring', - type: 'string', + name: 'field', + type: 'geo_shape', optional: false, }, + ], + returnType: 'geo_shape', + }, + { + params: [ { - name: 'start', - type: 'number', - optional: true, + name: 'field', + type: 'integer', + optional: false, }, ], - returnType: 'number', + returnType: 'integer', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['row a = "hello"\n| eval a_ll = locate(a, "ll")'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const logDefinition: FunctionDefinition = { - type: 'eval', - name: 'log', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.log', { - defaultMessage: - 'Returns the logarithm of a value to a base. The input can be any numeric value, the return value is always a double.\n\nLogs of zero, negative numbers, and base of one return `null` as well as a warning.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'base', - type: 'number', - optional: true, + name: 'field', + type: 'ip', + optional: false, }, ], - returnType: 'number', + returnType: 'ip', }, { params: [ { - name: 'base', - type: 'number', - optional: true, + name: 'field', + type: 'keyword', + optional: false, }, + ], + returnType: 'keyword', + }, + { + params: [ { - name: 'number', - type: 'number', + name: 'field', + type: 'long', optional: false, }, ], - returnType: 'number', + returnType: 'long', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: (fnDef: ESQLFunction) => { - const messages = []; - // do not really care here about the base and field - // just need to check both values are not negative - for (const arg of fnDef.args) { - if (isLiteralItem(arg) && Number(arg.value) < 0) { - messages.push({ - type: 'warning' as const, - code: 'logOfNegativeValue', - text: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.divide.warning.logOfNegativeValue', - { - defaultMessage: 'Log of a negative number results in null: {value}', - values: { - value: arg.value, - }, - } - ), - location: arg.location, - }); - } - } - return messages; - }, - examples: [ - 'ROW base = 2.0, value = 8.0\n| EVAL s = LOG(base, value)', - 'row value = 100\n| EVAL s = LOG(value);', - ], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const log10Definition: FunctionDefinition = { - type: 'eval', - name: 'log10', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.log10', { - defaultMessage: - 'Returns the logarithm of a value to base 10. The input can be any numeric value, the return value is always a double.\n\nLogs of 0 and negative numbers return `null` as well as a warning.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'number', - type: 'number', + name: 'field', + type: 'text', optional: false, }, ], - returnType: 'number', + returnType: 'text', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: (fnDef: ESQLFunction) => { - const messages = []; - // do not really care here about the base and field - // just need to check both values are not negative - for (const arg of fnDef.args) { - if (isLiteralItem(arg) && Number(arg.value) < 0) { - messages.push({ - type: 'warning' as const, - code: 'logOfNegativeValue', - text: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.divide.warning.logOfNegativeValue', - { - defaultMessage: 'Log of a negative number results in null: {value}', - values: { - value: arg.value, - }, - } - ), - location: arg.location, - }); - } - } - return messages; - }, - examples: ['ROW d = 1000.0 \n| EVAL s = LOG10(d)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const ltrimDefinition: FunctionDefinition = { - type: 'eval', - name: 'ltrim', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ltrim', { - defaultMessage: 'Removes leading whitespaces from a string.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'string', - type: 'string', + name: 'field', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'unsigned_long', + }, + { + params: [ + { + name: 'field', + type: 'version', optional: false, }, ], - returnType: 'string', + returnType: 'version', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: [ - 'ROW message = " some text ", color = " red "\n| EVAL message = LTRIM(message)\n| EVAL color = LTRIM(color)\n| EVAL message = CONCAT("\'", message, "\'")\n| EVAL color = CONCAT("\'", color, "\'")', - ], + examples: ['ROW a="foo;bar;baz"\n| EVAL last_a = MV_LAST(SPLIT(a, ";"))'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvAppendDefinition: FunctionDefinition = { +const mvMaxDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_append', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_append', { - defaultMessage: 'Concatenates values of two multi-value fields.', + name: 'mv_max', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_max', { + defaultMessage: + 'Converts a multivalued expression into a single valued column containing the maximum value.', }), alias: undefined, signatures: [ { params: [ { - name: 'field1', - type: 'boolean', - optional: false, - }, - { - name: 'field2', + name: 'field', type: 'boolean', optional: false, }, @@ -1549,132 +3838,87 @@ const mvAppendDefinition: FunctionDefinition = { { params: [ { - name: 'field1', - type: 'cartesian_point', - optional: false, - }, - { - name: 'field2', - type: 'cartesian_point', + name: 'field', + type: 'date', optional: false, }, ], - returnType: 'cartesian_point', + returnType: 'date', }, { params: [ { - name: 'field1', - type: 'cartesian_shape', - optional: false, - }, - { - name: 'field2', - type: 'cartesian_shape', + name: 'field', + type: 'double', optional: false, }, ], - returnType: 'cartesian_shape', + returnType: 'double', }, { params: [ { - name: 'field1', - type: 'date', - optional: false, - }, - { - name: 'field2', - type: 'date', + name: 'field', + type: 'integer', optional: false, }, ], - returnType: 'date', + returnType: 'integer', }, { params: [ { - name: 'field1', - type: 'number', - optional: false, - }, - { - name: 'field2', - type: 'number', + name: 'field', + type: 'ip', optional: false, }, ], - returnType: 'number', + returnType: 'ip', }, { params: [ { - name: 'field1', - type: 'geo_point', - optional: false, - }, - { - name: 'field2', - type: 'geo_point', + name: 'field', + type: 'keyword', optional: false, }, ], - returnType: 'geo_point', + returnType: 'keyword', }, { params: [ { - name: 'field1', - type: 'geo_shape', - optional: false, - }, - { - name: 'field2', - type: 'geo_shape', + name: 'field', + type: 'long', optional: false, }, ], - returnType: 'geo_shape', + returnType: 'long', }, { params: [ { - name: 'field1', - type: 'ip', - optional: false, - }, - { - name: 'field2', - type: 'ip', + name: 'field', + type: 'text', optional: false, }, ], - returnType: 'ip', + returnType: 'text', }, { params: [ { - name: 'field1', - type: 'string', - optional: false, - }, - { - name: 'field2', - type: 'string', + name: 'field', + type: 'unsigned_long', optional: false, }, ], - returnType: 'string', + returnType: 'unsigned_long', }, { params: [ { - name: 'field1', - type: 'version', - optional: false, - }, - { - name: 'field2', + name: 'field', type: 'version', optional: false, }, @@ -1685,16 +3929,19 @@ const mvAppendDefinition: FunctionDefinition = { supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: [], + examples: [ + 'ROW a=[3, 5, 1]\n| EVAL max_a = MV_MAX(a)', + 'ROW a=["foo", "zoo", "bar"]\n| EVAL max_a = MV_MAX(a)', + ], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvAvgDefinition: FunctionDefinition = { +const mvMedianDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_avg', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_avg', { + name: 'mv_median', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_median', { defaultMessage: - 'Converts a multivalued field into a single valued field containing the average of all of the values.', + 'Converts a multivalued field into a single valued field containing the median value.', }), alias: undefined, signatures: [ @@ -1702,61 +3949,59 @@ const mvAvgDefinition: FunctionDefinition = { params: [ { name: 'number', - type: 'number', + type: 'double', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW a=[3, 5, 1, 6]\n| EVAL avg_a = MV_AVG(a)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvConcatDefinition: FunctionDefinition = { - type: 'eval', - name: 'mv_concat', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_concat', { - defaultMessage: - 'Converts a multivalued string expression into a single valued column containing the concatenation of all values separated by a delimiter.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'string', - type: 'string', + name: 'number', + type: 'integer', optional: false, }, + ], + returnType: 'integer', + }, + { + params: [ { - name: 'delim', - type: 'string', + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', optional: false, }, ], - returnType: 'string', + returnType: 'unsigned_long', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, examples: [ - 'ROW a=["foo", "zoo", "bar"]\n| EVAL j = MV_CONCAT(a, ", ")', - 'ROW a=[10, 9, 8]\n| EVAL j = MV_CONCAT(TO_STRING(a), ", ")', + 'ROW a=[3, 5, 1]\n| EVAL median_a = MV_MEDIAN(a)', + 'ROW a=[3, 7, 1, 6]\n| EVAL median_a = MV_MEDIAN(a)', ], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvCountDefinition: FunctionDefinition = { +const mvMinDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_count', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_count', { + name: 'mv_min', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_min', { defaultMessage: - 'Converts a multivalued expression into a single valued column containing a count of the number of values.', + 'Converts a multivalued expression into a single valued column containing the minimum value.', }), alias: undefined, signatures: [ @@ -1768,87 +4013,87 @@ const mvCountDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'boolean', }, { params: [ { name: 'field', - type: 'cartesian_point', + type: 'date', optional: false, }, ], - returnType: 'number', + returnType: 'date', }, { params: [ { name: 'field', - type: 'cartesian_shape', + type: 'double', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, { params: [ { name: 'field', - type: 'date', + type: 'integer', optional: false, }, ], - returnType: 'number', + returnType: 'integer', }, { params: [ { name: 'field', - type: 'number', + type: 'ip', optional: false, }, ], - returnType: 'number', + returnType: 'ip', }, { params: [ { name: 'field', - type: 'geo_point', + type: 'keyword', optional: false, }, ], - returnType: 'number', + returnType: 'keyword', }, { params: [ { name: 'field', - type: 'geo_shape', + type: 'long', optional: false, }, ], - returnType: 'number', + returnType: 'long', }, { params: [ { name: 'field', - type: 'ip', + type: 'text', optional: false, }, ], - returnType: 'number', + returnType: 'text', }, { params: [ { name: 'field', - type: 'string', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'unsigned_long', }, { params: [ @@ -1858,21 +4103,25 @@ const mvCountDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'version', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW a=["foo", "zoo", "bar"]\n| EVAL count_a = MV_COUNT(a)'], + examples: [ + 'ROW a=[2, 1]\n| EVAL min_a = MV_MIN(a)', + 'ROW a=["foo", "bar"]\n| EVAL min_a = MV_MIN(a)', + ], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvDedupeDefinition: FunctionDefinition = { +const mvSliceDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_dedupe', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_dedupe', { - defaultMessage: 'Remove duplicate values from a multivalued field.', + name: 'mv_slice', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_slice', { + defaultMessage: + 'Returns a subset of the multivalued field using the start and end index values.', }), alias: undefined, signatures: [ @@ -1883,6 +4132,16 @@ const mvDedupeDefinition: FunctionDefinition = { type: 'boolean', optional: false, }, + { + name: 'start', + type: 'integer', + optional: false, + }, + { + name: 'end', + type: 'integer', + optional: true, + }, ], returnType: 'boolean', }, @@ -1893,78 +4152,218 @@ const mvDedupeDefinition: FunctionDefinition = { type: 'cartesian_point', optional: false, }, + { + name: 'start', + type: 'integer', + optional: false, + }, + { + name: 'end', + type: 'integer', + optional: true, + }, + ], + returnType: 'cartesian_point', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'start', + type: 'integer', + optional: false, + }, + { + name: 'end', + type: 'integer', + optional: true, + }, + ], + returnType: 'cartesian_shape', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + { + name: 'start', + type: 'integer', + optional: false, + }, + { + name: 'end', + type: 'integer', + optional: true, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + { + name: 'start', + type: 'integer', + optional: false, + }, + { + name: 'end', + type: 'integer', + optional: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + { + name: 'start', + type: 'integer', + optional: false, + }, + { + name: 'end', + type: 'integer', + optional: true, + }, ], - returnType: 'cartesian_point', + returnType: 'geo_point', }, { params: [ { name: 'field', - type: 'cartesian_shape', + type: 'geo_shape', optional: false, }, - ], - returnType: 'cartesian_shape', - }, - { - params: [ { - name: 'field', - type: 'date', + name: 'start', + type: 'integer', optional: false, }, + { + name: 'end', + type: 'integer', + optional: true, + }, ], - returnType: 'date', + returnType: 'geo_shape', }, { params: [ { name: 'field', - type: 'number', + type: 'integer', + optional: false, + }, + { + name: 'start', + type: 'integer', optional: false, }, + { + name: 'end', + type: 'integer', + optional: true, + }, ], - returnType: 'number', + returnType: 'integer', }, { params: [ { name: 'field', - type: 'geo_point', + type: 'ip', + optional: false, + }, + { + name: 'start', + type: 'integer', optional: false, }, + { + name: 'end', + type: 'integer', + optional: true, + }, ], - returnType: 'geo_point', + returnType: 'ip', }, { params: [ { name: 'field', - type: 'geo_shape', + type: 'keyword', optional: false, }, + { + name: 'start', + type: 'integer', + optional: false, + }, + { + name: 'end', + type: 'integer', + optional: true, + }, ], - returnType: 'geo_shape', + returnType: 'keyword', }, { params: [ { name: 'field', - type: 'ip', + type: 'long', + optional: false, + }, + { + name: 'start', + type: 'integer', optional: false, }, + { + name: 'end', + type: 'integer', + optional: true, + }, ], - returnType: 'ip', + returnType: 'long', }, { params: [ { name: 'field', - type: 'string', + type: 'text', + optional: false, + }, + { + name: 'start', + type: 'integer', optional: false, }, + { + name: 'end', + type: 'integer', + optional: true, + }, ], - returnType: 'string', + returnType: 'text', }, { params: [ @@ -1973,6 +4372,16 @@ const mvDedupeDefinition: FunctionDefinition = { type: 'version', optional: false, }, + { + name: 'start', + type: 'integer', + optional: false, + }, + { + name: 'end', + type: 'integer', + optional: true, + }, ], returnType: 'version', }, @@ -1980,16 +4389,18 @@ const mvDedupeDefinition: FunctionDefinition = { supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW a=["foo", "foo", "bar", "foo"]\n| EVAL dedupe_a = MV_DEDUPE(a)'], + examples: [ + 'row a = [1, 2, 2, 3]\n| eval a1 = mv_slice(a, 1), a2 = mv_slice(a, 2, 3)', + 'row a = [1, 2, 2, 3]\n| eval a1 = mv_slice(a, -2), a2 = mv_slice(a, -3, -1)', + ], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvFirstDefinition: FunctionDefinition = { +const mvSortDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_first', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_first', { - defaultMessage: - "Converts a multivalued expression into a single valued column containing the\nfirst value. This is most useful when reading from a function that emits\nmultivalued columns in a known order like `SPLIT`.\n\nThe order that multivalued fields are read from\nunderlying storage is not guaranteed. It is *frequently* ascending, but don't\nrely on that. If you need the minimum value use `MV_MIN` instead of\n`MV_FIRST`. `MV_MIN` has optimizations for sorted values so there isn't a\nperformance benefit to `MV_FIRST`.", + name: 'mv_sort', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_sort', { + defaultMessage: 'Sorts a multivalued field in lexicographical order.', }), alias: undefined, signatures: [ @@ -2000,6 +4411,12 @@ const mvFirstDefinition: FunctionDefinition = { type: 'boolean', optional: false, }, + { + name: 'order', + type: 'keyword', + optional: true, + literalOptions: ['asc', 'desc'], + }, ], returnType: 'boolean', }, @@ -2007,81 +4424,113 @@ const mvFirstDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'cartesian_point', + type: 'date', optional: false, }, - ], - returnType: 'cartesian_point', - }, - { - params: [ { - name: 'field', - type: 'cartesian_shape', - optional: false, + name: 'order', + type: 'keyword', + optional: true, + literalOptions: ['asc', 'desc'], }, ], - returnType: 'cartesian_shape', + returnType: 'date', }, { params: [ { name: 'field', - type: 'date', + type: 'double', optional: false, }, + { + name: 'order', + type: 'keyword', + optional: true, + literalOptions: ['asc', 'desc'], + }, ], - returnType: 'date', + returnType: 'double', }, { params: [ { name: 'field', - type: 'number', + type: 'integer', optional: false, }, + { + name: 'order', + type: 'keyword', + optional: true, + literalOptions: ['asc', 'desc'], + }, ], - returnType: 'number', + returnType: 'integer', }, { params: [ { name: 'field', - type: 'geo_point', + type: 'ip', optional: false, }, + { + name: 'order', + type: 'keyword', + optional: true, + literalOptions: ['asc', 'desc'], + }, ], - returnType: 'geo_point', + returnType: 'ip', }, { params: [ { name: 'field', - type: 'geo_shape', + type: 'keyword', optional: false, }, + { + name: 'order', + type: 'keyword', + optional: true, + literalOptions: ['asc', 'desc'], + }, ], - returnType: 'geo_shape', + returnType: 'keyword', }, { params: [ { name: 'field', - type: 'ip', + type: 'long', optional: false, }, + { + name: 'order', + type: 'keyword', + optional: true, + literalOptions: ['asc', 'desc'], + }, ], - returnType: 'ip', + returnType: 'long', }, { params: [ { name: 'field', - type: 'string', + type: 'text', optional: false, }, + { + name: 'order', + type: 'keyword', + optional: true, + literalOptions: ['asc', 'desc'], + }, ], - returnType: 'string', + returnType: 'text', }, { params: [ @@ -2090,6 +4539,12 @@ const mvFirstDefinition: FunctionDefinition = { type: 'version', optional: false, }, + { + name: 'order', + type: 'keyword', + optional: true, + literalOptions: ['asc', 'desc'], + }, ], returnType: 'version', }, @@ -2097,864 +4552,820 @@ const mvFirstDefinition: FunctionDefinition = { supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW a="foo;bar;baz"\n| EVAL first_a = MV_FIRST(SPLIT(a, ";"))'], + examples: ['ROW a = [4, 2, -3, 2]\n| EVAL sa = mv_sort(a), sd = mv_sort(a, "DESC")'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvLastDefinition: FunctionDefinition = { +const mvSumDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_last', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_last', { + name: 'mv_sum', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_sum', { defaultMessage: - "Converts a multivalue expression into a single valued column containing the last\nvalue. This is most useful when reading from a function that emits multivalued\ncolumns in a known order like `SPLIT`.\n\nThe order that multivalued fields are read from\nunderlying storage is not guaranteed. It is *frequently* ascending, but don't\nrely on that. If you need the maximum value use `MV_MAX` instead of\n`MV_LAST`. `MV_MAX` has optimizations for sorted values so there isn't a\nperformance benefit to `MV_LAST`.", + 'Converts a multivalued field into a single valued field containing the sum of all of the values.', }), alias: undefined, signatures: [ { params: [ { - name: 'field', - type: 'boolean', + name: 'number', + type: 'double', optional: false, }, ], - returnType: 'boolean', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'cartesian_point', + name: 'number', + type: 'integer', optional: false, }, ], - returnType: 'cartesian_point', + returnType: 'integer', }, { params: [ { - name: 'field', - type: 'cartesian_shape', + name: 'number', + type: 'long', optional: false, }, ], - returnType: 'cartesian_shape', + returnType: 'long', }, { params: [ { - name: 'field', - type: 'date', + name: 'number', + type: 'unsigned_long', optional: false, }, ], - returnType: 'date', + returnType: 'unsigned_long', }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=[3, 5, 6]\n| EVAL sum_a = MV_SUM(a)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const mvZipDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_zip', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_zip', { + defaultMessage: + 'Combines the values from two multivalued fields with a delimiter that joins them together.', + }), + alias: undefined, + signatures: [ { params: [ { - name: 'field', - type: 'number', + name: 'string1', + type: 'keyword', + optional: false, + }, + { + name: 'string2', + type: 'keyword', optional: false, }, ], - returnType: 'number', + returnType: 'keyword', }, { params: [ { - name: 'field', - type: 'geo_point', + name: 'string1', + type: 'keyword', + optional: false, + }, + { + name: 'string2', + type: 'keyword', optional: false, }, + { + name: 'delim', + type: 'keyword', + optional: true, + }, ], - returnType: 'geo_point', + returnType: 'keyword', }, { params: [ { - name: 'field', - type: 'geo_shape', + name: 'string1', + type: 'keyword', + optional: false, + }, + { + name: 'string2', + type: 'keyword', optional: false, }, + { + name: 'delim', + type: 'text', + optional: true, + }, ], - returnType: 'geo_shape', + returnType: 'keyword', }, { params: [ { - name: 'field', - type: 'ip', + name: 'string1', + type: 'keyword', + optional: false, + }, + { + name: 'string2', + type: 'text', optional: false, }, ], - returnType: 'ip', + returnType: 'keyword', }, { params: [ { - name: 'field', - type: 'string', + name: 'string1', + type: 'keyword', + optional: false, + }, + { + name: 'string2', + type: 'text', optional: false, }, + { + name: 'delim', + type: 'keyword', + optional: true, + }, ], - returnType: 'string', + returnType: 'keyword', }, { params: [ { - name: 'field', - type: 'version', + name: 'string1', + type: 'keyword', optional: false, }, + { + name: 'string2', + type: 'text', + optional: false, + }, + { + name: 'delim', + type: 'text', + optional: true, + }, ], - returnType: 'version', + returnType: 'keyword', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW a="foo;bar;baz"\n| EVAL last_a = MV_LAST(SPLIT(a, ";"))'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvMaxDefinition: FunctionDefinition = { - type: 'eval', - name: 'mv_max', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_max', { - defaultMessage: - 'Converts a multivalued expression into a single valued column containing the maximum value.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'field', - type: 'boolean', + name: 'string1', + type: 'text', + optional: false, + }, + { + name: 'string2', + type: 'keyword', optional: false, }, ], - returnType: 'boolean', + returnType: 'keyword', }, { params: [ { - name: 'field', - type: 'date', + name: 'string1', + type: 'text', + optional: false, + }, + { + name: 'string2', + type: 'keyword', optional: false, }, + { + name: 'delim', + type: 'keyword', + optional: true, + }, ], - returnType: 'date', + returnType: 'keyword', }, { params: [ { - name: 'field', - type: 'number', + name: 'string1', + type: 'text', optional: false, }, + { + name: 'string2', + type: 'keyword', + optional: false, + }, + { + name: 'delim', + type: 'text', + optional: true, + }, ], - returnType: 'number', + returnType: 'keyword', }, { params: [ { - name: 'field', - type: 'ip', + name: 'string1', + type: 'text', + optional: false, + }, + { + name: 'string2', + type: 'text', optional: false, }, ], - returnType: 'ip', + returnType: 'keyword', }, { params: [ { - name: 'field', - type: 'string', + name: 'string1', + type: 'text', + optional: false, + }, + { + name: 'string2', + type: 'text', optional: false, }, + { + name: 'delim', + type: 'keyword', + optional: true, + }, ], - returnType: 'string', + returnType: 'keyword', }, { params: [ { - name: 'field', - type: 'version', + name: 'string1', + type: 'text', + optional: false, + }, + { + name: 'string2', + type: 'text', optional: false, }, + { + name: 'delim', + type: 'text', + optional: true, + }, ], - returnType: 'version', + returnType: 'keyword', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, examples: [ - 'ROW a=[3, 5, 1]\n| EVAL max_a = MV_MAX(a)', - 'ROW a=["foo", "zoo", "bar"]\n| EVAL max_a = MV_MAX(a)', + 'ROW a = ["x", "y", "z"], b = ["1", "2"]\n| EVAL c = mv_zip(a, b, "-")\n| KEEP a, b, c', ], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvMedianDefinition: FunctionDefinition = { +const nowDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_median', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_median', { - defaultMessage: - 'Converts a multivalued field into a single valued field containing the median value.', + name: 'now', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.now', { + defaultMessage: 'Returns current date and time.', }), alias: undefined, signatures: [ { - params: [ - { - name: 'number', - type: 'number', - optional: false, - }, - ], - returnType: 'number', + params: [], + returnType: 'date', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: [ - 'ROW a=[3, 5, 1]\n| EVAL median_a = MV_MEDIAN(a)', - 'ROW a=[3, 7, 1, 6]\n| EVAL median_a = MV_MEDIAN(a)', - ], + examples: ['ROW current_date = NOW()', 'FROM sample_data\n| WHERE @timestamp > NOW() - 1 hour'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvMinDefinition: FunctionDefinition = { +const piDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_min', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_min', { - defaultMessage: - 'Converts a multivalued expression into a single valued column containing the minimum value.', + name: 'pi', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.pi', { + defaultMessage: "Returns Pi, the ratio of a circle's circumference to its diameter.", }), alias: undefined, signatures: [ { - params: [ - { - name: 'field', - type: 'boolean', - optional: false, - }, - ], - returnType: 'boolean', - }, - { - params: [ - { - name: 'field', - type: 'date', - optional: false, - }, - ], - returnType: 'date', - }, - { - params: [ - { - name: 'field', - type: 'number', - optional: false, - }, - ], - returnType: 'number', - }, - { - params: [ - { - name: 'field', - type: 'ip', - optional: false, - }, - ], - returnType: 'ip', - }, - { - params: [ - { - name: 'field', - type: 'string', - optional: false, - }, - ], - returnType: 'string', - }, - { - params: [ - { - name: 'field', - type: 'version', - optional: false, - }, - ], - returnType: 'version', + params: [], + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: [ - 'ROW a=[2, 1]\n| EVAL min_a = MV_MIN(a)', - 'ROW a=["foo", "bar"]\n| EVAL min_a = MV_MIN(a)', - ], + examples: ['ROW PI()'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvSliceDefinition: FunctionDefinition = { +const powDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_slice', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_slice', { - defaultMessage: - 'Returns a subset of the multivalued field using the start and end index values.', + name: 'pow', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.pow', { + defaultMessage: 'Returns the value of `base` raised to the power of `exponent`.', }), alias: undefined, signatures: [ { params: [ { - name: 'field', - type: 'boolean', + name: 'base', + type: 'double', optional: false, }, { - name: 'start', - type: 'number', + name: 'exponent', + type: 'double', optional: false, }, - { - name: 'end', - type: 'number', - optional: true, - }, ], - returnType: 'boolean', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'cartesian_point', + name: 'base', + type: 'double', optional: false, }, { - name: 'start', - type: 'number', + name: 'exponent', + type: 'integer', optional: false, }, - { - name: 'end', - type: 'number', - optional: true, - }, ], - returnType: 'cartesian_point', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'cartesian_shape', + name: 'base', + type: 'double', optional: false, }, { - name: 'start', - type: 'number', + name: 'exponent', + type: 'long', optional: false, }, - { - name: 'end', - type: 'number', - optional: true, - }, ], - returnType: 'cartesian_shape', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'date', + name: 'base', + type: 'double', optional: false, }, { - name: 'start', - type: 'number', + name: 'exponent', + type: 'unsigned_long', optional: false, }, - { - name: 'end', - type: 'number', - optional: true, - }, ], - returnType: 'date', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'number', + name: 'base', + type: 'integer', optional: false, }, { - name: 'start', - type: 'number', + name: 'exponent', + type: 'double', optional: false, }, - { - name: 'end', - type: 'number', - optional: true, - }, ], - returnType: 'number', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'geo_point', + name: 'base', + type: 'integer', optional: false, }, { - name: 'start', - type: 'number', + name: 'exponent', + type: 'integer', optional: false, }, - { - name: 'end', - type: 'number', - optional: true, - }, ], - returnType: 'geo_point', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'geo_shape', + name: 'base', + type: 'integer', optional: false, }, { - name: 'start', - type: 'number', + name: 'exponent', + type: 'long', optional: false, }, - { - name: 'end', - type: 'number', - optional: true, - }, ], - returnType: 'geo_shape', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'ip', - optional: false, - }, - { - name: 'start', - type: 'number', + name: 'base', + type: 'integer', optional: false, }, { - name: 'end', - type: 'number', - optional: true, + name: 'exponent', + type: 'unsigned_long', + optional: false, }, ], - returnType: 'ip', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'string', + name: 'base', + type: 'long', optional: false, }, { - name: 'start', - type: 'number', + name: 'exponent', + type: 'double', optional: false, }, - { - name: 'end', - type: 'number', - optional: true, - }, ], - returnType: 'string', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'version', + name: 'base', + type: 'long', optional: false, }, { - name: 'start', - type: 'number', + name: 'exponent', + type: 'integer', optional: false, }, - { - name: 'end', - type: 'number', - optional: true, - }, ], - returnType: 'version', + returnType: 'double', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: [ - 'row a = [1, 2, 2, 3]\n| eval a1 = mv_slice(a, 1), a2 = mv_slice(a, 2, 3)', - 'row a = [1, 2, 2, 3]\n| eval a1 = mv_slice(a, -2), a2 = mv_slice(a, -3, -1)', - ], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvSortDefinition: FunctionDefinition = { - type: 'eval', - name: 'mv_sort', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_sort', { - defaultMessage: 'Sorts a multivalued field in lexicographical order.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'field', - type: 'boolean', + name: 'base', + type: 'long', optional: false, }, { - name: 'order', - type: 'string', - optional: true, - literalOptions: ['asc', 'desc'], + name: 'exponent', + type: 'long', + optional: false, }, ], - returnType: 'boolean', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'date', + name: 'base', + type: 'long', optional: false, }, { - name: 'order', - type: 'string', - optional: true, - literalOptions: ['asc', 'desc'], + name: 'exponent', + type: 'unsigned_long', + optional: false, }, ], - returnType: 'date', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'number', + name: 'base', + type: 'unsigned_long', optional: false, }, { - name: 'order', - type: 'string', - optional: true, - literalOptions: ['asc', 'desc'], + name: 'exponent', + type: 'double', + optional: false, }, ], - returnType: 'number', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'ip', + name: 'base', + type: 'unsigned_long', optional: false, }, { - name: 'order', - type: 'string', - optional: true, - literalOptions: ['asc', 'desc'], + name: 'exponent', + type: 'integer', + optional: false, }, ], - returnType: 'ip', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'string', + name: 'base', + type: 'unsigned_long', optional: false, }, { - name: 'order', - type: 'string', - optional: true, - literalOptions: ['asc', 'desc'], + name: 'exponent', + type: 'long', + optional: false, }, ], - returnType: 'string', + returnType: 'double', }, { params: [ { - name: 'field', - type: 'version', + name: 'base', + type: 'unsigned_long', optional: false, }, { - name: 'order', - type: 'string', - optional: true, - literalOptions: ['asc', 'desc'], + name: 'exponent', + type: 'unsigned_long', + optional: false, }, ], - returnType: 'version', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW a = [4, 2, -3, 2]\n| EVAL sa = mv_sort(a), sd = mv_sort(a, "DESC")'], + examples: [ + 'ROW base = 2.0, exponent = 2\n| EVAL result = POW(base, exponent)', + 'ROW base = 4, exponent = 0.5\n| EVAL s = POW(base, exponent)', + ], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvSumDefinition: FunctionDefinition = { +const repeatDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_sum', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_sum', { + name: 'repeat', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.repeat', { defaultMessage: - 'Converts a multivalued field into a single valued field containing the sum of all of the values.', + 'Returns a string constructed by concatenating `string` with itself the specified `number` of times.', }), alias: undefined, signatures: [ { params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, { name: 'number', - type: 'number', + type: 'integer', optional: false, }, ], - returnType: 'number', + returnType: 'keyword', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], supportedOptions: ['by'], validate: undefined, - examples: ['ROW a=[3, 5, 6]\n| EVAL sum_a = MV_SUM(a)'], + examples: ['ROW a = "Hello!"\n| EVAL triple_a = REPEAT(a, 3);'], }; // Do not edit this manually... generated by scripts/generate_function_definitions.ts -const mvZipDefinition: FunctionDefinition = { +const replaceDefinition: FunctionDefinition = { type: 'eval', - name: 'mv_zip', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_zip', { + name: 'replace', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.replace', { defaultMessage: - 'Combines the values from two multivalued fields with a delimiter that joins them together.', + 'The function substitutes in the string `str` any match of the regular expression `regex`\nwith the replacement string `newStr`.', }), alias: undefined, signatures: [ { params: [ { - name: 'string1', - type: 'string', + name: 'string', + type: 'keyword', optional: false, }, { - name: 'string2', - type: 'string', + name: 'regex', + type: 'keyword', + optional: false, + }, + { + name: 'newString', + type: 'keyword', optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, { params: [ { - name: 'string1', - type: 'string', + name: 'string', + type: 'keyword', optional: false, }, { - name: 'string2', - type: 'string', + name: 'regex', + type: 'keyword', optional: false, }, { - name: 'delim', - type: 'string', - optional: true, + name: 'newString', + type: 'text', + optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: [ - 'ROW a = ["x", "y", "z"], b = ["1", "2"]\n| EVAL c = mv_zip(a, b, "-")\n| KEEP a, b, c', - ], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const nowDefinition: FunctionDefinition = { - type: 'eval', - name: 'now', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.now', { - defaultMessage: 'Returns current date and time.', - }), - alias: undefined, - signatures: [ { - params: [], - returnType: 'date', + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'regex', + type: 'text', + optional: false, + }, + { + name: 'newString', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW current_date = NOW()', 'FROM sample_data\n| WHERE @timestamp > NOW() - 1 hour'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const piDefinition: FunctionDefinition = { - type: 'eval', - name: 'pi', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.pi', { - defaultMessage: "Returns Pi, the ratio of a circle's circumference to its diameter.", - }), - alias: undefined, - signatures: [ { - params: [], - returnType: 'number', + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'regex', + type: 'text', + optional: false, + }, + { + name: 'newString', + type: 'text', + optional: false, + }, + ], + returnType: 'keyword', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW PI()'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const powDefinition: FunctionDefinition = { - type: 'eval', - name: 'pow', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.pow', { - defaultMessage: 'Returns the value of `base` raised to the power of `exponent`.', - }), - alias: undefined, - signatures: [ { params: [ { - name: 'base', - type: 'number', + name: 'string', + type: 'text', optional: false, }, { - name: 'exponent', - type: 'number', + name: 'regex', + type: 'keyword', + optional: false, + }, + { + name: 'newString', + type: 'keyword', optional: false, }, ], - returnType: 'number', + returnType: 'keyword', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: [ - 'ROW base = 2.0, exponent = 2\n| EVAL result = POW(base, exponent)', - 'ROW base = 4, exponent = 0.5\n| EVAL s = POW(base, exponent)', - ], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const repeatDefinition: FunctionDefinition = { - type: 'eval', - name: 'repeat', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.repeat', { - defaultMessage: - 'Returns a string constructed by concatenating `string` with itself the specified `number` of times.', - }), - alias: undefined, - signatures: [ { params: [ { name: 'string', - type: 'string', + type: 'text', optional: false, }, { - name: 'number', - type: 'number', + name: 'regex', + type: 'keyword', + optional: false, + }, + { + name: 'newString', + type: 'text', optional: false, }, ], - returnType: 'string', + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + { + name: 'regex', + type: 'text', + optional: false, + }, + { + name: 'newString', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW a = "Hello!"\n| EVAL triple_a = REPEAT(a, 3);'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const replaceDefinition: FunctionDefinition = { - type: 'eval', - name: 'replace', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.replace', { - defaultMessage: - 'The function substitutes in the string `str` any match of the regular expression `regex`\nwith the replacement string `newStr`.', - }), - alias: undefined, - signatures: [ { params: [ { name: 'string', - type: 'string', + type: 'text', optional: false, }, { name: 'regex', - type: 'string', + type: 'text', optional: false, }, { name: 'newString', - type: 'string', + type: 'text', optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -2977,16 +5388,31 @@ const rightDefinition: FunctionDefinition = { params: [ { name: 'string', - type: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'length', + type: 'integer', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', optional: false, }, { name: 'length', - type: 'number', + type: 'integer', optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3011,26 +5437,86 @@ const roundDefinition: FunctionDefinition = { params: [ { name: 'number', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'double', + optional: false, + }, + { + name: 'decimals', + type: 'integer', + optional: true, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + { + name: 'decimals', + type: 'integer', + optional: true, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'number', + type: 'long', optional: false, }, ], - returnType: 'number', + returnType: 'long', }, { params: [ { name: 'number', - type: 'number', + type: 'long', optional: false, }, { name: 'decimals', - type: 'number', + type: 'integer', optional: true, }, ], - returnType: 'number', + returnType: 'long', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'unsigned_long', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3054,11 +5540,21 @@ const rtrimDefinition: FunctionDefinition = { params: [ { name: 'string', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', optional: false, }, ], - returnType: 'string', + returnType: 'text', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3083,11 +5579,41 @@ const signumDefinition: FunctionDefinition = { params: [ { name: 'number', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3109,11 +5635,41 @@ const sinDefinition: FunctionDefinition = { params: [ { name: 'angle', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3135,11 +5691,41 @@ const sinhDefinition: FunctionDefinition = { params: [ { name: 'angle', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3161,16 +5747,61 @@ const splitDefinition: FunctionDefinition = { params: [ { name: 'string', - type: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'delim', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'delim', + type: 'text', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', + optional: false, + }, + { + name: 'delim', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', optional: false, }, { name: 'delim', - type: 'string', + type: 'text', optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3193,11 +5824,41 @@ const sqrtDefinition: FunctionDefinition = { params: [ { name: 'number', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3507,7 +6168,7 @@ const stDistanceDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'double', }, { params: [ @@ -3522,7 +6183,7 @@ const stDistanceDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3829,7 +6490,7 @@ const stXDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'double', }, { params: [ @@ -3839,7 +6500,7 @@ const stXDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3868,7 +6529,7 @@ const stYDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'double', }, { params: [ @@ -3878,7 +6539,7 @@ const stYDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3903,12 +6564,27 @@ const startsWithDefinition: FunctionDefinition = { params: [ { name: 'str', - type: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'prefix', + type: 'keyword', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'str', + type: 'text', optional: false, }, { name: 'prefix', - type: 'string', + type: 'text', optional: false, }, ], @@ -3935,21 +6611,41 @@ const substringDefinition: FunctionDefinition = { params: [ { name: 'string', - type: 'string', + type: 'keyword', + optional: false, + }, + { + name: 'start', + type: 'integer', + optional: false, + }, + { + name: 'length', + type: 'integer', + optional: true, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', optional: false, }, { name: 'start', - type: 'number', + type: 'integer', optional: false, }, { name: 'length', - type: 'number', + type: 'integer', optional: true, }, ], - returnType: 'string', + returnType: 'keyword', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -3975,11 +6671,41 @@ const tanDefinition: FunctionDefinition = { params: [ { name: 'angle', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4001,11 +6727,41 @@ const tanhDefinition: FunctionDefinition = { params: [ { name: 'angle', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'angle', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4025,7 +6781,7 @@ const tauDefinition: FunctionDefinition = { signatures: [ { params: [], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4047,11 +6803,21 @@ const toBase64Definition: FunctionDefinition = { params: [ { name: 'string', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4084,7 +6850,47 @@ const toBooleanDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'text', optional: false, }, ], @@ -4094,7 +6900,7 @@ const toBooleanDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'string', + type: 'unsigned_long', optional: false, }, ], @@ -4134,7 +6940,17 @@ const toCartesianpointDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'cartesian_point', + }, + { + params: [ + { + name: 'field', + type: 'text', optional: false, }, ], @@ -4186,7 +7002,17 @@ const toCartesianshapeDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'cartesian_shape', + }, + { + params: [ + { + name: 'field', + type: 'text', optional: false, }, ], @@ -4225,7 +7051,47 @@ const toDatetimeDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'text', optional: false, }, ], @@ -4235,7 +7101,7 @@ const toDatetimeDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'string', + type: 'unsigned_long', optional: false, }, ], @@ -4264,68 +7130,168 @@ const toDegreesDefinition: FunctionDefinition = { params: [ { name: 'number', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', + optional: false, + }, + ], + returnType: 'double', + }, + ], + supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW rad = [1.57, 3.14, 4.71]\n| EVAL deg = TO_DEGREES(rad)'], +}; + +// Do not edit this manually... generated by scripts/generate_function_definitions.ts +const toDoubleDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_double', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_double', { + defaultMessage: + 'Converts an input value to a double value. If the input parameter is of a date type,\nits value will be interpreted as milliseconds since the Unix epoch,\nconverted to double. Boolean *true* will be converted to double *1.0*, *false* to *0.0*.', + }), + alias: ['to_dbl'], + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'counter_double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'counter_integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'counter_long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'field', + type: 'integer', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, - ], - supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - validate: undefined, - examples: ['ROW rad = [1.57, 3.14, 4.71]\n| EVAL deg = TO_DEGREES(rad)'], -}; - -// Do not edit this manually... generated by scripts/generate_function_definitions.ts -const toDoubleDefinition: FunctionDefinition = { - type: 'eval', - name: 'to_double', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_double', { - defaultMessage: - 'Converts an input value to a double value. If the input parameter is of a date type,\nits value will be interpreted as milliseconds since the Unix epoch,\nconverted to double. Boolean *true* will be converted to double *1.0*, *false* to *0.0*.', - }), - alias: ['to_dbl'], - signatures: [ { params: [ { name: 'field', - type: 'boolean', + type: 'keyword', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, { params: [ { name: 'field', - type: 'number', + type: 'long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, { params: [ { name: 'field', - type: 'date', + type: 'text', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, { params: [ { name: 'field', - type: 'string', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4360,7 +7326,17 @@ const toGeopointDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'geo_point', + }, + { + params: [ + { + name: 'field', + type: 'text', optional: false, }, ], @@ -4407,7 +7383,17 @@ const toGeoshapeDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'geo_shape', + }, + { + params: [ + { + name: 'field', + type: 'text', optional: false, }, ], @@ -4440,17 +7426,17 @@ const toIntegerDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'integer', }, { params: [ { name: 'field', - type: 'number', + type: 'counter_integer', optional: false, }, ], - returnType: 'number', + returnType: 'integer', }, { params: [ @@ -4460,17 +7446,67 @@ const toIntegerDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + ], + returnType: 'integer', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + ], + returnType: 'integer', }, { params: [ { name: 'field', - type: 'string', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'integer', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4502,7 +7538,17 @@ const toIpDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'text', optional: false, }, ], @@ -4535,17 +7581,27 @@ const toLongDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'counter_integer', + optional: false, + }, + ], + returnType: 'long', }, { params: [ { name: 'field', - type: 'number', + type: 'counter_long', optional: false, }, ], - returnType: 'number', + returnType: 'long', }, { params: [ @@ -4555,17 +7611,67 @@ const toLongDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + ], + returnType: 'long', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + ], + returnType: 'long', }, { params: [ { name: 'field', - type: 'string', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'long', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4589,11 +7695,21 @@ const toLowerDefinition: FunctionDefinition = { params: [ { name: 'str', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'str', + type: 'text', optional: false, }, ], - returnType: 'string', + returnType: 'text', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4615,11 +7731,41 @@ const toRadiansDefinition: FunctionDefinition = { params: [ { name: 'number', - type: 'number', + type: 'double', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'integer', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'long', + optional: false, + }, + ], + returnType: 'double', + }, + { + params: [ + { + name: 'number', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'double', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4645,7 +7791,7 @@ const toStringDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, { params: [ @@ -4655,7 +7801,7 @@ const toStringDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, { params: [ @@ -4665,7 +7811,7 @@ const toStringDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, { params: [ @@ -4675,17 +7821,17 @@ const toStringDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, { params: [ { name: 'field', - type: 'number', + type: 'double', optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, { params: [ @@ -4695,7 +7841,7 @@ const toStringDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, { params: [ @@ -4705,7 +7851,17 @@ const toStringDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'string', + returnType: 'keyword', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'keyword', }, { params: [ @@ -4715,17 +7871,47 @@ const toStringDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'string', + returnType: 'keyword', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'field', + type: 'text', + optional: false, + }, + ], + returnType: 'keyword', }, { params: [ { name: 'field', - type: 'string', + type: 'unsigned_long', optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, { params: [ @@ -4735,7 +7921,7 @@ const toStringDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'string', + returnType: 'keyword', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4765,7 +7951,7 @@ const toUnsignedLongDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'unsigned_long', }, { params: [ @@ -4775,27 +7961,67 @@ const toUnsignedLongDefinition: FunctionDefinition = { optional: false, }, ], - returnType: 'number', + returnType: 'unsigned_long', + }, + { + params: [ + { + name: 'field', + type: 'double', + optional: false, + }, + ], + returnType: 'unsigned_long', + }, + { + params: [ + { + name: 'field', + type: 'integer', + optional: false, + }, + ], + returnType: 'unsigned_long', + }, + { + params: [ + { + name: 'field', + type: 'keyword', + optional: false, + }, + ], + returnType: 'unsigned_long', + }, + { + params: [ + { + name: 'field', + type: 'long', + optional: false, + }, + ], + returnType: 'unsigned_long', }, { params: [ { name: 'field', - type: 'number', + type: 'text', optional: false, }, ], - returnType: 'number', + returnType: 'unsigned_long', }, { params: [ { name: 'field', - type: 'string', + type: 'unsigned_long', optional: false, }, ], - returnType: 'number', + returnType: 'unsigned_long', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4819,11 +8045,21 @@ const toUpperDefinition: FunctionDefinition = { params: [ { name: 'str', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'str', + type: 'text', optional: false, }, ], - returnType: 'string', + returnType: 'text', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], @@ -4845,7 +8081,17 @@ const toVersionDefinition: FunctionDefinition = { params: [ { name: 'field', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'version', + }, + { + params: [ + { + name: 'field', + type: 'text', optional: false, }, ], @@ -4881,11 +8127,21 @@ const trimDefinition: FunctionDefinition = { params: [ { name: 'string', - type: 'string', + type: 'keyword', + optional: false, + }, + ], + returnType: 'keyword', + }, + { + params: [ + { + name: 'string', + type: 'text', optional: false, }, ], - returnType: 'string', + returnType: 'text', }, ], supportedCommands: ['stats', 'metrics', 'eval', 'where', 'row', 'sort'], diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts index 79ac91d14403a..043c6e44d55bc 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts @@ -7,8 +7,53 @@ */ import { i18n } from '@kbn/i18n'; -import { FunctionDefinition } from './types'; +import { FunctionDefinition, FunctionParameterType, FunctionReturnType } from './types'; +const groupingTypeTable: Array< + [ + FunctionParameterType, + FunctionParameterType, + FunctionParameterType | null, + FunctionParameterType | null, + FunctionReturnType + ] +> = [ + // field // bucket //from // to //result + ['date', 'date_period', null, null, 'date'], + ['date', 'integer', 'date', 'date', 'date'], + // Modified time_duration to time_literal + ['date', 'time_literal', null, null, 'date'], + ['double', 'double', null, null, 'double'], + ['double', 'integer', 'double', 'double', 'double'], + ['double', 'integer', 'double', 'integer', 'double'], + ['double', 'integer', 'double', 'long', 'double'], + ['double', 'integer', 'integer', 'double', 'double'], + ['double', 'integer', 'integer', 'integer', 'double'], + ['double', 'integer', 'integer', 'long', 'double'], + ['double', 'integer', 'long', 'double', 'double'], + ['double', 'integer', 'long', 'integer', 'double'], + ['double', 'integer', 'long', 'long', 'double'], + ['integer', 'double', null, null, 'double'], + ['integer', 'integer', 'double', 'double', 'double'], + ['integer', 'integer', 'double', 'integer', 'double'], + ['integer', 'integer', 'double', 'long', 'double'], + ['integer', 'integer', 'integer', 'double', 'double'], + ['integer', 'integer', 'integer', 'integer', 'double'], + ['integer', 'integer', 'integer', 'long', 'double'], + ['integer', 'integer', 'long', 'double', 'double'], + ['integer', 'integer', 'long', 'integer', 'double'], + ['integer', 'integer', 'long', 'long', 'double'], + ['long', 'double', null, null, 'double'], + ['long', 'integer', 'double', 'double', 'double'], + ['long', 'integer', 'double', 'integer', 'double'], + ['long', 'integer', 'double', 'long', 'double'], + ['long', 'integer', 'integer', 'double', 'double'], + ['long', 'integer', 'integer', 'integer', 'double'], + ['long', 'integer', 'integer', 'long', 'double'], + ['long', 'integer', 'long', 'double', 'double'], + ['long', 'integer', 'long', 'integer', 'double'], + ['long', 'integer', 'long', 'long', 'double'], +]; export const groupingFunctionDefinitions: FunctionDefinition[] = [ { name: 'bucket', @@ -21,65 +66,18 @@ export const groupingFunctionDefinitions: FunctionDefinition[] = [ supportedCommands: ['stats'], supportedOptions: ['by'], signatures: [ - { - params: [ - { name: 'field', type: 'date' }, - { name: 'buckets', type: 'time_literal', constantOnly: true }, - ], - returnType: 'date', - }, - { - params: [ - { name: 'field', type: 'number' }, - { name: 'buckets', type: 'number', constantOnly: true }, - ], - returnType: 'number', - }, - { - params: [ - { name: 'field', type: 'date' }, - { name: 'buckets', type: 'number', constantOnly: true }, - { name: 'startDate', type: 'string', constantOnly: true }, - { name: 'endDate', type: 'string', constantOnly: true }, - ], - returnType: 'date', - }, - { - params: [ - { name: 'field', type: 'date' }, - { name: 'buckets', type: 'number', constantOnly: true }, - { name: 'startDate', type: 'date', constantOnly: true }, - { name: 'endDate', type: 'date', constantOnly: true }, - ], - returnType: 'date', - }, - { - params: [ - { name: 'field', type: 'date' }, - { name: 'buckets', type: 'number', constantOnly: true }, - { name: 'startDate', type: 'string', constantOnly: true }, - { name: 'endDate', type: 'date', constantOnly: true }, - ], - returnType: 'date', - }, - { - params: [ - { name: 'field', type: 'date' }, - { name: 'buckets', type: 'number', constantOnly: true }, - { name: 'startDate', type: 'date', constantOnly: true }, - { name: 'endDate', type: 'string', constantOnly: true }, - ], - returnType: 'date', - }, - { - params: [ - { name: 'field', type: 'number' }, - { name: 'buckets', type: 'number', constantOnly: true }, - { name: 'startValue', type: 'number', constantOnly: true }, - { name: 'endValue', type: 'number', constantOnly: true }, - ], - returnType: 'number', - }, + ...groupingTypeTable.map((signature) => { + const [fieldType, bucketType, fromType, toType, resultType] = signature; + return { + params: [ + { name: 'field', type: fieldType }, + { name: 'buckets', type: bucketType, constantOnly: true }, + ...(fromType ? [{ name: 'startDate', type: fromType, constantOnly: true }] : []), + ...(toType ? [{ name: 'endDate', type: toType, constantOnly: true }] : []), + ], + returnType: resultType, + }; + }), ], examples: [ 'from index | eval hd = bucket(bytes, 1 hour)', diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts index dbf0b7782d1a4..660bb1c7aca81 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts @@ -8,10 +8,20 @@ import type { ESQLCommand, ESQLCommandOption, ESQLFunction, ESQLMessage } from '@kbn/esql-ast'; +// Currently, partial of the full list +// https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/esql-core/src/main/java/org/elasticsearch/xpack/esql/core/type/DataType.java export const supportedFieldTypes = [ - 'number', + 'double', + 'unsigned_long', + 'long', + 'integer', + 'counter_integer', + 'counter_long', + 'counter_double', 'date', - 'string', + 'date_period', + 'text', + 'keyword', 'boolean', 'ip', 'cartesian_point', @@ -28,21 +38,43 @@ export type SupportedFieldType = (typeof supportedFieldTypes)[number]; export type FunctionParameterType = | SupportedFieldType + | 'string' | 'null' | 'any' | 'chrono_literal' | 'time_literal' - | 'number[]' + | 'time_duration' + | 'double[]' + | 'unsigned_long[]' + | 'long[]' + | 'integer[]' + | 'counter_integer[]' + | 'counter_long[]' + | 'counter_double[]' | 'string[]' + | 'keyword[]' + | 'text[]' | 'boolean[]' | 'any[]' - | 'date[]'; + | 'datetime[]' + | 'date_period[]'; export type FunctionReturnType = - | 'number' + | 'double' + | 'unsigned_long' + | 'long' + | 'integer' + | 'int' + | 'counter_integer' + | 'counter_long' + | 'counter_double' | 'date' + | 'date_period' + | 'time_duration' | 'any' | 'boolean' + | 'text' + | 'keyword' | 'string' | 'cartesian_point' | 'cartesian_shape' diff --git a/packages/kbn-esql-validation-autocomplete/src/shared/esql_to_kibana_type.ts b/packages/kbn-esql-validation-autocomplete/src/shared/esql_to_kibana_type.ts deleted file mode 100644 index f13052288f29f..0000000000000 --- a/packages/kbn-esql-validation-autocomplete/src/shared/esql_to_kibana_type.ts +++ /dev/null @@ -1,44 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -const ESQL_NUMBER_TYPES = [ - 'double', - 'unsigned_long', - 'long', - 'integer', - 'int', - 'counter_integer', - 'counter_long', - 'counter_double', -]; - -const ESQL_TEXT_TYPES = ['text', 'keyword', 'string']; - -export const esqlToKibanaType = (elasticsearchType: string) => { - if (ESQL_NUMBER_TYPES.includes(elasticsearchType)) { - return 'number'; - } - - if (ESQL_TEXT_TYPES.includes(elasticsearchType)) { - return 'string'; - } - - if (['datetime', 'time_duration'].includes(elasticsearchType)) { - return 'date'; - } - - if (elasticsearchType === 'bool') { - return 'boolean'; - } - - if (elasticsearchType === 'date_period') { - return 'time_literal'; // TODO - consider aligning with Elasticsearch - } - - return elasticsearchType; -}; diff --git a/packages/kbn-esql-validation-autocomplete/src/shared/esql_types.ts b/packages/kbn-esql-validation-autocomplete/src/shared/esql_types.ts new file mode 100644 index 0000000000000..dab8769f8477a --- /dev/null +++ b/packages/kbn-esql-validation-autocomplete/src/shared/esql_types.ts @@ -0,0 +1,49 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { ESQLDecimalLiteral, ESQLNumericLiteralType } from '@kbn/esql-ast/src/types'; + +export const ESQL_COMMON_NUMERIC_TYPES = ['double', 'long', 'integer'] as const; +export const ESQL_NUMERIC_DECIMAL_TYPES = [ + 'double', + 'unsigned_long', + 'long', + 'counter_long', + 'counter_double', +] as const; +export const ESQL_NUMBER_TYPES = [ + 'integer', + 'counter_integer', + ...ESQL_NUMERIC_DECIMAL_TYPES, +] as const; + +export const ESQL_STRING_TYPES = ['keyword', 'text'] as const; +export const ESQL_DATE_TYPES = ['datetime', 'date_period'] as const; + +/** + * + * @param type + * @returns + */ +export function isStringType(type: unknown) { + return typeof type === 'string' && ['keyword', 'text'].includes(type); +} + +export function isNumericType(type: unknown): type is ESQLNumericLiteralType { + return ( + typeof type === 'string' && + [...ESQL_NUMBER_TYPES, 'decimal'].includes(type as (typeof ESQL_NUMBER_TYPES)[number]) + ); +} + +export function isNumericDecimalType(type: unknown): type is ESQLDecimalLiteral { + return ( + typeof type === 'string' && + ESQL_NUMERIC_DECIMAL_TYPES.includes(type as (typeof ESQL_NUMERIC_DECIMAL_TYPES)[number]) + ); +} diff --git a/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts b/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts index 68658b29251b5..e13326c2a9f43 100644 --- a/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts +++ b/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts @@ -33,7 +33,7 @@ import { withOption, appendSeparatorOption, } from '../definitions/options'; -import type { +import { CommandDefinition, CommandOptionsDefinition, FunctionParameter, @@ -43,7 +43,7 @@ import type { } from '../definitions/types'; import type { ESQLRealField, ESQLVariable, ReferenceMaps } from '../validation/types'; import { removeMarkerArgFromArgsList } from './context'; -import { esqlToKibanaType } from './esql_to_kibana_type'; +import { isNumericDecimalType } from './esql_types'; import type { ReasonTypes } from './types'; export function nonNullable(v: T): v is NonNullable { @@ -226,6 +226,14 @@ function compareLiteralType(argType: string, item: ESQLLiteral) { return true; } + if (item.literalType === 'decimal' && isNumericDecimalType(argType)) { + return true; + } + + if (item.literalType === 'string' && (argType === 'text' || argType === 'keyword')) { + return true; + } + if (item.literalType !== 'string') { if (argType === item.literalType) { return true; @@ -234,7 +242,7 @@ function compareLiteralType(argType: string, item: ESQLLiteral) { } // date-type parameters accept string literals because of ES auto-casting - return ['string', 'date'].includes(argType); + return ['string', 'date', 'date', 'date_period'].includes(argType); } /** @@ -245,7 +253,14 @@ export function lookupColumn( { fields, variables }: Pick ): ESQLRealField | ESQLVariable | undefined { const columnName = getQuotedColumnName(column); - return fields.get(columnName) || variables.get(columnName)?.[0]; + return ( + fields.get(columnName) || + variables.get(columnName)?.[0] || + // It's possible columnName has backticks "`fieldName`" + // so we need to access the original name as well + fields.get(column.name) || + variables.get(column.name)?.[0] + ); } const ARRAY_REGEXP = /\[\]$/; @@ -255,10 +270,19 @@ export function isArrayType(type: string) { } const arrayToSingularMap: Map = new Map([ - ['number[]', 'number'], - ['date[]', 'date'], - ['boolean[]', 'boolean'], + ['double[]', 'double'], + ['unsigned_long[]', 'unsigned_long'], + ['long[]', 'long'], + ['integer[]', 'integer'], + ['counter_integer[]', 'counter_integer'], + ['counter_long[]', 'counter_long'], + ['counter_double[]', 'counter_double'], ['string[]', 'string'], + ['keyword[]', 'keyword'], + ['text[]', 'text'], + ['datetime[]', 'date'], + ['date_period[]', 'date_period'], + ['boolean[]', 'boolean'], ['any[]', 'any'], ]); @@ -407,7 +431,8 @@ export function checkFunctionArgMatchesDefinition( return true; } if (arg.type === 'literal') { - return compareLiteralType(argType, arg); + const matched = compareLiteralType(argType, arg); + return matched; } if (arg.type === 'function') { if (isSupportedFunction(arg.name, parentCommand).supported) { @@ -428,11 +453,21 @@ export function checkFunctionArgMatchesDefinition( } const wrappedTypes = Array.isArray(validHit.type) ? validHit.type : [validHit.type]; // if final type is of type any make it pass for now - return wrappedTypes.some((ct) => ['any', 'null'].includes(ct) || argType === ct); + return wrappedTypes.some( + (ct) => + ['any', 'null'].includes(ct) || + argType === ct || + (ct === 'string' && ['text', 'keyword'].includes(argType)) + ); } if (arg.type === 'inlineCast') { - // TODO - remove with https://github.com/elastic/kibana/issues/174710 - return argType === esqlToKibanaType(arg.castType); + const lowerArgType = argType?.toLowerCase(); + const lowerArgCastType = arg.castType?.toLowerCase(); + return ( + lowerArgType === lowerArgCastType || + // for valid shorthand casts like 321.12::int or "false"::bool + (['int', 'bool'].includes(lowerArgCastType) && argType.startsWith(lowerArgCastType)) + ); } } diff --git a/packages/kbn-esql-validation-autocomplete/src/shared/variables.ts b/packages/kbn-esql-validation-autocomplete/src/shared/variables.ts index 22c38cd286e19..ee1a912c688ea 100644 --- a/packages/kbn-esql-validation-autocomplete/src/shared/variables.ts +++ b/packages/kbn-esql-validation-autocomplete/src/shared/variables.ts @@ -35,7 +35,7 @@ function addToVariables( if (isColumnItem(oldArg) && isColumnItem(newArg)) { const newVariable: ESQLVariable = { name: newArg.name, - type: 'number' /* fallback to number */, + type: 'double' /* fallback to number */, location: newArg.location, }; // Now workout the exact type @@ -107,7 +107,7 @@ function addVariableFromAssignment( const rightHandSideArgType = getAssignRightHandSideType(assignOperation.args[1], fields); addToVariableOccurrencies(variables, { name: assignOperation.args[0].name, - type: rightHandSideArgType || 'number' /* fallback to number */, + type: rightHandSideArgType || 'double' /* fallback to number */, location: assignOperation.args[0].location, }); } @@ -125,7 +125,7 @@ function addVariableFromExpression( queryString, expressionOperation.location ); - const expressionType = 'number'; + const expressionType = 'double'; addToVariableOccurrencies(variables, { name: forwardThinkingVariableName, type: expressionType, diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/helpers.ts b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/helpers.ts index 9d28f88115b42..02f7c30d96ff9 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/helpers.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/helpers.ts @@ -31,7 +31,7 @@ export const setup = async () => { return await validateQuery(query, getAstAndSyntaxErrors, opts, cb); }; - const assertErrors = (errors: unknown[], expectedErrors: string[]) => { + const assertErrors = (errors: unknown[], expectedErrors: string[], query?: string) => { const errorMessages: string[] = []; for (const error of errors) { if (error && typeof error === 'object') { @@ -46,7 +46,16 @@ export const setup = async () => { errorMessages.push(String(error)); } } - expect(errorMessages.sort()).toStrictEqual(expectedErrors.sort()); + + try { + expect(errorMessages.sort()).toStrictEqual(expectedErrors.sort()); + } catch (error) { + throw Error(`${query}\n + Received: + '${errorMessages.sort()}' + Expected: + ${expectedErrors.sort()}`); + } }; const expectErrors = async ( @@ -57,9 +66,9 @@ export const setup = async () => { cb: ESQLCallbacks = callbacks ) => { const { errors, warnings } = await validateQuery(query, getAstAndSyntaxErrors, opts, cb); - assertErrors(errors, expectedErrors); + assertErrors(errors, expectedErrors, query); if (expectedWarnings) { - assertErrors(warnings, expectedWarnings); + assertErrors(warnings, expectedWarnings, query); } }; diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/test_suites/validation.command.metrics.ts b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/test_suites/validation.command.metrics.ts index 44c15c722a1de..ea5df88553888 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/test_suites/validation.command.metrics.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/test_suites/validation.command.metrics.ts @@ -85,7 +85,7 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { await expectErrors(`METRICS average()`, ['Unknown index [average()]']); await expectErrors(`metrics custom_function()`, ['Unknown index [custom_function()]']); await expectErrors(`metrics indexes*`, ['Unknown index [indexes*]']); - await expectErrors('metrics numberField', ['Unknown index [numberField]']); + await expectErrors('metrics doubleField', ['Unknown index [doubleField]']); await expectErrors('metrics policy', ['Unknown index [policy]']); }); }); @@ -95,26 +95,26 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { const { expectErrors } = await setup(); await expectErrors('METRICS a_index count()', []); - await expectErrors('metrics a_index avg(numberField) by 1', []); - await expectErrors('metrics a_index count(`numberField`)', []); + await expectErrors('metrics a_index avg(doubleField) by 1', []); + await expectErrors('metrics a_index count(`doubleField`)', []); await expectErrors('metrics a_index count(*)', []); await expectErrors('metrics index var0 = count(*)', []); await expectErrors('metrics a_index var0 = count()', []); - await expectErrors('metrics a_index var0 = avg(numberField), count(*)', []); + await expectErrors('metrics a_index var0 = avg(doubleField), count(*)', []); await expectErrors(`metrics a_index sum(case(false, 0, 1))`, []); await expectErrors(`metrics a_index var0 = sum( case(false, 0, 1))`, []); - await expectErrors('metrics a_index count(stringField == "a" or null)', []); - await expectErrors('metrics other_index max(numberField) by stringField', []); + await expectErrors('metrics a_index count(textField == "a" or null)', []); + await expectErrors('metrics other_index max(doubleField) by textField', []); }); test('syntax errors', async () => { const { expectErrors } = await setup(); - await expectErrors('metrics a_index numberField=', [ + await expectErrors('metrics a_index doubleField=', [ expect.any(String), "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", ]); - await expectErrors('metrics a_index numberField=5 by ', [ + await expectErrors('metrics a_index doubleField=5 by ', [ expect.any(String), "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", ]); @@ -131,29 +131,29 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { test('errors when no aggregation function specified', async () => { const { expectErrors } = await setup(); - await expectErrors('metrics a_index numberField + 1', [ - 'At least one aggregation function required in [METRICS], found [numberField+1]', + await expectErrors('metrics a_index doubleField + 1', [ + 'At least one aggregation function required in [METRICS], found [doubleField+1]', ]); - await expectErrors('metrics a_index a = numberField + 1', [ - 'At least one aggregation function required in [METRICS], found [a=numberField+1]', + await expectErrors('metrics a_index a = doubleField + 1', [ + 'At least one aggregation function required in [METRICS], found [a=doubleField+1]', ]); - await expectErrors('metrics a_index a = numberField + 1, stringField', [ - 'At least one aggregation function required in [METRICS], found [a=numberField+1]', - 'Expected an aggregate function or group but got [stringField] of type [FieldAttribute]', + await expectErrors('metrics a_index a = doubleField + 1, textField', [ + 'At least one aggregation function required in [METRICS], found [a=doubleField+1]', + 'Expected an aggregate function or group but got [textField] of type [FieldAttribute]', ]); - await expectErrors('metrics a_index numberField + 1 by ipField', [ - 'At least one aggregation function required in [METRICS], found [numberField+1]', + await expectErrors('metrics a_index doubleField + 1 by ipField', [ + 'At least one aggregation function required in [METRICS], found [doubleField+1]', ]); }); test('errors on agg and non-agg mix', async () => { const { expectErrors } = await setup(); - await expectErrors('METRICS a_index sum( numberField ) + abs( numberField ) ', [ - 'Cannot combine aggregation and non-aggregation values in [METRICS], found [sum(numberField)+abs(numberField)]', + await expectErrors('METRICS a_index sum( doubleField ) + abs( doubleField ) ', [ + 'Cannot combine aggregation and non-aggregation values in [METRICS], found [sum(doubleField)+abs(doubleField)]', ]); - await expectErrors('METRICS a_index abs( numberField + sum( numberField )) ', [ - 'Cannot combine aggregation and non-aggregation values in [METRICS], found [abs(numberField+sum(numberField))]', + await expectErrors('METRICS a_index abs( doubleField + sum( doubleField )) ', [ + 'Cannot combine aggregation and non-aggregation values in [METRICS], found [abs(doubleField+sum(doubleField))]', ]); }); @@ -169,8 +169,8 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { test('errors when input is not an aggregate function', async () => { const { expectErrors } = await setup(); - await expectErrors('metrics a_index numberField ', [ - 'Expected an aggregate function or group but got [numberField] of type [FieldAttribute]', + await expectErrors('metrics a_index doubleField ', [ + 'Expected an aggregate function or group but got [doubleField] of type [FieldAttribute]', ]); }); @@ -179,9 +179,9 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { for (const subCommand of ['keep', 'drop', 'eval']) { await expectErrors( - 'metrics a_index count(`numberField`) | ' + + 'metrics a_index count(`doubleField`) | ' + subCommand + - ' `count(``numberField``)` ', + ' `count(``doubleField``)` ', [] ); } @@ -194,7 +194,7 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { 'Using wildcards (*) in round is not allowed', ]); await expectErrors('metrics a_index count(count(*))', [ - `Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [count(*)] of type [number]`, + `Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [count(*)] of type [long]`, ]); }); }); @@ -204,21 +204,21 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { const { expectErrors } = await setup(); await expectErrors( - 'metrics a_index avg(numberField), percentile(numberField, 50) by ipField', + 'metrics a_index avg(doubleField), percentile(doubleField, 50) by ipField', [] ); await expectErrors( - 'metrics a_index avg(numberField), percentile(numberField, 50) BY ipField', + 'metrics a_index avg(doubleField), percentile(doubleField, 50) BY ipField', [] ); await expectErrors( - 'metrics a_index avg(numberField), percentile(numberField, 50) + 1 by ipField', + 'metrics a_index avg(doubleField), percentile(doubleField, 50) + 1 by ipField', [] ); - await expectErrors('metrics a_index avg(numberField) by stringField | limit 100', []); + await expectErrors('metrics a_index avg(doubleField) by textField | limit 100', []); for (const op of ['+', '-', '*', '/', '%']) { await expectErrors( - `metrics a_index avg(numberField) ${op} percentile(numberField, 50) BY ipField`, + `metrics a_index avg(doubleField) ${op} percentile(doubleField, 50) BY ipField`, [] ); } @@ -227,9 +227,9 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { test('syntax does not allow clause without ', async () => { const { expectErrors } = await setup(); - await expectErrors('metrics a_index BY stringField', [ + await expectErrors('metrics a_index BY textField', [ 'Expected an aggregate function or group but got [BY] of type [FieldAttribute]', - "SyntaxError: extraneous input 'stringField' expecting ", + "SyntaxError: extraneous input 'textField' expecting ", ]); }); @@ -239,7 +239,7 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { await expectErrors('metrics a_index count(* + 1) BY ipField', [ "SyntaxError: no viable alternative at input 'count(* +'", ]); - await expectErrors('metrics a_index \n count(* + round(numberField)) BY ipField', [ + await expectErrors('metrics a_index \n count(* + round(doubleField)) BY ipField', [ "SyntaxError: no viable alternative at input 'count(* +'", ]); }); @@ -251,20 +251,20 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { 'Using wildcards (*) in round is not allowed', ]); await expectErrors('metrics a_index count(count(*)) BY ipField', [ - `Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [count(*)] of type [number]`, + `Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [count(*)] of type [long]`, ]); }); test('errors on unknown field', async () => { const { expectErrors } = await setup(); - await expectErrors('metrics a_index avg(numberField) by wrongField', [ + await expectErrors('metrics a_index avg(doubleField) by wrongField', [ 'Unknown column [wrongField]', ]); - await expectErrors('metrics a_index avg(numberField) by wrongField + 1', [ + await expectErrors('metrics a_index avg(doubleField) by wrongField + 1', [ 'Unknown column [wrongField]', ]); - await expectErrors('metrics a_index avg(numberField) by var0 = wrongField + 1', [ + await expectErrors('metrics a_index avg(doubleField) by var0 = wrongField + 1', [ 'Unknown column [wrongField]', ]); }); @@ -272,11 +272,11 @@ export const validationMetricsCommandTestSuite = (setup: helpers.Setup) => { test('various errors', async () => { const { expectErrors } = await setup(); - await expectErrors('METRICS a_index avg(numberField) by percentile(numberField)', [ + await expectErrors('METRICS a_index avg(doubleField) by percentile(doubleField)', [ 'METRICS BY does not support function percentile', ]); await expectErrors( - 'METRICS a_index avg(numberField) by stringField, percentile(numberField) by ipField', + 'METRICS a_index avg(doubleField) by textField, percentile(doubleField) by ipField', [ "SyntaxError: mismatched input 'by' expecting ", 'METRICS BY does not support function percentile', diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/test_suites/validation.command.stats.ts b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/test_suites/validation.command.stats.ts index 5a98d362dc002..f5bd10fe0ca83 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/test_suites/validation.command.stats.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/test_suites/validation.command.stats.ts @@ -15,15 +15,15 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { test('no errors on correct usage', async () => { const { expectErrors } = await setup(); - await expectErrors('from a_index | stats by stringField', []); + await expectErrors('from a_index | stats by textField', []); await expectErrors( `FROM index - | EVAL numberField * 3.281 - | STATS avg_numberField = AVG(\`numberField * 3.281\`)`, + | EVAL doubleField * 3.281 + | STATS avg_doubleField = AVG(\`doubleField * 3.281\`)`, [] ); await expectErrors( - `FROM index | STATS AVG(numberField) by round(numberField) + 1 | EVAL \`round(numberField) + 1\` / 2`, + `FROM index | STATS AVG(doubleField) by round(doubleField) + 1 | EVAL \`round(doubleField) + 1\` / 2`, [] ); }); @@ -40,18 +40,18 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { test('no errors on correct usage', async () => { const { expectErrors } = await setup(); - await expectErrors('from a_index | stats avg(numberField) by 1', []); - await expectErrors('from a_index | stats count(`numberField`)', []); + await expectErrors('from a_index | stats avg(doubleField) by 1', []); + await expectErrors('from a_index | stats count(`doubleField`)', []); await expectErrors('from a_index | stats count(*)', []); await expectErrors('from a_index | stats count()', []); await expectErrors('from a_index | stats var0 = count(*)', []); await expectErrors('from a_index | stats var0 = count()', []); - await expectErrors('from a_index | stats var0 = avg(numberField), count(*)', []); + await expectErrors('from a_index | stats var0 = avg(doubleField), count(*)', []); await expectErrors(`from a_index | stats sum(case(false, 0, 1))`, []); await expectErrors(`from a_index | stats var0 = sum( case(false, 0, 1))`, []); // "or" must accept "null" - await expectErrors('from a_index | stats count(stringField == "a" or null)', []); + await expectErrors('from a_index | stats count(textField == "a" or null)', []); }); test('sub-command can reference aggregated field', async () => { @@ -59,9 +59,9 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { for (const subCommand of ['keep', 'drop', 'eval']) { await expectErrors( - 'from a_index | stats count(`numberField`) | ' + + 'from a_index | stats count(`doubleField`) | ' + subCommand + - ' `count(``numberField``)` ', + ' `count(``doubleField``)` ', [] ); } @@ -70,64 +70,64 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { test('errors on agg and non-agg mix', async () => { const { expectErrors } = await setup(); - await expectErrors('from a_index | STATS sum( numberField ) + abs( numberField ) ', [ - 'Cannot combine aggregation and non-aggregation values in [STATS], found [sum(numberField)+abs(numberField)]', + await expectErrors('from a_index | STATS sum( doubleField ) + abs( doubleField ) ', [ + 'Cannot combine aggregation and non-aggregation values in [STATS], found [sum(doubleField)+abs(doubleField)]', ]); - await expectErrors('from a_index | STATS abs( numberField + sum( numberField )) ', [ - 'Cannot combine aggregation and non-aggregation values in [STATS], found [abs(numberField+sum(numberField))]', + await expectErrors('from a_index | STATS abs( doubleField + sum( doubleField )) ', [ + 'Cannot combine aggregation and non-aggregation values in [STATS], found [abs(doubleField+sum(doubleField))]', ]); }); test('errors on each aggregation field, which does not contain at least one agg function', async () => { const { expectErrors } = await setup(); - await expectErrors('from a_index | stats numberField + 1', [ - 'At least one aggregation function required in [STATS], found [numberField+1]', + await expectErrors('from a_index | stats doubleField + 1', [ + 'At least one aggregation function required in [STATS], found [doubleField+1]', ]); - await expectErrors('from a_index | stats numberField + 1, stringField', [ - 'At least one aggregation function required in [STATS], found [numberField+1]', - 'Expected an aggregate function or group but got [stringField] of type [FieldAttribute]', + await expectErrors('from a_index | stats doubleField + 1, textField', [ + 'At least one aggregation function required in [STATS], found [doubleField+1]', + 'Expected an aggregate function or group but got [textField] of type [FieldAttribute]', ]); - await expectErrors('from a_index | stats numberField + 1, numberField + 2, count()', [ - 'At least one aggregation function required in [STATS], found [numberField+1]', - 'At least one aggregation function required in [STATS], found [numberField+2]', + await expectErrors('from a_index | stats doubleField + 1, doubleField + 2, count()', [ + 'At least one aggregation function required in [STATS], found [doubleField+1]', + 'At least one aggregation function required in [STATS], found [doubleField+2]', ]); await expectErrors( - 'from a_index | stats numberField + 1, numberField + count(), count()', - ['At least one aggregation function required in [STATS], found [numberField+1]'] + 'from a_index | stats doubleField + 1, doubleField + count(), count()', + ['At least one aggregation function required in [STATS], found [doubleField+1]'] ); - await expectErrors('from a_index | stats 5 + numberField + 1', [ - 'At least one aggregation function required in [STATS], found [5+numberField+1]', + await expectErrors('from a_index | stats 5 + doubleField + 1', [ + 'At least one aggregation function required in [STATS], found [5+doubleField+1]', ]); - await expectErrors('from a_index | stats numberField + 1 by ipField', [ - 'At least one aggregation function required in [STATS], found [numberField+1]', + await expectErrors('from a_index | stats doubleField + 1 by ipField', [ + 'At least one aggregation function required in [STATS], found [doubleField+1]', ]); }); test('errors when input is not an aggregate function', async () => { const { expectErrors } = await setup(); - await expectErrors('from a_index | stats numberField ', [ - 'Expected an aggregate function or group but got [numberField] of type [FieldAttribute]', + await expectErrors('from a_index | stats doubleField ', [ + 'Expected an aggregate function or group but got [doubleField] of type [FieldAttribute]', ]); }); test('various errors', async () => { const { expectErrors } = await setup(); - await expectErrors('from a_index | stats numberField=', [ + await expectErrors('from a_index | stats doubleField=', [ "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", ]); - await expectErrors('from a_index | stats numberField=5 by ', [ + await expectErrors('from a_index | stats doubleField=5 by ', [ "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", ]); - await expectErrors('from a_index | stats avg(numberField) by wrongField', [ + await expectErrors('from a_index | stats avg(doubleField) by wrongField', [ 'Unknown column [wrongField]', ]); - await expectErrors('from a_index | stats avg(numberField) by wrongField + 1', [ + await expectErrors('from a_index | stats avg(doubleField) by wrongField + 1', [ 'Unknown column [wrongField]', ]); - await expectErrors('from a_index | stats avg(numberField) by var0 = wrongField + 1', [ + await expectErrors('from a_index | stats avg(doubleField) by var0 = wrongField + 1', [ 'Unknown column [wrongField]', ]); await expectErrors('from a_index | stats var0 = avg(fn(number)), count(*)', [ @@ -142,7 +142,7 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { 'Using wildcards (*) in round is not allowed', ]); await expectErrors('from a_index | stats count(count(*))', [ - `Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [count(*)] of type [number]`, + `Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [count(*)] of type [long]`, ]); }); }); @@ -152,20 +152,20 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { const { expectErrors } = await setup(); await expectErrors( - 'from a_index | stats avg(numberField), percentile(numberField, 50) by ipField', + 'from a_index | stats avg(doubleField), percentile(doubleField, 50) by ipField', [] ); await expectErrors( - 'from a_index | stats avg(numberField), percentile(numberField, 50) BY ipField', + 'from a_index | stats avg(doubleField), percentile(doubleField, 50) BY ipField', [] ); await expectErrors( - 'from a_index | stats avg(numberField), percentile(numberField, 50) + 1 by ipField', + 'from a_index | stats avg(doubleField), percentile(doubleField, 50) + 1 by ipField', [] ); for (const op of ['+', '-', '*', '/', '%']) { await expectErrors( - `from a_index | stats avg(numberField) ${op} percentile(numberField, 50) BY ipField`, + `from a_index | stats avg(doubleField) ${op} percentile(doubleField, 50) BY ipField`, [] ); } @@ -185,7 +185,7 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { await expectErrors('from a_index | stats count(* + 1) BY ipField', [ "SyntaxError: no viable alternative at input 'count(* +'", ]); - await expectErrors('from a_index | stats count(* + round(numberField)) BY ipField', [ + await expectErrors('from a_index | stats count(* + round(doubleField)) BY ipField', [ "SyntaxError: no viable alternative at input 'count(* +'", ]); }); @@ -197,18 +197,18 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { 'Using wildcards (*) in round is not allowed', ]); await expectErrors('from a_index | stats count(count(*)) BY ipField', [ - `Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [count(*)] of type [number]`, + `Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [count(*)] of type [long]`, ]); }); test('various errors', async () => { const { expectErrors } = await setup(); - await expectErrors('from a_index | stats avg(numberField) by percentile(numberField)', [ + await expectErrors('from a_index | stats avg(doubleField) by percentile(doubleField)', [ 'STATS BY does not support function percentile', ]); await expectErrors( - 'from a_index | stats avg(numberField) by stringField, percentile(numberField) by ipField', + 'from a_index | stats avg(doubleField) by textField, percentile(doubleField) by ipField', [ "SyntaxError: mismatched input 'by' expecting ", 'STATS BY does not support function percentile', @@ -220,34 +220,37 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { test('no errors', async () => { const { expectErrors } = await setup(); - await expectErrors('from index | stats by bucket(dateField, pi(), "", "")', []); await expectErrors( 'from index | stats by bucket(dateField, 1 + 30 / 10, "", "")', [] ); await expectErrors( 'from index | stats by bucket(dateField, 1 + 30 / 10, concat("", ""), "")', - [] + ['Argument of [bucket] must be [date], found value [concat("","")] type [keyword]'] ); }); test('errors', async () => { const { expectErrors } = await setup(); + await expectErrors('from index | stats by bucket(dateField, pi(), "", "")', [ + 'Argument of [bucket] must be [integer], found value [pi()] type [double]', + ]); + await expectErrors( - 'from index | stats by bucket(dateField, abs(numberField), "", "")', - ['Argument of [bucket] must be a constant, received [abs(numberField)]'] + 'from index | stats by bucket(dateField, abs(doubleField), "", "")', + ['Argument of [bucket] must be a constant, received [abs(doubleField)]'] ); await expectErrors( - 'from index | stats by bucket(dateField, abs(length(numberField)), "", "")', - ['Argument of [bucket] must be a constant, received [abs(length(numberField))]'] + 'from index | stats by bucket(dateField, abs(length(doubleField)), "", "")', + ['Argument of [bucket] must be a constant, received [abs(length(doubleField))]'] ); await expectErrors( - 'from index | stats by bucket(dateField, numberField, stringField, stringField)', + 'from index | stats by bucket(dateField, doubleField, textField, textField)', [ - 'Argument of [bucket] must be a constant, received [numberField]', - 'Argument of [bucket] must be a constant, received [stringField]', - 'Argument of [bucket] must be a constant, received [stringField]', + 'Argument of [bucket] must be a constant, received [doubleField]', + 'Argument of [bucket] must be a constant, received [textField]', + 'Argument of [bucket] must be a constant, received [textField]', ] ); }); @@ -269,11 +272,11 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { const { expectErrors } = await setup(); await expectErrors( - `from a_index | stats 5 + avg(numberField) ${builtinWrapping}`, + `from a_index | stats 5 + avg(doubleField) ${builtinWrapping}`, [] ); await expectErrors( - `from a_index | stats 5 ${builtinWrapping} + avg(numberField)`, + `from a_index | stats 5 ${builtinWrapping} + avg(doubleField)`, [] ); }); @@ -281,16 +284,16 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { test('errors', async () => { const { expectErrors } = await setup(); - await expectErrors(`from a_index | stats 5 ${builtinWrapping} + numberField`, [ - `At least one aggregation function required in [STATS], found [5${builtinWrapping}+numberField]`, + await expectErrors(`from a_index | stats 5 ${builtinWrapping} + doubleField`, [ + `At least one aggregation function required in [STATS], found [5${builtinWrapping}+doubleField]`, ]); - await expectErrors(`from a_index | stats 5 + numberField ${builtinWrapping}`, [ - `At least one aggregation function required in [STATS], found [5+numberField${builtinWrapping}]`, + await expectErrors(`from a_index | stats 5 + doubleField ${builtinWrapping}`, [ + `At least one aggregation function required in [STATS], found [5+doubleField${builtinWrapping}]`, ]); await expectErrors( - `from a_index | stats 5 + numberField ${builtinWrapping}, var0 = sum(numberField)`, + `from a_index | stats 5 + doubleField ${builtinWrapping}, var0 = sum(doubleField)`, [ - `At least one aggregation function required in [STATS], found [5+numberField${builtinWrapping}]`, + `At least one aggregation function required in [STATS], found [5+doubleField${builtinWrapping}]`, ] ); }); @@ -304,31 +307,31 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { const { expectErrors } = await setup(); await expectErrors( - `from a_index | stats ${evalWrapping} sum(numberField) ${closingWrapping}`, + `from a_index | stats ${evalWrapping} sum(doubleField) ${closingWrapping}`, [] ); await expectErrors( - `from a_index | stats ${evalWrapping} sum(numberField) ${closingWrapping} + ${evalWrapping} sum(numberField) ${closingWrapping}`, + `from a_index | stats ${evalWrapping} sum(doubleField) ${closingWrapping} + ${evalWrapping} sum(doubleField) ${closingWrapping}`, [] ); await expectErrors( - `from a_index | stats ${evalWrapping} sum(numberField + numberField) ${closingWrapping}`, + `from a_index | stats ${evalWrapping} sum(doubleField + doubleField) ${closingWrapping}`, [] ); await expectErrors( - `from a_index | stats ${evalWrapping} sum(numberField + round(numberField)) ${closingWrapping}`, + `from a_index | stats ${evalWrapping} sum(doubleField + round(doubleField)) ${closingWrapping}`, [] ); await expectErrors( - `from a_index | stats ${evalWrapping} sum(numberField + round(numberField)) ${closingWrapping} + ${evalWrapping} sum(numberField + round(numberField)) ${closingWrapping}`, + `from a_index | stats ${evalWrapping} sum(doubleField + round(doubleField)) ${closingWrapping} + ${evalWrapping} sum(doubleField + round(doubleField)) ${closingWrapping}`, [] ); await expectErrors( - `from a_index | stats sum(${evalWrapping} numberField ${closingWrapping} )`, + `from a_index | stats sum(${evalWrapping} doubleField ${closingWrapping} )`, [] ); await expectErrors( - `from a_index | stats sum(${evalWrapping} numberField ${closingWrapping} ) + sum(${evalWrapping} numberField ${closingWrapping} )`, + `from a_index | stats sum(${evalWrapping} doubleField ${closingWrapping} ) + sum(${evalWrapping} doubleField ${closingWrapping} )`, [] ); }); @@ -337,21 +340,21 @@ export const validationStatsCommandTestSuite = (setup: helpers.Setup) => { const { expectErrors } = await setup(); await expectErrors( - `from a_index | stats ${evalWrapping} numberField + sum(numberField) ${closingWrapping}`, + `from a_index | stats ${evalWrapping} doubleField + sum(doubleField) ${closingWrapping}`, [ - `Cannot combine aggregation and non-aggregation values in [STATS], found [${evalWrapping}numberField+sum(numberField)${closingWrapping}]`, + `Cannot combine aggregation and non-aggregation values in [STATS], found [${evalWrapping}doubleField+sum(doubleField)${closingWrapping}]`, ] ); await expectErrors( - `from a_index | stats ${evalWrapping} numberField + sum(numberField) ${closingWrapping}, var0 = sum(numberField)`, + `from a_index | stats ${evalWrapping} doubleField + sum(doubleField) ${closingWrapping}, var0 = sum(doubleField)`, [ - `Cannot combine aggregation and non-aggregation values in [STATS], found [${evalWrapping}numberField+sum(numberField)${closingWrapping}]`, + `Cannot combine aggregation and non-aggregation values in [STATS], found [${evalWrapping}doubleField+sum(doubleField)${closingWrapping}]`, ] ); await expectErrors( - `from a_index | stats var0 = ${evalWrapping} numberField + sum(numberField) ${closingWrapping}, var1 = sum(numberField)`, + `from a_index | stats var0 = ${evalWrapping} doubleField + sum(doubleField) ${closingWrapping}, var1 = sum(doubleField)`, [ - `Cannot combine aggregation and non-aggregation values in [STATS], found [${evalWrapping}numberField+sum(numberField)${closingWrapping}]`, + `Cannot combine aggregation and non-aggregation values in [STATS], found [${evalWrapping}doubleField+sum(doubleField)${closingWrapping}]`, ] ); }); diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/validation.eval.date_diff.test.ts b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/validation.eval.date_diff.test.ts new file mode 100644 index 0000000000000..fd21ceb9b681c --- /dev/null +++ b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/validation.eval.date_diff.test.ts @@ -0,0 +1,56 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { setup } from './helpers'; + +describe('validation', () => { + describe('command', () => { + test('date_diff', async () => { + const { expectErrors } = await setup(); + await expectErrors( + 'row var = date_diff("month", "2023-12-02T11:00:00.000Z", "2023-12-02T11:00:00.000Z")', + [] + ); + await expectErrors( + 'row var = date_diff("mm", "2023-12-02T11:00:00.000Z", "2023-12-02T11:00:00.000Z")', + [] + ); + await expectErrors( + 'row var = date_diff("bogus", "2023-12-02T11:00:00.000Z", "2023-12-02T11:00:00.000Z")', + [] + ); + await expectErrors( + 'from a_index | eval date_diff(textField, "2023-12-02T11:00:00.000Z", "2023-12-02T11:00:00.000Z")', + [] + ); + await expectErrors( + 'from a_index | eval date_diff("month", dateField, "2023-12-02T11:00:00.000Z")', + [] + ); + await expectErrors( + 'from a_index | eval date_diff("month", "2023-12-02T11:00:00.000Z", dateField)', + [] + ); + await expectErrors('from a_index | eval date_diff("month", textField, dateField)', [ + 'Argument of [date_diff] must be [date], found value [textField] type [text]', + ]); + await expectErrors('from a_index | eval date_diff("month", dateField, textField)', [ + 'Argument of [date_diff] must be [date], found value [textField] type [text]', + ]); + await expectErrors( + 'from a_index | eval var = date_diff("year", to_datetime(textField), to_datetime(textField))', + [] + ); + await expectErrors('from a_index | eval date_diff(doubleField, textField, textField)', [ + 'Argument of [date_diff] must be [date], found value [textField] type [text]', + 'Argument of [date_diff] must be [date], found value [textField] type [text]', + 'Argument of [date_diff] must be [keyword], found value [doubleField] type [double]', + ]); + }); + }); +}); diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/validation.params.test.ts b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/validation.params.test.ts index db132d4d3e488..d732838ed919e 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/validation.params.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/__tests__/validation.params.test.ts @@ -23,18 +23,18 @@ test('should allow param inside agg function argument', async () => { test('allow params in WHERE command expressions', async () => { const { validate } = await setup(); - const res1 = await validate('FROM index | WHERE stringField >= ?start'); + const res1 = await validate('FROM index | WHERE textField >= ?start'); const res2 = await validate(` FROM index - | WHERE stringField >= ?start - | WHERE stringField <= ?0 - | WHERE stringField == ? + | WHERE textField >= ?start + | WHERE textField <= ?0 + | WHERE textField == ? `); const res3 = await validate(` FROM index - | WHERE stringField >= ?start - AND stringField <= ?0 - AND stringField == ? + | WHERE textField >= ?start + AND textField <= ?0 + AND textField == ? `); expect(res1).toMatchObject({ errors: [], warnings: [] }); diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json b/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json index b8b91d665663f..0b601ab2f66a1 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json +++ b/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json @@ -9,16 +9,48 @@ ], "fields": [ { - "name": "numberField", - "type": "number" + "name": "doubleField", + "type": "double" + }, + { + "name": "unsignedLongField", + "type": "unsigned_long" + }, + { + "name": "longField", + "type": "long" + }, + { + "name": "integerField", + "type": "integer" + }, + { + "name": "counterIntegerField", + "type": "counter_integer" + }, + { + "name": "counterLongField", + "type": "counter_long" + }, + { + "name": "counterDoubleField", + "type": "counter_double" }, { "name": "dateField", "type": "date" }, { - "name": "stringField", - "type": "string" + "name": "datePeriodField", + "type": "date_period" + }, + { + "name": "textField", + "type": "text" + }, + { + "name": "keywordField", + "type": "keyword" }, { "name": "booleanField", @@ -50,11 +82,11 @@ }, { "name": "any#Char$Field", - "type": "number" + "type": "double" }, { "name": "kubernetes.something.something", - "type": "number" + "type": "double" }, { "name": "@timestamp", @@ -68,11 +100,11 @@ "enrichFields": [ { "name": "otherField", - "type": "string" + "type": "text" }, { "name": "yetAnotherField", - "type": "number" + "type": "double" }, { "name": "otherStringField", @@ -417,9 +449,9 @@ "warning": [] }, { - "query": "row var = (numberField > 0)", + "query": "row var = (doubleField > 0)", "error": [ - "Unknown column [numberField]" + "Unknown column [doubleField]" ], "warning": [] }, @@ -441,8 +473,8 @@ { "query": "row var = false > false", "error": [ - "Argument of [>] must be [number], found value [false] type [boolean]", - "Argument of [>] must be [number], found value [false] type [boolean]" + "Argument of [>] must be [date], found value [false] type [boolean]", + "Argument of [>] must be [date], found value [false] type [boolean]" ], "warning": [] }, @@ -467,9 +499,9 @@ "warning": [] }, { - "query": "row var = (numberField >= 0)", + "query": "row var = (doubleField >= 0)", "error": [ - "Unknown column [numberField]" + "Unknown column [doubleField]" ], "warning": [] }, @@ -491,8 +523,8 @@ { "query": "row var = false >= false", "error": [ - "Argument of [>=] must be [number], found value [false] type [boolean]", - "Argument of [>=] must be [number], found value [false] type [boolean]" + "Argument of [>=] must be [date], found value [false] type [boolean]", + "Argument of [>=] must be [date], found value [false] type [boolean]" ], "warning": [] }, @@ -517,9 +549,9 @@ "warning": [] }, { - "query": "row var = (numberField < 0)", + "query": "row var = (doubleField < 0)", "error": [ - "Unknown column [numberField]" + "Unknown column [doubleField]" ], "warning": [] }, @@ -541,8 +573,8 @@ { "query": "row var = false < false", "error": [ - "Argument of [<] must be [number], found value [false] type [boolean]", - "Argument of [<] must be [number], found value [false] type [boolean]" + "Argument of [<] must be [date], found value [false] type [boolean]", + "Argument of [<] must be [date], found value [false] type [boolean]" ], "warning": [] }, @@ -567,9 +599,9 @@ "warning": [] }, { - "query": "row var = (numberField <= 0)", + "query": "row var = (doubleField <= 0)", "error": [ - "Unknown column [numberField]" + "Unknown column [doubleField]" ], "warning": [] }, @@ -591,8 +623,8 @@ { "query": "row var = false <= false", "error": [ - "Argument of [<=] must be [number], found value [false] type [boolean]", - "Argument of [<=] must be [number], found value [false] type [boolean]" + "Argument of [<=] must be [date], found value [false] type [boolean]", + "Argument of [<=] must be [date], found value [false] type [boolean]" ], "warning": [] }, @@ -617,9 +649,9 @@ "warning": [] }, { - "query": "row var = (numberField == 0)", + "query": "row var = (doubleField == 0)", "error": [ - "Unknown column [numberField]" + "Unknown column [doubleField]" ], "warning": [] }, @@ -664,9 +696,9 @@ "warning": [] }, { - "query": "row var = (numberField != 0)", + "query": "row var = (doubleField != 0)", "error": [ - "Unknown column [numberField]" + "Unknown column [doubleField]" ], "warning": [] }, @@ -713,7 +745,7 @@ { "query": "row var = now() + now()", "error": [ - "Argument of [+] must be [time_literal], found value [now()] type [date]" + "Argument of [+] must be [date_period], found value [now()] type [date]" ], "warning": [] }, @@ -730,7 +762,7 @@ { "query": "row var = now() - now()", "error": [ - "Argument of [-] must be [time_literal], found value [now()] type [date]" + "Argument of [-] must be [date_period], found value [now()] type [date]" ], "warning": [] }, @@ -747,8 +779,8 @@ { "query": "row var = now() * now()", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [now()] type [date]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [now()] type [date]" ], "warning": [] }, @@ -765,8 +797,8 @@ { "query": "row var = now() / now()", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [now()] type [date]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [now()] type [date]" ], "warning": [] }, @@ -783,8 +815,8 @@ { "query": "row var = now() % now()", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [now()] type [date]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [now()] type [date]" ], "warning": [] }, @@ -811,28 +843,28 @@ { "query": "row var = 5 like \"?a\"", "error": [ - "Argument of [like] must be [string], found value [5] type [number]" + "Argument of [like] must be [text], found value [5] type [integer]" ], "warning": [] }, { "query": "row var = 5 NOT like \"?a\"", "error": [ - "Argument of [not_like] must be [string], found value [5] type [number]" + "Argument of [not_like] must be [text], found value [5] type [integer]" ], "warning": [] }, { "query": "row var = NOT 5 like \"?a\"", "error": [ - "Argument of [like] must be [string], found value [5] type [number]" + "Argument of [like] must be [text], found value [5] type [integer]" ], "warning": [] }, { "query": "row var = NOT 5 NOT like \"?a\"", "error": [ - "Argument of [not_like] must be [string], found value [5] type [number]" + "Argument of [not_like] must be [text], found value [5] type [integer]" ], "warning": [] }, @@ -859,28 +891,28 @@ { "query": "row var = 5 rlike \"?a\"", "error": [ - "Argument of [rlike] must be [string], found value [5] type [number]" + "Argument of [rlike] must be [text], found value [5] type [integer]" ], "warning": [] }, { "query": "row var = 5 NOT rlike \"?a\"", "error": [ - "Argument of [not_rlike] must be [string], found value [5] type [number]" + "Argument of [not_rlike] must be [text], found value [5] type [integer]" ], "warning": [] }, { "query": "row var = NOT 5 rlike \"?a\"", "error": [ - "Argument of [rlike] must be [string], found value [5] type [number]" + "Argument of [rlike] must be [text], found value [5] type [integer]" ], "warning": [] }, { "query": "row var = NOT 5 NOT rlike \"?a\"", "error": [ - "Argument of [not_rlike] must be [string], found value [5] type [number]" + "Argument of [not_rlike] must be [text], found value [5] type [integer]" ], "warning": [] }, @@ -966,24 +998,24 @@ { "query": "row var = now() * 1 year", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 year] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 year] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 year", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 year] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 year] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 year", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 year] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 year] type [duration]" ], "warning": [] }, @@ -1031,24 +1063,24 @@ { "query": "row var = now() * 1 years", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 years] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 years] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 years", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 years] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 years] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 years", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 years] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 years] type [duration]" ], "warning": [] }, @@ -1096,24 +1128,24 @@ { "query": "row var = now() * 1 quarter", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 quarter] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 quarter] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 quarter", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 quarter] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 quarter] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 quarter", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 quarter] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 quarter] type [duration]" ], "warning": [] }, @@ -1161,24 +1193,24 @@ { "query": "row var = now() * 1 quarters", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 quarters] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 quarters] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 quarters", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 quarters] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 quarters] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 quarters", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 quarters] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 quarters] type [duration]" ], "warning": [] }, @@ -1226,24 +1258,24 @@ { "query": "row var = now() * 1 month", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 month] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 month] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 month", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 month] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 month] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 month", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 month] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 month] type [duration]" ], "warning": [] }, @@ -1291,24 +1323,24 @@ { "query": "row var = now() * 1 months", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 months] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 months] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 months", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 months] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 months] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 months", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 months] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 months] type [duration]" ], "warning": [] }, @@ -1356,24 +1388,24 @@ { "query": "row var = now() * 1 week", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 week] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 week] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 week", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 week] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 week] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 week", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 week] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 week] type [duration]" ], "warning": [] }, @@ -1421,24 +1453,24 @@ { "query": "row var = now() * 1 weeks", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 weeks] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 weeks] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 weeks", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 weeks] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 weeks] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 weeks", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 weeks] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 weeks] type [duration]" ], "warning": [] }, @@ -1486,24 +1518,24 @@ { "query": "row var = now() * 1 day", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 day] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 day] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 day", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 day] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 day] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 day", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 day] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 day] type [duration]" ], "warning": [] }, @@ -1551,24 +1583,24 @@ { "query": "row var = now() * 1 days", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 days] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 days] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 days", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 days] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 days] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 days", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 days] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 days] type [duration]" ], "warning": [] }, @@ -1616,24 +1648,24 @@ { "query": "row var = now() * 1 hour", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 hour] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 hour] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 hour", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 hour] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 hour] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 hour", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 hour] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 hour] type [duration]" ], "warning": [] }, @@ -1681,24 +1713,24 @@ { "query": "row var = now() * 1 hours", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 hours] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 hours] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 hours", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 hours] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 hours] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 hours", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 hours] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 hours] type [duration]" ], "warning": [] }, @@ -1746,24 +1778,24 @@ { "query": "row var = now() * 1 minute", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 minute] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 minute] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 minute", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 minute] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 minute] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 minute", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 minute] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 minute] type [duration]" ], "warning": [] }, @@ -1811,24 +1843,24 @@ { "query": "row var = now() * 1 minutes", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 minutes] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 minutes] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 minutes", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 minutes] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 minutes] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 minutes", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 minutes] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 minutes] type [duration]" ], "warning": [] }, @@ -1876,24 +1908,24 @@ { "query": "row var = now() * 1 second", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 second] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 second] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 second", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 second] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 second] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 second", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 second] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 second] type [duration]" ], "warning": [] }, @@ -1941,24 +1973,24 @@ { "query": "row var = now() * 1 seconds", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 seconds] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 seconds] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 seconds", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 seconds] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 seconds] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 seconds", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 seconds] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 seconds] type [duration]" ], "warning": [] }, @@ -2006,24 +2038,24 @@ { "query": "row var = now() * 1 millisecond", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 millisecond] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 millisecond] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 millisecond", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 millisecond] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 millisecond] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 millisecond", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 millisecond] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 millisecond] type [duration]" ], "warning": [] }, @@ -2071,24 +2103,24 @@ { "query": "row var = now() * 1 milliseconds", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 milliseconds] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 milliseconds] type [duration]" ], "warning": [] }, { "query": "row var = now() / 1 milliseconds", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 milliseconds] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 milliseconds] type [duration]" ], "warning": [] }, { "query": "row var = now() % 1 milliseconds", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 milliseconds] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 milliseconds] type [duration]" ], "warning": [] }, @@ -2105,14 +2137,14 @@ "warning": [] }, { - "query": "show numberField", + "query": "show doubleField", "error": [ - "SyntaxError: token recognition error at: 'n'", + "SyntaxError: token recognition error at: 'd'", + "SyntaxError: token recognition error at: 'o'", "SyntaxError: token recognition error at: 'u'", - "SyntaxError: token recognition error at: 'm'", "SyntaxError: token recognition error at: 'b'", + "SyntaxError: token recognition error at: 'l'", "SyntaxError: token recognition error at: 'e'", - "SyntaxError: token recognition error at: 'r'", "SyntaxError: token recognition error at: 'F'", "SyntaxError: token recognition error at: 'ie'", "SyntaxError: token recognition error at: 'l'", @@ -2148,16 +2180,16 @@ "warning": [] }, { - "query": "from index | limit numberField", + "query": "from index | limit doubleField", "error": [ - "SyntaxError: mismatched input 'numberField' expecting INTEGER_LITERAL" + "SyntaxError: mismatched input 'doubleField' expecting INTEGER_LITERAL" ], "warning": [] }, { - "query": "from index | limit stringField", + "query": "from index | limit textField", "error": [ - "SyntaxError: mismatched input 'stringField' expecting INTEGER_LITERAL" + "SyntaxError: mismatched input 'textField' expecting INTEGER_LITERAL" ], "warning": [] }, @@ -2179,12 +2211,12 @@ "warning": [] }, { - "query": "from index | keep stringField, numberField, dateField", + "query": "from index | keep keywordField, doubleField, integerField, dateField", "error": [], "warning": [] }, { - "query": "from index | keep `stringField`, `numberField`, `dateField`", + "query": "from index | keep `keywordField`, `doubleField`, `integerField`, `dateField`", "error": [], "warning": [] }, @@ -2206,7 +2238,7 @@ "warning": [] }, { - "query": "from index | keep missingField, numberField, dateField", + "query": "from index | keep missingField, doubleField, dateField", "error": [ "Unknown column [missingField]" ], @@ -2225,28 +2257,28 @@ "warning": [] }, { - "query": "from index | project stringField, numberField, dateField", + "query": "from index | project textField, doubleField, dateField", "error": [ "SyntaxError: mismatched input 'project' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'inlinestats', 'keep', 'limit', 'lookup', 'mv_expand', 'rename', 'sort', 'stats', 'where'}" ], "warning": [] }, { - "query": "from index | PROJECT stringField, numberField, dateField", + "query": "from index | PROJECT textField, doubleField, dateField", "error": [ "SyntaxError: mismatched input 'PROJECT' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'inlinestats', 'keep', 'limit', 'lookup', 'mv_expand', 'rename', 'sort', 'stats', 'where'}" ], "warning": [] }, { - "query": "from index | project missingField, numberField, dateField", + "query": "from index | project missingField, doubleField, dateField", "error": [ "SyntaxError: mismatched input 'project' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'inlinestats', 'keep', 'limit', 'lookup', 'mv_expand', 'rename', 'sort', 'stats', 'where'}" ], "warning": [] }, { - "query": "from index | keep s*", + "query": "from index | keep k*", "error": [], "warning": [] }, @@ -2256,17 +2288,17 @@ "warning": [] }, { - "query": "from index | keep s*Field", + "query": "from index | keep k*Field", "error": [], "warning": [] }, { - "query": "from index | keep string*Field", + "query": "from index | keep key*Field", "error": [], "warning": [] }, { - "query": "from index | keep s*, n*", + "query": "from index | keep k*, i*", "error": [], "warning": [] }, @@ -2299,12 +2331,12 @@ ] }, { - "query": "FROM index | STATS ROUND(AVG(numberField * 1.5)), COUNT(*), MIN(numberField * 10) | KEEP `MIN(numberField * 10)`", + "query": "FROM index | STATS ROUND(AVG(doubleField * 1.5)), COUNT(*), MIN(doubleField * 10) | KEEP `MIN(doubleField * 10)`", "error": [], "warning": [] }, { - "query": "FROM index | STATS COUNT(*), MIN(numberField * 10), MAX(numberField)| KEEP `COUNT(*)`", + "query": "FROM index | STATS COUNT(*), MIN(doubleField * 10), MAX(doubleField)| KEEP `COUNT(*)`", "error": [], "warning": [] }, @@ -2316,7 +2348,7 @@ "warning": [] }, { - "query": "from index | drop stringField, numberField, dateField", + "query": "from index | drop textField, doubleField, dateField", "error": [], "warning": [] }, @@ -2331,7 +2363,7 @@ "warning": [] }, { - "query": "from index | drop missingField, numberField, dateField", + "query": "from index | drop missingField, doubleField, dateField", "error": [ "Unknown column [missingField]" ], @@ -2343,12 +2375,12 @@ "warning": [] }, { - "query": "from index | drop s*", + "query": "from index | drop t*", "error": [], "warning": [] }, { - "query": "from index | drop s**Field", + "query": "from index | drop t**Field", "error": [], "warning": [] }, @@ -2358,7 +2390,7 @@ "warning": [] }, { - "query": "from index | drop s*F*d", + "query": "from index | drop t*F*d", "error": [], "warning": [] }, @@ -2368,18 +2400,20 @@ "warning": [] }, { - "query": "from index | drop s*Field", + "query": "from index | drop t*Field", "error": [], "warning": [] }, { - "query": "from index | drop string*Field", + "query": "from index | drop textField", "error": [], "warning": [] }, { - "query": "from index | drop s*, n*", - "error": [], + "query": "from index | drop s*, d*", + "error": [ + "Unknown column [s*]" + ], "warning": [] }, { @@ -2411,7 +2445,7 @@ "warning": [] }, { - "query": "from index | drop stringField, *", + "query": "from index | drop textField, *", "error": [ "Removing all fields is not allowed [*]" ], @@ -2425,19 +2459,19 @@ ] }, { - "query": "from index | drop stringField, @timestamp", + "query": "from index | drop textField, @timestamp", "error": [], "warning": [ "Drop [@timestamp] will remove all time filters to the search results" ] }, { - "query": "FROM index | STATS ROUND(AVG(numberField * 1.5)), COUNT(*), MIN(numberField * 10) | DROP `MIN(numberField * 10)`", + "query": "FROM index | STATS ROUND(AVG(doubleField * 1.5)), COUNT(*), MIN(doubleField * 10) | DROP `MIN(doubleField * 10)`", "error": [], "warning": [] }, { - "query": "FROM index | STATS COUNT(*), MIN(numberField * 10), MAX(numberField)| DROP `COUNT(*)`", + "query": "FROM index | STATS COUNT(*), MIN(doubleField * 10), MAX(doubleField)| DROP `COUNT(*)`", "error": [], "warning": [] }, @@ -2449,12 +2483,12 @@ "warning": [] }, { - "query": "from a_index | mv_expand stringField", + "query": "from a_index | mv_expand textField", "error": [], "warning": [] }, { - "query": "from a_index | mv_expand numberField", + "query": "from a_index | mv_expand integerField", "error": [], "warning": [] }, @@ -2474,7 +2508,7 @@ "warning": [] }, { - "query": "from a_index | mv_expand numberField, b", + "query": "from a_index | mv_expand doubleField, b", "error": [ "SyntaxError: token recognition error at: ','", "SyntaxError: extraneous input 'b' expecting " @@ -2509,7 +2543,7 @@ "warning": [] }, { - "query": "from a_index | rename stringField", + "query": "from a_index | rename textField", "error": [ "SyntaxError: mismatched input '' expecting 'as'" ], @@ -2524,7 +2558,7 @@ "warning": [] }, { - "query": "from a_index | rename stringField as", + "query": "from a_index | rename textField as", "error": [ "SyntaxError: missing ID_PATTERN at ''" ], @@ -2539,22 +2573,22 @@ "warning": [] }, { - "query": "from a_index | rename stringField as b", + "query": "from a_index | rename textField as b", "error": [], "warning": [] }, { - "query": "from a_index | rename stringField AS b", + "query": "from a_index | rename textField AS b", "error": [], "warning": [] }, { - "query": "from a_index | rename stringField As b", + "query": "from a_index | rename textField As b", "error": [], "warning": [] }, { - "query": "from a_index | rename stringField As b, b AS c", + "query": "from a_index | rename textField As b, b AS c", "error": [], "warning": [] }, @@ -2569,26 +2603,34 @@ "warning": [] }, { - "query": "from a_index | eval numberField + 1 | rename `numberField + 1` as a", + "query": "from a_index | eval doubleField + 1 | rename `doubleField + 1` as a", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField) | rename `avg(numberField)` as avg0", + "query": "from a_index | stats avg(doubleField) | rename `avg(doubleField)` as avg0", "error": [], "warning": [] }, { - "query": "from a_index |eval numberField + 1 | rename `numberField + 1` as ", + "query": "from a_index |eval doubleField + 1 | rename `doubleField + 1` as ", "error": [ "SyntaxError: missing ID_PATTERN at ''" ], "warning": [] }, + { + "query": "from a_index | rename key* as keywords", + "error": [ + "Using wildcards (*) in RENAME is not allowed [key*]", + "Unknown column [keywords]" + ], + "warning": [] + }, { "query": "from a_index | rename s* as strings", "error": [ - "Using wildcards (*) in RENAME is not allowed [s*]", + "Unknown column [s*]", "Unknown column [strings]" ], "warning": [] @@ -2613,29 +2655,29 @@ "warning": [] }, { - "query": "from a_index | dissect stringField", + "query": "from a_index | dissect textField", "error": [ "SyntaxError: missing QUOTED_STRING at ''" ], "warning": [] }, { - "query": "from a_index | dissect stringField 2", + "query": "from a_index | dissect textField 2", "error": [ "SyntaxError: mismatched input '2' expecting QUOTED_STRING" ], "warning": [] }, { - "query": "from a_index | dissect stringField .", + "query": "from a_index | dissect textField .", "error": [ "SyntaxError: mismatched input '' expecting {UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", - "Unknown column [stringField.]" + "Unknown column [textField.]" ], "warning": [] }, { - "query": "from a_index | dissect stringField %a", + "query": "from a_index | dissect textField %a", "error": [ "SyntaxError: mismatched input '%' expecting QUOTED_STRING", "SyntaxError: mismatched input '' expecting '='" @@ -2643,26 +2685,26 @@ "warning": [] }, { - "query": "from a_index | dissect stringField \"%{firstWord}\"", + "query": "from a_index | dissect textField \"%{firstWord}\"", "error": [], "warning": [] }, { - "query": "from a_index | dissect numberField \"%{firstWord}\"", + "query": "from a_index | dissect doubleField \"%{firstWord}\"", "error": [ - "DISSECT only supports string type values, found [numberField] of type [number]" + "DISSECT only supports string type values, found [doubleField] of type [double]" ], "warning": [] }, { - "query": "from a_index | dissect stringField \"%{firstWord}\" option ", + "query": "from a_index | dissect textField \"%{firstWord}\" option ", "error": [ "SyntaxError: mismatched input '' expecting '='" ], "warning": [] }, { - "query": "from a_index | dissect stringField \"%{firstWord}\" option = ", + "query": "from a_index | dissect textField \"%{firstWord}\" option = ", "error": [ "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET}", "Invalid option for DISSECT: [option]" @@ -2670,33 +2712,33 @@ "warning": [] }, { - "query": "from a_index | dissect stringField \"%{firstWord}\" option = 1", + "query": "from a_index | dissect textField \"%{firstWord}\" option = 1", "error": [ "Invalid option for DISSECT: [option]" ], "warning": [] }, { - "query": "from a_index | dissect stringField \"%{firstWord}\" append_separator = \"-\"", + "query": "from a_index | dissect textField \"%{firstWord}\" append_separator = \"-\"", "error": [], "warning": [] }, { - "query": "from a_index | dissect stringField \"%{firstWord}\" ignore_missing = true", + "query": "from a_index | dissect textField \"%{firstWord}\" ignore_missing = true", "error": [ "Invalid option for DISSECT: [ignore_missing]" ], "warning": [] }, { - "query": "from a_index | dissect stringField \"%{firstWord}\" append_separator = true", + "query": "from a_index | dissect textField \"%{firstWord}\" append_separator = true", "error": [ "Invalid value for DISSECT append_separator: expected a string, but was [true]" ], "warning": [] }, { - "query": "from a_index | dissect stringField \"%{firstWord}\" | keep firstWord", + "query": "from a_index | dissect textField \"%{firstWord}\" | keep firstWord", "error": [], "warning": [] }, @@ -2708,48 +2750,48 @@ "warning": [] }, { - "query": "from a_index | grok stringField", + "query": "from a_index | grok textField", "error": [ "SyntaxError: missing QUOTED_STRING at ''" ], "warning": [] }, { - "query": "from a_index | grok stringField 2", + "query": "from a_index | grok textField 2", "error": [ "SyntaxError: mismatched input '2' expecting QUOTED_STRING" ], "warning": [] }, { - "query": "from a_index | grok stringField .", + "query": "from a_index | grok textField .", "error": [ "SyntaxError: mismatched input '' expecting {UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", - "Unknown column [stringField.]" + "Unknown column [textField.]" ], "warning": [] }, { - "query": "from a_index | grok stringField %a", + "query": "from a_index | grok textField %a", "error": [ "SyntaxError: mismatched input '%' expecting QUOTED_STRING" ], "warning": [] }, { - "query": "from a_index | grok stringField \"%{firstWord}\"", + "query": "from a_index | grok textField \"%{firstWord}\"", "error": [], "warning": [] }, { - "query": "from a_index | grok numberField \"%{firstWord}\"", + "query": "from a_index | grok doubleField \"%{firstWord}\"", "error": [ - "GROK only supports string type values, found [numberField] of type [number]" + "GROK only supports string type values, found [doubleField] of type [double]" ], "warning": [] }, { - "query": "from a_index | grok stringField \"%{firstWord}\" | keep firstWord", + "query": "from a_index | grok textField \"%{firstWord}\" | keep firstWord", "error": [], "warning": [] }, @@ -2851,22 +2893,22 @@ "warning": [] }, { - "query": "from a_index | where numberField > 0", + "query": "from a_index | where doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where NOT numberField > 0", + "query": "from a_index | where NOT doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where (numberField > 0)", + "query": "from a_index | where (doubleField > 0)", "error": [], "warning": [] }, { - "query": "from a_index | where (NOT (numberField > 0))", + "query": "from a_index | where (NOT (doubleField > 0))", "error": [], "warning": [] }, @@ -2876,12 +2918,12 @@ "warning": [] }, { - "query": "from a_index | where stringField > stringField", + "query": "from a_index | where textField > textField", "error": [], "warning": [] }, { - "query": "from a_index | where numberField > numberField", + "query": "from a_index | where doubleField > doubleField", "error": [], "warning": [] }, @@ -2893,8 +2935,8 @@ { "query": "from a_index | where booleanField > booleanField", "error": [ - "Argument of [>] must be [number], found value [booleanField] type [boolean]", - "Argument of [>] must be [number], found value [booleanField] type [boolean]" + "Argument of [>] must be [date], found value [booleanField] type [boolean]", + "Argument of [>] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, @@ -2904,22 +2946,22 @@ "warning": [] }, { - "query": "from a_index | where numberField >= 0", + "query": "from a_index | where doubleField >= 0", "error": [], "warning": [] }, { - "query": "from a_index | where NOT numberField >= 0", + "query": "from a_index | where NOT doubleField >= 0", "error": [], "warning": [] }, { - "query": "from a_index | where (numberField >= 0)", + "query": "from a_index | where (doubleField >= 0)", "error": [], "warning": [] }, { - "query": "from a_index | where (NOT (numberField >= 0))", + "query": "from a_index | where (NOT (doubleField >= 0))", "error": [], "warning": [] }, @@ -2929,12 +2971,12 @@ "warning": [] }, { - "query": "from a_index | where stringField >= stringField", + "query": "from a_index | where textField >= textField", "error": [], "warning": [] }, { - "query": "from a_index | where numberField >= numberField", + "query": "from a_index | where doubleField >= doubleField", "error": [], "warning": [] }, @@ -2946,8 +2988,8 @@ { "query": "from a_index | where booleanField >= booleanField", "error": [ - "Argument of [>=] must be [number], found value [booleanField] type [boolean]", - "Argument of [>=] must be [number], found value [booleanField] type [boolean]" + "Argument of [>=] must be [date], found value [booleanField] type [boolean]", + "Argument of [>=] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, @@ -2957,22 +2999,22 @@ "warning": [] }, { - "query": "from a_index | where numberField < 0", + "query": "from a_index | where doubleField < 0", "error": [], "warning": [] }, { - "query": "from a_index | where NOT numberField < 0", + "query": "from a_index | where NOT doubleField < 0", "error": [], "warning": [] }, { - "query": "from a_index | where (numberField < 0)", + "query": "from a_index | where (doubleField < 0)", "error": [], "warning": [] }, { - "query": "from a_index | where (NOT (numberField < 0))", + "query": "from a_index | where (NOT (doubleField < 0))", "error": [], "warning": [] }, @@ -2982,12 +3024,12 @@ "warning": [] }, { - "query": "from a_index | where stringField < stringField", + "query": "from a_index | where textField < textField", "error": [], "warning": [] }, { - "query": "from a_index | where numberField < numberField", + "query": "from a_index | where doubleField < doubleField", "error": [], "warning": [] }, @@ -2999,8 +3041,8 @@ { "query": "from a_index | where booleanField < booleanField", "error": [ - "Argument of [<] must be [number], found value [booleanField] type [boolean]", - "Argument of [<] must be [number], found value [booleanField] type [boolean]" + "Argument of [<] must be [date], found value [booleanField] type [boolean]", + "Argument of [<] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, @@ -3010,22 +3052,22 @@ "warning": [] }, { - "query": "from a_index | where numberField <= 0", + "query": "from a_index | where doubleField <= 0", "error": [], "warning": [] }, { - "query": "from a_index | where NOT numberField <= 0", + "query": "from a_index | where NOT doubleField <= 0", "error": [], "warning": [] }, { - "query": "from a_index | where (numberField <= 0)", + "query": "from a_index | where (doubleField <= 0)", "error": [], "warning": [] }, { - "query": "from a_index | where (NOT (numberField <= 0))", + "query": "from a_index | where (NOT (doubleField <= 0))", "error": [], "warning": [] }, @@ -3035,12 +3077,12 @@ "warning": [] }, { - "query": "from a_index | where stringField <= stringField", + "query": "from a_index | where textField <= textField", "error": [], "warning": [] }, { - "query": "from a_index | where numberField <= numberField", + "query": "from a_index | where doubleField <= doubleField", "error": [], "warning": [] }, @@ -3052,8 +3094,8 @@ { "query": "from a_index | where booleanField <= booleanField", "error": [ - "Argument of [<=] must be [number], found value [booleanField] type [boolean]", - "Argument of [<=] must be [number], found value [booleanField] type [boolean]" + "Argument of [<=] must be [date], found value [booleanField] type [boolean]", + "Argument of [<=] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, @@ -3063,22 +3105,22 @@ "warning": [] }, { - "query": "from a_index | where numberField == 0", + "query": "from a_index | where doubleField == 0", "error": [], "warning": [] }, { - "query": "from a_index | where NOT numberField == 0", + "query": "from a_index | where NOT doubleField == 0", "error": [], "warning": [] }, { - "query": "from a_index | where (numberField == 0)", + "query": "from a_index | where (doubleField == 0)", "error": [], "warning": [] }, { - "query": "from a_index | where (NOT (numberField == 0))", + "query": "from a_index | where (NOT (doubleField == 0))", "error": [], "warning": [] }, @@ -3088,12 +3130,12 @@ "warning": [] }, { - "query": "from a_index | where stringField == stringField", + "query": "from a_index | where textField == textField", "error": [], "warning": [] }, { - "query": "from a_index | where numberField == numberField", + "query": "from a_index | where doubleField == doubleField", "error": [], "warning": [] }, @@ -3113,22 +3155,22 @@ "warning": [] }, { - "query": "from a_index | where numberField != 0", + "query": "from a_index | where doubleField != 0", "error": [], "warning": [] }, { - "query": "from a_index | where NOT numberField != 0", + "query": "from a_index | where NOT doubleField != 0", "error": [], "warning": [] }, { - "query": "from a_index | where (numberField != 0)", + "query": "from a_index | where (doubleField != 0)", "error": [], "warning": [] }, { - "query": "from a_index | where (NOT (numberField != 0))", + "query": "from a_index | where (NOT (doubleField != 0))", "error": [], "warning": [] }, @@ -3138,12 +3180,12 @@ "warning": [] }, { - "query": "from a_index | where stringField != stringField", + "query": "from a_index | where textField != textField", "error": [], "warning": [] }, { - "query": "from a_index | where numberField != numberField", + "query": "from a_index | where doubleField != doubleField", "error": [], "warning": [] }, @@ -3163,82 +3205,82 @@ "warning": [] }, { - "query": "from a_index | where - numberField > 0", + "query": "from a_index | where - doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where - round(numberField) > 0", + "query": "from a_index | where - round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + - numberField > 0", + "query": "from a_index | where 1 + - doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 - numberField > 0", + "query": "from a_index | where 1 - doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where - numberField > 0", + "query": "from a_index | where - doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where - round(numberField) > 0", + "query": "from a_index | where - round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + - numberField > 0", + "query": "from a_index | where 1 + - doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 - numberField > 0", + "query": "from a_index | where 1 - doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where + numberField > 0", + "query": "from a_index | where + doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where + round(numberField) > 0", + "query": "from a_index | where + round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + + numberField > 0", + "query": "from a_index | where 1 + + doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + numberField > 0", + "query": "from a_index | where 1 + doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where + numberField > 0", + "query": "from a_index | where + doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where + round(numberField) > 0", + "query": "from a_index | where + round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + + numberField > 0", + "query": "from a_index | where 1 + + doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + numberField > 0", + "query": "from a_index | where 1 + doubleField > 0", "error": [], "warning": [] }, @@ -3248,82 +3290,82 @@ "warning": [] }, { - "query": "from a_index | where -- numberField > 0", + "query": "from a_index | where -- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where -- round(numberField) > 0", + "query": "from a_index | where -- round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + -- numberField > 0", + "query": "from a_index | where 1 + -- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 -- numberField > 0", + "query": "from a_index | where 1 -- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where -+ numberField > 0", + "query": "from a_index | where -+ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where -+ round(numberField) > 0", + "query": "from a_index | where -+ round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + -+ numberField > 0", + "query": "from a_index | where 1 + -+ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 -+ numberField > 0", + "query": "from a_index | where 1 -+ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where +- numberField > 0", + "query": "from a_index | where +- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where +- round(numberField) > 0", + "query": "from a_index | where +- round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + +- numberField > 0", + "query": "from a_index | where 1 + +- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 +- numberField > 0", + "query": "from a_index | where 1 +- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where ++ numberField > 0", + "query": "from a_index | where ++ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where ++ round(numberField) > 0", + "query": "from a_index | where ++ round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + ++ numberField > 0", + "query": "from a_index | where 1 + ++ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 ++ numberField > 0", + "query": "from a_index | where 1 ++ doubleField > 0", "error": [], "warning": [] }, @@ -3333,82 +3375,82 @@ "warning": [] }, { - "query": "from a_index | where --- numberField > 0", + "query": "from a_index | where --- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where --- round(numberField) > 0", + "query": "from a_index | where --- round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + --- numberField > 0", + "query": "from a_index | where 1 + --- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 --- numberField > 0", + "query": "from a_index | where 1 --- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where -+- numberField > 0", + "query": "from a_index | where -+- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where -+- round(numberField) > 0", + "query": "from a_index | where -+- round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + -+- numberField > 0", + "query": "from a_index | where 1 + -+- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 -+- numberField > 0", + "query": "from a_index | where 1 -+- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where +-+ numberField > 0", + "query": "from a_index | where +-+ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where +-+ round(numberField) > 0", + "query": "from a_index | where +-+ round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + +-+ numberField > 0", + "query": "from a_index | where 1 + +-+ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 +-+ numberField > 0", + "query": "from a_index | where 1 +-+ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where +++ numberField > 0", + "query": "from a_index | where +++ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where +++ round(numberField) > 0", + "query": "from a_index | where +++ round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + +++ numberField > 0", + "query": "from a_index | where 1 + +++ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 +++ numberField > 0", + "query": "from a_index | where 1 +++ doubleField > 0", "error": [], "warning": [] }, @@ -3418,82 +3460,82 @@ "warning": [] }, { - "query": "from a_index | where ---- numberField > 0", + "query": "from a_index | where ---- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where ---- round(numberField) > 0", + "query": "from a_index | where ---- round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + ---- numberField > 0", + "query": "from a_index | where 1 + ---- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 ---- numberField > 0", + "query": "from a_index | where 1 ---- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where -+-+ numberField > 0", + "query": "from a_index | where -+-+ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where -+-+ round(numberField) > 0", + "query": "from a_index | where -+-+ round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + -+-+ numberField > 0", + "query": "from a_index | where 1 + -+-+ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 -+-+ numberField > 0", + "query": "from a_index | where 1 -+-+ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where +-+- numberField > 0", + "query": "from a_index | where +-+- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where +-+- round(numberField) > 0", + "query": "from a_index | where +-+- round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + +-+- numberField > 0", + "query": "from a_index | where 1 + +-+- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 +-+- numberField > 0", + "query": "from a_index | where 1 +-+- doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where ++++ numberField > 0", + "query": "from a_index | where ++++ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where ++++ round(numberField) > 0", + "query": "from a_index | where ++++ round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 + ++++ numberField > 0", + "query": "from a_index | where 1 + ++++ doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | where 1 ++++ numberField > 0", + "query": "from a_index | where 1 ++++ doubleField > 0", "error": [], "warning": [] }, @@ -3503,166 +3545,166 @@ "warning": [] }, { - "query": "from a_index | where *+ numberField", + "query": "from a_index | where *+ doubleField", "error": [ "SyntaxError: extraneous input '*' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" ], "warning": [] }, { - "query": "from a_index | where /+ numberField", + "query": "from a_index | where /+ doubleField", "error": [ "SyntaxError: extraneous input '/' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" ], "warning": [] }, { - "query": "from a_index | where %+ numberField", + "query": "from a_index | where %+ doubleField", "error": [ "SyntaxError: extraneous input '%' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" ], "warning": [] }, { - "query": "from a_index | where numberField =~ 0", + "query": "from a_index | where doubleField =~ 0", "error": [ - "Argument of [=~] must be [string], found value [numberField] type [number]", - "Argument of [=~] must be [string], found value [0] type [number]" + "Argument of [=~] must be [text], found value [doubleField] type [double]", + "Argument of [=~] must be [text], found value [0] type [number]" ], "warning": [] }, { - "query": "from a_index | where NOT numberField =~ 0", + "query": "from a_index | where NOT doubleField =~ 0", "error": [ - "Argument of [=~] must be [string], found value [numberField] type [number]", - "Argument of [=~] must be [string], found value [0] type [number]" + "Argument of [=~] must be [text], found value [doubleField] type [double]", + "Argument of [=~] must be [text], found value [0] type [number]" ], "warning": [] }, { - "query": "from a_index | where (numberField =~ 0)", + "query": "from a_index | where (doubleField =~ 0)", "error": [ - "Argument of [=~] must be [string], found value [numberField] type [number]", - "Argument of [=~] must be [string], found value [0] type [number]" + "Argument of [=~] must be [text], found value [doubleField] type [double]", + "Argument of [=~] must be [text], found value [0] type [number]" ], "warning": [] }, { - "query": "from a_index | where (NOT (numberField =~ 0))", + "query": "from a_index | where (NOT (doubleField =~ 0))", "error": [ - "Argument of [=~] must be [string], found value [numberField] type [number]", - "Argument of [=~] must be [string], found value [0] type [number]" + "Argument of [=~] must be [text], found value [doubleField] type [double]", + "Argument of [=~] must be [text], found value [0] type [number]" ], "warning": [] }, { "query": "from a_index | where 1 =~ 0", "error": [ - "Argument of [=~] must be [string], found value [1] type [number]", - "Argument of [=~] must be [string], found value [0] type [number]" + "Argument of [=~] must be [text], found value [1] type [number]", + "Argument of [=~] must be [text], found value [0] type [number]" ], "warning": [] }, { - "query": "from a_index | eval stringField =~ 0", + "query": "from a_index | eval textField =~ 0", "error": [ - "Argument of [=~] must be [string], found value [0] type [number]" + "Argument of [=~] must be [text], found value [0] type [number]" ], "warning": [] }, { - "query": "from a_index | where stringField like \"?a\"", + "query": "from a_index | where textField like \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | where stringField NOT like \"?a\"", + "query": "from a_index | where textField NOT like \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | where NOT stringField like \"?a\"", + "query": "from a_index | where NOT textField like \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | where NOT stringField NOT like \"?a\"", + "query": "from a_index | where NOT textField NOT like \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | where numberField like \"?a\"", + "query": "from a_index | where doubleField like \"?a\"", "error": [ - "Argument of [like] must be [string], found value [numberField] type [number]" + "Argument of [like] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | where numberField NOT like \"?a\"", + "query": "from a_index | where doubleField NOT like \"?a\"", "error": [ - "Argument of [not_like] must be [string], found value [numberField] type [number]" + "Argument of [not_like] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | where NOT numberField like \"?a\"", + "query": "from a_index | where NOT doubleField like \"?a\"", "error": [ - "Argument of [like] must be [string], found value [numberField] type [number]" + "Argument of [like] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | where NOT numberField NOT like \"?a\"", + "query": "from a_index | where NOT doubleField NOT like \"?a\"", "error": [ - "Argument of [not_like] must be [string], found value [numberField] type [number]" + "Argument of [not_like] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | where stringField rlike \"?a\"", + "query": "from a_index | where textField rlike \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | where stringField NOT rlike \"?a\"", + "query": "from a_index | where textField NOT rlike \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | where NOT stringField rlike \"?a\"", + "query": "from a_index | where NOT textField rlike \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | where NOT stringField NOT rlike \"?a\"", + "query": "from a_index | where NOT textField NOT rlike \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | where numberField rlike \"?a\"", + "query": "from a_index | where doubleField rlike \"?a\"", "error": [ - "Argument of [rlike] must be [string], found value [numberField] type [number]" + "Argument of [rlike] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | where numberField NOT rlike \"?a\"", + "query": "from a_index | where doubleField NOT rlike \"?a\"", "error": [ - "Argument of [not_rlike] must be [string], found value [numberField] type [number]" + "Argument of [not_rlike] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | where NOT numberField rlike \"?a\"", + "query": "from a_index | where NOT doubleField rlike \"?a\"", "error": [ - "Argument of [rlike] must be [string], found value [numberField] type [number]" + "Argument of [rlike] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | where NOT numberField NOT rlike \"?a\"", + "query": "from a_index | where NOT doubleField NOT rlike \"?a\"", "error": [ - "Argument of [not_rlike] must be [string], found value [numberField] type [number]" + "Argument of [not_rlike] must be [text], found value [doubleField] type [double]" ], "warning": [] }, @@ -3679,22936 +3721,31688 @@ "warning": [] }, { - "query": "from a_index | where numberField IS NULL", + "query": "from a_index | where doubleField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where numberField IS null", + "query": "from a_index | where doubleField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where numberField is null", + "query": "from a_index | where doubleField is null", "error": [], "warning": [] }, { - "query": "from a_index | where numberField is NULL", + "query": "from a_index | where doubleField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where numberField IS NOT NULL", + "query": "from a_index | where doubleField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where numberField IS NOT null", + "query": "from a_index | where doubleField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where numberField IS not NULL", + "query": "from a_index | where doubleField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where numberField Is nOt NuLL", + "query": "from a_index | where doubleField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where dateField IS NULL", + "query": "from a_index | where unsignedLongField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where dateField IS null", + "query": "from a_index | where unsignedLongField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where dateField is null", + "query": "from a_index | where unsignedLongField is null", "error": [], "warning": [] }, { - "query": "from a_index | where dateField is NULL", + "query": "from a_index | where unsignedLongField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where dateField IS NOT NULL", + "query": "from a_index | where unsignedLongField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where dateField IS NOT null", + "query": "from a_index | where unsignedLongField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where dateField IS not NULL", + "query": "from a_index | where unsignedLongField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where dateField Is nOt NuLL", + "query": "from a_index | where unsignedLongField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where stringField IS NULL", + "query": "from a_index | where longField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where stringField IS null", + "query": "from a_index | where longField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where stringField is null", + "query": "from a_index | where longField is null", "error": [], "warning": [] }, { - "query": "from a_index | where stringField is NULL", + "query": "from a_index | where longField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where stringField IS NOT NULL", + "query": "from a_index | where longField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where stringField IS NOT null", + "query": "from a_index | where longField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where stringField IS not NULL", + "query": "from a_index | where longField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where stringField Is nOt NuLL", + "query": "from a_index | where longField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField IS NULL", + "query": "from a_index | where integerField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField IS null", + "query": "from a_index | where integerField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField is null", + "query": "from a_index | where integerField is null", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField is NULL", + "query": "from a_index | where integerField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField IS NOT NULL", + "query": "from a_index | where integerField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField IS NOT null", + "query": "from a_index | where integerField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField IS not NULL", + "query": "from a_index | where integerField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField Is nOt NuLL", + "query": "from a_index | where integerField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where ipField IS NULL", + "query": "from a_index | where counterIntegerField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where ipField IS null", + "query": "from a_index | where counterIntegerField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where ipField is null", + "query": "from a_index | where counterIntegerField is null", "error": [], "warning": [] }, { - "query": "from a_index | where ipField is NULL", + "query": "from a_index | where counterIntegerField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where ipField IS NOT NULL", + "query": "from a_index | where counterIntegerField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where ipField IS NOT null", + "query": "from a_index | where counterIntegerField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where ipField IS not NULL", + "query": "from a_index | where counterIntegerField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where ipField Is nOt NuLL", + "query": "from a_index | where counterIntegerField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianPointField IS NULL", + "query": "from a_index | where counterLongField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianPointField IS null", + "query": "from a_index | where counterLongField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianPointField is null", + "query": "from a_index | where counterLongField is null", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianPointField is NULL", + "query": "from a_index | where counterLongField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianPointField IS NOT NULL", + "query": "from a_index | where counterLongField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianPointField IS NOT null", + "query": "from a_index | where counterLongField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianPointField IS not NULL", + "query": "from a_index | where counterLongField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianPointField Is nOt NuLL", + "query": "from a_index | where counterLongField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianShapeField IS NULL", + "query": "from a_index | where counterDoubleField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianShapeField IS null", + "query": "from a_index | where counterDoubleField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianShapeField is null", + "query": "from a_index | where counterDoubleField is null", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianShapeField is NULL", + "query": "from a_index | where counterDoubleField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianShapeField IS NOT NULL", + "query": "from a_index | where counterDoubleField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianShapeField IS NOT null", + "query": "from a_index | where counterDoubleField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianShapeField IS not NULL", + "query": "from a_index | where counterDoubleField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where cartesianShapeField Is nOt NuLL", + "query": "from a_index | where counterDoubleField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where geoPointField IS NULL", + "query": "from a_index | where dateField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where geoPointField IS null", + "query": "from a_index | where dateField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where geoPointField is null", + "query": "from a_index | where dateField is null", "error": [], "warning": [] }, { - "query": "from a_index | where geoPointField is NULL", + "query": "from a_index | where dateField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where geoPointField IS NOT NULL", + "query": "from a_index | where dateField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where geoPointField IS NOT null", + "query": "from a_index | where dateField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where geoPointField IS not NULL", + "query": "from a_index | where dateField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where geoPointField Is nOt NuLL", + "query": "from a_index | where dateField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where geoShapeField IS NULL", + "query": "from a_index | where datePeriodField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where geoShapeField IS null", + "query": "from a_index | where datePeriodField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where geoShapeField is null", + "query": "from a_index | where datePeriodField is null", "error": [], "warning": [] }, { - "query": "from a_index | where geoShapeField is NULL", + "query": "from a_index | where datePeriodField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where geoShapeField IS NOT NULL", + "query": "from a_index | where datePeriodField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where geoShapeField IS NOT null", + "query": "from a_index | where datePeriodField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where geoShapeField IS not NULL", + "query": "from a_index | where datePeriodField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where geoShapeField Is nOt NuLL", + "query": "from a_index | where datePeriodField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where versionField IS NULL", + "query": "from a_index | where textField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where versionField IS null", + "query": "from a_index | where textField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where versionField is null", + "query": "from a_index | where textField is null", "error": [], "warning": [] }, { - "query": "from a_index | where versionField is NULL", + "query": "from a_index | where textField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where versionField IS NOT NULL", + "query": "from a_index | where textField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where versionField IS NOT null", + "query": "from a_index | where textField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where versionField IS not NULL", + "query": "from a_index | where textField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where versionField Is nOt NuLL", + "query": "from a_index | where textField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where stringField == \"a\" or null", + "query": "from a_index | where keywordField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval ", - "error": [ - "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" - ], - "warning": [] - }, - { - "query": "from a_index | eval stringField ", + "query": "from a_index | where keywordField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval b = stringField", + "query": "from a_index | where keywordField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField + 1", + "query": "from a_index | where keywordField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField + ", - "error": [ - "SyntaxError: no viable alternative at input 'numberField + '" - ], + "query": "from a_index | where keywordField IS NOT NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField + 1", - "error": [ - "Argument of [+] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | where keywordField IS NOT null", + "error": [], "warning": [] }, { - "query": "from a_index | eval a=b", - "error": [ - "Unknown column [b]" - ], + "query": "from a_index | where keywordField IS not NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval a=b, ", - "error": [ - "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", - "Unknown column [b]" - ], + "query": "from a_index | where keywordField Is nOt NuLL", + "error": [], "warning": [] }, { - "query": "from a_index | eval a=round", - "error": [ - "Unknown column [round]" - ], + "query": "from a_index | where booleanField IS NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval a=round(", - "error": [ - "SyntaxError: no viable alternative at input 'round('" - ], + "query": "from a_index | where booleanField IS null", + "error": [], "warning": [] }, { - "query": "from a_index | eval a=round(numberField) ", + "query": "from a_index | where booleanField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=round(numberField), ", - "error": [ - "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" - ], + "query": "from a_index | where booleanField is NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval a=round(numberField) + round(numberField) ", + "query": "from a_index | where booleanField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=round(numberField) + round(stringField) ", - "error": [ - "Argument of [round] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | where booleanField IS NOT null", + "error": [], "warning": [] }, { - "query": "from a_index | eval a=round(numberField) + round(stringField), numberField ", - "error": [ - "Argument of [round] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | where booleanField IS not NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval a=round(numberField) + round(numberField), numberField ", + "query": "from a_index | where booleanField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=round(numberField) + round(numberField), b = numberField ", + "query": "from a_index | where ipField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=[1, 2, 3]", + "query": "from a_index | where ipField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=[true, false]", + "query": "from a_index | where ipField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=[\"a\", \"b\"]", + "query": "from a_index | where ipField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=null", + "query": "from a_index | where ipField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField IS NULL", + "query": "from a_index | where ipField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField IS null", + "query": "from a_index | where ipField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField is null", + "query": "from a_index | where ipField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField is NULL", + "query": "from a_index | where cartesianPointField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField IS NOT NULL", + "query": "from a_index | where cartesianPointField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField IS NOT null", + "query": "from a_index | where cartesianPointField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField IS not NULL", + "query": "from a_index | where cartesianPointField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField IS NULL", + "query": "from a_index | where cartesianPointField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField IS null", + "query": "from a_index | where cartesianPointField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField is null", + "query": "from a_index | where cartesianPointField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField is NULL", + "query": "from a_index | where cartesianPointField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField IS NOT NULL", + "query": "from a_index | where cartesianShapeField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField IS NOT null", + "query": "from a_index | where cartesianShapeField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField IS not NULL", + "query": "from a_index | where cartesianShapeField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField IS NULL", + "query": "from a_index | where cartesianShapeField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField IS null", + "query": "from a_index | where cartesianShapeField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField is null", + "query": "from a_index | where cartesianShapeField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField is NULL", + "query": "from a_index | where cartesianShapeField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField IS NOT NULL", + "query": "from a_index | where cartesianShapeField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField IS NOT null", + "query": "from a_index | where geoPointField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField IS not NULL", + "query": "from a_index | where geoPointField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField IS NULL", + "query": "from a_index | where geoPointField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField IS null", + "query": "from a_index | where geoPointField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField is null", + "query": "from a_index | where geoPointField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField is NULL", + "query": "from a_index | where geoPointField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField IS NOT NULL", + "query": "from a_index | where geoPointField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField IS NOT null", + "query": "from a_index | where geoPointField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField IS not NULL", + "query": "from a_index | where geoShapeField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField IS NULL", + "query": "from a_index | where geoShapeField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField IS null", + "query": "from a_index | where geoShapeField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField is null", + "query": "from a_index | where geoShapeField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField is NULL", + "query": "from a_index | where geoShapeField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField IS NOT NULL", + "query": "from a_index | where geoShapeField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField IS NOT null", + "query": "from a_index | where geoShapeField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField IS not NULL", + "query": "from a_index | where geoShapeField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianPointField IS NULL", + "query": "from a_index | where versionField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianPointField IS null", + "query": "from a_index | where versionField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianPointField is null", + "query": "from a_index | where versionField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianPointField is NULL", + "query": "from a_index | where versionField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianPointField IS NOT NULL", + "query": "from a_index | where versionField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianPointField IS NOT null", + "query": "from a_index | where versionField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianPointField IS not NULL", + "query": "from a_index | where versionField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianShapeField IS NULL", + "query": "from a_index | where versionField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianShapeField IS null", + "query": "from a_index | where textField == \"a\" or null", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianShapeField is null", - "error": [], + "query": "from a_index | eval ", + "error": [ + "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" + ], "warning": [] }, { - "query": "from a_index | eval cartesianShapeField is NULL", + "query": "from a_index | eval textField ", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianShapeField IS NOT NULL", + "query": "from a_index | eval b = textField", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianShapeField IS NOT null", + "query": "from a_index | eval doubleField + 1", "error": [], "warning": [] }, { - "query": "from a_index | eval cartesianShapeField IS not NULL", - "error": [], + "query": "from a_index | eval doubleField + ", + "error": [ + "SyntaxError: no viable alternative at input 'doubleField + '" + ], "warning": [] }, { - "query": "from a_index | eval geoPointField IS NULL", - "error": [], + "query": "from a_index | eval textField + 1", + "error": [ + "Argument of [+] must be [double], found value [textField] type [text]" + ], "warning": [] }, { - "query": "from a_index | eval geoPointField IS null", - "error": [], + "query": "from a_index | eval a=b", + "error": [ + "Unknown column [b]" + ], "warning": [] }, { - "query": "from a_index | eval geoPointField is null", - "error": [], + "query": "from a_index | eval a=b, ", + "error": [ + "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", + "Unknown column [b]" + ], "warning": [] }, { - "query": "from a_index | eval geoPointField is NULL", - "error": [], + "query": "from a_index | eval a=round", + "error": [ + "Unknown column [round]" + ], "warning": [] }, { - "query": "from a_index | eval geoPointField IS NOT NULL", - "error": [], + "query": "from a_index | eval a=round(", + "error": [ + "SyntaxError: no viable alternative at input 'round('" + ], "warning": [] }, { - "query": "from a_index | eval geoPointField IS NOT null", + "query": "from a_index | eval a=round(doubleField) ", "error": [], "warning": [] }, { - "query": "from a_index | eval geoPointField IS not NULL", - "error": [], + "query": "from a_index | eval a=round(doubleField), ", + "error": [ + "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" + ], "warning": [] }, { - "query": "from a_index | eval geoShapeField IS NULL", + "query": "from a_index | eval a=round(doubleField) + round(doubleField) ", "error": [], "warning": [] }, { - "query": "from a_index | eval geoShapeField IS null", - "error": [], + "query": "from a_index | eval a=round(doubleField) + round(textField) ", + "error": [ + "Argument of [round] must be [double], found value [textField] type [text]" + ], "warning": [] }, { - "query": "from a_index | eval geoShapeField is null", - "error": [], + "query": "from a_index | eval a=round(doubleField) + round(textField), doubleField ", + "error": [ + "Argument of [round] must be [double], found value [textField] type [text]" + ], "warning": [] }, { - "query": "from a_index | eval geoShapeField is NULL", + "query": "from a_index | eval a=round(doubleField) + round(doubleField), doubleField ", "error": [], "warning": [] }, { - "query": "from a_index | eval geoShapeField IS NOT NULL", + "query": "from a_index | eval a=round(doubleField) + round(doubleField), b = doubleField ", "error": [], "warning": [] }, { - "query": "from a_index | eval geoShapeField IS NOT null", + "query": "from a_index | eval a=[1, 2, 3]", "error": [], "warning": [] }, { - "query": "from a_index | eval geoShapeField IS not NULL", + "query": "from a_index | eval a=[true, false]", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField IS NULL", + "query": "from a_index | eval a=[\"a\", \"b\"]", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField IS null", + "query": "from a_index | eval a=null", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField is null", + "query": "from a_index | eval doubleField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField is NULL", + "query": "from a_index | eval doubleField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField IS NOT NULL", + "query": "from a_index | eval doubleField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField IS NOT null", + "query": "from a_index | eval doubleField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField IS not NULL", + "query": "from a_index | eval doubleField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval - numberField", + "query": "from a_index | eval doubleField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=- numberField", + "query": "from a_index | eval doubleField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=- round(numberField)", + "query": "from a_index | eval unsignedLongField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + - numberField", + "query": "from a_index | eval unsignedLongField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 - numberField", + "query": "from a_index | eval unsignedLongField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval - numberField", + "query": "from a_index | eval unsignedLongField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=- numberField", + "query": "from a_index | eval unsignedLongField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=- round(numberField)", + "query": "from a_index | eval unsignedLongField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + - numberField", + "query": "from a_index | eval unsignedLongField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 - numberField", + "query": "from a_index | eval longField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval + numberField", + "query": "from a_index | eval longField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+ numberField", + "query": "from a_index | eval longField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+ round(numberField)", + "query": "from a_index | eval longField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + + numberField", + "query": "from a_index | eval longField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + numberField", + "query": "from a_index | eval longField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval + numberField", + "query": "from a_index | eval longField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+ numberField", + "query": "from a_index | eval integerField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+ round(numberField)", + "query": "from a_index | eval integerField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + + numberField", + "query": "from a_index | eval integerField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + numberField", + "query": "from a_index | eval integerField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval not booleanField", + "query": "from a_index | eval integerField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval -- numberField", + "query": "from a_index | eval integerField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=-- numberField", + "query": "from a_index | eval integerField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=-- round(numberField)", + "query": "from a_index | eval counterIntegerField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + -- numberField", + "query": "from a_index | eval counterIntegerField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 -- numberField", + "query": "from a_index | eval counterIntegerField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval -+ numberField", + "query": "from a_index | eval counterIntegerField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=-+ numberField", + "query": "from a_index | eval counterIntegerField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=-+ round(numberField)", + "query": "from a_index | eval counterIntegerField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + -+ numberField", + "query": "from a_index | eval counterIntegerField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 -+ numberField", + "query": "from a_index | eval counterLongField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval +- numberField", + "query": "from a_index | eval counterLongField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+- numberField", + "query": "from a_index | eval counterLongField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+- round(numberField)", + "query": "from a_index | eval counterLongField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + +- numberField", + "query": "from a_index | eval counterLongField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 +- numberField", + "query": "from a_index | eval counterLongField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval ++ numberField", + "query": "from a_index | eval counterLongField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=++ numberField", + "query": "from a_index | eval counterDoubleField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=++ round(numberField)", + "query": "from a_index | eval counterDoubleField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + ++ numberField", + "query": "from a_index | eval counterDoubleField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 ++ numberField", + "query": "from a_index | eval counterDoubleField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval not not booleanField", + "query": "from a_index | eval counterDoubleField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval --- numberField", + "query": "from a_index | eval counterDoubleField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=--- numberField", + "query": "from a_index | eval counterDoubleField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=--- round(numberField)", + "query": "from a_index | eval dateField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + --- numberField", + "query": "from a_index | eval dateField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 --- numberField", + "query": "from a_index | eval dateField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval -+- numberField", + "query": "from a_index | eval dateField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=-+- numberField", + "query": "from a_index | eval dateField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=-+- round(numberField)", + "query": "from a_index | eval dateField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + -+- numberField", + "query": "from a_index | eval dateField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 -+- numberField", + "query": "from a_index | eval datePeriodField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval +-+ numberField", + "query": "from a_index | eval datePeriodField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+-+ numberField", + "query": "from a_index | eval datePeriodField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+-+ round(numberField)", + "query": "from a_index | eval datePeriodField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + +-+ numberField", + "query": "from a_index | eval datePeriodField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 +-+ numberField", + "query": "from a_index | eval datePeriodField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval +++ numberField", + "query": "from a_index | eval datePeriodField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+++ numberField", + "query": "from a_index | eval textField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+++ round(numberField)", + "query": "from a_index | eval textField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + +++ numberField", + "query": "from a_index | eval textField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 +++ numberField", + "query": "from a_index | eval textField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval not not not booleanField", + "query": "from a_index | eval textField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval ---- numberField", + "query": "from a_index | eval textField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=---- numberField", + "query": "from a_index | eval textField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=---- round(numberField)", + "query": "from a_index | eval keywordField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + ---- numberField", + "query": "from a_index | eval keywordField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 ---- numberField", + "query": "from a_index | eval keywordField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval -+-+ numberField", + "query": "from a_index | eval keywordField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=-+-+ numberField", + "query": "from a_index | eval keywordField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=-+-+ round(numberField)", + "query": "from a_index | eval keywordField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + -+-+ numberField", + "query": "from a_index | eval keywordField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 -+-+ numberField", + "query": "from a_index | eval booleanField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval +-+- numberField", + "query": "from a_index | eval booleanField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+-+- numberField", + "query": "from a_index | eval booleanField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval a=+-+- round(numberField)", + "query": "from a_index | eval booleanField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + +-+- numberField", + "query": "from a_index | eval booleanField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 +-+- numberField", + "query": "from a_index | eval booleanField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval ++++ numberField", + "query": "from a_index | eval booleanField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=++++ numberField", + "query": "from a_index | eval ipField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval a=++++ round(numberField)", + "query": "from a_index | eval ipField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + ++++ numberField", + "query": "from a_index | eval ipField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 ++++ numberField", + "query": "from a_index | eval ipField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval not not not not booleanField", + "query": "from a_index | eval ipField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval *+ numberField", - "error": [ - "SyntaxError: extraneous input '*' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" - ], + "query": "from a_index | eval ipField IS NOT null", + "error": [], "warning": [] }, { - "query": "from a_index | eval /+ numberField", - "error": [ - "SyntaxError: extraneous input '/' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" - ], + "query": "from a_index | eval ipField IS not NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval %+ numberField", - "error": [ - "SyntaxError: extraneous input '%' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" - ], + "query": "from a_index | eval cartesianPointField IS NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval log10(-1)", + "query": "from a_index | eval cartesianPointField IS null", "error": [], - "warning": [ - "Log of a negative number results in null: -1" - ] + "warning": [] }, { - "query": "from a_index | eval log(-1)", + "query": "from a_index | eval cartesianPointField is null", "error": [], - "warning": [ - "Log of a negative number results in null: -1" - ] + "warning": [] }, { - "query": "from a_index | eval log(-1, 20)", + "query": "from a_index | eval cartesianPointField is NULL", "error": [], - "warning": [ - "Log of a negative number results in null: -1" - ] + "warning": [] }, { - "query": "from a_index | eval log(-1, -20)", + "query": "from a_index | eval cartesianPointField IS NOT NULL", "error": [], - "warning": [ - "Log of a negative number results in null: -1", - "Log of a negative number results in null: -20" - ] + "warning": [] }, { - "query": "from a_index | eval var0 = log(-1, -20)", + "query": "from a_index | eval cartesianPointField IS NOT null", "error": [], - "warning": [ - "Log of a negative number results in null: -1", - "Log of a negative number results in null: -20" - ] + "warning": [] }, { - "query": "from a_index | eval numberField > 0", + "query": "from a_index | eval cartesianPointField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval NOT numberField > 0", + "query": "from a_index | eval cartesianShapeField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField > 0)", + "query": "from a_index | eval cartesianShapeField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval (NOT (numberField > 0))", + "query": "from a_index | eval cartesianShapeField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 > 0", + "query": "from a_index | eval cartesianShapeField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField > stringField", + "query": "from a_index | eval cartesianShapeField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField > numberField", + "query": "from a_index | eval cartesianShapeField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField > dateField", + "query": "from a_index | eval cartesianShapeField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField > booleanField", - "error": [ - "Argument of [>] must be [number], found value [booleanField] type [boolean]", - "Argument of [>] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval geoPointField IS NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval ipField > ipField", + "query": "from a_index | eval geoPointField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField > stringField", - "error": [ - "Argument of [>] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval geoPointField is null", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField > numberField", - "error": [ - "Argument of [>] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval geoPointField is NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval numberField > \"2022\"", - "error": [ - "Argument of [>] must be [number], found value [\"2022\"] type [string]" - ], + "query": "from a_index | eval geoPointField IS NOT NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval dateField > stringField", - "error": [ - "Argument of [>] must be [string], found value [dateField] type [date]" - ], + "query": "from a_index | eval geoPointField IS NOT null", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField > dateField", - "error": [ - "Argument of [>] must be [string], found value [dateField] type [date]" - ], + "query": "from a_index | eval geoPointField IS not NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField > 0", - "error": [ - "Argument of [>] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval geoShapeField IS NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField > now()", - "error": [ - "Argument of [>] must be [string], found value [now()] type [date]" - ], + "query": "from a_index | eval geoShapeField IS null", + "error": [], "warning": [] }, { - "query": "from a_index | eval dateField > \"2022\"", + "query": "from a_index | eval geoShapeField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval \"2022\" > dateField", + "query": "from a_index | eval geoShapeField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField > \"1.2.3\"", + "query": "from a_index | eval geoShapeField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval \"1.2.3\" > versionField", + "query": "from a_index | eval geoShapeField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField > \"true\"", - "error": [ - "Argument of [>] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval geoShapeField IS not NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval \"true\" > booleanField", - "error": [ - "Argument of [>] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval versionField IS NULL", + "error": [], "warning": [] }, { - "query": "from a_index | eval ipField > \"136.36.3.205\"", + "query": "from a_index | eval versionField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval \"136.36.3.205\" > ipField", + "query": "from a_index | eval versionField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField >= 0", + "query": "from a_index | eval versionField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval NOT numberField >= 0", + "query": "from a_index | eval versionField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField >= 0)", + "query": "from a_index | eval versionField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval (NOT (numberField >= 0))", + "query": "from a_index | eval versionField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 >= 0", + "query": "from a_index | eval - doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField >= stringField", + "query": "from a_index | eval a=- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField >= numberField", + "query": "from a_index | eval a=- round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField >= dateField", + "query": "from a_index | eval 1 + - doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField >= booleanField", - "error": [ - "Argument of [>=] must be [number], found value [booleanField] type [boolean]", - "Argument of [>=] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval 1 - doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval ipField >= ipField", + "query": "from a_index | eval - doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField >= stringField", - "error": [ - "Argument of [>=] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval a=- doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField >= numberField", - "error": [ - "Argument of [>=] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval a=- round(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval numberField >= \"2022\"", - "error": [ - "Argument of [>=] must be [number], found value [\"2022\"] type [string]" - ], + "query": "from a_index | eval 1 + - doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval dateField >= stringField", - "error": [ - "Argument of [>=] must be [string], found value [dateField] type [date]" - ], + "query": "from a_index | eval 1 - doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField >= dateField", - "error": [ - "Argument of [>=] must be [string], found value [dateField] type [date]" - ], + "query": "from a_index | eval + doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField >= 0", - "error": [ - "Argument of [>=] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval a=+ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField >= now()", - "error": [ - "Argument of [>=] must be [string], found value [now()] type [date]" - ], + "query": "from a_index | eval a=+ round(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval dateField >= \"2022\"", + "query": "from a_index | eval 1 + + doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval \"2022\" >= dateField", + "query": "from a_index | eval 1 + doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField >= \"1.2.3\"", + "query": "from a_index | eval + doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval \"1.2.3\" >= versionField", + "query": "from a_index | eval a=+ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField >= \"true\"", - "error": [ - "Argument of [>=] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval a=+ round(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval \"true\" >= booleanField", - "error": [ - "Argument of [>=] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval 1 + + doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval ipField >= \"136.36.3.205\"", + "query": "from a_index | eval 1 + doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval \"136.36.3.205\" >= ipField", + "query": "from a_index | eval not booleanField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField < 0", + "query": "from a_index | eval -- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval NOT numberField < 0", + "query": "from a_index | eval a=-- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField < 0)", + "query": "from a_index | eval a=-- round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval (NOT (numberField < 0))", + "query": "from a_index | eval 1 + -- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 < 0", + "query": "from a_index | eval 1 -- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField < stringField", + "query": "from a_index | eval -+ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField < numberField", + "query": "from a_index | eval a=-+ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField < dateField", + "query": "from a_index | eval a=-+ round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField < booleanField", - "error": [ - "Argument of [<] must be [number], found value [booleanField] type [boolean]", - "Argument of [<] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval 1 + -+ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval ipField < ipField", + "query": "from a_index | eval 1 -+ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField < stringField", - "error": [ - "Argument of [<] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval +- doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField < numberField", - "error": [ - "Argument of [<] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval a=+- doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval numberField < \"2022\"", - "error": [ - "Argument of [<] must be [number], found value [\"2022\"] type [string]" - ], + "query": "from a_index | eval a=+- round(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval dateField < stringField", - "error": [ - "Argument of [<] must be [string], found value [dateField] type [date]" - ], + "query": "from a_index | eval 1 + +- doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField < dateField", - "error": [ - "Argument of [<] must be [string], found value [dateField] type [date]" - ], + "query": "from a_index | eval 1 +- doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField < 0", - "error": [ - "Argument of [<] must be [number], found value [stringField] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | eval stringField < now()", - "error": [ - "Argument of [<] must be [string], found value [now()] type [date]" - ], + "query": "from a_index | eval ++ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval dateField < \"2022\"", + "query": "from a_index | eval a=++ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval \"2022\" < dateField", + "query": "from a_index | eval a=++ round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField < \"1.2.3\"", + "query": "from a_index | eval 1 + ++ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval \"1.2.3\" < versionField", + "query": "from a_index | eval 1 ++ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField < \"true\"", - "error": [ - "Argument of [<] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval not not booleanField", + "error": [], "warning": [] }, { - "query": "from a_index | eval \"true\" < booleanField", - "error": [ - "Argument of [<] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval --- doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval ipField < \"136.36.3.205\"", + "query": "from a_index | eval a=--- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval \"136.36.3.205\" < ipField", + "query": "from a_index | eval a=--- round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField <= 0", + "query": "from a_index | eval 1 + --- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval NOT numberField <= 0", + "query": "from a_index | eval 1 --- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField <= 0)", + "query": "from a_index | eval -+- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval (NOT (numberField <= 0))", + "query": "from a_index | eval a=-+- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 <= 0", + "query": "from a_index | eval a=-+- round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField <= stringField", + "query": "from a_index | eval 1 + -+- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField <= numberField", + "query": "from a_index | eval 1 -+- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField <= dateField", + "query": "from a_index | eval +-+ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField <= booleanField", - "error": [ - "Argument of [<=] must be [number], found value [booleanField] type [boolean]", - "Argument of [<=] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval a=+-+ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval ipField <= ipField", + "query": "from a_index | eval a=+-+ round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField <= stringField", - "error": [ - "Argument of [<=] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval 1 + +-+ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField <= numberField", - "error": [ - "Argument of [<=] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval 1 +-+ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval numberField <= \"2022\"", - "error": [ - "Argument of [<=] must be [number], found value [\"2022\"] type [string]" - ], + "query": "from a_index | eval +++ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval dateField <= stringField", - "error": [ - "Argument of [<=] must be [string], found value [dateField] type [date]" - ], + "query": "from a_index | eval a=+++ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField <= dateField", - "error": [ - "Argument of [<=] must be [string], found value [dateField] type [date]" - ], + "query": "from a_index | eval a=+++ round(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField <= 0", - "error": [ - "Argument of [<=] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval 1 + +++ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField <= now()", - "error": [ - "Argument of [<=] must be [string], found value [now()] type [date]" - ], + "query": "from a_index | eval 1 +++ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval dateField <= \"2022\"", + "query": "from a_index | eval not not not booleanField", "error": [], "warning": [] }, { - "query": "from a_index | eval \"2022\" <= dateField", + "query": "from a_index | eval ---- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField <= \"1.2.3\"", + "query": "from a_index | eval a=---- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval \"1.2.3\" <= versionField", + "query": "from a_index | eval a=---- round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField <= \"true\"", - "error": [ - "Argument of [<=] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval 1 + ---- doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval \"true\" <= booleanField", - "error": [ - "Argument of [<=] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval 1 ---- doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval ipField <= \"136.36.3.205\"", + "query": "from a_index | eval -+-+ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval \"136.36.3.205\" <= ipField", + "query": "from a_index | eval a=-+-+ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField == 0", + "query": "from a_index | eval a=-+-+ round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval NOT numberField == 0", + "query": "from a_index | eval 1 + -+-+ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField == 0)", + "query": "from a_index | eval 1 -+-+ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval (NOT (numberField == 0))", + "query": "from a_index | eval +-+- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 == 0", + "query": "from a_index | eval a=+-+- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField == stringField", + "query": "from a_index | eval a=+-+- round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField == numberField", + "query": "from a_index | eval 1 + +-+- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField == dateField", + "query": "from a_index | eval 1 +-+- doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField == booleanField", + "query": "from a_index | eval ++++ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField == ipField", + "query": "from a_index | eval a=++++ doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField == stringField", - "error": [ - "Argument of [==] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval a=++++ round(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField == numberField", - "error": [ - "Argument of [==] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval 1 + ++++ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval numberField == \"2022\"", - "error": [ - "Argument of [==] must be [number], found value [\"2022\"] type [string]" - ], + "query": "from a_index | eval 1 ++++ doubleField", + "error": [], "warning": [] }, { - "query": "from a_index | eval dateField == stringField", - "error": [ - "Argument of [==] must be [string], found value [dateField] type [date]" - ], + "query": "from a_index | eval not not not not booleanField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField == dateField", + "query": "from a_index | eval *+ doubleField", "error": [ - "Argument of [==] must be [string], found value [dateField] type [date]" + "SyntaxError: extraneous input '*' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" ], "warning": [] }, { - "query": "from a_index | eval stringField == 0", + "query": "from a_index | eval /+ doubleField", "error": [ - "Argument of [==] must be [number], found value [stringField] type [string]" + "SyntaxError: extraneous input '/' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" ], "warning": [] }, { - "query": "from a_index | eval stringField == now()", + "query": "from a_index | eval %+ doubleField", "error": [ - "Argument of [==] must be [string], found value [now()] type [date]" + "SyntaxError: extraneous input '%' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" ], "warning": [] }, { - "query": "from a_index | eval dateField == \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval \"2022\" == dateField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval versionField == \"1.2.3\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval \"1.2.3\" == versionField", + "query": "from a_index | eval log10(-1)", "error": [], - "warning": [] + "warning": [ + "Log of a negative number results in null: -1" + ] }, { - "query": "from a_index | eval booleanField == \"true\"", + "query": "from a_index | eval log(-1)", "error": [], - "warning": [] + "warning": [ + "Log of a negative number results in null: -1" + ] }, { - "query": "from a_index | eval \"true\" == booleanField", + "query": "from a_index | eval log(-1, 20)", "error": [], - "warning": [] + "warning": [ + "Log of a negative number results in null: -1" + ] }, { - "query": "from a_index | eval ipField == \"136.36.3.205\"", + "query": "from a_index | eval log(-1, -20)", "error": [], - "warning": [] + "warning": [ + "Log of a negative number results in null: -1", + "Log of a negative number results in null: -20" + ] }, { - "query": "from a_index | eval \"136.36.3.205\" == ipField", + "query": "from a_index | eval var0 = log(-1, -20)", "error": [], - "warning": [] + "warning": [ + "Log of a negative number results in null: -1", + "Log of a negative number results in null: -20" + ] }, { - "query": "from a_index | eval numberField != 0", + "query": "from a_index | eval doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval NOT numberField != 0", + "query": "from a_index | eval NOT doubleField > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField != 0)", + "query": "from a_index | eval (doubleField > 0)", "error": [], "warning": [] }, { - "query": "from a_index | eval (NOT (numberField != 0))", + "query": "from a_index | eval (NOT (doubleField > 0))", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 != 0", + "query": "from a_index | eval 1 > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField != stringField", + "query": "from a_index | eval textField > textField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField != numberField", + "query": "from a_index | eval doubleField > doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField != dateField", + "query": "from a_index | eval dateField > dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField != booleanField", - "error": [], + "query": "from a_index | eval booleanField > booleanField", + "error": [ + "Argument of [>] must be [date], found value [booleanField] type [boolean]", + "Argument of [>] must be [date], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval ipField != ipField", + "query": "from a_index | eval ipField > ipField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField != stringField", + "query": "from a_index | eval doubleField > textField", "error": [ - "Argument of [!=] must be [number], found value [stringField] type [string]" + "Argument of [>] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval stringField != numberField", + "query": "from a_index | eval keywordField > doubleField", "error": [ - "Argument of [!=] must be [number], found value [stringField] type [string]" + "Argument of [>] must be [double], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval numberField != \"2022\"", + "query": "from a_index | eval doubleField > \"2022\"", "error": [ - "Argument of [!=] must be [number], found value [\"2022\"] type [string]" + "Argument of [>] must be [date], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval dateField != stringField", + "query": "from a_index | eval dateField > keywordField", "error": [ - "Argument of [!=] must be [string], found value [dateField] type [date]" + "Argument of [>] must be [date], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval stringField != dateField", + "query": "from a_index | eval keywordField > dateField", "error": [ - "Argument of [!=] must be [string], found value [dateField] type [date]" + "Argument of [>] must be [date], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval stringField != 0", + "query": "from a_index | eval textField > 0", "error": [ - "Argument of [!=] must be [number], found value [stringField] type [string]" + "Argument of [>] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval stringField != now()", + "query": "from a_index | eval textField > now()", "error": [ - "Argument of [!=] must be [string], found value [now()] type [date]" + "Argument of [>] must be [date], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval dateField != \"2022\"", + "query": "from a_index | eval dateField > \"2022\"", "error": [], "warning": [] }, { - "query": "from a_index | eval \"2022\" != dateField", + "query": "from a_index | eval \"2022\" > dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField != \"1.2.3\"", + "query": "from a_index | eval versionField > \"1.2.3\"", "error": [], "warning": [] }, { - "query": "from a_index | eval \"1.2.3\" != versionField", + "query": "from a_index | eval \"1.2.3\" > versionField", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField != \"true\"", - "error": [], + "query": "from a_index | eval booleanField > \"true\"", + "error": [ + "Argument of [>] must be [date], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval \"true\" != booleanField", + "query": "from a_index | eval \"true\" > booleanField", + "error": [ + "Argument of [>] must be [date], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval ipField > \"136.36.3.205\"", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField != \"136.36.3.205\"", + "query": "from a_index | eval \"136.36.3.205\" > ipField", "error": [], "warning": [] }, { - "query": "from a_index | eval \"136.36.3.205\" != ipField", + "query": "from a_index | eval doubleField >= 0", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField in (\"1.2.3\", \"4.5.6\", to_version(\"2.3.2\"))", + "query": "from a_index | eval NOT doubleField >= 0", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField in (\"2023-12-12\", \"2024-12-12\", date_parse(\"yyyy-MM-dd\", \"2025-12-12\"))", + "query": "from a_index | eval (doubleField >= 0)", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField in (\"true\", \"false\", false)", + "query": "from a_index | eval (NOT (doubleField >= 0))", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField in (\"136.36.3.205\", \"136.36.3.206\", to_ip(\"136.36.3.207\"))", + "query": "from a_index | eval 1 >= 0", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField + 1", + "query": "from a_index | eval textField >= textField", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField + 1)", + "query": "from a_index | eval doubleField >= doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + 1", + "query": "from a_index | eval dateField >= dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval now() + now()", + "query": "from a_index | eval booleanField >= booleanField", "error": [ - "Argument of [+] must be [time_literal], found value [now()] type [date]" + "Argument of [>=] must be [date], found value [booleanField] type [boolean]", + "Argument of [>=] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval 1 + \"1\"", - "error": [ - "Argument of [+] must be [number], found value [\"1\"] type [string]" - ], + "query": "from a_index | eval ipField >= ipField", + "error": [], "warning": [] }, { - "query": "from a_index | eval \"1\" + 1", + "query": "from a_index | eval doubleField >= textField", "error": [ - "Argument of [+] must be [number], found value [\"1\"] type [string]" + "Argument of [>=] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval numberField - 1", - "error": [], + "query": "from a_index | eval keywordField >= doubleField", + "error": [ + "Argument of [>=] must be [double], found value [keywordField] type [keyword]" + ], "warning": [] }, { - "query": "from a_index | eval (numberField - 1)", - "error": [], + "query": "from a_index | eval doubleField >= \"2022\"", + "error": [ + "Argument of [>=] must be [date], found value [doubleField] type [double]" + ], "warning": [] }, { - "query": "from a_index | eval 1 - 1", - "error": [], + "query": "from a_index | eval dateField >= keywordField", + "error": [ + "Argument of [>=] must be [date], found value [keywordField] type [keyword]" + ], "warning": [] }, { - "query": "from a_index | eval now() - now()", + "query": "from a_index | eval keywordField >= dateField", "error": [ - "Argument of [-] must be [time_literal], found value [now()] type [date]" + "Argument of [>=] must be [date], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval 1 - \"1\"", + "query": "from a_index | eval textField >= 0", "error": [ - "Argument of [-] must be [number], found value [\"1\"] type [string]" + "Argument of [>=] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval \"1\" - 1", + "query": "from a_index | eval textField >= now()", "error": [ - "Argument of [-] must be [number], found value [\"1\"] type [string]" + "Argument of [>=] must be [date], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval numberField * 1", + "query": "from a_index | eval dateField >= \"2022\"", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField * 1)", + "query": "from a_index | eval \"2022\" >= dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 * 1", + "query": "from a_index | eval versionField >= \"1.2.3\"", "error": [], "warning": [] }, { - "query": "from a_index | eval now() * now()", - "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [now()] type [date]" - ], + "query": "from a_index | eval \"1.2.3\" >= versionField", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 * \"1\"", + "query": "from a_index | eval booleanField >= \"true\"", "error": [ - "Argument of [*] must be [number], found value [\"1\"] type [string]" + "Argument of [>=] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval \"1\" * 1", + "query": "from a_index | eval \"true\" >= booleanField", "error": [ - "Argument of [*] must be [number], found value [\"1\"] type [string]" + "Argument of [>=] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval numberField / 1", + "query": "from a_index | eval ipField >= \"136.36.3.205\"", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField / 1)", + "query": "from a_index | eval \"136.36.3.205\" >= ipField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 / 1", + "query": "from a_index | eval doubleField < 0", "error": [], "warning": [] }, { - "query": "from a_index | eval now() / now()", - "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [now()] type [date]" - ], + "query": "from a_index | eval NOT doubleField < 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 / \"1\"", - "error": [ - "Argument of [/] must be [number], found value [\"1\"] type [string]" - ], + "query": "from a_index | eval (doubleField < 0)", + "error": [], "warning": [] }, { - "query": "from a_index | eval \"1\" / 1", - "error": [ - "Argument of [/] must be [number], found value [\"1\"] type [string]" - ], + "query": "from a_index | eval (NOT (doubleField < 0))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval 1 < 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval numberField % 1", + "query": "from a_index | eval textField < textField", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField % 1)", + "query": "from a_index | eval doubleField < doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 % 1", + "query": "from a_index | eval dateField < dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval now() % now()", + "query": "from a_index | eval booleanField < booleanField", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [now()] type [date]" + "Argument of [<] must be [date], found value [booleanField] type [boolean]", + "Argument of [<] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval 1 % \"1\"", + "query": "from a_index | eval ipField < ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval doubleField < textField", "error": [ - "Argument of [%] must be [number], found value [\"1\"] type [string]" + "Argument of [<] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval \"1\" % 1", + "query": "from a_index | eval keywordField < doubleField", "error": [ - "Argument of [%] must be [number], found value [\"1\"] type [string]" + "Argument of [<] must be [double], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval 1/0", - "error": [], - "warning": [ - "Cannot divide by zero: 1/0" - ] + "query": "from a_index | eval doubleField < \"2022\"", + "error": [ + "Argument of [<] must be [date], found value [doubleField] type [double]" + ], + "warning": [] }, { - "query": "from a_index | eval var = 1/0", - "error": [], - "warning": [ - "Cannot divide by zero: 1/0" - ] + "query": "from a_index | eval dateField < keywordField", + "error": [ + "Argument of [<] must be [date], found value [keywordField] type [keyword]" + ], + "warning": [] }, { - "query": "from a_index | eval 1 + 1/0", - "error": [], - "warning": [ - "Cannot divide by zero: 1/0" - ] - }, - { - "query": "from a_index | eval 1%0", - "error": [], - "warning": [ - "Module by zero can return null value: 1%0" - ] - }, - { - "query": "from a_index | eval var = 1%0", - "error": [], - "warning": [ - "Module by zero can return null value: 1%0" - ] - }, - { - "query": "from a_index | eval 1 + 1%0", - "error": [], - "warning": [ - "Module by zero can return null value: 1%0" - ] - }, - { - "query": "from a_index | eval stringField like \"?a\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval stringField NOT like \"?a\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval NOT stringField like \"?a\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval NOT stringField NOT like \"?a\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval numberField like \"?a\"", - "error": [ - "Argument of [like] must be [string], found value [numberField] type [number]" - ], - "warning": [] - }, - { - "query": "from a_index | eval numberField NOT like \"?a\"", + "query": "from a_index | eval keywordField < dateField", "error": [ - "Argument of [not_like] must be [string], found value [numberField] type [number]" + "Argument of [<] must be [date], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval NOT numberField like \"?a\"", + "query": "from a_index | eval textField < 0", "error": [ - "Argument of [like] must be [string], found value [numberField] type [number]" + "Argument of [<] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval NOT numberField NOT like \"?a\"", + "query": "from a_index | eval textField < now()", "error": [ - "Argument of [not_like] must be [string], found value [numberField] type [number]" + "Argument of [<] must be [date], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval stringField rlike \"?a\"", + "query": "from a_index | eval dateField < \"2022\"", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField NOT rlike \"?a\"", + "query": "from a_index | eval \"2022\" < dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval NOT stringField rlike \"?a\"", + "query": "from a_index | eval versionField < \"1.2.3\"", "error": [], "warning": [] }, { - "query": "from a_index | eval NOT stringField NOT rlike \"?a\"", + "query": "from a_index | eval \"1.2.3\" < versionField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField rlike \"?a\"", - "error": [ - "Argument of [rlike] must be [string], found value [numberField] type [number]" - ], - "warning": [] - }, - { - "query": "from a_index | eval numberField NOT rlike \"?a\"", - "error": [ - "Argument of [not_rlike] must be [string], found value [numberField] type [number]" - ], - "warning": [] - }, - { - "query": "from a_index | eval NOT numberField rlike \"?a\"", + "query": "from a_index | eval booleanField < \"true\"", "error": [ - "Argument of [rlike] must be [string], found value [numberField] type [number]" + "Argument of [<] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval NOT numberField NOT rlike \"?a\"", + "query": "from a_index | eval \"true\" < booleanField", "error": [ - "Argument of [not_rlike] must be [string], found value [numberField] type [number]" + "Argument of [<] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval 1 in (1, 2, 3)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval numberField in (1, 2, 3)", + "query": "from a_index | eval ipField < \"136.36.3.205\"", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField not in (1, 2, 3)", + "query": "from a_index | eval \"136.36.3.205\" < ipField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField not in (1, 2, 3, numberField)", + "query": "from a_index | eval doubleField <= 0", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 in (1, 2, 3, round(numberField))", + "query": "from a_index | eval NOT doubleField <= 0", "error": [], "warning": [] }, { - "query": "from a_index | eval \"a\" in (\"a\", \"b\", \"c\")", + "query": "from a_index | eval (doubleField <= 0)", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField in (\"a\", \"b\", \"c\")", + "query": "from a_index | eval (NOT (doubleField <= 0))", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField not in (\"a\", \"b\", \"c\")", + "query": "from a_index | eval 1 <= 0", "error": [], "warning": [] }, { - "query": "from a_index | eval stringField not in (\"a\", \"b\", \"c\", stringField)", + "query": "from a_index | eval textField <= textField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 in (\"a\", \"b\", \"c\")", + "query": "from a_index | eval doubleField <= doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField in (\"a\", \"b\", \"c\")", + "query": "from a_index | eval dateField <= dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval numberField not in (\"a\", \"b\", \"c\")", - "error": [], + "query": "from a_index | eval booleanField <= booleanField", + "error": [ + "Argument of [<=] must be [date], found value [booleanField] type [boolean]", + "Argument of [<=] must be [date], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval numberField not in (1, 2, 3, stringField)", + "query": "from a_index | eval ipField <= ipField", "error": [], "warning": [] }, { - "query": "from a_index | eval avg(numberField)", + "query": "from a_index | eval doubleField <= textField", "error": [ - "EVAL does not support function avg" + "Argument of [<=] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | stats avg(numberField) | eval `avg(numberField)` + 1", - "error": [], + "query": "from a_index | eval keywordField <= doubleField", + "error": [ + "Argument of [<=] must be [double], found value [keywordField] type [keyword]" + ], "warning": [] }, { - "query": "from a_index | eval not", + "query": "from a_index | eval doubleField <= \"2022\"", "error": [ - "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", - "Error: [not] function expects exactly one argument, got 0." + "Argument of [<=] must be [date], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval in", + "query": "from a_index | eval dateField <= keywordField", "error": [ - "SyntaxError: mismatched input 'in' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" + "Argument of [<=] must be [date], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval stringField in stringField", + "query": "from a_index | eval keywordField <= dateField", "error": [ - "SyntaxError: missing '(' at 'stringField'", - "SyntaxError: mismatched input '' expecting {',', ')'}" + "Argument of [<=] must be [date], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval stringField in stringField)", + "query": "from a_index | eval textField <= 0", "error": [ - "SyntaxError: missing '(' at 'stringField'", - "Error: [in] function expects exactly 2 arguments, got 1." + "Argument of [<=] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval stringField not in stringField", + "query": "from a_index | eval textField <= now()", "error": [ - "SyntaxError: missing '(' at 'stringField'", - "SyntaxError: mismatched input '' expecting {',', ')'}" + "Argument of [<=] must be [date], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval mv_sort([\"a\", \"b\"], \"bogus\")", + "query": "from a_index | eval dateField <= \"2022\"", "error": [], - "warning": [ - "Invalid option [\"bogus\"] for mv_sort. Supported options: [\"asc\", \"desc\"]." - ] + "warning": [] }, { - "query": "from a_index | eval mv_sort([\"a\", \"b\"], \"ASC\")", + "query": "from a_index | eval \"2022\" <= dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sort([\"a\", \"b\"], \"DESC\")", + "query": "from a_index | eval versionField <= \"1.2.3\"", "error": [], "warning": [] }, { - "query": "from a_index | eval result = case(false, 0, 1), round(result)", + "query": "from a_index | eval \"1.2.3\" <= versionField", "error": [], "warning": [] }, { - "query": "from a_index | eval result = case(false, 0, 1) | stats sum(result)", - "error": [], + "query": "from a_index | eval booleanField <= \"true\"", + "error": [ + "Argument of [<=] must be [date], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval result = case(false, 0, 1) | stats var0 = sum(result)", + "query": "from a_index | eval \"true\" <= booleanField", + "error": [ + "Argument of [<=] must be [date], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval ipField <= \"136.36.3.205\"", "error": [], "warning": [] }, { - "query": "from a_index | eval round(case(false, 0, 1))", + "query": "from a_index | eval \"136.36.3.205\" <= ipField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 anno", - "error": [ - "EVAL does not support [date_period] in expression [1 anno]" - ], + "query": "from a_index | eval doubleField == 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = 1 anno", - "error": [ - "Unexpected time interval qualifier: 'anno'" - ], + "query": "from a_index | eval NOT doubleField == 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval now() + 1 anno", - "error": [ - "Unexpected time interval qualifier: 'anno'" - ], + "query": "from a_index | eval (doubleField == 0)", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 year", - "error": [ - "EVAL does not support [date_period] in expression [1 year]" - ], + "query": "from a_index | eval (NOT (doubleField == 0))", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 year", - "error": [ - "EVAL does not support [date_period] in expression [1 year]" - ], + "query": "from a_index | eval 1 == 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 year", + "query": "from a_index | eval textField == textField", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 year", + "query": "from a_index | eval doubleField == doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 YEAR", + "query": "from a_index | eval dateField == dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Year", + "query": "from a_index | eval booleanField == booleanField", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 year", + "query": "from a_index | eval ipField == ipField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 year + 1 year", + "query": "from a_index | eval doubleField == textField", "error": [ - "Argument of [+] must be [date], found value [1 year] type [duration]" + "Argument of [==] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 year", + "query": "from a_index | eval keywordField == doubleField", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 year] type [duration]" + "Argument of [==] must be [double], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 year", + "query": "from a_index | eval doubleField == \"2022\"", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 year] type [duration]" + "Argument of [==] must be [date], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 year", + "query": "from a_index | eval dateField == keywordField", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 year] type [duration]" + "Argument of [==] must be [date], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval 1 years", + "query": "from a_index | eval keywordField == dateField", "error": [ - "EVAL does not support [date_period] in expression [1 years]" + "Argument of [==] must be [date], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval 1 years", + "query": "from a_index | eval textField == 0", "error": [ - "EVAL does not support [date_period] in expression [1 years]" + "Argument of [==] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 years", + "query": "from a_index | eval textField == now()", + "error": [ + "Argument of [==] must be [date], found value [textField] type [text]" + ], + "warning": [] + }, + { + "query": "from a_index | eval dateField == \"2022\"", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 years", + "query": "from a_index | eval \"2022\" == dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 YEARS", + "query": "from a_index | eval versionField == \"1.2.3\"", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Years", + "query": "from a_index | eval \"1.2.3\" == versionField", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 years", + "query": "from a_index | eval booleanField == \"true\"", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 years + 1 year", - "error": [ - "Argument of [+] must be [date], found value [1 years] type [duration]" - ], + "query": "from a_index | eval \"true\" == booleanField", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 years", - "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 years] type [duration]" - ], + "query": "from a_index | eval ipField == \"136.36.3.205\"", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 years", - "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 years] type [duration]" - ], + "query": "from a_index | eval \"136.36.3.205\" == ipField", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 years", - "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 years] type [duration]" - ], + "query": "from a_index | eval doubleField != 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 quarter", - "error": [ - "EVAL does not support [date_period] in expression [1 quarter]" - ], + "query": "from a_index | eval NOT doubleField != 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 quarter", - "error": [ - "EVAL does not support [date_period] in expression [1 quarter]" - ], + "query": "from a_index | eval (doubleField != 0)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 quarter", + "query": "from a_index | eval (NOT (doubleField != 0))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 quarter", + "query": "from a_index | eval 1 != 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 QUARTER", + "query": "from a_index | eval textField != textField", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Quarter", + "query": "from a_index | eval doubleField != doubleField", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 quarter", + "query": "from a_index | eval dateField != dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 quarter + 1 year", + "query": "from a_index | eval booleanField != booleanField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval ipField != ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval doubleField != textField", "error": [ - "Argument of [+] must be [date], found value [1 quarter] type [duration]" + "Argument of [!=] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 quarter", + "query": "from a_index | eval keywordField != doubleField", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 quarter] type [duration]" + "Argument of [!=] must be [double], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 quarter", + "query": "from a_index | eval doubleField != \"2022\"", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 quarter] type [duration]" + "Argument of [!=] must be [date], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 quarter", + "query": "from a_index | eval dateField != keywordField", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 quarter] type [duration]" + "Argument of [!=] must be [date], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval 1 quarters", + "query": "from a_index | eval keywordField != dateField", "error": [ - "EVAL does not support [date_period] in expression [1 quarters]" + "Argument of [!=] must be [date], found value [keywordField] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval 1 quarters", + "query": "from a_index | eval textField != 0", "error": [ - "EVAL does not support [date_period] in expression [1 quarters]" + "Argument of [!=] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 quarters", - "error": [], + "query": "from a_index | eval textField != now()", + "error": [ + "Argument of [!=] must be [date], found value [textField] type [text]" + ], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 quarters", + "query": "from a_index | eval dateField != \"2022\"", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 QUARTERS", + "query": "from a_index | eval \"2022\" != dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Quarters", + "query": "from a_index | eval versionField != \"1.2.3\"", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 quarters", + "query": "from a_index | eval \"1.2.3\" != versionField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 quarters + 1 year", - "error": [ - "Argument of [+] must be [date], found value [1 quarters] type [duration]" - ], + "query": "from a_index | eval booleanField != \"true\"", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 quarters", - "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 quarters] type [duration]" - ], + "query": "from a_index | eval \"true\" != booleanField", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 quarters", - "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 quarters] type [duration]" - ], + "query": "from a_index | eval ipField != \"136.36.3.205\"", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 quarters", - "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 quarters] type [duration]" - ], + "query": "from a_index | eval \"136.36.3.205\" != ipField", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 month", - "error": [ - "EVAL does not support [date_period] in expression [1 month]" - ], + "query": "from a_index | eval versionField in (\"1.2.3\", \"4.5.6\", to_version(\"2.3.2\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 month", - "error": [ - "EVAL does not support [date_period] in expression [1 month]" - ], + "query": "from a_index | eval dateField in (\"2023-12-12\", \"2024-12-12\", date_parse(\"yyyy-MM-dd\", \"2025-12-12\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 month", + "query": "from a_index | eval booleanField in (\"true\", \"false\", false)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 month", + "query": "from a_index | eval ipField in (\"136.36.3.205\", \"136.36.3.206\", to_ip(\"136.36.3.207\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 MONTH", + "query": "from a_index | eval doubleField + 1", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Month", + "query": "from a_index | eval (doubleField + 1)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 month", + "query": "from a_index | eval 1 + 1", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 month + 1 year", + "query": "from a_index | eval now() + now()", "error": [ - "Argument of [+] must be [date], found value [1 month] type [duration]" + "Argument of [+] must be [date_period], found value [now()] type [date]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 month", + "query": "from a_index | eval 1 + \"1\"", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 month] type [duration]" + "Argument of [+] must be [date_period], found value [1] type [integer]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 month", + "query": "from a_index | eval \"1\" + 1", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 month] type [duration]" + "Argument of [+] must be [date_period], found value [1] type [integer]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 month", - "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 month] type [duration]" - ], + "query": "from a_index | eval doubleField - 1", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 months", - "error": [ - "EVAL does not support [date_period] in expression [1 months]" - ], + "query": "from a_index | eval (doubleField - 1)", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 months", + "query": "from a_index | eval 1 - 1", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval now() - now()", "error": [ - "EVAL does not support [date_period] in expression [1 months]" + "Argument of [-] must be [date_period], found value [now()] type [date]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 months", - "error": [], + "query": "from a_index | eval 1 - \"1\"", + "error": [ + "Argument of [-] must be [date_period], found value [1] type [integer]" + ], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 months", - "error": [], + "query": "from a_index | eval \"1\" - 1", + "error": [ + "Argument of [-] must be [date_period], found value [1] type [integer]" + ], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 MONTHS", + "query": "from a_index | eval doubleField * 1", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Months", + "query": "from a_index | eval (doubleField * 1)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 months", + "query": "from a_index | eval 1 * 1", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 months + 1 year", + "query": "from a_index | eval now() * now()", "error": [ - "Argument of [+] must be [date], found value [1 months] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [now()] type [date]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 months", + "query": "from a_index | eval 1 * \"1\"", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 months] type [duration]" + "Argument of [*] must be [double], found value [\"1\"] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 months", + "query": "from a_index | eval \"1\" * 1", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 months] type [duration]" + "Argument of [*] must be [double], found value [\"1\"] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 months", - "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 months] type [duration]" - ], + "query": "from a_index | eval doubleField / 1", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 week", - "error": [ - "EVAL does not support [date_period] in expression [1 week]" - ], + "query": "from a_index | eval (doubleField / 1)", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 week", + "query": "from a_index | eval 1 / 1", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval now() / now()", "error": [ - "EVAL does not support [date_period] in expression [1 week]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [now()] type [date]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 week", - "error": [], + "query": "from a_index | eval 1 / \"1\"", + "error": [ + "Argument of [/] must be [double], found value [\"1\"] type [string]" + ], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 week", - "error": [], + "query": "from a_index | eval \"1\" / 1", + "error": [ + "Argument of [/] must be [double], found value [\"1\"] type [string]" + ], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 WEEK", + "query": "from a_index | eval doubleField % 1", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Week", + "query": "from a_index | eval (doubleField % 1)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 week", + "query": "from a_index | eval 1 % 1", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 week + 1 year", + "query": "from a_index | eval now() % now()", "error": [ - "Argument of [+] must be [date], found value [1 week] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [now()] type [date]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 week", + "query": "from a_index | eval 1 % \"1\"", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 week] type [duration]" + "Argument of [%] must be [double], found value [\"1\"] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 week", + "query": "from a_index | eval \"1\" % 1", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 week] type [duration]" + "Argument of [%] must be [double], found value [\"1\"] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 week", - "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 week] type [duration]" - ], - "warning": [] + "query": "from a_index | eval 1/0", + "error": [], + "warning": [ + "Cannot divide by zero: 1/0" + ] }, { - "query": "from a_index | eval 1 weeks", - "error": [ - "EVAL does not support [date_period] in expression [1 weeks]" - ], - "warning": [] + "query": "from a_index | eval var = 1/0", + "error": [], + "warning": [ + "Cannot divide by zero: 1/0" + ] }, { - "query": "from a_index | eval 1 weeks", - "error": [ - "EVAL does not support [date_period] in expression [1 weeks]" - ], - "warning": [] + "query": "from a_index | eval 1 + 1/0", + "error": [], + "warning": [ + "Cannot divide by zero: 1/0" + ] }, { - "query": "from a_index | eval var = now() - 1 weeks", + "query": "from a_index | eval 1%0", "error": [], - "warning": [] + "warning": [ + "Module by zero can return null value: 1%0" + ] }, { - "query": "from a_index | eval var = dateField - 1 weeks", + "query": "from a_index | eval var = 1%0", "error": [], - "warning": [] + "warning": [ + "Module by zero can return null value: 1%0" + ] }, { - "query": "from a_index | eval var = dateField - 1 WEEKS", + "query": "from a_index | eval 1 + 1%0", "error": [], - "warning": [] + "warning": [ + "Module by zero can return null value: 1%0" + ] }, { - "query": "from a_index | eval var = dateField - 1 Weeks", + "query": "from a_index | eval textField like \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 weeks", + "query": "from a_index | eval textField NOT like \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 weeks + 1 year", - "error": [ - "Argument of [+] must be [date], found value [1 weeks] type [duration]" - ], + "query": "from a_index | eval NOT textField like \"?a\"", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 weeks", - "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 weeks] type [duration]" - ], + "query": "from a_index | eval NOT textField NOT like \"?a\"", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 weeks", + "query": "from a_index | eval doubleField like \"?a\"", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 weeks] type [duration]" + "Argument of [like] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 weeks", + "query": "from a_index | eval doubleField NOT like \"?a\"", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 weeks] type [duration]" + "Argument of [not_like] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval 1 day", + "query": "from a_index | eval NOT doubleField like \"?a\"", "error": [ - "EVAL does not support [date_period] in expression [1 day]" + "Argument of [like] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval 1 day", + "query": "from a_index | eval NOT doubleField NOT like \"?a\"", "error": [ - "EVAL does not support [date_period] in expression [1 day]" + "Argument of [not_like] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 day", + "query": "from a_index | eval textField rlike \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 day", + "query": "from a_index | eval textField NOT rlike \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 DAY", + "query": "from a_index | eval NOT textField rlike \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Day", + "query": "from a_index | eval NOT textField NOT rlike \"?a\"", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 day", - "error": [], + "query": "from a_index | eval doubleField rlike \"?a\"", + "error": [ + "Argument of [rlike] must be [text], found value [doubleField] type [double]" + ], "warning": [] }, { - "query": "from a_index | eval 1 day + 1 year", + "query": "from a_index | eval doubleField NOT rlike \"?a\"", "error": [ - "Argument of [+] must be [date], found value [1 day] type [duration]" + "Argument of [not_rlike] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 day", + "query": "from a_index | eval NOT doubleField rlike \"?a\"", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 day] type [duration]" + "Argument of [rlike] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 day", + "query": "from a_index | eval NOT doubleField NOT rlike \"?a\"", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 day] type [duration]" + "Argument of [not_rlike] must be [text], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 day", - "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 day] type [duration]" - ], + "query": "from a_index | eval 1 in (1, 2, 3)", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 days", - "error": [ - "EVAL does not support [date_period] in expression [1 days]" - ], + "query": "from a_index | eval doubleField in (1, 2, 3)", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 days", - "error": [ - "EVAL does not support [date_period] in expression [1 days]" - ], + "query": "from a_index | eval doubleField not in (1, 2, 3)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 days", + "query": "from a_index | eval doubleField not in (1, 2, 3, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 days", + "query": "from a_index | eval 1 in (1, 2, 3, round(doubleField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 DAYS", + "query": "from a_index | eval \"a\" in (\"a\", \"b\", \"c\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Days", + "query": "from a_index | eval textField in (\"a\", \"b\", \"c\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 days", + "query": "from a_index | eval textField not in (\"a\", \"b\", \"c\")", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 days + 1 year", - "error": [ - "Argument of [+] must be [date], found value [1 days] type [duration]" - ], + "query": "from a_index | eval textField not in (\"a\", \"b\", \"c\", textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 days", - "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 days] type [duration]" - ], + "query": "from a_index | eval 1 in (\"a\", \"b\", \"c\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 days", - "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 days] type [duration]" - ], + "query": "from a_index | eval doubleField in (\"a\", \"b\", \"c\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 days", - "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 days] type [duration]" - ], + "query": "from a_index | eval doubleField not in (\"a\", \"b\", \"c\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 hour", - "error": [ - "EVAL does not support [date_period] in expression [1 hour]" - ], + "query": "from a_index | eval doubleField not in (1, 2, 3, textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval 1 hour", + "query": "from a_index | eval avg(doubleField)", "error": [ - "EVAL does not support [date_period] in expression [1 hour]" + "EVAL does not support function avg" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 hour", + "query": "from a_index | stats avg(doubleField) | eval `avg(doubleField)` + 1", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 hour", - "error": [], + "query": "from a_index | eval not", + "error": [ + "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", + "Error: [not] function expects exactly one argument, got 0." + ], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 HOUR", - "error": [], + "query": "from a_index | eval in", + "error": [ + "SyntaxError: mismatched input 'in' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" + ], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Hour", - "error": [], + "query": "from a_index | eval textField in textField", + "error": [ + "SyntaxError: missing '(' at 'textField'", + "SyntaxError: mismatched input '' expecting {',', ')'}" + ], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 hour", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval 1 hour + 1 year", - "error": [ - "Argument of [+] must be [date], found value [1 hour] type [duration]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = now() * 1 hour", - "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 hour] type [duration]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = now() / 1 hour", - "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 hour] type [duration]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = now() % 1 hour", + "query": "from a_index | eval textField in textField)", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 hour] type [duration]" + "SyntaxError: missing '(' at 'textField'", + "Error: [in] function expects exactly 2 arguments, got 1." ], "warning": [] }, { - "query": "from a_index | eval 1 hours", + "query": "from a_index | eval textField not in textField", "error": [ - "EVAL does not support [date_period] in expression [1 hours]" + "SyntaxError: missing '(' at 'textField'", + "SyntaxError: mismatched input '' expecting {',', ')'}" ], "warning": [] }, { - "query": "from a_index | eval 1 hours", - "error": [ - "EVAL does not support [date_period] in expression [1 hours]" - ], - "warning": [] + "query": "from a_index | eval mv_sort([\"a\", \"b\"], \"bogus\")", + "error": [], + "warning": [ + "Invalid option [\"bogus\"] for mv_sort. Supported options: [\"asc\", \"desc\"]." + ] }, { - "query": "from a_index | eval var = now() - 1 hours", + "query": "from a_index | eval mv_sort([\"a\", \"b\"], \"ASC\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 hours", + "query": "from a_index | eval mv_sort([\"a\", \"b\"], \"DESC\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 HOURS", + "query": "from a_index | eval result = case(false, 0, 1), round(result)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Hours", + "query": "from a_index | eval result = case(false, 0, 1) | stats sum(result)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 hours", + "query": "from a_index | eval result = case(false, 0, 1) | stats var0 = sum(result)", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 hours + 1 year", - "error": [ - "Argument of [+] must be [date], found value [1 hours] type [duration]" - ], + "query": "from a_index | eval round(case(false, 0, 1))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 hours", + "query": "from a_index | eval 1 anno", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 hours] type [duration]" + "EVAL does not support [date_period] in expression [1 anno]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 hours", + "query": "from a_index | eval var = 1 anno", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 hours] type [duration]" + "Unexpected time interval qualifier: 'anno'" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 hours", + "query": "from a_index | eval now() + 1 anno", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 hours] type [duration]" + "Unexpected time interval qualifier: 'anno'" ], "warning": [] }, { - "query": "from a_index | eval 1 minute", + "query": "from a_index | eval 1 year", "error": [ - "EVAL does not support [date_period] in expression [1 minute]" + "EVAL does not support [date_period] in expression [1 year]" ], "warning": [] }, { - "query": "from a_index | eval 1 minute", + "query": "from a_index | eval 1 year", "error": [ - "EVAL does not support [date_period] in expression [1 minute]" + "EVAL does not support [date_period] in expression [1 year]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 minute", + "query": "from a_index | eval var = now() - 1 year", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 minute", + "query": "from a_index | eval var = dateField - 1 year", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 MINUTE", + "query": "from a_index | eval var = dateField - 1 YEAR", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Minute", + "query": "from a_index | eval var = dateField - 1 Year", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 minute", + "query": "from a_index | eval var = dateField + 1 year", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 minute + 1 year", + "query": "from a_index | eval 1 year + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 minute] type [duration]" + "Argument of [+] must be [date], found value [1 year] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 minute", + "query": "from a_index | eval var = now() * 1 year", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 minute] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 year] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 minute", + "query": "from a_index | eval var = now() / 1 year", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 minute] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 year] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 minute", + "query": "from a_index | eval var = now() % 1 year", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 minute] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 year] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 minutes", + "query": "from a_index | eval 1 years", "error": [ - "EVAL does not support [date_period] in expression [1 minutes]" + "EVAL does not support [date_period] in expression [1 years]" ], "warning": [] }, { - "query": "from a_index | eval 1 minutes", + "query": "from a_index | eval 1 years", "error": [ - "EVAL does not support [date_period] in expression [1 minutes]" + "EVAL does not support [date_period] in expression [1 years]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 minutes", + "query": "from a_index | eval var = now() - 1 years", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 minutes", + "query": "from a_index | eval var = dateField - 1 years", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 MINUTES", + "query": "from a_index | eval var = dateField - 1 YEARS", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Minutes", + "query": "from a_index | eval var = dateField - 1 Years", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 minutes", + "query": "from a_index | eval var = dateField + 1 years", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 minutes + 1 year", + "query": "from a_index | eval 1 years + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 minutes] type [duration]" + "Argument of [+] must be [date], found value [1 years] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 minutes", + "query": "from a_index | eval var = now() * 1 years", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 minutes] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 years] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 minutes", + "query": "from a_index | eval var = now() / 1 years", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 minutes] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 years] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 minutes", + "query": "from a_index | eval var = now() % 1 years", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 minutes] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 years] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 second", + "query": "from a_index | eval 1 quarter", "error": [ - "EVAL does not support [date_period] in expression [1 second]" + "EVAL does not support [date_period] in expression [1 quarter]" ], "warning": [] }, { - "query": "from a_index | eval 1 second", + "query": "from a_index | eval 1 quarter", "error": [ - "EVAL does not support [date_period] in expression [1 second]" + "EVAL does not support [date_period] in expression [1 quarter]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 second", + "query": "from a_index | eval var = now() - 1 quarter", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 second", + "query": "from a_index | eval var = dateField - 1 quarter", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 SECOND", + "query": "from a_index | eval var = dateField - 1 QUARTER", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Second", + "query": "from a_index | eval var = dateField - 1 Quarter", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 second", + "query": "from a_index | eval var = dateField + 1 quarter", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 second + 1 year", + "query": "from a_index | eval 1 quarter + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 second] type [duration]" + "Argument of [+] must be [date], found value [1 quarter] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 second", + "query": "from a_index | eval var = now() * 1 quarter", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 second] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 quarter] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 second", + "query": "from a_index | eval var = now() / 1 quarter", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 second] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 quarter] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 second", + "query": "from a_index | eval var = now() % 1 quarter", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 second] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 quarter] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 seconds", + "query": "from a_index | eval 1 quarters", "error": [ - "EVAL does not support [date_period] in expression [1 seconds]" + "EVAL does not support [date_period] in expression [1 quarters]" ], "warning": [] }, { - "query": "from a_index | eval 1 seconds", + "query": "from a_index | eval 1 quarters", "error": [ - "EVAL does not support [date_period] in expression [1 seconds]" + "EVAL does not support [date_period] in expression [1 quarters]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 seconds", + "query": "from a_index | eval var = now() - 1 quarters", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 seconds", + "query": "from a_index | eval var = dateField - 1 quarters", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 SECONDS", + "query": "from a_index | eval var = dateField - 1 QUARTERS", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Seconds", + "query": "from a_index | eval var = dateField - 1 Quarters", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 seconds", + "query": "from a_index | eval var = dateField + 1 quarters", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 seconds + 1 year", + "query": "from a_index | eval 1 quarters + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 seconds] type [duration]" + "Argument of [+] must be [date], found value [1 quarters] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 seconds", + "query": "from a_index | eval var = now() * 1 quarters", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 seconds] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 quarters] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 seconds", + "query": "from a_index | eval var = now() / 1 quarters", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 seconds] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 quarters] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 seconds", + "query": "from a_index | eval var = now() % 1 quarters", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 seconds] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 quarters] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 millisecond", + "query": "from a_index | eval 1 month", "error": [ - "EVAL does not support [date_period] in expression [1 millisecond]" + "EVAL does not support [date_period] in expression [1 month]" ], "warning": [] }, { - "query": "from a_index | eval 1 millisecond", + "query": "from a_index | eval 1 month", "error": [ - "EVAL does not support [date_period] in expression [1 millisecond]" + "EVAL does not support [date_period] in expression [1 month]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 millisecond", + "query": "from a_index | eval var = now() - 1 month", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 millisecond", + "query": "from a_index | eval var = dateField - 1 month", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 MILLISECOND", + "query": "from a_index | eval var = dateField - 1 MONTH", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Millisecond", + "query": "from a_index | eval var = dateField - 1 Month", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 millisecond", + "query": "from a_index | eval var = dateField + 1 month", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 millisecond + 1 year", + "query": "from a_index | eval 1 month + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 millisecond] type [duration]" + "Argument of [+] must be [date], found value [1 month] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 millisecond", + "query": "from a_index | eval var = now() * 1 month", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 millisecond] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 month] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 millisecond", + "query": "from a_index | eval var = now() / 1 month", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 millisecond] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 month] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 millisecond", + "query": "from a_index | eval var = now() % 1 month", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 millisecond] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 month] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 milliseconds", + "query": "from a_index | eval 1 months", "error": [ - "EVAL does not support [date_period] in expression [1 milliseconds]" + "EVAL does not support [date_period] in expression [1 months]" ], "warning": [] }, { - "query": "from a_index | eval 1 milliseconds", + "query": "from a_index | eval 1 months", "error": [ - "EVAL does not support [date_period] in expression [1 milliseconds]" + "EVAL does not support [date_period] in expression [1 months]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 milliseconds", + "query": "from a_index | eval var = now() - 1 months", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 milliseconds", + "query": "from a_index | eval var = dateField - 1 months", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 MILLISECONDS", + "query": "from a_index | eval var = dateField - 1 MONTHS", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Milliseconds", + "query": "from a_index | eval var = dateField - 1 Months", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 milliseconds", + "query": "from a_index | eval var = dateField + 1 months", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 milliseconds + 1 year", + "query": "from a_index | eval 1 months + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 milliseconds] type [duration]" + "Argument of [+] must be [date], found value [1 months] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 milliseconds", + "query": "from a_index | eval var = now() * 1 months", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 milliseconds] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 months] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 milliseconds", + "query": "from a_index | eval var = now() / 1 months", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 milliseconds] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 months] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 milliseconds", + "query": "from a_index | eval var = now() % 1 months", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 milliseconds] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 months] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 ms", + "query": "from a_index | eval 1 week", "error": [ - "EVAL does not support [date_period] in expression [1 ms]" + "EVAL does not support [date_period] in expression [1 week]" ], "warning": [] }, { - "query": "from a_index | eval 1 ms", + "query": "from a_index | eval 1 week", "error": [ - "EVAL does not support [date_period] in expression [1 ms]" + "EVAL does not support [date_period] in expression [1 week]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 ms", + "query": "from a_index | eval var = now() - 1 week", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 ms", + "query": "from a_index | eval var = dateField - 1 week", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 MS", + "query": "from a_index | eval var = dateField - 1 WEEK", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Ms", + "query": "from a_index | eval var = dateField - 1 Week", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 ms", + "query": "from a_index | eval var = dateField + 1 week", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 ms + 1 year", + "query": "from a_index | eval 1 week + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 ms] type [duration]" + "Argument of [+] must be [date], found value [1 week] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 ms", + "query": "from a_index | eval var = now() * 1 week", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 ms] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 week] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 ms", + "query": "from a_index | eval var = now() / 1 week", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 ms] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 week] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 ms", + "query": "from a_index | eval var = now() % 1 week", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 ms] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 week] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 s", + "query": "from a_index | eval 1 weeks", "error": [ - "EVAL does not support [date_period] in expression [1 s]" + "EVAL does not support [date_period] in expression [1 weeks]" ], "warning": [] }, { - "query": "from a_index | eval 1 s", + "query": "from a_index | eval 1 weeks", "error": [ - "EVAL does not support [date_period] in expression [1 s]" + "EVAL does not support [date_period] in expression [1 weeks]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 s", + "query": "from a_index | eval var = now() - 1 weeks", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 s", + "query": "from a_index | eval var = dateField - 1 weeks", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 S", + "query": "from a_index | eval var = dateField - 1 WEEKS", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 S", + "query": "from a_index | eval var = dateField - 1 Weeks", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 s", + "query": "from a_index | eval var = dateField + 1 weeks", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 s + 1 year", + "query": "from a_index | eval 1 weeks + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 s] type [duration]" + "Argument of [+] must be [date], found value [1 weeks] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 s", + "query": "from a_index | eval var = now() * 1 weeks", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 s] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 weeks] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 s", + "query": "from a_index | eval var = now() / 1 weeks", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 s] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 weeks] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 s", + "query": "from a_index | eval var = now() % 1 weeks", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 s] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 weeks] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 m", + "query": "from a_index | eval 1 day", "error": [ - "EVAL does not support [date_period] in expression [1 m]" + "EVAL does not support [date_period] in expression [1 day]" ], "warning": [] }, { - "query": "from a_index | eval 1 m", + "query": "from a_index | eval 1 day", "error": [ - "EVAL does not support [date_period] in expression [1 m]" + "EVAL does not support [date_period] in expression [1 day]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 m", + "query": "from a_index | eval var = now() - 1 day", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 m", + "query": "from a_index | eval var = dateField - 1 day", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 M", + "query": "from a_index | eval var = dateField - 1 DAY", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 M", + "query": "from a_index | eval var = dateField - 1 Day", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 m", + "query": "from a_index | eval var = dateField + 1 day", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 m + 1 year", + "query": "from a_index | eval 1 day + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 m] type [duration]" + "Argument of [+] must be [date], found value [1 day] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 m", + "query": "from a_index | eval var = now() * 1 day", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 m] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 day] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 m", + "query": "from a_index | eval var = now() / 1 day", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 m] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 day] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 m", + "query": "from a_index | eval var = now() % 1 day", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 m] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 day] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 h", + "query": "from a_index | eval 1 days", "error": [ - "EVAL does not support [date_period] in expression [1 h]" + "EVAL does not support [date_period] in expression [1 days]" ], "warning": [] }, { - "query": "from a_index | eval 1 h", + "query": "from a_index | eval 1 days", "error": [ - "EVAL does not support [date_period] in expression [1 h]" + "EVAL does not support [date_period] in expression [1 days]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 h", + "query": "from a_index | eval var = now() - 1 days", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 h", + "query": "from a_index | eval var = dateField - 1 days", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 H", + "query": "from a_index | eval var = dateField - 1 DAYS", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 H", + "query": "from a_index | eval var = dateField - 1 Days", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 h", + "query": "from a_index | eval var = dateField + 1 days", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 h + 1 year", + "query": "from a_index | eval 1 days + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 h] type [duration]" + "Argument of [+] must be [date], found value [1 days] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 h", + "query": "from a_index | eval var = now() * 1 days", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 h] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 days] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 h", + "query": "from a_index | eval var = now() / 1 days", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 h] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 days] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 h", + "query": "from a_index | eval var = now() % 1 days", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 h] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 days] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 d", + "query": "from a_index | eval 1 hour", "error": [ - "EVAL does not support [date_period] in expression [1 d]" + "EVAL does not support [date_period] in expression [1 hour]" ], "warning": [] }, { - "query": "from a_index | eval 1 d", + "query": "from a_index | eval 1 hour", "error": [ - "EVAL does not support [date_period] in expression [1 d]" + "EVAL does not support [date_period] in expression [1 hour]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 d", + "query": "from a_index | eval var = now() - 1 hour", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 d", + "query": "from a_index | eval var = dateField - 1 hour", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 D", + "query": "from a_index | eval var = dateField - 1 HOUR", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 D", + "query": "from a_index | eval var = dateField - 1 Hour", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 d", + "query": "from a_index | eval var = dateField + 1 hour", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 d + 1 year", + "query": "from a_index | eval 1 hour + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 d] type [duration]" + "Argument of [+] must be [date], found value [1 hour] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 d", + "query": "from a_index | eval var = now() * 1 hour", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 d] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 hour] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 d", + "query": "from a_index | eval var = now() / 1 hour", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 d] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 hour] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 d", + "query": "from a_index | eval var = now() % 1 hour", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 d] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 hour] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 w", + "query": "from a_index | eval 1 hours", "error": [ - "EVAL does not support [date_period] in expression [1 w]" + "EVAL does not support [date_period] in expression [1 hours]" ], "warning": [] }, { - "query": "from a_index | eval 1 w", + "query": "from a_index | eval 1 hours", "error": [ - "EVAL does not support [date_period] in expression [1 w]" + "EVAL does not support [date_period] in expression [1 hours]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 w", + "query": "from a_index | eval var = now() - 1 hours", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 w", + "query": "from a_index | eval var = dateField - 1 hours", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 W", + "query": "from a_index | eval var = dateField - 1 HOURS", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 W", + "query": "from a_index | eval var = dateField - 1 Hours", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 w", + "query": "from a_index | eval var = dateField + 1 hours", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 w + 1 year", + "query": "from a_index | eval 1 hours + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 w] type [duration]" + "Argument of [+] must be [date], found value [1 hours] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 w", + "query": "from a_index | eval var = now() * 1 hours", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 w] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 hours] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 w", + "query": "from a_index | eval var = now() / 1 hours", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 w] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 hours] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 w", + "query": "from a_index | eval var = now() % 1 hours", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 w] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 hours] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 mo", + "query": "from a_index | eval 1 minute", "error": [ - "EVAL does not support [date_period] in expression [1 mo]" + "EVAL does not support [date_period] in expression [1 minute]" ], "warning": [] }, { - "query": "from a_index | eval 1 mo", + "query": "from a_index | eval 1 minute", "error": [ - "EVAL does not support [date_period] in expression [1 mo]" + "EVAL does not support [date_period] in expression [1 minute]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 mo", + "query": "from a_index | eval var = now() - 1 minute", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 mo", + "query": "from a_index | eval var = dateField - 1 minute", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 MO", + "query": "from a_index | eval var = dateField - 1 MINUTE", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Mo", + "query": "from a_index | eval var = dateField - 1 Minute", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 mo", + "query": "from a_index | eval var = dateField + 1 minute", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 mo + 1 year", + "query": "from a_index | eval 1 minute + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 mo] type [duration]" + "Argument of [+] must be [date], found value [1 minute] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 mo", + "query": "from a_index | eval var = now() * 1 minute", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 mo] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 minute] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 mo", + "query": "from a_index | eval var = now() / 1 minute", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 mo] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 minute] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 mo", + "query": "from a_index | eval var = now() % 1 minute", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 mo] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 minute] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 q", + "query": "from a_index | eval 1 minutes", "error": [ - "EVAL does not support [date_period] in expression [1 q]" + "EVAL does not support [date_period] in expression [1 minutes]" ], "warning": [] }, { - "query": "from a_index | eval 1 q", + "query": "from a_index | eval 1 minutes", "error": [ - "EVAL does not support [date_period] in expression [1 q]" + "EVAL does not support [date_period] in expression [1 minutes]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 q", + "query": "from a_index | eval var = now() - 1 minutes", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 q", + "query": "from a_index | eval var = dateField - 1 minutes", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Q", + "query": "from a_index | eval var = dateField - 1 MINUTES", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Q", + "query": "from a_index | eval var = dateField - 1 Minutes", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 q", + "query": "from a_index | eval var = dateField + 1 minutes", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 q + 1 year", + "query": "from a_index | eval 1 minutes + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 q] type [duration]" + "Argument of [+] must be [date], found value [1 minutes] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 q", + "query": "from a_index | eval var = now() * 1 minutes", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 q] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 minutes] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 q", + "query": "from a_index | eval var = now() / 1 minutes", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 q] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 minutes] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 q", + "query": "from a_index | eval var = now() % 1 minutes", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 q] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 minutes] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 y", + "query": "from a_index | eval 1 second", "error": [ - "EVAL does not support [date_period] in expression [1 y]" + "EVAL does not support [date_period] in expression [1 second]" ], "warning": [] }, { - "query": "from a_index | eval 1 y", + "query": "from a_index | eval 1 second", "error": [ - "EVAL does not support [date_period] in expression [1 y]" + "EVAL does not support [date_period] in expression [1 second]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 y", + "query": "from a_index | eval var = now() - 1 second", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 y", + "query": "from a_index | eval var = dateField - 1 second", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Y", + "query": "from a_index | eval var = dateField - 1 SECOND", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Y", + "query": "from a_index | eval var = dateField - 1 Second", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 y", + "query": "from a_index | eval var = dateField + 1 second", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 y + 1 year", + "query": "from a_index | eval 1 second + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 y] type [duration]" + "Argument of [+] must be [date], found value [1 second] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 y", + "query": "from a_index | eval var = now() * 1 second", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 y] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 second] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 y", + "query": "from a_index | eval var = now() / 1 second", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 y] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 second] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 y", + "query": "from a_index | eval var = now() % 1 second", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 y] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 second] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval 1 yr", + "query": "from a_index | eval 1 seconds", "error": [ - "EVAL does not support [date_period] in expression [1 yr]" + "EVAL does not support [date_period] in expression [1 seconds]" ], "warning": [] }, { - "query": "from a_index | eval 1 yr", + "query": "from a_index | eval 1 seconds", "error": [ - "EVAL does not support [date_period] in expression [1 yr]" + "EVAL does not support [date_period] in expression [1 seconds]" ], "warning": [] }, { - "query": "from a_index | eval var = now() - 1 yr", + "query": "from a_index | eval var = now() - 1 seconds", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 yr", + "query": "from a_index | eval var = dateField - 1 seconds", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 YR", + "query": "from a_index | eval var = dateField - 1 SECONDS", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField - 1 Yr", + "query": "from a_index | eval var = dateField - 1 Seconds", "error": [], "warning": [] }, { - "query": "from a_index | eval var = dateField + 1 yr", + "query": "from a_index | eval var = dateField + 1 seconds", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 yr + 1 year", + "query": "from a_index | eval 1 seconds + 1 year", "error": [ - "Argument of [+] must be [date], found value [1 yr] type [duration]" + "Argument of [+] must be [date], found value [1 seconds] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() * 1 yr", + "query": "from a_index | eval var = now() * 1 seconds", "error": [ - "Argument of [*] must be [number], found value [now()] type [date]", - "Argument of [*] must be [number], found value [1 yr] type [duration]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 seconds] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() / 1 yr", + "query": "from a_index | eval var = now() / 1 seconds", "error": [ - "Argument of [/] must be [number], found value [now()] type [date]", - "Argument of [/] must be [number], found value [1 yr] type [duration]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 seconds] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = now() % 1 yr", + "query": "from a_index | eval var = now() % 1 seconds", "error": [ - "Argument of [%] must be [number], found value [now()] type [date]", - "Argument of [%] must be [number], found value [1 yr] type [duration]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 seconds] type [duration]" ], "warning": [] }, { - "query": "from a_index | sort ", + "query": "from a_index | eval 1 millisecond", "error": [ - "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" + "EVAL does not support [date_period] in expression [1 millisecond]" ], "warning": [] }, { - "query": "from a_index | sort \"field\" ", - "error": [], + "query": "from a_index | eval 1 millisecond", + "error": [ + "EVAL does not support [date_period] in expression [1 millisecond]" + ], "warning": [] }, { - "query": "from a_index | sort wrongField ", - "error": [ - "Unknown column [wrongField]" - ], + "query": "from a_index | eval var = now() - 1 millisecond", + "error": [], "warning": [] }, { - "query": "from a_index | sort numberField, ", - "error": [ - "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" - ], + "query": "from a_index | eval var = dateField - 1 millisecond", + "error": [], "warning": [] }, { - "query": "from a_index | sort numberField, stringField", + "query": "from a_index | eval var = dateField - 1 MILLISECOND", "error": [], "warning": [] }, { - "query": "from a_index | sort \"field\" desc ", + "query": "from a_index | eval var = dateField - 1 Millisecond", "error": [], "warning": [] }, { - "query": "from a_index | sort numberField desc ", + "query": "from a_index | eval var = dateField + 1 millisecond", "error": [], "warning": [] }, { - "query": "from a_index | sort numberField desc nulls ", + "query": "from a_index | eval 1 millisecond + 1 year", "error": [ - "SyntaxError: missing {'first', 'last'} at ''" + "Argument of [+] must be [date], found value [1 millisecond] type [duration]" ], "warning": [] }, { - "query": "from a_index | sort numberField desc nulls first", - "error": [], + "query": "from a_index | eval var = now() * 1 millisecond", + "error": [ + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 millisecond] type [duration]" + ], "warning": [] }, { - "query": "from a_index | sort numberField desc first", + "query": "from a_index | eval var = now() / 1 millisecond", "error": [ - "SyntaxError: extraneous input 'first' expecting " + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 millisecond] type [duration]" ], "warning": [] }, { - "query": "from a_index | sort numberField desc nulls last", - "error": [], + "query": "from a_index | eval var = now() % 1 millisecond", + "error": [ + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 millisecond] type [duration]" + ], "warning": [] }, { - "query": "from a_index | sort numberField desc last", + "query": "from a_index | eval 1 milliseconds", "error": [ - "SyntaxError: extraneous input 'last' expecting " + "EVAL does not support [date_period] in expression [1 milliseconds]" ], "warning": [] }, { - "query": "from a_index | sort \"field\" asc ", - "error": [], + "query": "from a_index | eval 1 milliseconds", + "error": [ + "EVAL does not support [date_period] in expression [1 milliseconds]" + ], "warning": [] }, { - "query": "from a_index | sort numberField asc ", + "query": "from a_index | eval var = now() - 1 milliseconds", "error": [], "warning": [] }, { - "query": "from a_index | sort numberField asc nulls ", - "error": [ - "SyntaxError: missing {'first', 'last'} at ''" - ], + "query": "from a_index | eval var = dateField - 1 milliseconds", + "error": [], "warning": [] }, { - "query": "from a_index | sort numberField asc nulls first", + "query": "from a_index | eval var = dateField - 1 MILLISECONDS", "error": [], "warning": [] }, { - "query": "from a_index | sort numberField asc first", - "error": [ - "SyntaxError: extraneous input 'first' expecting " - ], + "query": "from a_index | eval var = dateField - 1 Milliseconds", + "error": [], "warning": [] }, { - "query": "from a_index | sort numberField asc nulls last", + "query": "from a_index | eval var = dateField + 1 milliseconds", "error": [], "warning": [] }, { - "query": "from a_index | sort numberField asc last", + "query": "from a_index | eval 1 milliseconds + 1 year", "error": [ - "SyntaxError: extraneous input 'last' expecting " + "Argument of [+] must be [date], found value [1 milliseconds] type [duration]" ], "warning": [] }, { - "query": "from a_index | sort numberField nulls first", - "error": [], + "query": "from a_index | eval var = now() * 1 milliseconds", + "error": [ + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 milliseconds] type [duration]" + ], "warning": [] }, { - "query": "from a_index | sort numberField first", + "query": "from a_index | eval var = now() / 1 milliseconds", "error": [ - "SyntaxError: extraneous input 'first' expecting " + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 milliseconds] type [duration]" ], "warning": [] }, { - "query": "from a_index | sort numberField nulls last", - "error": [], + "query": "from a_index | eval var = now() % 1 milliseconds", + "error": [ + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 milliseconds] type [duration]" + ], "warning": [] }, { - "query": "from a_index | sort numberField last", + "query": "from a_index | eval 1 ms", "error": [ - "SyntaxError: extraneous input 'last' expecting " + "EVAL does not support [date_period] in expression [1 ms]" ], "warning": [] }, { - "query": "row a = 1 | stats COUNT(*) | sort `COUNT(*)`", - "error": [], + "query": "from a_index | eval 1 ms", + "error": [ + "EVAL does not support [date_period] in expression [1 ms]" + ], "warning": [] }, { - "query": "ROW a = 1 | STATS couNt(*) | SORT `couNt(*)`", + "query": "from a_index | eval var = now() - 1 ms", "error": [], "warning": [] }, { - "query": "from a_index | sort abs(numberField) - to_long(stringField) desc nulls first", + "query": "from a_index | eval var = dateField - 1 ms", "error": [], "warning": [] }, { - "query": "from a_index | sort sin(stringField)", - "error": [ - "Argument of [sin] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = dateField - 1 MS", + "error": [], "warning": [] }, { - "query": "from a_index | sort numberField + stringField", - "error": [ - "Argument of [+] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = dateField - 1 Ms", + "error": [], "warning": [] }, { - "query": "from a_index | enrich", - "error": [ - "SyntaxError: missing ENRICH_POLICY_NAME at ''" - ], + "query": "from a_index | eval var = dateField + 1 ms", + "error": [], "warning": [] }, { - "query": "from a_index | enrich _", + "query": "from a_index | eval 1 ms + 1 year", "error": [ - "Unknown policy [_]" + "Argument of [+] must be [date], found value [1 ms] type [duration]" ], "warning": [] }, { - "query": "from a_index | enrich _:", + "query": "from a_index | eval var = now() * 1 ms", "error": [ - "SyntaxError: token recognition error at: ':'", - "Unknown policy [_]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 ms] type [duration]" ], "warning": [] }, { - "query": "from a_index | enrich _:policy", + "query": "from a_index | eval var = now() / 1 ms", "error": [ - "Unrecognized value [_] for ENRICH, mode needs to be one of [_ANY, _COORDINATOR, _REMOTE]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 ms] type [duration]" ], "warning": [] }, { - "query": "from a_index | enrich :policy", + "query": "from a_index | eval var = now() % 1 ms", "error": [ - "SyntaxError: token recognition error at: ':'" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 ms] type [duration]" ], "warning": [] }, { - "query": "from a_index | enrich any:", + "query": "from a_index | eval 1 s", "error": [ - "SyntaxError: token recognition error at: ':'", - "Unknown policy [any]" + "EVAL does not support [date_period] in expression [1 s]" ], "warning": [] }, { - "query": "from a_index | enrich _any:", + "query": "from a_index | eval 1 s", "error": [ - "SyntaxError: token recognition error at: ':'", - "Unknown policy [_any]" + "EVAL does not support [date_period] in expression [1 s]" ], "warning": [] }, { - "query": "from a_index | enrich any:policy", - "error": [ - "Unrecognized value [any] for ENRICH, mode needs to be one of [_ANY, _COORDINATOR, _REMOTE]" - ], + "query": "from a_index | eval var = now() - 1 s", + "error": [], "warning": [] }, { - "query": "from a_index | enrich policy ", + "query": "from a_index | eval var = dateField - 1 s", "error": [], "warning": [] }, { - "query": "from a_index | enrich `this``is fine`", - "error": [ - "SyntaxError: extraneous input 'fine`' expecting ", - "Unknown policy [`this``is]" - ], + "query": "from a_index | eval var = dateField - 1 S", + "error": [], "warning": [] }, { - "query": "from a_index | enrich this is fine", - "error": [ - "SyntaxError: mismatched input 'is' expecting ", - "Unknown policy [this]" - ], + "query": "from a_index | eval var = dateField - 1 S", + "error": [], "warning": [] }, { - "query": "from a_index | enrich _any:policy ", + "query": "from a_index | eval var = dateField + 1 s", "error": [], "warning": [] }, { - "query": "from a_index | enrich _any : policy ", + "query": "from a_index | eval 1 s + 1 year", "error": [ - "SyntaxError: token recognition error at: ':'", - "SyntaxError: extraneous input 'policy' expecting ", - "Unknown policy [_any]" + "Argument of [+] must be [date], found value [1 s] type [duration]" ], "warning": [] }, { - "query": "from a_index | enrich _any: policy ", + "query": "from a_index | eval var = now() * 1 s", "error": [ - "SyntaxError: token recognition error at: ':'", - "SyntaxError: extraneous input 'policy' expecting ", - "Unknown policy [_any]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 s] type [duration]" ], "warning": [] }, { - "query": "from a_index | enrich _any:policy ", - "error": [], - "warning": [] - }, - { - "query": "from a_index | enrich _ANY:policy ", - "error": [], + "query": "from a_index | eval var = now() / 1 s", + "error": [ + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 s] type [duration]" + ], "warning": [] }, { - "query": "from a_index | enrich _coordinator:policy ", - "error": [], + "query": "from a_index | eval var = now() % 1 s", + "error": [ + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 s] type [duration]" + ], "warning": [] }, { - "query": "from a_index | enrich _coordinator : policy ", + "query": "from a_index | eval 1 m", "error": [ - "SyntaxError: token recognition error at: ':'", - "SyntaxError: extraneous input 'policy' expecting ", - "Unknown policy [_coordinator]" + "EVAL does not support [date_period] in expression [1 m]" ], "warning": [] }, { - "query": "from a_index | enrich _coordinator: policy ", + "query": "from a_index | eval 1 m", "error": [ - "SyntaxError: token recognition error at: ':'", - "SyntaxError: extraneous input 'policy' expecting ", - "Unknown policy [_coordinator]" + "EVAL does not support [date_period] in expression [1 m]" ], "warning": [] }, { - "query": "from a_index | enrich _coordinator:policy ", + "query": "from a_index | eval var = now() - 1 m", "error": [], "warning": [] }, { - "query": "from a_index | enrich _COORDINATOR:policy ", + "query": "from a_index | eval var = dateField - 1 m", "error": [], "warning": [] }, { - "query": "from a_index | enrich _remote:policy ", + "query": "from a_index | eval var = dateField - 1 M", "error": [], "warning": [] }, { - "query": "from a_index | enrich _remote : policy ", - "error": [ - "SyntaxError: token recognition error at: ':'", - "SyntaxError: extraneous input 'policy' expecting ", - "Unknown policy [_remote]" - ], - "warning": [] - }, - { - "query": "from a_index | enrich _remote: policy ", - "error": [ - "SyntaxError: token recognition error at: ':'", - "SyntaxError: extraneous input 'policy' expecting ", - "Unknown policy [_remote]" - ], - "warning": [] - }, - { - "query": "from a_index | enrich _remote:policy ", + "query": "from a_index | eval var = dateField - 1 M", "error": [], "warning": [] }, { - "query": "from a_index | enrich _REMOTE:policy ", + "query": "from a_index | eval var = dateField + 1 m", "error": [], "warning": [] }, { - "query": "from a_index | enrich _unknown:policy", + "query": "from a_index | eval 1 m + 1 year", "error": [ - "Unrecognized value [_unknown] for ENRICH, mode needs to be one of [_ANY, _COORDINATOR, _REMOTE]" + "Argument of [+] must be [date], found value [1 m] type [duration]" ], "warning": [] }, { - "query": "from a_index |enrich missing-policy ", + "query": "from a_index | eval var = now() * 1 m", "error": [ - "Unknown policy [missing-policy]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 m] type [duration]" ], "warning": [] }, { - "query": "from a_index |enrich policy on ", + "query": "from a_index | eval var = now() / 1 m", "error": [ - "SyntaxError: missing ID_PATTERN at ''" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 m] type [duration]" ], "warning": [] }, { - "query": "from a_index | enrich policy on b ", + "query": "from a_index | eval var = now() % 1 m", "error": [ - "Unknown column [b]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 m] type [duration]" ], "warning": [] }, { - "query": "from a_index | enrich policy on `this``is fine`", + "query": "from a_index | eval 1 h", "error": [ - "Unknown column [this`is fine]" + "EVAL does not support [date_period] in expression [1 h]" ], "warning": [] }, { - "query": "from a_index | enrich policy on this is fine", + "query": "from a_index | eval 1 h", "error": [ - "SyntaxError: mismatched input 'is' expecting ", - "Unknown column [this]" + "EVAL does not support [date_period] in expression [1 h]" ], "warning": [] }, { - "query": "from a_index | enrich policy on stringField with ", - "error": [ - "SyntaxError: mismatched input '' expecting ID_PATTERN" - ], + "query": "from a_index | eval var = now() - 1 h", + "error": [], "warning": [] }, { - "query": "from a_index | enrich policy on stringField with var0 ", - "error": [ - "Unknown column [var0]" - ], + "query": "from a_index | eval var = dateField - 1 h", + "error": [], "warning": [] }, { - "query": "from a_index |enrich policy on numberField with var0 = ", - "error": [ - "SyntaxError: missing ID_PATTERN at ''", - "Unknown column [var0]" - ], + "query": "from a_index | eval var = dateField - 1 H", + "error": [], "warning": [] }, { - "query": "from a_index | enrich policy on stringField with var0 = c ", - "error": [ - "Unknown column [var0]", - "Unknown column [c]" - ], + "query": "from a_index | eval var = dateField - 1 H", + "error": [], "warning": [] }, { - "query": "from a_index |enrich policy on numberField with var0 = , ", + "query": "from a_index | eval var = dateField + 1 h", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval 1 h + 1 year", "error": [ - "SyntaxError: missing ID_PATTERN at ','", - "SyntaxError: mismatched input '' expecting ID_PATTERN", - "Unknown column [var0]" + "Argument of [+] must be [date], found value [1 h] type [duration]" ], "warning": [] }, { - "query": "from a_index | enrich policy on stringField with var0 = otherField, var1 ", + "query": "from a_index | eval var = now() * 1 h", "error": [ - "Unknown column [var1]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 h] type [duration]" ], "warning": [] }, { - "query": "from a_index | enrich policy on stringField with var0 = otherField ", - "error": [], + "query": "from a_index | eval var = now() / 1 h", + "error": [ + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 h] type [duration]" + ], "warning": [] }, { - "query": "from a_index | enrich policy on stringField with var0 = otherField, yetAnotherField ", - "error": [], + "query": "from a_index | eval var = now() % 1 h", + "error": [ + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 h] type [duration]" + ], "warning": [] }, { - "query": "from a_index |enrich policy on numberField with var0 = otherField, var1 = ", + "query": "from a_index | eval 1 d", "error": [ - "SyntaxError: missing ID_PATTERN at ''", - "Unknown column [var1]" + "EVAL does not support [date_period] in expression [1 d]" ], "warning": [] }, { - "query": "from a_index | enrich policy on stringField with var0 = otherField, var1 = yetAnotherField", - "error": [], + "query": "from a_index | eval 1 d", + "error": [ + "EVAL does not support [date_period] in expression [1 d]" + ], "warning": [] }, { - "query": "from a_index | enrich policy on stringField with var0 = otherField, `this``is fine` = yetAnotherField", + "query": "from a_index | eval var = now() - 1 d", "error": [], "warning": [] }, { - "query": "from a_index | enrich policy with ", - "error": [ - "SyntaxError: mismatched input '' expecting ID_PATTERN" - ], + "query": "from a_index | eval var = dateField - 1 d", + "error": [], "warning": [] }, { - "query": "from a_index | enrich policy with otherField", + "query": "from a_index | eval var = dateField - 1 D", "error": [], "warning": [] }, { - "query": "from a_index | enrich policy | eval otherField", + "query": "from a_index | eval var = dateField - 1 D", "error": [], "warning": [] }, { - "query": "from a_index | enrich policy with var0 = otherField | eval var0", + "query": "from a_index | eval var = dateField + 1 d", "error": [], "warning": [] }, { - "query": "from a_index | enrich my-pol*", + "query": "from a_index | eval 1 d + 1 year", "error": [ - "Using wildcards (*) in ENRICH is not allowed [my-pol*]" + "Argument of [+] must be [date], found value [1 d] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval stringField = 5", - "error": [], - "warning": [ - "Column [stringField] of type string has been overwritten as new type: number" - ] - }, - { - "query": "from a_index | eval numberField = \"5\"", - "error": [], - "warning": [ - "Column [numberField] of type number has been overwritten as new type: string" - ] + "query": "from a_index | eval var = now() * 1 d", + "error": [ + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 d] type [duration]" + ], + "warning": [] }, { - "query": "from a_index | eval round(numberField) + 1 | eval `round(numberField) + 1` + 1 | keep ```round(numberField) + 1`` + 1`", - "error": [], + "query": "from a_index | eval var = now() / 1 d", + "error": [ + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 d] type [duration]" + ], "warning": [] }, { - "query": "from a_index | eval round(numberField) + 1 | eval `round(numberField) + 1` + 1 | eval ```round(numberField) + 1`` + 1` + 1 | keep ```````round(numberField) + 1```` + 1`` + 1`", - "error": [], + "query": "from a_index | eval var = now() % 1 d", + "error": [ + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 d] type [duration]" + ], "warning": [] }, { - "query": "from a_index | eval round(numberField) + 1 | eval `round(numberField) + 1` + 1 | eval ```round(numberField) + 1`` + 1` + 1 | eval ```````round(numberField) + 1```` + 1`` + 1` + 1 | keep ```````````````round(numberField) + 1```````` + 1```` + 1`` + 1`", - "error": [], + "query": "from a_index | eval 1 w", + "error": [ + "EVAL does not support [date_period] in expression [1 w]" + ], "warning": [] }, { - "query": "from a_index | eval round(numberField) + 1 | eval `round(numberField) + 1` + 1 | eval ```round(numberField) + 1`` + 1` + 1 | eval ```````round(numberField) + 1```` + 1`` + 1` + 1 | eval ```````````````round(numberField) + 1```````` + 1```` + 1`` + 1` + 1 | keep ```````````````````````````````round(numberField) + 1```````````````` + 1```````` + 1```` + 1`` + 1`", - "error": [], + "query": "from a_index | eval 1 w", + "error": [ + "EVAL does not support [date_period] in expression [1 w]" + ], "warning": [] }, { - "query": "from a_index | eval 1::string", + "query": "from a_index | eval var = now() - 1 w", "error": [], "warning": [] }, { - "query": "from a_index | eval 1::string::long::double", + "query": "from a_index | eval var = dateField - 1 w", "error": [], "warning": [] }, { - "query": "from a_index | eval trim(\"23\"::double)", - "error": [ - "Argument of [trim] must be [string], found value [\"23\"::double] type [double]" - ], + "query": "from a_index | eval var = dateField - 1 W", + "error": [], "warning": [] }, { - "query": "from a_index | eval trim(23::string)", + "query": "from a_index | eval var = dateField - 1 W", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + \"2\"::long", + "query": "from a_index | eval var = dateField + 1 w", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 + \"2\"", + "query": "from a_index | eval 1 w + 1 year", "error": [ - "Argument of [+] must be [number], found value [\"2\"] type [string]" + "Argument of [+] must be [date], found value [1 w] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval trim(to_double(\"23\")::string::double::long::string::double)", + "query": "from a_index | eval var = now() * 1 w", "error": [ - "Argument of [trim] must be [string], found value [to_double(\"23\")::string::double::long::string::double] type [double]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 w] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval CEIL(23::long)", - "error": [], + "query": "from a_index | eval var = now() / 1 w", + "error": [ + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 w] type [duration]" + ], "warning": [] }, { - "query": "from a_index | eval CEIL(23::unsigned_long)", - "error": [], + "query": "from a_index | eval var = now() % 1 w", + "error": [ + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 w] type [duration]" + ], "warning": [] }, { - "query": "from a_index | eval CEIL(23::int)", - "error": [], + "query": "from a_index | eval 1 mo", + "error": [ + "EVAL does not support [date_period] in expression [1 mo]" + ], "warning": [] }, { - "query": "from a_index | eval CEIL(23::integer)", - "error": [], + "query": "from a_index | eval 1 mo", + "error": [ + "EVAL does not support [date_period] in expression [1 mo]" + ], "warning": [] }, { - "query": "from a_index | eval CEIL(23::double)", + "query": "from a_index | eval var = now() - 1 mo", "error": [], "warning": [] }, { - "query": "from a_index | eval TRIM(23::string)", + "query": "from a_index | eval var = dateField - 1 mo", "error": [], "warning": [] }, { - "query": "from a_index | eval TRIM(23::text)", + "query": "from a_index | eval var = dateField - 1 MO", "error": [], "warning": [] }, { - "query": "from a_index | eval TRIM(23::keyword)", + "query": "from a_index | eval var = dateField - 1 Mo", "error": [], "warning": [] }, { - "query": "from a_index | eval true AND \"false\"::boolean", + "query": "from a_index | eval var = dateField + 1 mo", "error": [], "warning": [] }, { - "query": "from a_index | eval true AND \"false\"::bool", - "error": [], + "query": "from a_index | eval 1 mo + 1 year", + "error": [ + "Argument of [+] must be [date], found value [1 mo] type [duration]" + ], "warning": [] }, { - "query": "from a_index | eval true AND \"false\"", + "query": "from a_index | eval var = now() * 1 mo", "error": [ - "Argument of [and] must be [boolean], found value [\"false\"] type [string]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 mo] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval to_lower(trim(numberField)::string)", + "query": "from a_index | eval var = now() / 1 mo", "error": [ - "Argument of [trim] must be [string], found value [numberField] type [number]" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 mo] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval to_upper(trim(numberField)::string::string::string::string)", + "query": "from a_index | eval var = now() % 1 mo", "error": [ - "Argument of [trim] must be [string], found value [numberField] type [number]" + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 mo] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval to_lower(to_upper(trim(numberField)::string)::string)", + "query": "from a_index | eval 1 q", "error": [ - "Argument of [trim] must be [string], found value [numberField] type [number]" + "EVAL does not support [date_period] in expression [1 q]" ], "warning": [] }, { - "query": "row var = date_diff(\"month\", \"2023-12-02T11:00:00.000Z\", \"2023-12-02T11:00:00.000Z\")", - "error": [], + "query": "from a_index | eval 1 q", + "error": [ + "EVAL does not support [date_period] in expression [1 q]" + ], "warning": [] }, { - "query": "row var = date_diff(\"mm\", \"2023-12-02T11:00:00.000Z\", \"2023-12-02T11:00:00.000Z\")", + "query": "from a_index | eval var = now() - 1 q", "error": [], "warning": [] }, { - "query": "row var = date_diff(\"bogus\", \"2023-12-02T11:00:00.000Z\", \"2023-12-02T11:00:00.000Z\")", + "query": "from a_index | eval var = dateField - 1 q", "error": [], - "warning": [ - "Invalid option [\"bogus\"] for date_diff. Supported options: [\"year\", \"years\", \"yy\", \"yyyy\", \"quarter\", \"quarters\", \"qq\", \"q\", \"month\", \"months\", \"mm\", \"m\", \"dayofyear\", \"dy\", \"y\", \"day\", \"days\", \"dd\", \"d\", \"week\", \"weeks\", \"wk\", \"ww\", \"weekday\", \"weekdays\", \"dw\", \"hour\", \"hours\", \"hh\", \"minute\", \"minutes\", \"mi\", \"n\", \"second\", \"seconds\", \"ss\", \"s\", \"millisecond\", \"milliseconds\", \"ms\", \"microsecond\", \"microseconds\", \"mcs\", \"nanosecond\", \"nanoseconds\", \"ns\"]." - ] + "warning": [] }, { - "query": "from a_index | eval date_diff(stringField, \"2023-12-02T11:00:00.000Z\", \"2023-12-02T11:00:00.000Z\")", + "query": "from a_index | eval var = dateField - 1 Q", "error": [], "warning": [] }, { - "query": "from a_index | eval date_diff(\"month\", dateField, \"2023-12-02T11:00:00.000Z\")", + "query": "from a_index | eval var = dateField - 1 Q", "error": [], "warning": [] }, { - "query": "from a_index | eval date_diff(\"month\", \"2023-12-02T11:00:00.000Z\", dateField)", + "query": "from a_index | eval var = dateField + 1 q", "error": [], "warning": [] }, { - "query": "from a_index | eval date_diff(\"month\", stringField, dateField)", + "query": "from a_index | eval 1 q + 1 year", "error": [ - "Argument of [date_diff] must be [date], found value [stringField] type [string]" + "Argument of [+] must be [date], found value [1 q] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval date_diff(\"month\", dateField, stringField)", + "query": "from a_index | eval var = now() * 1 q", "error": [ - "Argument of [date_diff] must be [date], found value [stringField] type [string]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 q] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = date_diff(\"year\", dateField, dateField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval date_diff(\"year\", dateField, dateField)", - "error": [], + "query": "from a_index | eval var = now() / 1 q", + "error": [ + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 q] type [duration]" + ], "warning": [] }, { - "query": "from a_index | eval var = date_diff(\"year\", to_datetime(stringField), to_datetime(stringField))", - "error": [], + "query": "from a_index | eval var = now() % 1 q", + "error": [ + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 q] type [duration]" + ], "warning": [] }, { - "query": "from a_index | eval date_diff(numberField, stringField, stringField)", + "query": "from a_index | eval 1 y", "error": [ - "Argument of [date_diff] must be [string], found value [numberField] type [number]", - "Argument of [date_diff] must be [date], found value [stringField] type [string]", - "Argument of [date_diff] must be [date], found value [stringField] type [string]" + "EVAL does not support [date_period] in expression [1 y]" ], "warning": [] }, { - "query": "from a_index | eval date_diff(\"year\", dateField, dateField, extraArg)", + "query": "from a_index | eval 1 y", "error": [ - "Error: [date_diff] function expects exactly 3 arguments, got 4." + "EVAL does not support [date_period] in expression [1 y]" ], "warning": [] }, { - "query": "from a_index | sort date_diff(\"year\", dateField, dateField)", + "query": "from a_index | eval var = now() - 1 y", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_diff(\"year\", to_datetime(dateField), to_datetime(dateField))", + "query": "from a_index | eval var = dateField - 1 y", "error": [], "warning": [] }, { - "query": "from a_index | eval date_diff(booleanField, booleanField, booleanField)", - "error": [ - "Argument of [date_diff] must be [string], found value [booleanField] type [boolean]", - "Argument of [date_diff] must be [date], found value [booleanField] type [boolean]", - "Argument of [date_diff] must be [date], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = dateField - 1 Y", + "error": [], "warning": [] }, { - "query": "from a_index | eval date_diff(null, null, null)", + "query": "from a_index | eval var = dateField - 1 Y", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval date_diff(nullVar, nullVar, nullVar)", + "query": "from a_index | eval var = dateField + 1 y", "error": [], "warning": [] }, { - "query": "from a_index | eval date_diff(\"year\", \"2022\", \"2022\")", - "error": [], + "query": "from a_index | eval 1 y + 1 year", + "error": [ + "Argument of [+] must be [date], found value [1 y] type [duration]" + ], "warning": [] }, { - "query": "from a_index | eval date_diff(\"year\", concat(\"20\", \"22\"), concat(\"20\", \"22\"))", + "query": "from a_index | eval var = now() * 1 y", "error": [ - "Argument of [date_diff] must be [date], found value [concat(\"20\",\"22\")] type [string]", - "Argument of [date_diff] must be [date], found value [concat(\"20\",\"22\")] type [string]" + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 y] type [duration]" ], "warning": [] }, { - "query": "row var = abs(5)", - "error": [], + "query": "from a_index | eval var = now() / 1 y", + "error": [ + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 y] type [duration]" + ], "warning": [] }, { - "query": "row abs(5)", - "error": [], + "query": "from a_index | eval var = now() % 1 y", + "error": [ + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 y] type [duration]" + ], "warning": [] }, { - "query": "row var = abs(to_integer(\"a\"))", - "error": [], + "query": "from a_index | eval 1 yr", + "error": [ + "EVAL does not support [date_period] in expression [1 yr]" + ], "warning": [] }, { - "query": "row var = abs(\"a\")", + "query": "from a_index | eval 1 yr", "error": [ - "Argument of [abs] must be [number], found value [\"a\"] type [string]" + "EVAL does not support [date_period] in expression [1 yr]" ], "warning": [] }, { - "query": "from a_index | where abs(numberField) > 0", + "query": "from a_index | eval var = now() - 1 yr", "error": [], "warning": [] }, { - "query": "from a_index | where abs(stringField) > 0", - "error": [ - "Argument of [abs] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = dateField - 1 yr", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = abs(numberField)", + "query": "from a_index | eval var = dateField - 1 YR", "error": [], "warning": [] }, { - "query": "from a_index | eval abs(numberField)", + "query": "from a_index | eval var = dateField - 1 Yr", "error": [], "warning": [] }, { - "query": "from a_index | eval var = abs(to_integer(stringField))", + "query": "from a_index | eval var = dateField + 1 yr", "error": [], "warning": [] }, { - "query": "from a_index | eval abs(stringField)", + "query": "from a_index | eval 1 yr + 1 year", "error": [ - "Argument of [abs] must be [number], found value [stringField] type [string]" + "Argument of [+] must be [date], found value [1 yr] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval abs(numberField, extraArg)", + "query": "from a_index | eval var = now() * 1 yr", "error": [ - "Error: [abs] function expects exactly one argument, got 2." + "Argument of [*] must be [double], found value [now()] type [date]", + "Argument of [*] must be [double], found value [1 yr] type [duration]" ], "warning": [] }, { - "query": "from a_index | eval var = abs(*)", + "query": "from a_index | eval var = now() / 1 yr", "error": [ - "Using wildcards (*) in abs is not allowed" + "Argument of [/] must be [double], found value [now()] type [date]", + "Argument of [/] must be [double], found value [1 yr] type [duration]" ], "warning": [] }, { - "query": "from a_index | sort abs(numberField)", - "error": [], + "query": "from a_index | eval var = now() % 1 yr", + "error": [ + "Argument of [%] must be [double], found value [now()] type [date]", + "Argument of [%] must be [double], found value [1 yr] type [duration]" + ], "warning": [] }, { - "query": "row var = abs(to_integer(true))", + "query": "from a_index | sort ", + "error": [ + "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" + ], + "warning": [] + }, + { + "query": "from a_index | sort \"field\" ", "error": [], "warning": [] }, { - "query": "row var = abs(true)", + "query": "from a_index | sort wrongField ", "error": [ - "Argument of [abs] must be [number], found value [true] type [boolean]" + "Unknown column [wrongField]" ], "warning": [] }, { - "query": "from a_index | where abs(booleanField) > 0", + "query": "from a_index | sort doubleField, ", "error": [ - "Argument of [abs] must be [number], found value [booleanField] type [boolean]" + "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}" ], "warning": [] }, { - "query": "from a_index | eval var = abs(to_integer(booleanField))", + "query": "from a_index | sort doubleField, textField", "error": [], "warning": [] }, { - "query": "from a_index | eval abs(booleanField)", - "error": [ - "Argument of [abs] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | sort \"field\" desc ", + "error": [], "warning": [] }, { - "query": "from a_index | eval abs(null)", + "query": "from a_index | sort doubleField desc ", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval abs(nullVar)", - "error": [], + "query": "from a_index | sort doubleField desc nulls ", + "error": [ + "SyntaxError: missing {'first', 'last'} at ''" + ], "warning": [] }, { - "query": "row var = acos(5)", + "query": "from a_index | sort doubleField desc nulls first", "error": [], "warning": [] }, { - "query": "row acos(5)", - "error": [], - "warning": [] - }, - { - "query": "row var = acos(to_integer(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = acos(\"a\")", + "query": "from a_index | sort doubleField desc first", "error": [ - "Argument of [acos] must be [number], found value [\"a\"] type [string]" + "SyntaxError: extraneous input 'first' expecting " ], "warning": [] }, { - "query": "from a_index | where acos(numberField) > 0", + "query": "from a_index | sort doubleField desc nulls last", "error": [], "warning": [] }, { - "query": "from a_index | where acos(stringField) > 0", + "query": "from a_index | sort doubleField desc last", "error": [ - "Argument of [acos] must be [number], found value [stringField] type [string]" + "SyntaxError: extraneous input 'last' expecting " ], "warning": [] }, { - "query": "from a_index | eval var = acos(numberField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval acos(numberField)", + "query": "from a_index | sort \"field\" asc ", "error": [], "warning": [] }, { - "query": "from a_index | eval var = acos(to_integer(stringField))", + "query": "from a_index | sort doubleField asc ", "error": [], "warning": [] }, { - "query": "from a_index | eval acos(stringField)", + "query": "from a_index | sort doubleField asc nulls ", "error": [ - "Argument of [acos] must be [number], found value [stringField] type [string]" + "SyntaxError: missing {'first', 'last'} at ''" ], "warning": [] }, { - "query": "from a_index | eval acos(numberField, extraArg)", - "error": [ - "Error: [acos] function expects exactly one argument, got 2." - ], + "query": "from a_index | sort doubleField asc nulls first", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = acos(*)", + "query": "from a_index | sort doubleField asc first", "error": [ - "Using wildcards (*) in acos is not allowed" + "SyntaxError: extraneous input 'first' expecting " ], "warning": [] }, { - "query": "from a_index | sort acos(numberField)", + "query": "from a_index | sort doubleField asc nulls last", "error": [], "warning": [] }, { - "query": "row var = acos(to_integer(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = acos(true)", - "error": [ - "Argument of [acos] must be [number], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where acos(booleanField) > 0", + "query": "from a_index | sort doubleField asc last", "error": [ - "Argument of [acos] must be [number], found value [booleanField] type [boolean]" + "SyntaxError: extraneous input 'last' expecting " ], "warning": [] }, { - "query": "from a_index | eval var = acos(to_integer(booleanField))", + "query": "from a_index | sort doubleField nulls first", "error": [], "warning": [] }, { - "query": "from a_index | eval acos(booleanField)", + "query": "from a_index | sort doubleField first", "error": [ - "Argument of [acos] must be [number], found value [booleanField] type [boolean]" + "SyntaxError: extraneous input 'first' expecting " ], "warning": [] }, { - "query": "from a_index | eval acos(null)", + "query": "from a_index | sort doubleField nulls last", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval acos(nullVar)", - "error": [], + "query": "from a_index | sort doubleField last", + "error": [ + "SyntaxError: extraneous input 'last' expecting " + ], "warning": [] }, { - "query": "row var = asin(5)", + "query": "row a = 1 | stats COUNT(*) | sort `COUNT(*)`", "error": [], "warning": [] }, { - "query": "row asin(5)", + "query": "ROW a = 1 | STATS couNt(*) | SORT `couNt(*)`", "error": [], "warning": [] }, { - "query": "row var = asin(to_integer(\"a\"))", + "query": "from a_index | sort abs(doubleField) - to_long(textField) desc nulls first", "error": [], "warning": [] }, { - "query": "row var = asin(\"a\")", + "query": "from a_index | sort sin(textField)", "error": [ - "Argument of [asin] must be [number], found value [\"a\"] type [string]" + "Argument of [sin] must be [double], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | where asin(numberField) > 0", - "error": [], + "query": "from a_index | sort doubleField + textField", + "error": [ + "Argument of [+] must be [double], found value [textField] type [text]" + ], "warning": [] }, { - "query": "from a_index | where asin(stringField) > 0", + "query": "from a_index | enrich", "error": [ - "Argument of [asin] must be [number], found value [stringField] type [string]" + "SyntaxError: missing ENRICH_POLICY_NAME at ''" ], "warning": [] }, { - "query": "from a_index | eval var = asin(numberField)", - "error": [], + "query": "from a_index | enrich _", + "error": [ + "Unknown policy [_]" + ], "warning": [] }, { - "query": "from a_index | eval asin(numberField)", - "error": [], + "query": "from a_index | enrich _:", + "error": [ + "SyntaxError: token recognition error at: ':'", + "Unknown policy [_]" + ], "warning": [] }, { - "query": "from a_index | eval var = asin(to_integer(stringField))", - "error": [], + "query": "from a_index | enrich _:policy", + "error": [ + "Unrecognized value [_] for ENRICH, mode needs to be one of [_ANY, _COORDINATOR, _REMOTE]" + ], "warning": [] }, { - "query": "from a_index | eval asin(stringField)", + "query": "from a_index | enrich :policy", "error": [ - "Argument of [asin] must be [number], found value [stringField] type [string]" + "SyntaxError: token recognition error at: ':'" ], "warning": [] }, { - "query": "from a_index | eval asin(numberField, extraArg)", + "query": "from a_index | enrich any:", "error": [ - "Error: [asin] function expects exactly one argument, got 2." + "SyntaxError: token recognition error at: ':'", + "Unknown policy [any]" ], "warning": [] }, { - "query": "from a_index | eval var = asin(*)", + "query": "from a_index | enrich _any:", "error": [ - "Using wildcards (*) in asin is not allowed" + "SyntaxError: token recognition error at: ':'", + "Unknown policy [_any]" ], "warning": [] }, { - "query": "from a_index | sort asin(numberField)", - "error": [], + "query": "from a_index | enrich any:policy", + "error": [ + "Unrecognized value [any] for ENRICH, mode needs to be one of [_ANY, _COORDINATOR, _REMOTE]" + ], "warning": [] }, { - "query": "row var = asin(to_integer(true))", + "query": "from a_index | enrich policy ", "error": [], "warning": [] }, { - "query": "row var = asin(true)", + "query": "from a_index | enrich `this``is fine`", "error": [ - "Argument of [asin] must be [number], found value [true] type [boolean]" + "SyntaxError: extraneous input 'fine`' expecting ", + "Unknown policy [`this``is]" ], "warning": [] }, { - "query": "from a_index | where asin(booleanField) > 0", + "query": "from a_index | enrich this is fine", "error": [ - "Argument of [asin] must be [number], found value [booleanField] type [boolean]" + "SyntaxError: mismatched input 'is' expecting ", + "Unknown policy [this]" ], "warning": [] }, { - "query": "from a_index | eval var = asin(to_integer(booleanField))", + "query": "from a_index | enrich _any:policy ", "error": [], "warning": [] }, { - "query": "from a_index | eval asin(booleanField)", + "query": "from a_index | enrich _any : policy ", "error": [ - "Argument of [asin] must be [number], found value [booleanField] type [boolean]" + "SyntaxError: token recognition error at: ':'", + "SyntaxError: extraneous input 'policy' expecting ", + "Unknown policy [_any]" ], "warning": [] }, { - "query": "from a_index | eval asin(null)", - "error": [], - "warning": [] - }, - { - "query": "row nullVar = null | eval asin(nullVar)", - "error": [], + "query": "from a_index | enrich _any: policy ", + "error": [ + "SyntaxError: token recognition error at: ':'", + "SyntaxError: extraneous input 'policy' expecting ", + "Unknown policy [_any]" + ], "warning": [] }, { - "query": "row var = atan(5)", + "query": "from a_index | enrich _any:policy ", "error": [], "warning": [] }, { - "query": "row atan(5)", + "query": "from a_index | enrich _ANY:policy ", "error": [], "warning": [] }, { - "query": "row var = atan(to_integer(\"a\"))", + "query": "from a_index | enrich _coordinator:policy ", "error": [], "warning": [] }, { - "query": "row var = atan(\"a\")", + "query": "from a_index | enrich _coordinator : policy ", "error": [ - "Argument of [atan] must be [number], found value [\"a\"] type [string]" + "SyntaxError: token recognition error at: ':'", + "SyntaxError: extraneous input 'policy' expecting ", + "Unknown policy [_coordinator]" ], "warning": [] }, { - "query": "from a_index | where atan(numberField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where atan(stringField) > 0", + "query": "from a_index | enrich _coordinator: policy ", "error": [ - "Argument of [atan] must be [number], found value [stringField] type [string]" + "SyntaxError: token recognition error at: ':'", + "SyntaxError: extraneous input 'policy' expecting ", + "Unknown policy [_coordinator]" ], "warning": [] }, { - "query": "from a_index | eval var = atan(numberField)", + "query": "from a_index | enrich _coordinator:policy ", "error": [], "warning": [] }, { - "query": "from a_index | eval atan(numberField)", + "query": "from a_index | enrich _COORDINATOR:policy ", "error": [], "warning": [] }, { - "query": "from a_index | eval var = atan(to_integer(stringField))", + "query": "from a_index | enrich _remote:policy ", "error": [], "warning": [] }, { - "query": "from a_index | eval atan(stringField)", - "error": [ - "Argument of [atan] must be [number], found value [stringField] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | eval atan(numberField, extraArg)", + "query": "from a_index | enrich _remote : policy ", "error": [ - "Error: [atan] function expects exactly one argument, got 2." + "SyntaxError: token recognition error at: ':'", + "SyntaxError: extraneous input 'policy' expecting ", + "Unknown policy [_remote]" ], "warning": [] }, { - "query": "from a_index | eval var = atan(*)", + "query": "from a_index | enrich _remote: policy ", "error": [ - "Using wildcards (*) in atan is not allowed" + "SyntaxError: token recognition error at: ':'", + "SyntaxError: extraneous input 'policy' expecting ", + "Unknown policy [_remote]" ], "warning": [] }, { - "query": "from a_index | sort atan(numberField)", + "query": "from a_index | enrich _remote:policy ", "error": [], "warning": [] }, { - "query": "row var = atan(to_integer(true))", + "query": "from a_index | enrich _REMOTE:policy ", "error": [], "warning": [] }, { - "query": "row var = atan(true)", + "query": "from a_index | enrich _unknown:policy", "error": [ - "Argument of [atan] must be [number], found value [true] type [boolean]" + "Unrecognized value [_unknown] for ENRICH, mode needs to be one of [_ANY, _COORDINATOR, _REMOTE]" ], "warning": [] }, { - "query": "from a_index | where atan(booleanField) > 0", + "query": "from a_index |enrich missing-policy ", "error": [ - "Argument of [atan] must be [number], found value [booleanField] type [boolean]" + "Unknown policy [missing-policy]" ], "warning": [] }, { - "query": "from a_index | eval var = atan(to_integer(booleanField))", - "error": [], + "query": "from a_index |enrich policy on ", + "error": [ + "SyntaxError: missing ID_PATTERN at ''" + ], "warning": [] }, { - "query": "from a_index | eval atan(booleanField)", + "query": "from a_index | enrich policy on b ", "error": [ - "Argument of [atan] must be [number], found value [booleanField] type [boolean]" + "Unknown column [b]" ], "warning": [] }, { - "query": "from a_index | eval atan(null)", - "error": [], + "query": "from a_index | enrich policy on `this``is fine`", + "error": [ + "Unknown column [this`is fine]" + ], "warning": [] }, { - "query": "row nullVar = null | eval atan(nullVar)", - "error": [], + "query": "from a_index | enrich policy on this is fine", + "error": [ + "SyntaxError: mismatched input 'is' expecting ", + "Unknown column [this]" + ], "warning": [] }, { - "query": "row var = atan2(5, 5)", - "error": [], + "query": "from a_index | enrich policy on textField with ", + "error": [ + "SyntaxError: mismatched input '' expecting ID_PATTERN" + ], "warning": [] }, { - "query": "row atan2(5, 5)", - "error": [], + "query": "from a_index | enrich policy on textField with var0 ", + "error": [ + "Unknown column [var0]" + ], "warning": [] }, { - "query": "row var = atan2(to_integer(\"a\"), to_integer(\"a\"))", - "error": [], + "query": "from a_index |enrich policy on doubleField with var0 = ", + "error": [ + "SyntaxError: missing ID_PATTERN at ''", + "Unknown column [var0]" + ], "warning": [] }, { - "query": "row var = atan2(\"a\", \"a\")", + "query": "from a_index | enrich policy on textField with var0 = c ", "error": [ - "Argument of [atan2] must be [number], found value [\"a\"] type [string]", - "Argument of [atan2] must be [number], found value [\"a\"] type [string]" + "Unknown column [var0]", + "Unknown column [c]" ], "warning": [] }, { - "query": "from a_index | where atan2(numberField, numberField) > 0", - "error": [], + "query": "from a_index |enrich policy on doubleField with var0 = , ", + "error": [ + "SyntaxError: missing ID_PATTERN at ','", + "SyntaxError: mismatched input '' expecting ID_PATTERN", + "Unknown column [var0]" + ], "warning": [] }, { - "query": "from a_index | where atan2(stringField, stringField) > 0", + "query": "from a_index | enrich policy on textField with var0 = otherField, var1 ", "error": [ - "Argument of [atan2] must be [number], found value [stringField] type [string]", - "Argument of [atan2] must be [number], found value [stringField] type [string]" + "Unknown column [var1]" ], "warning": [] }, { - "query": "from a_index | eval var = atan2(numberField, numberField)", + "query": "from a_index | enrich policy on textField with var0 = otherField ", "error": [], "warning": [] }, { - "query": "from a_index | eval atan2(numberField, numberField)", + "query": "from a_index | enrich policy on textField with var0 = otherField, yetAnotherField ", "error": [], "warning": [] }, { - "query": "from a_index | eval var = atan2(to_integer(stringField), to_integer(stringField))", + "query": "from a_index |enrich policy on doubleField with var0 = otherField, var1 = ", + "error": [ + "SyntaxError: missing ID_PATTERN at ''", + "Unknown column [var1]" + ], + "warning": [] + }, + { + "query": "from a_index | enrich policy on textField with var0 = otherField, var1 = yetAnotherField", "error": [], "warning": [] }, { - "query": "from a_index | eval atan2(stringField, stringField)", - "error": [ - "Argument of [atan2] must be [number], found value [stringField] type [string]", - "Argument of [atan2] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | enrich policy on textField with var0 = otherField, `this``is fine` = yetAnotherField", + "error": [], "warning": [] }, { - "query": "from a_index | eval atan2(numberField, numberField, extraArg)", + "query": "from a_index | enrich policy with ", "error": [ - "Error: [atan2] function expects exactly 2 arguments, got 3." + "SyntaxError: mismatched input '' expecting ID_PATTERN" ], "warning": [] }, { - "query": "from a_index | sort atan2(numberField, numberField)", + "query": "from a_index | enrich policy with otherField", "error": [], "warning": [] }, { - "query": "row var = atan2(to_integer(true), to_integer(true))", + "query": "from a_index | enrich policy | eval otherField", "error": [], "warning": [] }, { - "query": "row var = atan2(true, true)", - "error": [ - "Argument of [atan2] must be [number], found value [true] type [boolean]", - "Argument of [atan2] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | enrich policy with var0 = otherField | eval var0", + "error": [], "warning": [] }, { - "query": "from a_index | where atan2(booleanField, booleanField) > 0", + "query": "from a_index | enrich my-pol*", "error": [ - "Argument of [atan2] must be [number], found value [booleanField] type [boolean]", - "Argument of [atan2] must be [number], found value [booleanField] type [boolean]" + "Using wildcards (*) in ENRICH is not allowed [my-pol*]" ], "warning": [] }, { - "query": "from a_index | eval var = atan2(to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval textField = 5", "error": [], - "warning": [] - }, - { - "query": "from a_index | eval atan2(booleanField, booleanField)", - "error": [ - "Argument of [atan2] must be [number], found value [booleanField] type [boolean]", - "Argument of [atan2] must be [number], found value [booleanField] type [boolean]" - ], - "warning": [] + "warning": [ + "Column [textField] of type text has been overwritten as new type: integer" + ] }, { - "query": "from a_index | eval atan2(null, null)", + "query": "from a_index | eval doubleField = \"5\"", "error": [], - "warning": [] + "warning": [ + "Column [doubleField] of type double has been overwritten as new type: string" + ] }, { - "query": "row nullVar = null | eval atan2(nullVar, nullVar)", + "query": "from a_index | eval round(doubleField) + 1 | eval `round(doubleField) + 1` + 1 | keep ```round(doubleField) + 1`` + 1`", "error": [], "warning": [] }, { - "query": "row var = case(true, \"a\")", + "query": "from a_index | eval round(doubleField) + 1 | eval `round(doubleField) + 1` + 1 | eval ```round(doubleField) + 1`` + 1` + 1 | keep ```````round(doubleField) + 1```` + 1`` + 1`", "error": [], "warning": [] }, { - "query": "row case(true, \"a\")", + "query": "from a_index | eval round(doubleField) + 1 | eval `round(doubleField) + 1` + 1 | eval ```round(doubleField) + 1`` + 1` + 1 | eval ```````round(doubleField) + 1```` + 1`` + 1` + 1 | keep ```````````````round(doubleField) + 1```````` + 1```` + 1`` + 1`", "error": [], "warning": [] }, { - "query": "from a_index | eval var = case(booleanField, stringField)", + "query": "from a_index | eval round(doubleField) + 1 | eval `round(doubleField) + 1` + 1 | eval ```round(doubleField) + 1`` + 1` + 1 | eval ```````round(doubleField) + 1```` + 1`` + 1` + 1 | eval ```````````````round(doubleField) + 1```````` + 1```` + 1`` + 1` + 1 | keep ```````````````````````````````round(doubleField) + 1```````````````` + 1```````` + 1```` + 1`` + 1`", "error": [], "warning": [] }, { - "query": "from a_index | eval case(booleanField, stringField)", + "query": "from a_index | eval 1::keyword", "error": [], "warning": [] }, { - "query": "from a_index | sort case(booleanField, stringField)", + "query": "from a_index | eval 1::keyword::long::double", "error": [], "warning": [] }, { - "query": "row var = case(to_cartesianpoint(\"POINT (30 10)\"), true)", + "query": "from a_index | eval trim(\"23\"::double)", "error": [ - "Argument of [case] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + "Argument of [trim] must be [keyword], found value [\"23\"::double] type [double]" ], "warning": [] }, { - "query": "from a_index | eval case(null, null)", + "query": "from a_index | eval trim(23::keyword)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval case(nullVar, nullVar)", + "query": "from a_index | eval 1 + \"2\"::long", "error": [], "warning": [] }, { - "query": "row var = ceil(5)", + "query": "from a_index | eval 1 + \"2\"::LONG", "error": [], "warning": [] }, { - "query": "row ceil(5)", + "query": "from a_index | eval 1 + \"2\"::Long", "error": [], "warning": [] }, { - "query": "row var = ceil(to_integer(\"a\"))", + "query": "from a_index | eval 1 + \"2\"::LoNg", "error": [], "warning": [] }, { - "query": "row var = ceil(\"a\")", + "query": "from a_index | eval 1 + \"2\"", + "error": [ + "Argument of [+] must be [date_period], found value [1] type [integer]" + ], + "warning": [] + }, + { + "query": "from a_index | eval trim(to_double(\"23\")::keyword::double::long::keyword::double)", "error": [ - "Argument of [ceil] must be [number], found value [\"a\"] type [string]" + "Argument of [trim] must be [keyword], found value [to_double(\"23\")::keyword::double::long::keyword::double] type [double]" ], "warning": [] }, { - "query": "from a_index | where ceil(numberField) > 0", + "query": "from a_index | eval CEIL(23::long)", "error": [], "warning": [] }, { - "query": "from a_index | where ceil(stringField) > 0", - "error": [ - "Argument of [ceil] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval CEIL(23::unsigned_long)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = ceil(numberField)", + "query": "from a_index | eval CEIL(23::int)", "error": [], "warning": [] }, { - "query": "from a_index | eval ceil(numberField)", + "query": "from a_index | eval CEIL(23::integer)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = ceil(to_integer(stringField))", + "query": "from a_index | eval CEIL(23::Integer)", "error": [], "warning": [] }, { - "query": "from a_index | eval ceil(stringField)", - "error": [ - "Argument of [ceil] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval CEIL(23::double)", + "error": [], "warning": [] }, { - "query": "from a_index | eval ceil(numberField, extraArg)", - "error": [ - "Error: [ceil] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval CEIL(23::DOUBLE)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = ceil(*)", + "query": "from a_index | eval CEIL(23::doubla)", "error": [ - "Using wildcards (*) in ceil is not allowed" + "Argument of [ceil] must be [double], found value [23::doubla] type [doubla]" ], "warning": [] }, { - "query": "from a_index | sort ceil(numberField)", + "query": "from a_index | eval TRIM(23::keyword)", "error": [], "warning": [] }, { - "query": "row var = ceil(to_integer(true))", + "query": "from a_index | eval TRIM(23::text)", "error": [], "warning": [] }, { - "query": "row var = ceil(true)", + "query": "from a_index | eval TRIM(23::keyword)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval true AND \"false\"::boolean", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval true AND \"false\"::bool", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval true AND \"false\"", "error": [ - "Argument of [ceil] must be [number], found value [true] type [boolean]" + "Argument of [and] must be [boolean], found value [\"false\"] type [string]" ], "warning": [] }, { - "query": "from a_index | where ceil(booleanField) > 0", + "query": "from a_index | eval to_lower(trim(doubleField)::keyword)", "error": [ - "Argument of [ceil] must be [number], found value [booleanField] type [boolean]" + "Argument of [trim] must be [keyword], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval var = ceil(to_integer(booleanField))", - "error": [], + "query": "from a_index | eval to_upper(trim(doubleField)::keyword::keyword::keyword::keyword)", + "error": [ + "Argument of [trim] must be [keyword], found value [doubleField] type [double]" + ], "warning": [] }, { - "query": "from a_index | eval ceil(booleanField)", + "query": "from a_index | eval to_lower(to_upper(trim(doubleField)::keyword)::keyword)", "error": [ - "Argument of [ceil] must be [number], found value [booleanField] type [boolean]" + "Argument of [trim] must be [keyword], found value [doubleField] type [double]" ], "warning": [] }, { - "query": "from a_index | eval ceil(null)", + "query": "row var = abs(5.5)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval ceil(nullVar)", + "query": "row abs(5.5)", "error": [], "warning": [] }, { - "query": "row var = cidr_match(to_ip(\"127.0.0.1\"), \"a\")", + "query": "row var = abs(to_double(true))", "error": [], "warning": [] }, { - "query": "row cidr_match(to_ip(\"127.0.0.1\"), \"a\")", + "query": "row var = abs(5)", "error": [], "warning": [] }, { - "query": "row var = cidr_match(to_ip(\"a\"), to_string(\"a\"))", + "query": "row abs(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = abs(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = cidr_match(\"a\", 5)", + "query": "row var = abs(true)", "error": [ - "Argument of [cidr_match] must be [ip], found value [\"a\"] type [string]", - "Argument of [cidr_match] must be [string], found value [5] type [number]" + "Argument of [abs] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = cidr_match(ipField, stringField)", + "query": "from a_index | where abs(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval cidr_match(ipField, stringField)", - "error": [], + "query": "from a_index | where abs(booleanField) > 0", + "error": [ + "Argument of [abs] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = cidr_match(to_ip(stringField), to_string(stringField))", + "query": "from a_index | where abs(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval cidr_match(stringField, numberField)", - "error": [ - "Argument of [cidr_match] must be [ip], found value [stringField] type [string]", - "Argument of [cidr_match] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | where abs(longField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | sort cidr_match(ipField, stringField)", + "query": "from a_index | where abs(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = cidr_match(to_ip(to_ip(\"127.0.0.1\")), to_string(true))", + "query": "from a_index | eval var = abs(doubleField)", "error": [], "warning": [] }, { - "query": "row var = cidr_match(true, true)", - "error": [ - "Argument of [cidr_match] must be [ip], found value [true] type [boolean]", - "Argument of [cidr_match] must be [string], found value [true] type [boolean]" - ], + "query": "from a_index | eval abs(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cidr_match(to_ip(ipField), to_string(booleanField))", + "query": "from a_index | eval var = abs(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval cidr_match(booleanField, booleanField)", + "query": "from a_index | eval abs(booleanField)", "error": [ - "Argument of [cidr_match] must be [ip], found value [booleanField] type [boolean]", - "Argument of [cidr_match] must be [string], found value [booleanField] type [boolean]" + "Argument of [abs] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval cidr_match(null, null)", - "error": [], + "query": "from a_index | eval var = abs(*)", + "error": [ + "Using wildcards (*) in abs is not allowed" + ], "warning": [] }, { - "query": "row nullVar = null | eval cidr_match(nullVar, nullVar)", + "query": "from a_index | eval var = abs(integerField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(5)", + "query": "from a_index | eval abs(integerField)", "error": [], "warning": [] }, { - "query": "row coalesce(5)", + "query": "from a_index | eval var = abs(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_integer(true))", + "query": "from a_index | eval var = abs(longField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(5, 5)", + "query": "from a_index | eval abs(longField)", "error": [], "warning": [] }, { - "query": "row coalesce(5, 5)", + "query": "from a_index | eval var = abs(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_integer(true), to_integer(true))", + "query": "from a_index | eval abs(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(now())", - "error": [], + "query": "from a_index | eval abs(doubleField, extraArg)", + "error": [ + "Error: [abs] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row coalesce(now())", + "query": "from a_index | sort abs(doubleField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_datetime(now()))", + "query": "from a_index | eval abs(null)", "error": [], "warning": [] }, { - "query": "row var = coalesce(now(), now())", + "query": "row nullVar = null | eval abs(nullVar)", "error": [], "warning": [] }, { - "query": "row coalesce(now(), now())", + "query": "row var = acos(5.5)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_datetime(now()), to_datetime(now()))", + "query": "row acos(5.5)", "error": [], "warning": [] }, { - "query": "row var = coalesce(\"a\")", + "query": "row var = acos(to_double(true))", "error": [], "warning": [] }, { - "query": "row coalesce(\"a\")", + "query": "row var = acos(5)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_string(true))", + "query": "row acos(5)", "error": [], "warning": [] }, { - "query": "row var = coalesce(\"a\", \"a\")", + "query": "row var = acos(to_integer(true))", "error": [], "warning": [] }, { - "query": "row coalesce(\"a\", \"a\")", - "error": [], + "query": "row var = acos(true)", + "error": [ + "Argument of [acos] must be [double], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = coalesce(to_string(true), to_string(true))", + "query": "from a_index | where acos(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = coalesce(true)", - "error": [], + "query": "from a_index | where acos(booleanField) > 0", + "error": [ + "Argument of [acos] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row coalesce(true)", + "query": "from a_index | where acos(integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_boolean(true))", + "query": "from a_index | where acos(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = coalesce(true, true)", + "query": "from a_index | where acos(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row coalesce(true, true)", + "query": "from a_index | eval var = acos(doubleField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_boolean(true), to_boolean(true))", + "query": "from a_index | eval acos(doubleField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = acos(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row coalesce(to_ip(\"127.0.0.1\"))", - "error": [], + "query": "from a_index | eval acos(booleanField)", + "error": [ + "Argument of [acos] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = coalesce(to_ip(to_ip(\"127.0.0.1\")))", - "error": [], + "query": "from a_index | eval var = acos(*)", + "error": [ + "Using wildcards (*) in acos is not allowed" + ], "warning": [] }, { - "query": "row var = coalesce(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = acos(integerField)", "error": [], "warning": [] }, { - "query": "row coalesce(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval acos(integerField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", + "query": "from a_index | eval var = acos(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = acos(longField)", "error": [], "warning": [] }, { - "query": "row coalesce(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval acos(longField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = acos(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval acos(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row coalesce(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval acos(doubleField, extraArg)", + "error": [ + "Error: [acos] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row var = coalesce(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | sort acos(doubleField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval acos(null)", "error": [], "warning": [] }, { - "query": "row coalesce(to_cartesianshape(\"POINT (30 10)\"))", + "query": "row nullVar = null | eval acos(nullVar)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row var = asin(5.5)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row asin(5.5)", "error": [], "warning": [] }, { - "query": "row coalesce(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row var = asin(to_double(true))", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row var = asin(5)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_geopoint(\"POINT (30 10)\"))", + "query": "row asin(5)", "error": [], "warning": [] }, { - "query": "row coalesce(to_geopoint(\"POINT (30 10)\"))", + "query": "row var = asin(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_geopoint(to_geopoint(\"POINT (30 10)\")))", - "error": [], + "query": "row var = asin(true)", + "error": [ + "Argument of [asin] must be [double], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = coalesce(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | where asin(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row coalesce(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | where asin(booleanField) > 0", + "error": [ + "Argument of [asin] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = coalesce(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | where asin(integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | where asin(longField) > 0", "error": [], "warning": [] }, { - "query": "row coalesce(to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | where asin(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = asin(doubleField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval asin(doubleField)", "error": [], "warning": [] }, { - "query": "row coalesce(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = asin(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", - "error": [], + "query": "from a_index | eval asin(booleanField)", + "error": [ + "Argument of [asin] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = coalesce(to_version(\"1.0.0\"))", - "error": [], + "query": "from a_index | eval var = asin(*)", + "error": [ + "Using wildcards (*) in asin is not allowed" + ], "warning": [] }, { - "query": "row coalesce(to_version(\"1.0.0\"))", + "query": "from a_index | eval var = asin(integerField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_version(\"a\"))", + "query": "from a_index | eval asin(integerField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", + "query": "from a_index | eval var = asin(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row coalesce(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", + "query": "from a_index | eval var = asin(longField)", "error": [], "warning": [] }, { - "query": "row var = coalesce(to_version(\"a\"), to_version(\"a\"))", + "query": "from a_index | eval asin(longField)", "error": [], "warning": [] }, { - "query": "from a_index | where coalesce(numberField) > 0", + "query": "from a_index | eval var = asin(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | where coalesce(numberField, numberField) > 0", + "query": "from a_index | eval asin(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(coalesce(stringField)) > 0", - "error": [], + "query": "from a_index | eval asin(doubleField, extraArg)", + "error": [ + "Error: [asin] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "from a_index | where length(coalesce(stringField, stringField)) > 0", + "query": "from a_index | sort asin(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(numberField)", + "query": "from a_index | eval asin(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(numberField)", + "query": "row nullVar = null | eval asin(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_integer(booleanField))", + "query": "row var = atan(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(numberField, numberField)", + "query": "row atan(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(numberField, numberField)", + "query": "row var = atan(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_integer(booleanField), to_integer(booleanField))", + "query": "row var = atan(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(dateField)", + "query": "row atan(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(dateField)", + "query": "row var = atan(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_datetime(dateField))", - "error": [], + "query": "row var = atan(true)", + "error": [ + "Argument of [atan] must be [double], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = coalesce(dateField, dateField)", + "query": "from a_index | where atan(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(dateField, dateField)", - "error": [], + "query": "from a_index | where atan(booleanField) > 0", + "error": [ + "Argument of [atan] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_datetime(dateField), to_datetime(dateField))", + "query": "from a_index | where atan(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(stringField)", + "query": "from a_index | where atan(longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(stringField)", + "query": "from a_index | where atan(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_string(booleanField))", + "query": "from a_index | eval var = atan(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(stringField, stringField)", + "query": "from a_index | eval atan(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(stringField, stringField)", + "query": "from a_index | eval var = atan(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_string(booleanField), to_string(booleanField))", - "error": [], + "query": "from a_index | eval atan(booleanField)", + "error": [ + "Argument of [atan] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = coalesce(booleanField)", - "error": [], + "query": "from a_index | eval var = atan(*)", + "error": [ + "Using wildcards (*) in atan is not allowed" + ], "warning": [] }, { - "query": "from a_index | eval coalesce(booleanField)", + "query": "from a_index | eval var = atan(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_boolean(booleanField))", + "query": "from a_index | eval atan(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(booleanField, booleanField)", + "query": "from a_index | eval var = atan(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(booleanField, booleanField)", + "query": "from a_index | eval var = atan(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_boolean(booleanField), to_boolean(booleanField))", + "query": "from a_index | eval atan(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(ipField)", + "query": "from a_index | eval var = atan(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(ipField)", + "query": "from a_index | eval atan(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_ip(ipField))", - "error": [], + "query": "from a_index | eval atan(doubleField, extraArg)", + "error": [ + "Error: [atan] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "from a_index | eval var = coalesce(ipField, ipField)", + "query": "from a_index | sort atan(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(ipField, ipField)", + "query": "from a_index | eval atan(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_ip(ipField), to_ip(ipField))", + "query": "row nullVar = null | eval atan(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(cartesianPointField)", + "query": "row var = atan2(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(cartesianPointField)", + "query": "row atan2(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_cartesianpoint(cartesianPointField))", + "query": "row var = atan2(to_double(true), to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(cartesianPointField, cartesianPointField)", + "query": "row var = atan2(5.5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(cartesianPointField, cartesianPointField)", + "query": "row atan2(5.5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "query": "row var = atan2(to_double(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(cartesianShapeField)", + "query": "row var = atan2(to_double(true), 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(cartesianShapeField)", + "query": "row var = atan2(5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField))", + "query": "row atan2(5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(cartesianShapeField, cartesianShapeField)", + "query": "row var = atan2(to_integer(true), to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(cartesianShapeField, cartesianShapeField)", + "query": "row var = atan2(5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "query": "row atan2(5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(geoPointField)", + "query": "row var = atan2(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(geoPointField)", + "query": "row var = atan2(to_integer(true), 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_geopoint(geoPointField))", + "query": "row var = atan2(5, to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(geoPointField, geoPointField)", + "query": "row var = atan2(5, to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(geoPointField, geoPointField)", - "error": [], + "query": "row var = atan2(true, true)", + "error": [ + "Argument of [atan2] must be [double], found value [true] type [boolean]", + "Argument of [atan2] must be [double], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "query": "from a_index | where atan2(doubleField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(geoShapeField)", - "error": [], + "query": "from a_index | where atan2(booleanField, booleanField) > 0", + "error": [ + "Argument of [atan2] must be [double], found value [booleanField] type [boolean]", + "Argument of [atan2] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval coalesce(geoShapeField)", + "query": "from a_index | where atan2(doubleField, integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_geoshape(geoPointField))", + "query": "from a_index | where atan2(doubleField, longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(geoShapeField, geoShapeField)", + "query": "from a_index | where atan2(doubleField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(geoShapeField, geoShapeField)", + "query": "from a_index | where atan2(integerField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "query": "from a_index | where atan2(integerField, integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(versionField)", + "query": "from a_index | where atan2(integerField, longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(versionField)", + "query": "from a_index | where atan2(integerField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_version(stringField))", + "query": "from a_index | where atan2(longField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(versionField, versionField)", + "query": "from a_index | where atan2(longField, integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(versionField, versionField)", + "query": "from a_index | where atan2(longField, longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = coalesce(to_version(stringField), to_version(stringField))", + "query": "from a_index | where atan2(longField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | sort coalesce(numberField)", + "query": "from a_index | where atan2(unsignedLongField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval coalesce(null)", + "query": "from a_index | where atan2(unsignedLongField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval coalesce(nullVar)", + "query": "from a_index | where atan2(unsignedLongField, longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | sort coalesce(booleanField)", + "query": "from a_index | where atan2(unsignedLongField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = concat(\"a\", \"a\")", + "query": "from a_index | eval var = atan2(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "row concat(\"a\", \"a\")", + "query": "from a_index | eval atan2(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "row var = concat(to_string(\"a\"), to_string(\"a\"))", + "query": "from a_index | eval var = atan2(to_double(booleanField), to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = concat(5, 5)", + "query": "from a_index | eval atan2(booleanField, booleanField)", "error": [ - "Argument of [concat] must be [string], found value [5] type [number]", - "Argument of [concat] must be [string], found value [5] type [number]" + "Argument of [atan2] must be [double], found value [booleanField] type [boolean]", + "Argument of [atan2] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where length(concat(stringField, stringField)) > 0", + "query": "from a_index | eval var = atan2(doubleField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(concat(numberField, numberField)) > 0", - "error": [ - "Argument of [concat] must be [string], found value [numberField] type [number]", - "Argument of [concat] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval atan2(doubleField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = concat(stringField, stringField)", + "query": "from a_index | eval var = atan2(to_double(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval concat(stringField, stringField)", + "query": "from a_index | eval var = atan2(doubleField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = concat(to_string(stringField), to_string(stringField))", + "query": "from a_index | eval atan2(doubleField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval concat(numberField, numberField)", - "error": [ - "Argument of [concat] must be [string], found value [numberField] type [number]", - "Argument of [concat] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval var = atan2(to_double(booleanField), longField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort concat(stringField, stringField)", + "query": "from a_index | eval var = atan2(doubleField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = concat(to_string(true), to_string(true))", + "query": "from a_index | eval atan2(doubleField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = concat(true, true)", - "error": [ - "Argument of [concat] must be [string], found value [true] type [boolean]", - "Argument of [concat] must be [string], found value [true] type [boolean]" - ], + "query": "from a_index | eval var = atan2(to_double(booleanField), unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(concat(booleanField, booleanField)) > 0", - "error": [ - "Argument of [concat] must be [string], found value [booleanField] type [boolean]", - "Argument of [concat] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = atan2(integerField, doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = concat(to_string(booleanField), to_string(booleanField))", + "query": "from a_index | eval atan2(integerField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval concat(booleanField, booleanField)", - "error": [ - "Argument of [concat] must be [string], found value [booleanField] type [boolean]", - "Argument of [concat] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = atan2(to_integer(booleanField), to_double(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval concat(null, null)", + "query": "from a_index | eval var = atan2(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval concat(nullVar, nullVar)", + "query": "from a_index | eval atan2(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = cos(5)", + "query": "from a_index | eval var = atan2(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row cos(5)", + "query": "from a_index | eval var = atan2(integerField, longField)", "error": [], "warning": [] }, { - "query": "row var = cos(to_integer(\"a\"))", + "query": "from a_index | eval atan2(integerField, longField)", "error": [], "warning": [] }, { - "query": "row var = cos(\"a\")", - "error": [ - "Argument of [cos] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval var = atan2(to_integer(booleanField), longField)", + "error": [], "warning": [] }, { - "query": "from a_index | where cos(numberField) > 0", + "query": "from a_index | eval var = atan2(integerField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | where cos(stringField) > 0", - "error": [ - "Argument of [cos] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval atan2(integerField, unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cos(numberField)", + "query": "from a_index | eval var = atan2(to_integer(booleanField), unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval cos(numberField)", + "query": "from a_index | eval var = atan2(longField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = cos(to_integer(stringField))", + "query": "from a_index | eval atan2(longField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval cos(stringField)", - "error": [ - "Argument of [cos] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = atan2(longField, to_double(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval cos(numberField, extraArg)", - "error": [ - "Error: [cos] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = atan2(longField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cos(*)", - "error": [ - "Using wildcards (*) in cos is not allowed" - ], + "query": "from a_index | eval atan2(longField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort cos(numberField)", + "query": "from a_index | eval var = atan2(longField, to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = cos(to_integer(true))", + "query": "from a_index | eval var = atan2(longField, longField)", "error": [], "warning": [] }, { - "query": "row var = cos(true)", - "error": [ - "Argument of [cos] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | eval atan2(longField, longField)", + "error": [], "warning": [] }, { - "query": "from a_index | where cos(booleanField) > 0", - "error": [ - "Argument of [cos] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = atan2(longField, unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cos(to_integer(booleanField))", + "query": "from a_index | eval atan2(longField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval cos(booleanField)", - "error": [ - "Argument of [cos] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = atan2(unsignedLongField, doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval cos(null)", + "query": "from a_index | eval atan2(unsignedLongField, doubleField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval cos(nullVar)", + "query": "from a_index | eval var = atan2(unsignedLongField, to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = cosh(5)", + "query": "from a_index | eval var = atan2(unsignedLongField, integerField)", "error": [], "warning": [] }, { - "query": "row cosh(5)", + "query": "from a_index | eval atan2(unsignedLongField, integerField)", "error": [], "warning": [] }, { - "query": "row var = cosh(to_integer(\"a\"))", + "query": "from a_index | eval var = atan2(unsignedLongField, to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = cosh(\"a\")", - "error": [ - "Argument of [cosh] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval var = atan2(unsignedLongField, longField)", + "error": [], "warning": [] }, { - "query": "from a_index | where cosh(numberField) > 0", + "query": "from a_index | eval atan2(unsignedLongField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | where cosh(stringField) > 0", - "error": [ - "Argument of [cosh] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = atan2(unsignedLongField, unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cosh(numberField)", + "query": "from a_index | eval atan2(unsignedLongField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval cosh(numberField)", - "error": [], + "query": "from a_index | eval atan2(doubleField, doubleField, extraArg)", + "error": [ + "Error: [atan2] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "from a_index | eval var = cosh(to_integer(stringField))", + "query": "from a_index | sort atan2(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval cosh(stringField)", - "error": [ - "Argument of [cosh] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval atan2(null, null)", + "error": [], "warning": [] }, { - "query": "from a_index | eval cosh(numberField, extraArg)", - "error": [ - "Error: [cosh] function expects exactly one argument, got 2." - ], + "query": "row nullVar = null | eval atan2(nullVar, nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cosh(*)", - "error": [ - "Using wildcards (*) in cosh is not allowed" - ], + "query": "row var = cbrt(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | sort cosh(numberField)", + "query": "row cbrt(5.5)", "error": [], "warning": [] }, { - "query": "row var = cosh(to_integer(true))", + "query": "row var = cbrt(to_double(true))", "error": [], "warning": [] }, { - "query": "row var = cosh(true)", - "error": [ - "Argument of [cosh] must be [number], found value [true] type [boolean]" - ], + "query": "row var = cbrt(5)", + "error": [], "warning": [] }, { - "query": "from a_index | where cosh(booleanField) > 0", - "error": [ - "Argument of [cosh] must be [number], found value [booleanField] type [boolean]" - ], + "query": "row cbrt(5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cosh(to_integer(booleanField))", + "query": "row var = cbrt(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval cosh(booleanField)", + "query": "row var = cbrt(true)", "error": [ - "Argument of [cosh] must be [number], found value [booleanField] type [boolean]" + "Argument of [cbrt] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval cosh(null)", + "query": "from a_index | where cbrt(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval cosh(nullVar)", - "error": [], + "query": "from a_index | where cbrt(booleanField) > 0", + "error": [ + "Argument of [cbrt] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", now())", + "query": "from a_index | where cbrt(integerField) > 0", "error": [], "warning": [] }, { - "query": "row date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", now())", + "query": "from a_index | where cbrt(longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval date_extract(\"SOME_RANDOM_STRING\", now())", + "query": "from a_index | where cbrt(unsignedLongField) > 0", "error": [], - "warning": [ - "Invalid option [\"SOME_RANDOM_STRING\"] for date_extract. Supported options: [\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", \"ALIGNED_DAY_OF_WEEK_IN_YEAR\", \"ALIGNED_WEEK_OF_MONTH\", \"ALIGNED_WEEK_OF_YEAR\", \"AMPM_OF_DAY\", \"CLOCK_HOUR_OF_AMPM\", \"CLOCK_HOUR_OF_DAY\", \"DAY_OF_MONTH\", \"DAY_OF_WEEK\", \"DAY_OF_YEAR\", \"EPOCH_DAY\", \"ERA\", \"HOUR_OF_AMPM\", \"HOUR_OF_DAY\", \"INSTANT_SECONDS\", \"MICRO_OF_DAY\", \"MICRO_OF_SECOND\", \"MILLI_OF_DAY\", \"MILLI_OF_SECOND\", \"MINUTE_OF_DAY\", \"MINUTE_OF_HOUR\", \"MONTH_OF_YEAR\", \"NANO_OF_DAY\", \"NANO_OF_SECOND\", \"OFFSET_SECONDS\", \"PROLEPTIC_MONTH\", \"SECOND_OF_DAY\", \"SECOND_OF_MINUTE\", \"YEAR\", \"YEAR_OF_ERA\"]." - ] + "warning": [] }, { - "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "query": "from a_index | eval var = cbrt(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "query": "from a_index | eval cbrt(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(stringField))", + "query": "from a_index | eval var = cbrt(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval date_extract(stringField, stringField)", + "query": "from a_index | eval cbrt(booleanField)", "error": [ - "Argument of [date_extract] must be [date], found value [stringField] type [string]" + "Argument of [cbrt] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField, extraArg)", + "query": "from a_index | eval var = cbrt(*)", "error": [ - "Error: [date_extract] function expects exactly 2 arguments, got 3." + "Using wildcards (*) in cbrt is not allowed" ], "warning": [] }, { - "query": "from a_index | sort date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "query": "from a_index | eval var = cbrt(integerField)", "error": [], "warning": [] }, { - "query": "row var = date_extract(true, true)", - "error": [ - "Argument of [date_extract] must be [string], found value [true] type [boolean]", - "Argument of [date_extract] must be [date], found value [true] type [boolean]" - ], + "query": "from a_index | eval cbrt(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(dateField))", + "query": "from a_index | eval var = cbrt(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval date_extract(booleanField, booleanField)", - "error": [ - "Argument of [date_extract] must be [string], found value [booleanField] type [boolean]", - "Argument of [date_extract] must be [date], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = cbrt(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval date_extract(null, null)", + "query": "from a_index | eval cbrt(longField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval date_extract(nullVar, nullVar)", + "query": "from a_index | eval var = cbrt(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", \"2022\")", + "query": "from a_index | eval cbrt(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", concat(\"20\", \"22\"))", + "query": "from a_index | eval cbrt(doubleField, extraArg)", "error": [ - "Argument of [date_extract] must be [date], found value [concat(\"20\",\"22\")] type [string]" + "Error: [cbrt] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "row var = date_format(\"a\", now())", + "query": "from a_index | sort cbrt(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval cbrt(null)", "error": [], "warning": [] }, { - "query": "row date_format(\"a\", now())", + "query": "row nullVar = null | eval cbrt(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_format(stringField, dateField)", + "query": "row var = ceil(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_format(stringField, dateField)", + "query": "row ceil(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_format(to_string(stringField), to_datetime(stringField))", + "query": "row var = ceil(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval date_format(stringField, numberField)", - "error": [ - "Argument of [date_format] must be [date], found value [numberField] type [number]" - ], + "query": "row var = ceil(5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval date_format(stringField, dateField, extraArg)", - "error": [ - "Error: [date_format] function expects no more than 2 arguments, got 3." - ], + "query": "row ceil(5)", + "error": [], "warning": [] }, { - "query": "from a_index | sort date_format(stringField, dateField)", + "query": "row var = ceil(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = date_format(true, true)", + "query": "row var = ceil(true)", "error": [ - "Argument of [date_format] must be [string], found value [true] type [boolean]", - "Argument of [date_format] must be [date], found value [true] type [boolean]" + "Argument of [ceil] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = date_format(to_string(booleanField), to_datetime(dateField))", + "query": "from a_index | where ceil(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval date_format(booleanField, booleanField)", + "query": "from a_index | where ceil(booleanField) > 0", "error": [ - "Argument of [date_format] must be [string], found value [booleanField] type [boolean]", - "Argument of [date_format] must be [date], found value [booleanField] type [boolean]" + "Argument of [ceil] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval date_format(null, null)", + "query": "from a_index | where ceil(integerField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval date_format(nullVar, nullVar)", + "query": "from a_index | where ceil(longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval date_format(stringField, \"2022\")", + "query": "from a_index | where ceil(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval date_format(stringField, concat(\"20\", \"22\"))", - "error": [ - "Argument of [date_format] must be [date], found value [concat(\"20\",\"22\")] type [string]" - ], - "warning": [] - }, - { - "query": "row var = date_parse(\"a\", \"a\")", + "query": "from a_index | eval var = ceil(doubleField)", "error": [], "warning": [] }, { - "query": "row var = date_parse(\"a\")", + "query": "from a_index | eval ceil(doubleField)", "error": [], "warning": [] }, { - "query": "row date_parse(\"a\", \"a\")", + "query": "from a_index | eval var = ceil(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = date_parse(to_string(\"a\"), to_string(\"a\"))", - "error": [], + "query": "from a_index | eval ceil(booleanField)", + "error": [ + "Argument of [ceil] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = date_parse(5, 5)", + "query": "from a_index | eval var = ceil(*)", "error": [ - "Argument of [date_parse] must be [string], found value [5] type [number]", - "Argument of [date_parse] must be [string], found value [5] type [number]" + "Using wildcards (*) in ceil is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = date_parse(stringField)", + "query": "from a_index | eval var = ceil(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_parse(stringField, stringField)", + "query": "from a_index | eval ceil(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_parse(stringField, stringField)", + "query": "from a_index | eval var = ceil(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_parse(to_string(stringField), to_string(stringField))", + "query": "from a_index | eval var = ceil(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_parse(numberField, numberField)", - "error": [ - "Argument of [date_parse] must be [string], found value [numberField] type [number]", - "Argument of [date_parse] must be [string], found value [numberField] type [number]" - ], - "warning": [] - }, - { - "query": "from a_index | eval date_parse(stringField, stringField, extraArg)", - "error": [ - "Error: [date_parse] function expects no more than 2 arguments, got 3." - ], + "query": "from a_index | eval ceil(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort date_parse(stringField, stringField)", + "query": "from a_index | eval var = ceil(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = date_parse(to_string(true), to_string(true))", + "query": "from a_index | eval ceil(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = date_parse(true, true)", + "query": "from a_index | eval ceil(doubleField, extraArg)", "error": [ - "Argument of [date_parse] must be [string], found value [true] type [boolean]", - "Argument of [date_parse] must be [string], found value [true] type [boolean]" + "Error: [ceil] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = date_parse(to_string(booleanField), to_string(booleanField))", + "query": "from a_index | sort ceil(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_parse(booleanField, booleanField)", - "error": [ - "Argument of [date_parse] must be [string], found value [booleanField] type [boolean]", - "Argument of [date_parse] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval ceil(null)", + "error": [], "warning": [] }, { - "query": "from a_index | eval date_parse(null, null)", + "query": "row nullVar = null | eval ceil(nullVar)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval date_parse(nullVar, nullVar)", + "query": "row var = cidr_match(to_ip(\"127.0.0.1\"), \"a\")", "error": [], "warning": [] }, { - "query": "row var = date_trunc(1 year, now())", + "query": "row cidr_match(to_ip(\"127.0.0.1\"), \"a\")", "error": [], "warning": [] }, { - "query": "row date_trunc(1 year, now())", + "query": "row var = cidr_match(to_ip(to_ip(\"127.0.0.1\")), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_trunc(1 year, dateField)", - "error": [], + "query": "row var = cidr_match(true, true)", + "error": [ + "Argument of [cidr_match] must be [ip], found value [true] type [boolean]", + "Argument of [cidr_match] must be [keyword], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval date_trunc(1 year, dateField)", + "query": "from a_index | eval var = cidr_match(ipField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_trunc(1 year, to_datetime(stringField))", + "query": "from a_index | eval cidr_match(ipField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_trunc(stringField, stringField)", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [stringField] type [string]", - "Argument of [date_trunc] must be [date], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = cidr_match(to_ip(ipField), to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval date_trunc(1 year, dateField, extraArg)", + "query": "from a_index | eval cidr_match(booleanField, booleanField)", "error": [ - "Error: [date_trunc] function expects exactly 2 arguments, got 3." + "Argument of [cidr_match] must be [ip], found value [booleanField] type [boolean]", + "Argument of [cidr_match] must be [keyword], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort date_trunc(1 year, dateField)", + "query": "from a_index | eval var = cidr_match(ipField, textField)", "error": [], "warning": [] }, { - "query": "row var = date_trunc(now(), now())", + "query": "from a_index | eval cidr_match(ipField, textField)", "error": [], "warning": [] }, { - "query": "row date_trunc(now(), now())", + "query": "from a_index | sort cidr_match(ipField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = date_trunc(true, true)", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [true] type [boolean]", - "Argument of [date_trunc] must be [date], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = date_trunc(1 year, to_datetime(dateField))", + "query": "from a_index | eval cidr_match(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_trunc(booleanField, booleanField)", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [booleanField] type [boolean]", - "Argument of [date_trunc] must be [date], found value [booleanField] type [boolean]" - ], + "query": "row nullVar = null | eval cidr_match(nullVar, nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_trunc(dateField, dateField)", + "query": "row var = coalesce(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_trunc(dateField, dateField)", + "query": "row coalesce(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_trunc(to_datetime(dateField), to_datetime(dateField))", + "query": "row var = coalesce(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval date_trunc(null, null)", + "query": "row var = coalesce(true, true)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval date_trunc(nullVar, nullVar)", + "query": "row coalesce(true, true)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_trunc(1 year, \"2022\")", + "query": "row var = coalesce(to_boolean(true), to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval date_trunc(1 year, concat(\"20\", \"22\"))", + "query": "row var = coalesce(cartesianPointField, cartesianPointField)", "error": [ - "Argument of [date_trunc] must be [date], found value [concat(\"20\",\"22\")] type [string]" + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval date_trunc(\"2022\", \"2022\")", - "error": [], + "query": "row coalesce(cartesianPointField, cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval date_trunc(concat(\"20\", \"22\"), concat(\"20\", \"22\"))", + "query": "row var = coalesce(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [ - "Argument of [date_trunc] must be [time_literal], found value [concat(\"20\",\"22\")] type [string]", - "Argument of [date_trunc] must be [date], found value [concat(\"20\",\"22\")] type [string]" + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "row var = e()", + "query": "row var = coalesce(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row e()", + "query": "row coalesce(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | where e() > 0", + "query": "row var = coalesce(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], + "warning": [] + }, + { + "query": "row var = coalesce(to_datetime(\"2021-01-01T00:00:00Z\"), to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = e()", + "query": "row coalesce(to_datetime(\"2021-01-01T00:00:00Z\"), to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval e()", + "query": "row var = coalesce(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")), to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval e(extraArg)", + "query": "row var = coalesce(geoPointField, geoPointField)", "error": [ - "Error: [e] function expects exactly 0 arguments, got 1." + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | sort e()", - "error": [], + "query": "row coalesce(geoPointField, geoPointField)", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row nullVar = null | eval e()", - "error": [], - "warning": [] - }, - { - "query": "row var = ends_with(\"a\", \"a\")", - "error": [], + "query": "row var = coalesce(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row ends_with(\"a\", \"a\")", + "query": "row var = coalesce(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = ends_with(to_string(\"a\"), to_string(\"a\"))", + "query": "row coalesce(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = ends_with(5, 5)", + "query": "row var = coalesce(to_geoshape(geoPointField), to_geoshape(geoPointField))", "error": [ - "Argument of [ends_with] must be [string], found value [5] type [number]", - "Argument of [ends_with] must be [string], found value [5] type [number]" + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = ends_with(stringField, stringField)", + "query": "row var = coalesce(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval ends_with(stringField, stringField)", + "query": "row coalesce(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = ends_with(to_string(stringField), to_string(stringField))", + "query": "row var = coalesce(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval ends_with(numberField, numberField)", - "error": [ - "Argument of [ends_with] must be [string], found value [numberField] type [number]", - "Argument of [ends_with] must be [string], found value [numberField] type [number]" - ], - "warning": [] - }, - { - "query": "from a_index | eval ends_with(stringField, stringField, extraArg)", - "error": [ - "Error: [ends_with] function expects exactly 2 arguments, got 3." - ], + "query": "row var = coalesce(5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | sort ends_with(stringField, stringField)", + "query": "row coalesce(5, 5)", "error": [], "warning": [] }, { - "query": "row var = ends_with(to_string(true), to_string(true))", + "query": "row var = coalesce(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = ends_with(true, true)", - "error": [ - "Argument of [ends_with] must be [string], found value [true] type [boolean]", - "Argument of [ends_with] must be [string], found value [true] type [boolean]" - ], + "query": "row var = coalesce(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = ends_with(to_string(booleanField), to_string(booleanField))", + "query": "row coalesce(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval ends_with(booleanField, booleanField)", - "error": [ - "Argument of [ends_with] must be [string], found value [booleanField] type [boolean]", - "Argument of [ends_with] must be [string], found value [booleanField] type [boolean]" - ], + "query": "row var = coalesce(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", + "error": [], "warning": [] }, { - "query": "from a_index | eval ends_with(null, null)", + "query": "row var = coalesce(\"a\")", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval ends_with(nullVar, nullVar)", + "query": "row coalesce(\"a\")", "error": [], "warning": [] }, { - "query": "row var = floor(5)", + "query": "row var = coalesce(to_string(true))", "error": [], "warning": [] }, { - "query": "row floor(5)", + "query": "row var = coalesce(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = floor(to_integer(\"a\"))", + "query": "row coalesce(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = floor(\"a\")", - "error": [ - "Argument of [floor] must be [number], found value [\"a\"] type [string]" - ], + "query": "row var = coalesce(to_string(true), to_string(true))", + "error": [], "warning": [] }, { - "query": "from a_index | where floor(numberField) > 0", + "query": "row var = coalesce(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | where floor(stringField) > 0", - "error": [ - "Argument of [floor] must be [number], found value [stringField] type [string]" - ], + "query": "row coalesce(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = floor(numberField)", + "query": "row var = coalesce(to_version(\"a\"), to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval floor(numberField)", + "query": "row var = coalesce(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = floor(to_integer(stringField))", + "query": "from a_index | where coalesce(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval floor(stringField)", + "query": "from a_index | where coalesce(counterDoubleField) > 0", "error": [ - "Argument of [floor] must be [number], found value [stringField] type [string]" + "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | eval floor(numberField, extraArg)", - "error": [ - "Error: [floor] function expects exactly one argument, got 2." - ], + "query": "from a_index | where coalesce(integerField, integerField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = floor(*)", + "query": "from a_index | where coalesce(counterDoubleField, counterDoubleField) > 0", "error": [ - "Using wildcards (*) in floor is not allowed" + "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]", + "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | sort floor(numberField)", + "query": "from a_index | where coalesce(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = floor(to_integer(true))", + "query": "from a_index | where coalesce(longField, longField) > 0", "error": [], "warning": [] }, { - "query": "row var = floor(true)", - "error": [ - "Argument of [floor] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | eval var = coalesce(booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | where floor(booleanField) > 0", - "error": [ - "Argument of [floor] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval coalesce(booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = floor(to_integer(booleanField))", + "query": "from a_index | eval var = coalesce(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval floor(booleanField)", + "query": "from a_index | eval coalesce(counterDoubleField)", "error": [ - "Argument of [floor] must be [number], found value [booleanField] type [boolean]" + "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | eval floor(null)", + "query": "from a_index | eval var = coalesce(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval floor(nullVar)", + "query": "from a_index | eval coalesce(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "row var = greatest(\"a\")", + "query": "from a_index | eval var = coalesce(to_boolean(booleanField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row greatest(\"a\")", - "error": [], + "query": "from a_index | eval coalesce(counterDoubleField, counterDoubleField)", + "error": [ + "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]", + "Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]" + ], "warning": [] }, { - "query": "from a_index | eval var = greatest(stringField)", + "query": "from a_index | eval var = coalesce(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(stringField)", + "query": "from a_index | eval coalesce(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | sort greatest(stringField)", + "query": "from a_index | eval var = coalesce(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row var = greatest(true)", + "query": "from a_index | eval var = coalesce(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row greatest(true)", + "query": "from a_index | eval coalesce(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = greatest(to_boolean(true))", + "query": "from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row var = greatest(true, true)", + "query": "from a_index | eval var = coalesce(dateField, dateField)", "error": [], "warning": [] }, { - "query": "row greatest(true, true)", + "query": "from a_index | eval coalesce(dateField, dateField)", "error": [], "warning": [] }, { - "query": "row var = greatest(to_boolean(true), to_boolean(true))", + "query": "from a_index | eval var = coalesce(to_datetime(dateField), to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row var = greatest(5, 5)", + "query": "from a_index | eval var = coalesce(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "row greatest(5, 5)", + "query": "from a_index | eval coalesce(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "row var = greatest(to_integer(true), to_integer(true))", + "query": "from a_index | eval var = coalesce(to_geopoint(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = greatest(5)", + "query": "from a_index | eval var = coalesce(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row greatest(5)", + "query": "from a_index | eval coalesce(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = greatest(to_integer(true))", + "query": "from a_index | eval var = coalesce(to_geoshape(geoPointField), to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = greatest(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = coalesce(integerField)", "error": [], "warning": [] }, { - "query": "row greatest(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval coalesce(integerField)", "error": [], "warning": [] }, { - "query": "row var = greatest(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", + "query": "from a_index | eval var = coalesce(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = greatest(to_string(true))", + "query": "from a_index | eval var = coalesce(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = greatest(\"a\", \"a\")", + "query": "from a_index | eval coalesce(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row greatest(\"a\", \"a\")", + "query": "from a_index | eval var = coalesce(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = greatest(to_string(true), to_string(true))", + "query": "from a_index | eval var = coalesce(ipField, ipField)", "error": [], "warning": [] }, { - "query": "row var = greatest(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", + "query": "from a_index | eval coalesce(ipField, ipField)", "error": [], "warning": [] }, { - "query": "row greatest(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", + "query": "from a_index | eval var = coalesce(to_ip(ipField), to_ip(ipField))", "error": [], "warning": [] }, { - "query": "row var = greatest(to_version(\"a\"), to_version(\"a\"))", + "query": "from a_index | eval var = coalesce(keywordField)", "error": [], "warning": [] }, { - "query": "row var = greatest(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [greatest] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", - "Argument of [greatest] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where greatest(numberField, numberField) > 0", + "query": "from a_index | eval coalesce(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | where greatest(cartesianPointField, cartesianPointField) > 0", - "error": [ - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | eval var = coalesce(to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | where greatest(numberField) > 0", + "query": "from a_index | eval var = coalesce(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | where greatest(cartesianPointField) > 0", - "error": [ - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | eval coalesce(keywordField, keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(greatest(stringField)) > 0", + "query": "from a_index | eval var = coalesce(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where length(greatest(cartesianPointField)) > 0", - "error": [ - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | eval var = coalesce(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(greatest(stringField, stringField)) > 0", + "query": "from a_index | eval coalesce(longField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(greatest(cartesianPointField, cartesianPointField)) > 0", - "error": [ - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | eval var = coalesce(longField, longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(booleanField)", + "query": "from a_index | eval coalesce(longField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(booleanField)", + "query": "from a_index | eval var = coalesce(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(to_boolean(booleanField))", + "query": "from a_index | eval coalesce(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(cartesianPointField)", - "error": [ - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | eval var = coalesce(textField, textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(booleanField, booleanField)", + "query": "from a_index | eval coalesce(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(booleanField, booleanField)", + "query": "from a_index | eval var = coalesce(versionField, versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(to_boolean(booleanField), to_boolean(booleanField))", + "query": "from a_index | eval coalesce(versionField, versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(cartesianPointField, cartesianPointField)", - "error": [ - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | eval var = coalesce(to_version(keywordField), to_version(keywordField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(numberField, numberField)", + "query": "from a_index | sort coalesce(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(numberField, numberField)", + "query": "from a_index | eval coalesce(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(to_integer(booleanField), to_integer(booleanField))", + "query": "row nullVar = null | eval coalesce(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(numberField)", + "query": "from a_index | eval coalesce(\"2022\", \"2022\")", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(numberField)", + "query": "from a_index | eval coalesce(concat(\"20\", \"22\"), concat(\"20\", \"22\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(to_integer(booleanField))", + "query": "row var = concat(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(ipField, ipField)", + "query": "row concat(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(ipField, ipField)", + "query": "row var = concat(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(to_ip(ipField), to_ip(ipField))", - "error": [], + "query": "row var = concat(true, true)", + "error": [ + "Argument of [concat] must be [keyword], found value [true] type [boolean]", + "Argument of [concat] must be [keyword], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = greatest(to_string(booleanField))", + "query": "from a_index | eval var = concat(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(stringField, stringField)", + "query": "from a_index | eval concat(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(stringField, stringField)", + "query": "from a_index | eval var = concat(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(to_string(booleanField), to_string(booleanField))", - "error": [], + "query": "from a_index | eval concat(booleanField, booleanField)", + "error": [ + "Argument of [concat] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [concat] must be [keyword], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = greatest(versionField, versionField)", + "query": "from a_index | eval var = concat(keywordField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(versionField, versionField)", + "query": "from a_index | eval concat(keywordField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(to_version(stringField), to_version(stringField))", + "query": "from a_index | eval var = concat(textField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | sort greatest(booleanField)", + "query": "from a_index | eval concat(textField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(null)", + "query": "from a_index | eval var = concat(textField, textField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval greatest(nullVar)", + "query": "from a_index | eval concat(textField, textField)", "error": [], "warning": [] }, { - "query": "row var = least(\"a\")", + "query": "from a_index | sort concat(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row least(\"a\")", + "query": "from a_index | eval concat(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(stringField)", + "query": "row nullVar = null | eval concat(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval least(stringField)", + "query": "row var = cos(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | sort least(stringField)", + "query": "row cos(5.5)", "error": [], "warning": [] }, { - "query": "row var = least(true)", + "query": "row var = cos(to_double(true))", "error": [], "warning": [] }, { - "query": "row least(true)", + "query": "row var = cos(5)", "error": [], "warning": [] }, { - "query": "row var = least(to_boolean(true))", + "query": "row cos(5)", "error": [], "warning": [] }, { - "query": "row var = least(true, true)", + "query": "row var = cos(to_integer(true))", "error": [], "warning": [] }, { - "query": "row least(true, true)", - "error": [], + "query": "row var = cos(true)", + "error": [ + "Argument of [cos] must be [double], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = least(to_boolean(true), to_boolean(true))", + "query": "from a_index | where cos(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = least(5, 5)", - "error": [], + "query": "from a_index | where cos(booleanField) > 0", + "error": [ + "Argument of [cos] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row least(5, 5)", + "query": "from a_index | where cos(integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = least(to_integer(true), to_integer(true))", + "query": "from a_index | where cos(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = least(5)", + "query": "from a_index | where cos(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row least(5)", + "query": "from a_index | eval var = cos(doubleField)", "error": [], "warning": [] }, { - "query": "row var = least(to_integer(true))", + "query": "from a_index | eval cos(doubleField)", "error": [], "warning": [] }, { - "query": "row var = least(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = cos(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row least(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", - "error": [], + "query": "from a_index | eval cos(booleanField)", + "error": [ + "Argument of [cos] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = least(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", - "error": [], + "query": "from a_index | eval var = cos(*)", + "error": [ + "Using wildcards (*) in cos is not allowed" + ], "warning": [] }, { - "query": "row var = least(to_string(true))", + "query": "from a_index | eval var = cos(integerField)", "error": [], "warning": [] }, { - "query": "row var = least(\"a\", \"a\")", + "query": "from a_index | eval cos(integerField)", "error": [], "warning": [] }, { - "query": "row least(\"a\", \"a\")", + "query": "from a_index | eval var = cos(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = least(to_string(true), to_string(true))", + "query": "from a_index | eval var = cos(longField)", "error": [], "warning": [] }, { - "query": "row var = least(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", + "query": "from a_index | eval cos(longField)", "error": [], "warning": [] }, { - "query": "row least(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", + "query": "from a_index | eval var = cos(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = least(to_version(\"a\"), to_version(\"a\"))", + "query": "from a_index | eval cos(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = least(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval cos(doubleField, extraArg)", "error": [ - "Argument of [least] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", - "Argument of [least] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + "Error: [cos] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | where least(numberField, numberField) > 0", + "query": "from a_index | sort cos(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | where least(cartesianPointField, cartesianPointField) > 0", - "error": [ - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | eval cos(null)", + "error": [], "warning": [] }, { - "query": "from a_index | where least(numberField) > 0", + "query": "row nullVar = null | eval cos(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | where least(cartesianPointField) > 0", - "error": [ - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "row var = cosh(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row cosh(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(least(stringField)) > 0", + "query": "row var = cosh(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | where length(least(cartesianPointField)) > 0", + "query": "row var = cosh(5)", + "error": [], + "warning": [] + }, + { + "query": "row cosh(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = cosh(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = cosh(true)", "error": [ - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Argument of [cosh] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where length(least(stringField, stringField)) > 0", + "query": "from a_index | where cosh(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where length(least(cartesianPointField, cartesianPointField)) > 0", + "query": "from a_index | where cosh(booleanField) > 0", "error": [ - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Argument of [cosh] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = least(booleanField)", + "query": "from a_index | where cosh(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval least(booleanField)", + "query": "from a_index | where cosh(longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(to_boolean(booleanField))", + "query": "from a_index | where cosh(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval least(cartesianPointField)", - "error": [ - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | eval var = cosh(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(booleanField, booleanField)", + "query": "from a_index | eval cosh(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval least(booleanField, booleanField)", + "query": "from a_index | eval var = cosh(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(to_boolean(booleanField), to_boolean(booleanField))", - "error": [], + "query": "from a_index | eval cosh(booleanField)", + "error": [ + "Argument of [cosh] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval least(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval var = cosh(*)", "error": [ - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Using wildcards (*) in cosh is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = least(numberField, numberField)", + "query": "from a_index | eval var = cosh(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval least(numberField, numberField)", + "query": "from a_index | eval cosh(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval var = cosh(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(numberField)", + "query": "from a_index | eval var = cosh(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval least(numberField)", + "query": "from a_index | eval cosh(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(to_integer(booleanField))", + "query": "from a_index | eval var = cosh(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(ipField, ipField)", + "query": "from a_index | eval cosh(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval least(ipField, ipField)", - "error": [], + "query": "from a_index | eval cosh(doubleField, extraArg)", + "error": [ + "Error: [cosh] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "from a_index | eval var = least(to_ip(ipField), to_ip(ipField))", + "query": "from a_index | sort cosh(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(to_string(booleanField))", + "query": "from a_index | eval cosh(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(stringField, stringField)", + "query": "row nullVar = null | eval cosh(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval least(stringField, stringField)", + "query": "from a_index | eval var = date_diff(\"year\", dateField, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(to_string(booleanField), to_string(booleanField))", + "query": "from a_index | eval date_diff(\"year\", dateField, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(versionField, versionField)", + "query": "from a_index | eval var = date_diff(\"year\", to_datetime(dateField), to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | eval least(versionField, versionField)", - "error": [], + "query": "from a_index | eval date_diff(booleanField, booleanField, booleanField)", + "error": [ + "Argument of [date_diff] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [date_diff] must be [date], found value [booleanField] type [boolean]", + "Argument of [date_diff] must be [date], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = least(to_version(stringField), to_version(stringField))", + "query": "from a_index | eval var = date_diff(textField, dateField, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | sort least(booleanField)", + "query": "from a_index | eval date_diff(textField, dateField, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval least(null)", + "query": "from a_index | eval var = date_diff(to_string(booleanField), to_datetime(dateField), to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval least(nullVar)", + "query": "from a_index | eval date_diff(\"year\", dateField, dateField, extraArg)", + "error": [ + "Error: [date_diff] function expects exactly 3 arguments, got 4." + ], + "warning": [] + }, + { + "query": "from a_index | sort date_diff(\"year\", dateField, dateField)", "error": [], "warning": [] }, { - "query": "row var = left(\"a\", 5)", + "query": "from a_index | eval date_diff(null, null, null)", "error": [], "warning": [] }, { - "query": "row left(\"a\", 5)", + "query": "row nullVar = null | eval date_diff(nullVar, nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row var = left(to_string(\"a\"), to_integer(\"a\"))", + "query": "from a_index | eval date_diff(\"year\", \"2022\", \"2022\")", "error": [], "warning": [] }, { - "query": "row var = left(5, \"a\")", + "query": "from a_index | eval date_diff(\"year\", concat(\"20\", \"22\"), concat(\"20\", \"22\"))", "error": [ - "Argument of [left] must be [string], found value [5] type [number]", - "Argument of [left] must be [number], found value [\"a\"] type [string]" + "Argument of [date_diff] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", + "Argument of [date_diff] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" ], "warning": [] }, { - "query": "from a_index | where length(left(stringField, numberField)) > 0", + "query": "from a_index | eval date_diff(textField, \"2022\", \"2022\")", "error": [], "warning": [] }, { - "query": "from a_index | where length(left(numberField, stringField)) > 0", + "query": "from a_index | eval date_diff(textField, concat(\"20\", \"22\"), concat(\"20\", \"22\"))", "error": [ - "Argument of [left] must be [string], found value [numberField] type [number]", - "Argument of [left] must be [number], found value [stringField] type [string]" + "Argument of [date_diff] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", + "Argument of [date_diff] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval var = left(stringField, numberField)", + "query": "row var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval left(stringField, numberField)", + "query": "row date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = left(to_string(stringField), to_integer(stringField))", + "query": "row var = date_extract(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval left(numberField, stringField)", - "error": [ - "Argument of [left] must be [string], found value [numberField] type [number]", - "Argument of [left] must be [number], found value [stringField] type [string]" - ], + "query": "row date_extract(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval left(stringField, numberField, extraArg)", + "query": "row var = date_extract(true, true)", "error": [ - "Error: [left] function expects exactly 2 arguments, got 3." + "Argument of [date_extract] must be [keyword], found value [true] type [boolean]", + "Argument of [date_extract] must be [date], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort left(stringField, numberField)", + "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", "error": [], "warning": [] }, { - "query": "row var = left(to_string(true), to_integer(true))", + "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", "error": [], "warning": [] }, { - "query": "row var = left(true, true)", - "error": [ - "Argument of [left] must be [string], found value [true] type [boolean]", - "Argument of [left] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(dateField))", + "error": [], "warning": [] }, { - "query": "from a_index | where length(left(booleanField, booleanField)) > 0", + "query": "from a_index | eval date_extract(booleanField, booleanField)", "error": [ - "Argument of [left] must be [string], found value [booleanField] type [boolean]", - "Argument of [left] must be [number], found value [booleanField] type [boolean]" + "Argument of [date_extract] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [date_extract] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = left(to_string(booleanField), to_integer(booleanField))", + "query": "from a_index | eval var = date_extract(textField, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval left(booleanField, booleanField)", - "error": [ - "Argument of [left] must be [string], found value [booleanField] type [boolean]", - "Argument of [left] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval date_extract(textField, dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval left(null, null)", + "query": "from a_index | eval var = date_extract(to_string(booleanField), to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval left(nullVar, nullVar)", + "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField, extraArg)", + "error": [ + "Error: [date_extract] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | sort date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", "error": [], "warning": [] }, { - "query": "row var = length(\"a\")", + "query": "from a_index | eval date_extract(null, null)", "error": [], "warning": [] }, { - "query": "row length(\"a\")", + "query": "row nullVar = null | eval date_extract(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row var = length(to_string(\"a\"))", + "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", \"2022\")", "error": [], "warning": [] }, { - "query": "row var = length(5)", + "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", concat(\"20\", \"22\"))", "error": [ - "Argument of [length] must be [string], found value [5] type [number]" + "Argument of [date_extract] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" ], "warning": [] }, { - "query": "from a_index | where length(stringField) > 0", + "query": "from a_index | eval date_extract(textField, \"2022\")", "error": [], "warning": [] }, { - "query": "from a_index | where length(numberField) > 0", + "query": "from a_index | eval date_extract(textField, concat(\"20\", \"22\"))", "error": [ - "Argument of [length] must be [string], found value [numberField] type [number]" + "Argument of [date_extract] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval var = length(stringField)", + "query": "row var = date_format(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval length(stringField)", + "query": "row date_format(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = length(to_string(stringField))", + "query": "row var = date_format(true, true)", + "error": [ + "Argument of [date_format] must be [keyword], found value [true] type [boolean]", + "Argument of [date_format] must be [date], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = date_format(keywordField, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval length(numberField)", - "error": [ - "Argument of [length] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval date_format(keywordField, dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval length(stringField, extraArg)", - "error": [ - "Error: [length] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = date_format(to_string(booleanField), to_datetime(dateField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = length(*)", + "query": "from a_index | eval date_format(booleanField, booleanField)", "error": [ - "Using wildcards (*) in length is not allowed" + "Argument of [date_format] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [date_format] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort length(stringField)", + "query": "from a_index | eval var = date_format(textField, dateField)", "error": [], "warning": [] }, { - "query": "row var = length(to_string(true))", + "query": "from a_index | eval date_format(textField, dateField)", "error": [], "warning": [] }, { - "query": "row var = length(true)", + "query": "from a_index | eval date_format(keywordField, dateField, extraArg)", "error": [ - "Argument of [length] must be [string], found value [true] type [boolean]" + "Error: [date_format] function expects no more than 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | where length(booleanField) > 0", - "error": [ - "Argument of [length] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | sort date_format(keywordField, dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = length(to_string(booleanField))", + "query": "from a_index | eval date_format(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval length(booleanField)", - "error": [ - "Argument of [length] must be [string], found value [booleanField] type [boolean]" - ], + "query": "row nullVar = null | eval date_format(nullVar, nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | eval length(null)", + "query": "from a_index | eval date_format(keywordField, \"2022\")", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval length(nullVar)", - "error": [], + "query": "from a_index | eval date_format(keywordField, concat(\"20\", \"22\"))", + "error": [ + "Argument of [date_format] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" + ], "warning": [] }, { - "query": "row var = log(5, 5)", + "query": "from a_index | eval date_format(textField, \"2022\")", "error": [], "warning": [] }, { - "query": "row log(5, 5)", - "error": [], + "query": "from a_index | eval date_format(textField, concat(\"20\", \"22\"))", + "error": [ + "Argument of [date_format] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" + ], "warning": [] }, { - "query": "row var = log(to_integer(\"a\"), to_integer(\"a\"))", + "query": "row var = date_parse(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = log(\"a\", \"a\")", - "error": [ - "Argument of [log] must be [number], found value [\"a\"] type [string]", - "Argument of [log] must be [number], found value [\"a\"] type [string]" - ], + "query": "row date_parse(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | where log(numberField, numberField) > 0", + "query": "row var = date_parse(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | where log(stringField, stringField) > 0", + "query": "row var = date_parse(true, true)", "error": [ - "Argument of [log] must be [number], found value [stringField] type [string]", - "Argument of [log] must be [number], found value [stringField] type [string]" + "Argument of [date_parse] must be [keyword], found value [true] type [boolean]", + "Argument of [date_parse] must be [keyword], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = log(numberField, numberField)", + "query": "from a_index | eval var = date_parse(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval log(numberField, numberField)", + "query": "from a_index | eval date_parse(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = log(to_integer(stringField), to_integer(stringField))", + "query": "from a_index | eval var = date_parse(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval log(stringField, stringField)", + "query": "from a_index | eval date_parse(booleanField, booleanField)", "error": [ - "Argument of [log] must be [number], found value [stringField] type [string]", - "Argument of [log] must be [number], found value [stringField] type [string]" + "Argument of [date_parse] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [date_parse] must be [keyword], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval log(numberField, numberField, extraArg)", - "error": [ - "Error: [log] function expects no more than 2 arguments, got 3." - ], + "query": "from a_index | eval var = date_parse(keywordField, textField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort log(numberField, numberField)", + "query": "from a_index | eval date_parse(keywordField, textField)", "error": [], "warning": [] }, { - "query": "row var = log(5)", + "query": "from a_index | eval var = date_parse(textField, keywordField)", "error": [], "warning": [] }, { - "query": "row log(5)", + "query": "from a_index | eval date_parse(textField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = log(to_integer(true))", + "query": "from a_index | eval var = date_parse(textField, textField)", "error": [], "warning": [] }, { - "query": "row var = log(to_integer(true), to_integer(true))", + "query": "from a_index | eval date_parse(textField, textField)", "error": [], "warning": [] }, { - "query": "row var = log(true, true)", + "query": "from a_index | eval date_parse(keywordField, keywordField, extraArg)", "error": [ - "Argument of [log] must be [number], found value [true] type [boolean]", - "Argument of [log] must be [number], found value [true] type [boolean]" + "Error: [date_parse] function expects no more than 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | where log(numberField) > 0", + "query": "from a_index | sort date_parse(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | where log(booleanField) > 0", - "error": [ - "Argument of [log] must be [number], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where log(booleanField, booleanField) > 0", - "error": [ - "Argument of [log] must be [number], found value [booleanField] type [boolean]", - "Argument of [log] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval date_parse(null, null)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = log(numberField)", + "query": "row nullVar = null | eval date_parse(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval log(numberField)", + "query": "row var = date_trunc(1 year, to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = log(to_integer(booleanField))", + "query": "row date_trunc(1 year, to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval log(booleanField)", + "query": "row var = date_trunc(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [ - "Argument of [log] must be [number], found value [booleanField] type [boolean]" + "Argument of [date_trunc] must be [time_literal], found value [\"a\"] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = log(*)", + "query": "row date_trunc(\"a\", to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [ - "Using wildcards (*) in log is not allowed" + "Argument of [date_trunc] must be [time_literal], found value [\"a\"] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = log(to_integer(booleanField), to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval log(booleanField, booleanField)", + "query": "row var = date_trunc(true, true)", "error": [ - "Argument of [log] must be [number], found value [booleanField] type [boolean]", - "Argument of [log] must be [number], found value [booleanField] type [boolean]" + "Argument of [date_trunc] must be [time_literal], found value [true] type [boolean]", + "Argument of [date_trunc] must be [date], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort log(numberField)", + "query": "from a_index | eval var = date_trunc(1 year, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval log(null, null)", + "query": "from a_index | eval date_trunc(1 year, dateField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval log(nullVar, nullVar)", + "query": "from a_index | eval var = date_trunc(1 year, to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row var = log10(5)", - "error": [], + "query": "from a_index | eval date_trunc(booleanField, booleanField)", + "error": [ + "Argument of [date_trunc] must be [time_literal], found value [booleanField] type [boolean]", + "Argument of [date_trunc] must be [date], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row log10(5)", - "error": [], + "query": "from a_index | eval var = date_trunc(textField, dateField)", + "error": [ + "Argument of [date_trunc] must be [time_literal], found value [textField] type [text]" + ], "warning": [] }, { - "query": "row var = log10(to_integer(\"a\"))", - "error": [], + "query": "from a_index | eval date_trunc(textField, dateField)", + "error": [ + "Argument of [date_trunc] must be [time_literal], found value [textField] type [text]" + ], "warning": [] }, { - "query": "row var = log10(\"a\")", + "query": "from a_index | eval var = date_trunc(textField, to_datetime(dateField))", "error": [ - "Argument of [log10] must be [number], found value [\"a\"] type [string]" + "Argument of [date_trunc] must be [time_literal], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | where log10(numberField) > 0", - "error": [], + "query": "from a_index | eval date_trunc(1 year, dateField, extraArg)", + "error": [ + "Error: [date_trunc] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "from a_index | where log10(stringField) > 0", - "error": [ - "Argument of [log10] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | sort date_trunc(1 year, dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = log10(numberField)", + "query": "from a_index | eval date_trunc(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval log10(numberField)", + "query": "row nullVar = null | eval date_trunc(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = log10(to_integer(stringField))", + "query": "from a_index | eval date_trunc(1 year, \"2022\")", "error": [], "warning": [] }, { - "query": "from a_index | eval log10(stringField)", + "query": "from a_index | eval date_trunc(1 year, concat(\"20\", \"22\"))", "error": [ - "Argument of [log10] must be [number], found value [stringField] type [string]" + "Argument of [date_trunc] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" ], "warning": [] }, { - "query": "from a_index | eval log10(numberField, extraArg)", + "query": "from a_index | eval date_trunc(textField, \"2022\")", "error": [ - "Error: [log10] function expects exactly one argument, got 2." + "Argument of [date_trunc] must be [time_literal], found value [textField] type [text]" ], "warning": [] }, { - "query": "from a_index | eval var = log10(*)", + "query": "from a_index | eval date_trunc(textField, concat(\"20\", \"22\"))", "error": [ - "Using wildcards (*) in log10 is not allowed" + "Argument of [date_trunc] must be [time_literal], found value [textField] type [text]", + "Argument of [date_trunc] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" ], "warning": [] }, { - "query": "from a_index | sort log10(numberField)", + "query": "row var = e()", "error": [], "warning": [] }, { - "query": "row var = log10(to_integer(true))", + "query": "row e()", "error": [], "warning": [] }, { - "query": "row var = log10(true)", - "error": [ - "Argument of [log10] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | where e() > 0", + "error": [], "warning": [] }, { - "query": "from a_index | where log10(booleanField) > 0", - "error": [ - "Argument of [log10] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = e()", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = log10(to_integer(booleanField))", + "query": "from a_index | eval e()", "error": [], "warning": [] }, { - "query": "from a_index | eval log10(booleanField)", + "query": "from a_index | eval e(extraArg)", "error": [ - "Argument of [log10] must be [number], found value [booleanField] type [boolean]" + "Error: [e] function expects exactly 0 arguments, got 1." ], "warning": [] }, { - "query": "from a_index | eval log10(null)", + "query": "from a_index | sort e()", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval log10(nullVar)", + "query": "row nullVar = null | eval e()", "error": [], "warning": [] }, { - "query": "row var = ltrim(\"a\")", + "query": "row var = ends_with(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row ltrim(\"a\")", + "query": "row ends_with(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = ltrim(to_string(\"a\"))", + "query": "row var = ends_with(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "row var = ltrim(5)", + "query": "row var = ends_with(true, true)", "error": [ - "Argument of [ltrim] must be [string], found value [5] type [number]" + "Argument of [ends_with] must be [keyword], found value [true] type [boolean]", + "Argument of [ends_with] must be [keyword], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where length(ltrim(stringField)) > 0", + "query": "from a_index | eval var = ends_with(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(ltrim(numberField)) > 0", - "error": [ - "Argument of [ltrim] must be [string], found value [numberField] type [number]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = ltrim(stringField)", + "query": "from a_index | eval ends_with(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval ltrim(stringField)", + "query": "from a_index | eval var = ends_with(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = ltrim(to_string(stringField))", - "error": [], + "query": "from a_index | eval ends_with(booleanField, booleanField)", + "error": [ + "Argument of [ends_with] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [ends_with] must be [keyword], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval ltrim(numberField)", - "error": [ - "Argument of [ltrim] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval var = ends_with(textField, textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval ltrim(stringField, extraArg)", - "error": [ - "Error: [ltrim] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval ends_with(textField, textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = ltrim(*)", + "query": "from a_index | eval ends_with(keywordField, keywordField, extraArg)", "error": [ - "Using wildcards (*) in ltrim is not allowed" + "Error: [ends_with] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | sort ltrim(stringField)", + "query": "from a_index | sort ends_with(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = ltrim(to_string(true))", + "query": "from a_index | eval ends_with(null, null)", "error": [], "warning": [] }, { - "query": "row var = ltrim(true)", - "error": [ - "Argument of [ltrim] must be [string], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where length(ltrim(booleanField)) > 0", - "error": [ - "Argument of [ltrim] must be [string], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = ltrim(to_string(booleanField))", + "query": "row nullVar = null | eval ends_with(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval ltrim(booleanField)", - "error": [ - "Argument of [ltrim] must be [string], found value [booleanField] type [boolean]" - ], + "query": "row var = exp(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval ltrim(null)", + "query": "row exp(5.5)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval ltrim(nullVar)", + "query": "row var = exp(to_double(true))", "error": [], "warning": [] }, { - "query": "row var = mv_avg(5)", + "query": "row var = exp(5)", "error": [], "warning": [] }, { - "query": "row mv_avg(5)", + "query": "row exp(5)", "error": [], "warning": [] }, { - "query": "row var = mv_avg(to_integer(\"a\"))", + "query": "row var = exp(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = mv_avg(\"a\")", + "query": "row var = exp(true)", "error": [ - "Argument of [mv_avg] must be [number], found value [\"a\"] type [string]" + "Argument of [exp] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where mv_avg(numberField) > 0", + "query": "from a_index | where exp(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where mv_avg(stringField) > 0", + "query": "from a_index | where exp(booleanField) > 0", "error": [ - "Argument of [mv_avg] must be [number], found value [stringField] type [string]" + "Argument of [exp] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = mv_avg(numberField)", + "query": "from a_index | where exp(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_avg(numberField)", + "query": "from a_index | where exp(longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_avg(to_integer(stringField))", + "query": "from a_index | where exp(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_avg(stringField)", - "error": [ - "Argument of [mv_avg] must be [number], found value [stringField] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | eval mv_avg(numberField, extraArg)", - "error": [ - "Error: [mv_avg] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_avg(*)", - "error": [ - "Using wildcards (*) in mv_avg is not allowed" - ], + "query": "from a_index | eval var = exp(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort mv_avg(numberField)", + "query": "from a_index | eval exp(doubleField)", "error": [], "warning": [] }, { - "query": "row var = mv_avg(to_integer(true))", + "query": "from a_index | eval var = exp(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_avg(true)", + "query": "from a_index | eval exp(booleanField)", "error": [ - "Argument of [mv_avg] must be [number], found value [true] type [boolean]" + "Argument of [exp] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where mv_avg(booleanField) > 0", + "query": "from a_index | eval var = exp(*)", "error": [ - "Argument of [mv_avg] must be [number], found value [booleanField] type [boolean]" + "Using wildcards (*) in exp is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = mv_avg(to_integer(booleanField))", + "query": "from a_index | eval var = exp(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_avg(booleanField)", - "error": [ - "Argument of [mv_avg] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval exp(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval mv_avg(null)", + "query": "from a_index | eval var = exp(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_avg(nullVar)", + "query": "from a_index | eval var = exp(longField)", "error": [], "warning": [] }, { - "query": "row var = mv_concat(\"a\", \"a\")", + "query": "from a_index | eval exp(longField)", "error": [], "warning": [] }, { - "query": "row mv_concat(\"a\", \"a\")", + "query": "from a_index | eval var = exp(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = mv_concat(to_string(\"a\"), to_string(\"a\"))", + "query": "from a_index | eval exp(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = mv_concat(5, 5)", + "query": "from a_index | eval exp(doubleField, extraArg)", "error": [ - "Argument of [mv_concat] must be [string], found value [5] type [number]", - "Argument of [mv_concat] must be [string], found value [5] type [number]" + "Error: [exp] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | where length(mv_concat(stringField, stringField)) > 0", + "query": "from a_index | sort exp(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_concat(numberField, numberField)) > 0", - "error": [ - "Argument of [mv_concat] must be [string], found value [numberField] type [number]", - "Argument of [mv_concat] must be [string], found value [numberField] type [number]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_concat(stringField, stringField)", + "query": "from a_index | eval exp(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_concat(stringField, stringField)", + "query": "row nullVar = null | eval exp(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_concat(to_string(stringField), to_string(stringField))", + "query": "row var = floor(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_concat(numberField, numberField)", - "error": [ - "Argument of [mv_concat] must be [string], found value [numberField] type [number]", - "Argument of [mv_concat] must be [string], found value [numberField] type [number]" - ], + "query": "row floor(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval mv_concat(stringField, stringField, extraArg)", - "error": [ - "Error: [mv_concat] function expects exactly 2 arguments, got 3." - ], + "query": "row var = floor(to_double(true))", + "error": [], "warning": [] }, { - "query": "from a_index | sort mv_concat(stringField, stringField)", + "query": "row var = floor(5)", "error": [], "warning": [] }, { - "query": "row var = mv_concat(to_string(true), to_string(true))", + "query": "row floor(5)", "error": [], "warning": [] }, { - "query": "row var = mv_concat(true, true)", - "error": [ - "Argument of [mv_concat] must be [string], found value [true] type [boolean]", - "Argument of [mv_concat] must be [string], found value [true] type [boolean]" - ], + "query": "row var = floor(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_concat(booleanField, booleanField)) > 0", + "query": "row var = floor(true)", "error": [ - "Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]", - "Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]" + "Argument of [floor] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = mv_concat(to_string(booleanField), to_string(booleanField))", + "query": "from a_index | where floor(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_concat(booleanField, booleanField)", + "query": "from a_index | where floor(booleanField) > 0", "error": [ - "Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]", - "Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]" + "Argument of [floor] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval mv_concat(null, null)", + "query": "from a_index | where floor(integerField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_concat(nullVar, nullVar)", + "query": "from a_index | where floor(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_count(\"a\")", + "query": "from a_index | where floor(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row mv_count(\"a\")", + "query": "from a_index | eval var = floor(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(stringField)", + "query": "from a_index | eval floor(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_count(stringField)", + "query": "from a_index | eval var = floor(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(*)", + "query": "from a_index | eval floor(booleanField)", "error": [ - "Using wildcards (*) in mv_count is not allowed" + "Argument of [floor] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort mv_count(stringField)", - "error": [], + "query": "from a_index | eval var = floor(*)", + "error": [ + "Using wildcards (*) in floor is not allowed" + ], "warning": [] }, { - "query": "row var = mv_count(true)", + "query": "from a_index | eval var = floor(integerField)", "error": [], "warning": [] }, { - "query": "row mv_count(true)", + "query": "from a_index | eval floor(integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_boolean(true))", + "query": "from a_index | eval var = floor(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = floor(longField)", "error": [], "warning": [] }, { - "query": "row mv_count(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval floor(longField)", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = floor(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval floor(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row mv_count(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval floor(doubleField, extraArg)", + "error": [ + "Error: [floor] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row var = mv_count(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | sort floor(doubleField)", "error": [], "warning": [] }, { - "query": "row var = mv_count(now())", + "query": "from a_index | eval floor(null)", "error": [], "warning": [] }, { - "query": "row mv_count(now())", + "query": "row nullVar = null | eval floor(nullVar)", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_datetime(now()))", + "query": "row var = from_base64(\"a\")", "error": [], "warning": [] }, { - "query": "row var = mv_count(5)", + "query": "row from_base64(\"a\")", "error": [], "warning": [] }, { - "query": "row mv_count(5)", + "query": "row var = from_base64(to_string(true))", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_integer(true))", - "error": [], + "query": "row var = from_base64(true)", + "error": [ + "Argument of [from_base64] must be [keyword], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = mv_count(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = from_base64(keywordField)", "error": [], "warning": [] }, { - "query": "row mv_count(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval from_base64(keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = from_base64(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_geoshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval from_base64(booleanField)", + "error": [ + "Argument of [from_base64] must be [keyword], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row mv_count(to_geoshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval var = from_base64(*)", + "error": [ + "Using wildcards (*) in from_base64 is not allowed" + ], "warning": [] }, { - "query": "row var = mv_count(to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = from_base64(textField)", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval from_base64(textField)", "error": [], "warning": [] }, { - "query": "row mv_count(to_ip(\"127.0.0.1\"))", - "error": [], + "query": "from a_index | eval from_base64(keywordField, extraArg)", + "error": [ + "Error: [from_base64] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row var = mv_count(to_ip(to_ip(\"127.0.0.1\")))", + "query": "from a_index | sort from_base64(keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_string(true))", + "query": "from a_index | eval from_base64(null)", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_version(\"1.0.0\"))", + "query": "row nullVar = null | eval from_base64(nullVar)", "error": [], "warning": [] }, { - "query": "row mv_count(to_version(\"1.0.0\"))", + "query": "row var = greatest(true)", "error": [], "warning": [] }, { - "query": "row var = mv_count(to_version(\"a\"))", + "query": "row greatest(true)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_count(booleanField) > 0", + "query": "row var = greatest(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | where mv_count(cartesianPointField) > 0", + "query": "row var = greatest(true, true)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_count(cartesianShapeField) > 0", + "query": "row greatest(true, true)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_count(dateField) > 0", + "query": "row var = greatest(to_boolean(true), to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | where mv_count(numberField) > 0", + "query": "row var = greatest(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_count(geoPointField) > 0", + "query": "row greatest(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_count(geoShapeField) > 0", + "query": "row var = greatest(to_double(true), to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | where mv_count(ipField) > 0", + "query": "row var = greatest(5)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_count(stringField) > 0", + "query": "row greatest(5)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_count(versionField) > 0", + "query": "row var = greatest(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(booleanField)", + "query": "row var = greatest(5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_count(booleanField)", + "query": "row greatest(5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(to_boolean(booleanField))", + "query": "row var = greatest(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(cartesianPointField)", + "query": "row var = greatest(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_count(cartesianPointField)", + "query": "row greatest(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(to_cartesianpoint(cartesianPointField))", + "query": "row var = greatest(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(cartesianShapeField)", + "query": "row var = greatest(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_count(cartesianShapeField)", + "query": "row greatest(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(to_cartesianshape(cartesianPointField))", + "query": "row var = greatest(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(dateField)", + "query": "row var = greatest(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_count(dateField)", + "query": "row greatest(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(to_datetime(dateField))", + "query": "row var = greatest(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(numberField)", + "query": "row var = greatest(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_count(numberField)", + "query": "row greatest(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(to_integer(booleanField))", + "query": "row var = greatest(to_version(\"a\"), to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(geoPointField)", - "error": [], + "query": "row var = greatest(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [greatest] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", + "Argument of [greatest] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | eval mv_count(geoPointField)", + "query": "from a_index | where greatest(doubleField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(to_geopoint(geoPointField))", + "query": "from a_index | where greatest(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(geoShapeField)", - "error": [], + "query": "from a_index | where greatest(cartesianPointField) > 0", + "error": [ + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | eval mv_count(geoShapeField)", + "query": "from a_index | where greatest(integerField, integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(to_geoshape(geoPointField))", + "query": "from a_index | where greatest(longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_count(ipField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_ip(ipField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_count(to_string(booleanField))", + "query": "from a_index | where greatest(longField, longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(versionField)", + "query": "from a_index | eval var = greatest(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_count(versionField)", + "query": "from a_index | eval greatest(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(to_version(stringField))", + "query": "from a_index | eval var = greatest(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_count(booleanField, extraArg)", + "query": "from a_index | eval greatest(cartesianPointField)", "error": [ - "Error: [mv_count] function expects exactly one argument, got 2." + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | sort mv_count(booleanField)", + "query": "from a_index | eval var = greatest(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_count(null)", + "query": "from a_index | eval greatest(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_count(nullVar)", + "query": "from a_index | eval var = greatest(to_boolean(booleanField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(\"a\")", - "error": [], + "query": "from a_index | eval greatest(cartesianPointField, cartesianPointField)", + "error": [ + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "row mv_dedupe(\"a\")", + "query": "from a_index | eval var = greatest(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(stringField)", + "query": "from a_index | eval greatest(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(stringField)", + "query": "from a_index | eval var = greatest(to_double(booleanField), to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(*)", - "error": [ - "Using wildcards (*) in mv_dedupe is not allowed" - ], + "query": "from a_index | eval var = greatest(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort mv_dedupe(stringField)", + "query": "from a_index | eval greatest(integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(true)", + "query": "from a_index | eval var = greatest(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row mv_dedupe(true)", + "query": "from a_index | eval var = greatest(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_boolean(true))", + "query": "from a_index | eval greatest(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(now())", + "query": "from a_index | eval var = greatest(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row mv_dedupe(now())", + "query": "from a_index | eval var = greatest(ipField, ipField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_datetime(now()))", + "query": "from a_index | eval greatest(ipField, ipField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(5)", + "query": "from a_index | eval var = greatest(to_ip(ipField), to_ip(ipField))", "error": [], "warning": [] }, { - "query": "row mv_dedupe(5)", + "query": "from a_index | eval var = greatest(keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_integer(true))", + "query": "from a_index | eval greatest(keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = greatest(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row mv_dedupe(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = greatest(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_ip(to_ip(\"127.0.0.1\")))", + "query": "from a_index | eval greatest(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_string(true))", + "query": "from a_index | eval var = greatest(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_version(\"1.0.0\"))", + "query": "from a_index | eval var = greatest(longField)", "error": [], "warning": [] }, { - "query": "row mv_dedupe(to_version(\"1.0.0\"))", + "query": "from a_index | eval greatest(longField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_version(\"a\"))", + "query": "from a_index | eval var = greatest(longField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_dedupe(numberField) > 0", + "query": "from a_index | eval greatest(longField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_dedupe(stringField)) > 0", + "query": "from a_index | eval var = greatest(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(booleanField)", + "query": "from a_index | eval greatest(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(booleanField)", + "query": "from a_index | eval var = greatest(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(to_boolean(booleanField))", + "query": "from a_index | eval greatest(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(dateField)", + "query": "from a_index | eval var = greatest(versionField, versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(dateField)", + "query": "from a_index | eval greatest(versionField, versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(to_datetime(dateField))", + "query": "from a_index | eval var = greatest(to_version(keywordField), to_version(keywordField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(numberField)", + "query": "from a_index | sort greatest(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(numberField)", + "query": "from a_index | eval greatest(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(to_integer(booleanField))", + "query": "row nullVar = null | eval greatest(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(ipField)", + "query": "row var = ip_prefix(to_ip(\"127.0.0.1\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(ipField)", + "query": "row ip_prefix(to_ip(\"127.0.0.1\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(to_ip(ipField))", + "query": "row var = ip_prefix(to_ip(to_ip(\"127.0.0.1\")), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(to_string(booleanField))", - "error": [], + "query": "row var = ip_prefix(true, true, true)", + "error": [ + "Argument of [ip_prefix] must be [ip], found value [true] type [boolean]", + "Argument of [ip_prefix] must be [integer], found value [true] type [boolean]", + "Argument of [ip_prefix] must be [integer], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(versionField)", + "query": "from a_index | eval var = ip_prefix(ipField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(versionField)", + "query": "from a_index | eval ip_prefix(ipField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(to_version(stringField))", + "query": "from a_index | eval var = ip_prefix(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(booleanField, extraArg)", + "query": "from a_index | eval ip_prefix(booleanField, booleanField, booleanField)", "error": [ - "Error: [mv_dedupe] function expects exactly one argument, got 2." + "Argument of [ip_prefix] must be [ip], found value [booleanField] type [boolean]", + "Argument of [ip_prefix] must be [integer], found value [booleanField] type [boolean]", + "Argument of [ip_prefix] must be [integer], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort mv_dedupe(booleanField)", - "error": [], + "query": "from a_index | eval ip_prefix(ipField, integerField, integerField, extraArg)", + "error": [ + "Error: [ip_prefix] function expects exactly 3 arguments, got 4." + ], "warning": [] }, { - "query": "row mv_dedupe(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | sort ip_prefix(ipField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval ip_prefix(null, null, null)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_cartesianshape(\"POINT (30 10)\"))", + "query": "row nullVar = null | eval ip_prefix(nullVar, nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row mv_dedupe(to_cartesianshape(\"POINT (30 10)\"))", + "query": "row var = least(true)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row least(true)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_geopoint(\"POINT (30 10)\"))", + "query": "row var = least(to_boolean(true))", "error": [], "warning": [] }, { - "query": "row mv_dedupe(to_geopoint(\"POINT (30 10)\"))", + "query": "row var = least(true, true)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "row least(true, true)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_geoshape(\"POINT (30 10)\"))", + "query": "row var = least(to_boolean(true), to_boolean(true))", "error": [], "warning": [] }, { - "query": "row mv_dedupe(to_geoshape(\"POINT (30 10)\"))", + "query": "row var = least(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "row least(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(cartesianPointField)", + "query": "row var = least(to_double(true), to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(to_cartesianpoint(cartesianPointField))", + "query": "row var = least(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(cartesianShapeField)", + "query": "row least(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(cartesianShapeField)", + "query": "row var = least(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(to_cartesianshape(cartesianPointField))", + "query": "row var = least(5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(geoPointField)", + "query": "row least(5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(geoPointField)", + "query": "row var = least(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(to_geopoint(geoPointField))", + "query": "row var = least(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(geoShapeField)", + "query": "row least(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(geoShapeField)", + "query": "row var = least(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(to_geoshape(geoPointField))", + "query": "row var = least(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(numberField, extraArg)", - "error": [ - "Error: [mv_dedupe] function expects exactly one argument, got 2." - ], + "query": "row least(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | sort mv_dedupe(numberField)", + "query": "row var = least(to_string(true))", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row var = least(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(cartesianPointField)", + "query": "row least(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(null)", + "query": "row var = least(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_dedupe(nullVar)", + "query": "row var = least(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row var = mv_first(\"a\")", + "query": "row least(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row mv_first(\"a\")", + "query": "row var = least(to_version(\"a\"), to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(stringField)", - "error": [], + "query": "row var = least(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [least] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", + "Argument of [least] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | eval mv_first(stringField)", + "query": "from a_index | where least(doubleField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(*)", + "query": "from a_index | where least(cartesianPointField, cartesianPointField) > 0", "error": [ - "Using wildcards (*) in mv_first is not allowed" + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | sort mv_first(stringField)", + "query": "from a_index | where least(integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_first(true)", - "error": [], + "query": "from a_index | where least(cartesianPointField) > 0", + "error": [ + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "row mv_first(true)", + "query": "from a_index | where least(integerField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_boolean(true))", + "query": "from a_index | where least(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | where least(longField, longField) > 0", "error": [], "warning": [] }, { - "query": "row mv_first(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = least(booleanField)", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval least(booleanField)", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = least(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row mv_first(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval least(cartesianPointField)", + "error": [ + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "row var = mv_first(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = least(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "row var = mv_first(now())", + "query": "from a_index | eval least(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "row mv_first(now())", + "query": "from a_index | eval var = least(to_boolean(booleanField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_datetime(now()))", - "error": [], + "query": "from a_index | eval least(cartesianPointField, cartesianPointField)", + "error": [ + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "row var = mv_first(5)", + "query": "from a_index | eval var = least(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "row mv_first(5)", + "query": "from a_index | eval least(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_integer(true))", + "query": "from a_index | eval var = least(to_double(booleanField), to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = least(integerField)", "error": [], "warning": [] }, { - "query": "row mv_first(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval least(integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = least(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = least(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row mv_first(to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval least(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = least(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = least(ipField, ipField)", "error": [], "warning": [] }, { - "query": "row mv_first(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval least(ipField, ipField)", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_ip(to_ip(\"127.0.0.1\")))", + "query": "from a_index | eval var = least(to_ip(ipField), to_ip(ipField))", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_string(true))", + "query": "from a_index | eval var = least(keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_version(\"1.0.0\"))", + "query": "from a_index | eval least(keywordField)", "error": [], "warning": [] }, { - "query": "row mv_first(to_version(\"1.0.0\"))", + "query": "from a_index | eval var = least(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_first(to_version(\"a\"))", + "query": "from a_index | eval var = least(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_first(numberField) > 0", + "query": "from a_index | eval least(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_first(stringField)) > 0", + "query": "from a_index | eval var = least(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(booleanField)", + "query": "from a_index | eval var = least(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_first(booleanField)", + "query": "from a_index | eval least(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(to_boolean(booleanField))", + "query": "from a_index | eval var = least(longField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(cartesianPointField)", + "query": "from a_index | eval least(longField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_first(cartesianPointField)", + "query": "from a_index | eval var = least(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(to_cartesianpoint(cartesianPointField))", + "query": "from a_index | eval least(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(cartesianShapeField)", + "query": "from a_index | eval var = least(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_first(cartesianShapeField)", + "query": "from a_index | eval least(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(to_cartesianshape(cartesianPointField))", + "query": "from a_index | eval var = least(versionField, versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(dateField)", + "query": "from a_index | eval least(versionField, versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_first(dateField)", + "query": "from a_index | eval var = least(to_version(keywordField), to_version(keywordField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(to_datetime(dateField))", + "query": "from a_index | sort least(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(numberField)", + "query": "from a_index | eval least(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_first(numberField)", + "query": "row nullVar = null | eval least(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(to_integer(booleanField))", + "query": "row var = left(\"a\", 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(geoPointField)", + "query": "row left(\"a\", 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_first(geoPointField)", + "query": "row var = left(to_string(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(to_geopoint(geoPointField))", - "error": [], + "query": "row var = left(true, true)", + "error": [ + "Argument of [left] must be [keyword], found value [true] type [boolean]", + "Argument of [left] must be [integer], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = mv_first(geoShapeField)", + "query": "from a_index | eval var = left(keywordField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_first(geoShapeField)", + "query": "from a_index | eval left(keywordField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(to_geoshape(geoPointField))", + "query": "from a_index | eval var = left(to_string(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(ipField)", - "error": [], + "query": "from a_index | eval left(booleanField, booleanField)", + "error": [ + "Argument of [left] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [left] must be [integer], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval mv_first(ipField)", + "query": "from a_index | eval var = left(textField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(to_ip(ipField))", + "query": "from a_index | eval left(textField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(to_string(booleanField))", - "error": [], + "query": "from a_index | eval left(keywordField, integerField, extraArg)", + "error": [ + "Error: [left] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "from a_index | eval var = mv_first(versionField)", + "query": "from a_index | sort left(keywordField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_first(versionField)", + "query": "from a_index | eval left(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(to_version(stringField))", + "query": "row nullVar = null | eval left(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_first(booleanField, extraArg)", - "error": [ - "Error: [mv_first] function expects exactly one argument, got 2." - ], + "query": "row var = length(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | sort mv_first(booleanField)", + "query": "row length(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_first(null)", + "query": "row var = length(to_string(true))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_first(nullVar)", - "error": [], + "query": "row var = length(true)", + "error": [ + "Argument of [length] must be [keyword], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = mv_last(\"a\")", + "query": "from a_index | eval var = length(keywordField)", "error": [], "warning": [] }, { - "query": "row mv_last(\"a\")", + "query": "from a_index | eval length(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(stringField)", + "query": "from a_index | eval var = length(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(stringField)", - "error": [], + "query": "from a_index | eval length(booleanField)", + "error": [ + "Argument of [length] must be [keyword], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = mv_last(*)", + "query": "from a_index | eval var = length(*)", "error": [ - "Using wildcards (*) in mv_last is not allowed" + "Using wildcards (*) in length is not allowed" ], "warning": [] }, { - "query": "from a_index | sort mv_last(stringField)", + "query": "from a_index | eval var = length(textField)", "error": [], "warning": [] }, { - "query": "row var = mv_last(true)", + "query": "from a_index | eval length(textField)", "error": [], "warning": [] }, { - "query": "row mv_last(true)", - "error": [], + "query": "from a_index | eval length(keywordField, extraArg)", + "error": [ + "Error: [length] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row var = mv_last(to_boolean(true))", + "query": "from a_index | sort length(keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval length(null)", "error": [], "warning": [] }, { - "query": "row mv_last(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row nullVar = null | eval length(nullVar)", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row var = locate(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_cartesianshape(\"POINT (30 10)\"))", + "query": "row locate(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row mv_last(to_cartesianshape(\"POINT (30 10)\"))", + "query": "row var = locate(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row var = locate(\"a\", \"a\", 5)", "error": [], "warning": [] }, { - "query": "row var = mv_last(now())", + "query": "row locate(\"a\", \"a\", 5)", "error": [], "warning": [] }, { - "query": "row mv_last(now())", + "query": "row var = locate(to_string(true), to_string(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_datetime(now()))", - "error": [], + "query": "row var = locate(true, true, true)", + "error": [ + "Argument of [locate] must be [keyword], found value [true] type [boolean]", + "Argument of [locate] must be [keyword], found value [true] type [boolean]", + "Argument of [locate] must be [integer], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = mv_last(5)", + "query": "from a_index | eval var = locate(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row mv_last(5)", + "query": "from a_index | eval locate(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_integer(true))", + "query": "from a_index | eval var = locate(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval locate(booleanField, booleanField)", + "error": [ + "Argument of [locate] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [locate] must be [keyword], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row mv_last(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = locate(keywordField, keywordField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval locate(keywordField, keywordField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = locate(to_string(booleanField), to_string(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row mv_last(to_geoshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval locate(booleanField, booleanField, booleanField)", + "error": [ + "Argument of [locate] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [locate] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [locate] must be [integer], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = mv_last(to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = locate(keywordField, textField)", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval locate(keywordField, textField)", "error": [], "warning": [] }, { - "query": "row mv_last(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = locate(keywordField, textField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_ip(to_ip(\"127.0.0.1\")))", + "query": "from a_index | eval locate(keywordField, textField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_string(true))", + "query": "from a_index | eval var = locate(textField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_version(\"1.0.0\"))", + "query": "from a_index | eval locate(textField, keywordField)", "error": [], "warning": [] }, { - "query": "row mv_last(to_version(\"1.0.0\"))", + "query": "from a_index | eval var = locate(textField, keywordField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_last(to_version(\"a\"))", + "query": "from a_index | eval locate(textField, keywordField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_last(numberField) > 0", + "query": "from a_index | eval var = locate(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_last(stringField)) > 0", + "query": "from a_index | eval locate(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(booleanField)", + "query": "from a_index | eval var = locate(textField, textField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(booleanField)", + "query": "from a_index | eval locate(textField, textField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(to_boolean(booleanField))", - "error": [], + "query": "from a_index | eval locate(keywordField, keywordField, integerField, extraArg)", + "error": [ + "Error: [locate] function expects no more than 3 arguments, got 4." + ], "warning": [] }, { - "query": "from a_index | eval var = mv_last(cartesianPointField)", + "query": "from a_index | sort locate(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(cartesianPointField)", + "query": "from a_index | eval locate(null, null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(to_cartesianpoint(cartesianPointField))", + "query": "row nullVar = null | eval locate(nullVar, nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(cartesianShapeField)", + "query": "row var = log(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(cartesianShapeField)", + "query": "row log(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(to_cartesianshape(cartesianPointField))", + "query": "row var = log(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(dateField)", + "query": "row var = log(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(dateField)", + "query": "row log(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(to_datetime(dateField))", + "query": "row var = log(to_double(true), to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(numberField)", + "query": "row var = log(5.5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(numberField)", + "query": "row log(5.5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(to_integer(booleanField))", + "query": "row var = log(to_double(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(geoPointField)", + "query": "row var = log(to_double(true), 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(geoPointField)", + "query": "row var = log(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(to_geopoint(geoPointField))", + "query": "row log(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(geoShapeField)", + "query": "row var = log(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(geoShapeField)", + "query": "row var = log(5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(to_geoshape(geoPointField))", + "query": "row log(5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(ipField)", + "query": "row var = log(to_integer(true), to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(ipField)", + "query": "row var = log(5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(to_ip(ipField))", + "query": "row log(5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(to_string(booleanField))", + "query": "row var = log(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(versionField)", + "query": "row var = log(to_integer(true), 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(versionField)", + "query": "row var = log(5, to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(to_version(stringField))", + "query": "row var = log(5, to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(booleanField, extraArg)", + "query": "row var = log(true, true)", "error": [ - "Error: [mv_last] function expects exactly one argument, got 2." + "Argument of [log] must be [double], found value [true] type [boolean]", + "Argument of [log] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort mv_last(booleanField)", + "query": "from a_index | where log(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(null)", - "error": [], + "query": "from a_index | where log(booleanField) > 0", + "error": [ + "Argument of [log] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row nullVar = null | eval mv_last(nullVar)", + "query": "from a_index | where log(doubleField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(\"a\")", - "error": [], + "query": "from a_index | where log(booleanField, booleanField) > 0", + "error": [ + "Argument of [log] must be [double], found value [booleanField] type [boolean]", + "Argument of [log] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row mv_max(\"a\")", + "query": "from a_index | where log(doubleField, integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(stringField)", + "query": "from a_index | where log(doubleField, longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_max(stringField)", + "query": "from a_index | where log(doubleField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(*)", - "error": [ - "Using wildcards (*) in mv_max is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_max(stringField)", + "query": "from a_index | where log(integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(true)", + "query": "from a_index | where log(integerField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "row mv_max(true)", + "query": "from a_index | where log(integerField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(to_boolean(true))", + "query": "from a_index | where log(integerField, longField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(now())", + "query": "from a_index | where log(integerField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row mv_max(now())", + "query": "from a_index | where log(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(to_datetime(now()))", + "query": "from a_index | where log(longField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(5)", + "query": "from a_index | where log(longField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row mv_max(5)", + "query": "from a_index | where log(longField, longField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(to_integer(true))", + "query": "from a_index | where log(longField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(to_ip(\"127.0.0.1\"))", + "query": "from a_index | where log(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row mv_max(to_ip(\"127.0.0.1\"))", + "query": "from a_index | where log(unsignedLongField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(to_ip(to_ip(\"127.0.0.1\")))", + "query": "from a_index | where log(unsignedLongField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(to_string(true))", + "query": "from a_index | where log(unsignedLongField, longField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_max(to_version(\"1.0.0\"))", + "query": "from a_index | where log(unsignedLongField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row mv_max(to_version(\"1.0.0\"))", + "query": "from a_index | eval var = log(doubleField)", "error": [], "warning": [] }, { - "query": "row var = mv_max(to_version(\"a\"))", + "query": "from a_index | eval log(doubleField)", "error": [], "warning": [] }, { - "query": "row var = mv_max(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [mv_max] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], - "warning": [] - }, - { - "query": "from a_index | where mv_max(numberField) > 0", + "query": "from a_index | eval var = log(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where mv_max(cartesianPointField) > 0", + "query": "from a_index | eval log(booleanField)", "error": [ - "Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Argument of [log] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where length(mv_max(stringField)) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where length(mv_max(cartesianPointField)) > 0", + "query": "from a_index | eval var = log(*)", "error": [ - "Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Using wildcards (*) in log is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = mv_max(booleanField)", + "query": "from a_index | eval var = log(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_max(booleanField)", + "query": "from a_index | eval log(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(to_boolean(booleanField))", + "query": "from a_index | eval var = log(to_double(booleanField), to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_max(cartesianPointField)", + "query": "from a_index | eval log(booleanField, booleanField)", "error": [ - "Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Argument of [log] must be [double], found value [booleanField] type [boolean]", + "Argument of [log] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = mv_max(dateField)", + "query": "from a_index | eval var = log(doubleField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_max(dateField)", + "query": "from a_index | eval log(doubleField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(to_datetime(dateField))", + "query": "from a_index | eval var = log(to_double(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(numberField)", + "query": "from a_index | eval var = log(doubleField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_max(numberField)", + "query": "from a_index | eval log(doubleField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(to_integer(booleanField))", + "query": "from a_index | eval var = log(to_double(booleanField), longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(ipField)", + "query": "from a_index | eval var = log(doubleField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_max(ipField)", + "query": "from a_index | eval log(doubleField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(to_ip(ipField))", + "query": "from a_index | eval var = log(to_double(booleanField), unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(to_string(booleanField))", + "query": "from a_index | eval var = log(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(versionField)", + "query": "from a_index | eval log(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_max(versionField)", + "query": "from a_index | eval var = log(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(to_version(stringField))", + "query": "from a_index | eval var = log(integerField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_max(booleanField, extraArg)", - "error": [ - "Error: [mv_max] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort mv_max(booleanField)", + "query": "from a_index | eval log(integerField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_max(null)", + "query": "from a_index | eval var = log(to_integer(booleanField), to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_max(nullVar)", + "query": "from a_index | eval var = log(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_median(5)", + "query": "from a_index | eval log(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row mv_median(5)", + "query": "from a_index | eval var = log(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_median(to_integer(\"a\"))", + "query": "from a_index | eval var = log(integerField, longField)", "error": [], "warning": [] }, { - "query": "row var = mv_median(\"a\")", - "error": [ - "Argument of [mv_median] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval log(integerField, longField)", + "error": [], "warning": [] }, { - "query": "from a_index | where mv_median(numberField) > 0", + "query": "from a_index | eval var = log(to_integer(booleanField), longField)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_median(stringField) > 0", - "error": [ - "Argument of [mv_median] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = log(integerField, unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_median(numberField)", + "query": "from a_index | eval log(integerField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_median(numberField)", + "query": "from a_index | eval var = log(to_integer(booleanField), unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_median(to_integer(stringField))", + "query": "from a_index | eval var = log(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_median(stringField)", - "error": [ - "Argument of [mv_median] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval log(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval mv_median(numberField, extraArg)", - "error": [ - "Error: [mv_median] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = log(longField, doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_median(*)", - "error": [ - "Using wildcards (*) in mv_median is not allowed" - ], + "query": "from a_index | eval log(longField, doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort mv_median(numberField)", + "query": "from a_index | eval var = log(longField, to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_median(to_integer(true))", + "query": "from a_index | eval var = log(longField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_median(true)", - "error": [ - "Argument of [mv_median] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | eval log(longField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | where mv_median(booleanField) > 0", - "error": [ - "Argument of [mv_median] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = log(longField, to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_median(to_integer(booleanField))", + "query": "from a_index | eval var = log(longField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_median(booleanField)", - "error": [ - "Argument of [mv_median] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval log(longField, longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval mv_median(null)", + "query": "from a_index | eval var = log(longField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_median(nullVar)", + "query": "from a_index | eval log(longField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = mv_min(\"a\")", + "query": "from a_index | eval var = log(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row mv_min(\"a\")", + "query": "from a_index | eval log(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(stringField)", + "query": "from a_index | eval var = log(unsignedLongField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_min(stringField)", + "query": "from a_index | eval log(unsignedLongField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(*)", - "error": [ - "Using wildcards (*) in mv_min is not allowed" - ], + "query": "from a_index | eval var = log(unsignedLongField, to_double(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort mv_min(stringField)", + "query": "from a_index | eval var = log(unsignedLongField, integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_min(true)", + "query": "from a_index | eval log(unsignedLongField, integerField)", "error": [], "warning": [] }, { - "query": "row mv_min(true)", + "query": "from a_index | eval var = log(unsignedLongField, to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_min(to_boolean(true))", + "query": "from a_index | eval var = log(unsignedLongField, longField)", "error": [], "warning": [] }, { - "query": "row var = mv_min(now())", + "query": "from a_index | eval log(unsignedLongField, longField)", "error": [], "warning": [] }, { - "query": "row mv_min(now())", + "query": "from a_index | eval var = log(unsignedLongField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = mv_min(to_datetime(now()))", + "query": "from a_index | eval log(unsignedLongField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = mv_min(5)", - "error": [], + "query": "from a_index | eval log(doubleField, doubleField, extraArg)", + "error": [ + "Error: [log] function expects no more than 2 arguments, got 3." + ], "warning": [] }, { - "query": "row mv_min(5)", + "query": "from a_index | sort log(doubleField)", "error": [], "warning": [] }, { - "query": "row var = mv_min(to_integer(true))", + "query": "from a_index | eval log(null, null)", "error": [], "warning": [] }, { - "query": "row var = mv_min(to_ip(\"127.0.0.1\"))", + "query": "row nullVar = null | eval log(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row mv_min(to_ip(\"127.0.0.1\"))", + "query": "row var = log10(5.5)", "error": [], "warning": [] }, { - "query": "row var = mv_min(to_ip(to_ip(\"127.0.0.1\")))", + "query": "row log10(5.5)", "error": [], "warning": [] }, { - "query": "row var = mv_min(to_string(true))", + "query": "row var = log10(to_double(true))", "error": [], "warning": [] }, { - "query": "row var = mv_min(to_version(\"1.0.0\"))", + "query": "row var = log10(5)", "error": [], "warning": [] }, { - "query": "row mv_min(to_version(\"1.0.0\"))", + "query": "row log10(5)", "error": [], "warning": [] }, { - "query": "row var = mv_min(to_version(\"a\"))", + "query": "row var = log10(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = mv_min(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row var = log10(true)", "error": [ - "Argument of [mv_min] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + "Argument of [log10] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where mv_min(numberField) > 0", + "query": "from a_index | where log10(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where mv_min(cartesianPointField) > 0", + "query": "from a_index | where log10(booleanField) > 0", "error": [ - "Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Argument of [log10] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where length(mv_min(stringField)) > 0", + "query": "from a_index | where log10(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_min(cartesianPointField)) > 0", - "error": [ - "Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | where log10(longField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(booleanField)", + "query": "from a_index | where log10(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_min(booleanField)", + "query": "from a_index | eval var = log10(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(to_boolean(booleanField))", + "query": "from a_index | eval log10(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_min(cartesianPointField)", + "query": "from a_index | eval var = log10(to_double(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval log10(booleanField)", "error": [ - "Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Argument of [log10] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = mv_min(dateField)", + "query": "from a_index | eval var = log10(*)", + "error": [ + "Using wildcards (*) in log10 is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = log10(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_min(dateField)", + "query": "from a_index | eval log10(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(to_datetime(dateField))", + "query": "from a_index | eval var = log10(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(numberField)", + "query": "from a_index | eval var = log10(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_min(numberField)", + "query": "from a_index | eval log10(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(to_integer(booleanField))", + "query": "from a_index | eval var = log10(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(ipField)", + "query": "from a_index | eval log10(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_min(ipField)", + "query": "from a_index | eval log10(doubleField, extraArg)", + "error": [ + "Error: [log10] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort log10(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(to_ip(ipField))", + "query": "from a_index | eval log10(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(to_string(booleanField))", + "query": "row nullVar = null | eval log10(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(versionField)", + "query": "row var = ltrim(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_min(versionField)", + "query": "row ltrim(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(to_version(stringField))", + "query": "row var = ltrim(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_min(booleanField, extraArg)", + "query": "row var = ltrim(true)", "error": [ - "Error: [mv_min] function expects exactly one argument, got 2." + "Argument of [ltrim] must be [keyword], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort mv_min(booleanField)", + "query": "from a_index | eval var = ltrim(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_min(null)", + "query": "from a_index | eval ltrim(keywordField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_min(nullVar)", + "query": "from a_index | eval var = ltrim(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(\"a\", 5, 5)", - "error": [], + "query": "from a_index | eval ltrim(booleanField)", + "error": [ + "Argument of [ltrim] must be [keyword], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row mv_slice(\"a\", 5, 5)", - "error": [], + "query": "from a_index | eval var = ltrim(*)", + "error": [ + "Using wildcards (*) in ltrim is not allowed" + ], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(stringField, numberField, numberField)", + "query": "from a_index | eval var = ltrim(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(stringField, numberField, numberField)", + "query": "from a_index | eval ltrim(textField)", "error": [], "warning": [] }, { - "query": "from a_index | sort mv_slice(stringField, numberField, numberField)", - "error": [], + "query": "from a_index | eval ltrim(keywordField, extraArg)", + "error": [ + "Error: [ltrim] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row var = mv_slice(true, 5, 5)", + "query": "from a_index | sort ltrim(keywordField)", "error": [], "warning": [] }, { - "query": "row mv_slice(true, 5, 5)", + "query": "from a_index | eval ltrim(null)", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_boolean(true), to_integer(true), to_integer(true))", + "query": "row nullVar = null | eval ltrim(nullVar)", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_cartesianpoint(\"POINT (30 10)\"), 5, 5)", + "query": "row var = mv_append(true, true)", "error": [], "warning": [] }, { - "query": "row mv_slice(to_cartesianpoint(\"POINT (30 10)\"), 5, 5)", + "query": "row mv_append(true, true)", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", + "query": "row var = mv_append(to_boolean(true), to_boolean(true))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_cartesianshape(\"POINT (30 10)\"), 5, 5)", - "error": [], + "query": "row var = mv_append(cartesianPointField, cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row mv_slice(to_cartesianshape(\"POINT (30 10)\"), 5, 5)", + "query": "row mv_append(cartesianPointField, cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], + "warning": [] + }, + { + "query": "row var = mv_append(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], + "warning": [] + }, + { + "query": "row var = mv_append(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", + "query": "row mv_append(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(now(), 5, 5)", + "query": "row var = mv_append(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], + "warning": [] + }, + { + "query": "row var = mv_append(to_datetime(\"2021-01-01T00:00:00Z\"), to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "row mv_slice(now(), 5, 5)", + "query": "row mv_append(to_datetime(\"2021-01-01T00:00:00Z\"), to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_datetime(now()), to_integer(true), to_integer(true))", + "query": "row var = mv_append(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")), to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(5, 5, 5)", + "query": "row var = mv_append(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "row mv_slice(5, 5, 5)", + "query": "row mv_append(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_integer(true), to_integer(true), to_integer(true))", + "query": "row var = mv_append(to_double(true), to_double(true))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_geopoint(\"POINT (30 10)\"), 5, 5)", + "query": "row var = mv_append(geoPointField, geoPointField)", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], + "warning": [] + }, + { + "query": "row mv_append(geoPointField, geoPointField)", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], + "warning": [] + }, + { + "query": "row var = mv_append(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], + "warning": [] + }, + { + "query": "row var = mv_append(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row mv_slice(to_geopoint(\"POINT (30 10)\"), 5, 5)", + "query": "row mv_append(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", + "query": "row var = mv_append(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], + "warning": [] + }, + { + "query": "row var = mv_append(5, 5)", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_geoshape(\"POINT (30 10)\"), 5, 5)", + "query": "row mv_append(5, 5)", "error": [], "warning": [] }, { - "query": "row mv_slice(to_geoshape(\"POINT (30 10)\"), 5, 5)", + "query": "row var = mv_append(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", + "query": "row var = mv_append(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_ip(\"127.0.0.1\"), 5, 5)", + "query": "row mv_append(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "row mv_slice(to_ip(\"127.0.0.1\"), 5, 5)", + "query": "row var = mv_append(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_ip(to_ip(\"127.0.0.1\")), to_integer(true), to_integer(true))", + "query": "row var = mv_append(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_string(true), to_integer(true), to_integer(true))", + "query": "row mv_append(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_version(\"1.0.0\"), 5, 5)", + "query": "row var = mv_append(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "row mv_slice(to_version(\"1.0.0\"), 5, 5)", + "query": "row var = mv_append(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_version(\"a\"), to_integer(true), to_integer(true))", + "query": "row mv_append(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row var = mv_slice(to_version(\"1.0.0\"), true, true)", - "error": [ - "Argument of [mv_slice] must be [number], found value [true] type [boolean]", - "Argument of [mv_slice] must be [number], found value [true] type [boolean]" - ], + "query": "row var = mv_append(to_version(\"a\"), to_version(\"a\"))", + "error": [], "warning": [] }, { - "query": "from a_index | where mv_slice(numberField, numberField, numberField) > 0", + "query": "from a_index | where mv_append(doubleField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where mv_slice(numberField, booleanField, booleanField) > 0", + "query": "from a_index | where mv_append(counterDoubleField, counterDoubleField) > 0", "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" + "Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]", + "Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | where length(mv_slice(stringField, numberField, numberField)) > 0", + "query": "from a_index | where mv_append(integerField, integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_slice(stringField, booleanField, booleanField)) > 0", - "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | where mv_append(longField, longField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(booleanField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(booleanField, numberField, numberField)", + "query": "from a_index | eval mv_append(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(to_boolean(booleanField), to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval var = mv_append(to_boolean(booleanField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(booleanField, booleanField, booleanField)", + "query": "from a_index | eval mv_append(counterDoubleField, counterDoubleField)", "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" + "Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]", + "Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(cartesianPointField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(cartesianPointField, numberField, numberField)", + "query": "from a_index | eval mv_append(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(to_cartesianpoint(cartesianPointField), to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval var = mv_append(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(cartesianPointField, booleanField, booleanField)", - "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_append(cartesianShapeField, cartesianShapeField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(cartesianShapeField, numberField, numberField)", + "query": "from a_index | eval mv_append(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(cartesianShapeField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(to_cartesianshape(cartesianPointField), to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval var = mv_append(dateField, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(cartesianShapeField, booleanField, booleanField)", - "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval mv_append(dateField, dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(dateField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(to_datetime(dateField), to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(dateField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(to_datetime(dateField), to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval mv_append(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(dateField, booleanField, booleanField)", - "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_append(to_double(booleanField), to_double(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(numberField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(numberField, numberField, numberField)", + "query": "from a_index | eval mv_append(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(to_integer(booleanField), to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval var = mv_append(to_geopoint(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(numberField, booleanField, booleanField)", - "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_append(geoShapeField, geoShapeField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(geoPointField, numberField, numberField)", + "query": "from a_index | eval mv_append(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(geoPointField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(to_geoshape(geoPointField), to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(to_geopoint(geoPointField), to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval var = mv_append(integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(geoPointField, booleanField, booleanField)", - "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval mv_append(integerField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(geoShapeField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(geoShapeField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(ipField, ipField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(to_geoshape(geoPointField), to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval mv_append(ipField, ipField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(geoShapeField, booleanField, booleanField)", - "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_append(to_ip(ipField), to_ip(ipField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(ipField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(ipField, numberField, numberField)", + "query": "from a_index | eval mv_append(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval var = mv_append(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(ipField, booleanField, booleanField)", - "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_append(longField, longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval mv_append(longField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(stringField, booleanField, booleanField)", - "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_append(textField, textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(versionField, numberField, numberField)", + "query": "from a_index | eval mv_append(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(versionField, numberField, numberField)", + "query": "from a_index | eval var = mv_append(versionField, versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(to_version(stringField), to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval mv_append(versionField, versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(versionField, booleanField, booleanField)", - "error": [ - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", - "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_append(to_version(keywordField), to_version(keywordField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(booleanField, numberField, numberField, extraArg)", + "query": "from a_index | eval mv_append(booleanField, booleanField, extraArg)", "error": [ - "Error: [mv_slice] function expects no more than 3 arguments, got 4." + "Error: [mv_append] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | sort mv_slice(booleanField, numberField, numberField)", + "query": "from a_index | sort mv_append(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(null, null, null)", + "query": "from a_index | eval mv_append(null, null)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_slice(nullVar, nullVar, nullVar)", + "query": "row nullVar = null | eval mv_append(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row var = mv_sort(\"a\", \"asc\")", + "query": "from a_index | eval mv_append(\"2022\", \"2022\")", "error": [], "warning": [] }, { - "query": "row mv_sort(\"a\", \"asc\")", + "query": "from a_index | eval mv_append(concat(\"20\", \"22\"), concat(\"20\", \"22\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_sort(stringField, \"asc\")", + "query": "row var = mv_avg(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sort(stringField, \"asc\")", + "query": "row mv_avg(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | sort mv_sort(stringField, \"asc\")", + "query": "row var = mv_avg(to_double(true))", "error": [], "warning": [] }, { - "query": "row var = mv_sort(true, \"asc\")", + "query": "row var = mv_avg(5)", "error": [], "warning": [] }, { - "query": "row mv_sort(true, \"asc\")", + "query": "row mv_avg(5)", "error": [], "warning": [] }, { - "query": "row var = mv_sort(now(), \"asc\")", + "query": "row var = mv_avg(to_integer(true))", "error": [], "warning": [] }, { - "query": "row mv_sort(now(), \"asc\")", - "error": [], + "query": "row var = mv_avg(true)", + "error": [ + "Argument of [mv_avg] must be [double], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = mv_sort(5, \"asc\")", + "query": "from a_index | where mv_avg(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row mv_sort(5, \"asc\")", - "error": [], + "query": "from a_index | where mv_avg(booleanField) > 0", + "error": [ + "Argument of [mv_avg] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = mv_sort(to_ip(\"127.0.0.1\"), \"asc\")", + "query": "from a_index | where mv_avg(integerField) > 0", "error": [], "warning": [] }, { - "query": "row mv_sort(to_ip(\"127.0.0.1\"), \"asc\")", + "query": "from a_index | where mv_avg(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_sort(to_version(\"1.0.0\"), \"asc\")", + "query": "from a_index | where mv_avg(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row mv_sort(to_version(\"1.0.0\"), \"asc\")", + "query": "from a_index | eval var = mv_avg(doubleField)", "error": [], "warning": [] }, { - "query": "row var = mv_sort(to_cartesianpoint(\"POINT (30 10)\"), true)", - "error": [ - "Argument of [mv_sort] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", - "Argument of [mv_sort] must be [string], found value [true] type [boolean]" - ], + "query": "from a_index | eval mv_avg(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | where mv_sort(numberField, \"asc\") > 0", + "query": "from a_index | eval var = mv_avg(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where mv_sort(cartesianPointField, booleanField) > 0", + "query": "from a_index | eval mv_avg(booleanField)", "error": [ - "Argument of [mv_sort] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [mv_sort] must be [string], found value [booleanField] type [boolean]" + "Argument of [mv_avg] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where length(mv_sort(stringField, \"asc\")) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where length(mv_sort(cartesianPointField, booleanField)) > 0", + "query": "from a_index | eval var = mv_avg(*)", "error": [ - "Argument of [mv_sort] must be [boolean], found value [cartesianPointField] type [cartesian_point]", - "Argument of [mv_sort] must be [string], found value [booleanField] type [boolean]" + "Using wildcards (*) in mv_avg is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = mv_sort(booleanField, \"asc\")", + "query": "from a_index | eval var = mv_avg(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sort(booleanField, \"asc\")", + "query": "from a_index | eval mv_avg(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_sort(dateField, \"asc\")", + "query": "from a_index | eval var = mv_avg(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sort(dateField, \"asc\")", + "query": "from a_index | eval var = mv_avg(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_sort(numberField, \"asc\")", + "query": "from a_index | eval mv_avg(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sort(numberField, \"asc\")", + "query": "from a_index | eval var = mv_avg(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_sort(ipField, \"asc\")", + "query": "from a_index | eval mv_avg(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sort(ipField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval var = mv_sort(versionField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(versionField, \"asc\")", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval mv_sort(booleanField, \"asc\", extraArg)", + "query": "from a_index | eval mv_avg(doubleField, extraArg)", "error": [ - "Error: [mv_sort] function expects no more than 2 arguments, got 3." + "Error: [mv_avg] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | sort mv_sort(booleanField, \"asc\")", + "query": "from a_index | sort mv_avg(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sort(null, null)", + "query": "from a_index | eval mv_avg(null)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_sort(nullVar, nullVar)", + "query": "row nullVar = null | eval mv_avg(nullVar)", "error": [], "warning": [] }, { - "query": "row var = mv_sum(5)", + "query": "row var = mv_concat(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row mv_sum(5)", + "query": "row mv_concat(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = mv_sum(to_integer(\"a\"))", + "query": "row var = mv_concat(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "row var = mv_sum(\"a\")", + "query": "row var = mv_concat(true, true)", "error": [ - "Argument of [mv_sum] must be [number], found value [\"a\"] type [string]" + "Argument of [mv_concat] must be [keyword], found value [true] type [boolean]", + "Argument of [mv_concat] must be [keyword], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where mv_sum(numberField) > 0", + "query": "from a_index | eval var = mv_concat(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_sum(stringField) > 0", - "error": [ - "Argument of [mv_sum] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval mv_concat(keywordField, keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_sum(numberField)", + "query": "from a_index | eval var = mv_concat(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sum(numberField)", - "error": [], + "query": "from a_index | eval mv_concat(booleanField, booleanField)", + "error": [ + "Argument of [mv_concat] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [mv_concat] must be [keyword], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = mv_sum(to_integer(stringField))", + "query": "from a_index | eval var = mv_concat(keywordField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sum(stringField)", - "error": [ - "Argument of [mv_sum] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval mv_concat(keywordField, textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sum(numberField, extraArg)", - "error": [ - "Error: [mv_sum] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = mv_concat(textField, keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_sum(*)", - "error": [ - "Using wildcards (*) in mv_sum is not allowed" - ], + "query": "from a_index | eval mv_concat(textField, keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort mv_sum(numberField)", + "query": "from a_index | eval var = mv_concat(textField, textField)", "error": [], "warning": [] }, { - "query": "row var = mv_sum(to_integer(true))", + "query": "from a_index | eval mv_concat(textField, textField)", "error": [], "warning": [] }, { - "query": "row var = mv_sum(true)", + "query": "from a_index | eval mv_concat(keywordField, keywordField, extraArg)", "error": [ - "Argument of [mv_sum] must be [number], found value [true] type [boolean]" + "Error: [mv_concat] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | where mv_sum(booleanField) > 0", - "error": [ - "Argument of [mv_sum] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | sort mv_concat(keywordField, keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_sum(to_integer(booleanField))", + "query": "from a_index | eval mv_concat(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sum(booleanField)", - "error": [ - "Argument of [mv_sum] must be [number], found value [booleanField] type [boolean]" - ], + "query": "row nullVar = null | eval mv_concat(nullVar, nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sum(null)", + "query": "row var = mv_count(true)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_sum(nullVar)", + "query": "row mv_count(true)", "error": [], "warning": [] }, { - "query": "row var = mv_zip(\"a\", \"a\", \"a\")", + "query": "row var = mv_count(to_boolean(true))", "error": [], "warning": [] }, { - "query": "row var = mv_zip(\"a\", \"a\")", - "error": [], + "query": "row var = mv_count(cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row mv_zip(\"a\", \"a\", \"a\")", - "error": [], + "query": "row mv_count(cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row mv_zip(\"a\", \"a\")", + "query": "row var = mv_count(to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]" + ], + "warning": [] + }, + { + "query": "row var = mv_count(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = mv_zip(to_string(\"a\"), to_string(\"a\"), to_string(\"a\"))", + "query": "row mv_count(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = mv_zip(5, 5, 5)", + "query": "row var = mv_count(to_cartesianshape(cartesianPointField))", "error": [ - "Argument of [mv_zip] must be [string], found value [5] type [number]", - "Argument of [mv_zip] must be [string], found value [5] type [number]", - "Argument of [mv_zip] must be [string], found value [5] type [number]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | where length(mv_zip(stringField, stringField, stringField)) > 0", + "query": "row var = mv_count(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_zip(numberField, numberField, numberField)) > 0", - "error": [ - "Argument of [mv_zip] must be [string], found value [numberField] type [number]", - "Argument of [mv_zip] must be [string], found value [numberField] type [number]", - "Argument of [mv_zip] must be [string], found value [numberField] type [number]" - ], + "query": "row mv_count(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_zip(stringField, stringField, stringField)", + "query": "row var = mv_count(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_zip(stringField, stringField)", + "query": "row var = mv_count(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_zip(stringField, stringField, stringField)", + "query": "row mv_count(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_zip(to_string(stringField), to_string(stringField), to_string(stringField))", + "query": "row var = mv_count(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_zip(numberField, numberField, numberField)", + "query": "row var = mv_count(geoPointField)", "error": [ - "Argument of [mv_zip] must be [string], found value [numberField] type [number]", - "Argument of [mv_zip] must be [string], found value [numberField] type [number]", - "Argument of [mv_zip] must be [string], found value [numberField] type [number]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval mv_zip(stringField, stringField, stringField, extraArg)", + "query": "row mv_count(geoPointField)", "error": [ - "Error: [mv_zip] function expects no more than 3 arguments, got 4." + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | sort mv_zip(stringField, stringField, stringField)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_zip(to_string(true), to_string(true), to_string(true))", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_zip(true, true, true)", + "query": "row var = mv_count(to_geopoint(geoPointField))", "error": [ - "Argument of [mv_zip] must be [string], found value [true] type [boolean]", - "Argument of [mv_zip] must be [string], found value [true] type [boolean]", - "Argument of [mv_zip] must be [string], found value [true] type [boolean]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | where length(mv_zip(booleanField, booleanField, booleanField)) > 0", - "error": [ - "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]", - "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]", - "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]" - ], + "query": "row var = mv_count(to_geoshape(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField), to_string(booleanField))", + "query": "row mv_count(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_zip(booleanField, booleanField, booleanField)", + "query": "row var = mv_count(to_geoshape(geoPointField))", "error": [ - "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]", - "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]", - "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval mv_zip(null, null, null)", + "query": "row var = mv_count(5)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval mv_zip(nullVar, nullVar, nullVar)", + "query": "row mv_count(5)", "error": [], "warning": [] }, { - "query": "row var = mv_zip(to_string(true), to_string(true))", + "query": "row var = mv_count(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_zip(stringField, stringField)) > 0", + "query": "row var = mv_count(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_zip(booleanField, booleanField)) > 0", - "error": [ - "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]", - "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]" - ], + "query": "row mv_count(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_zip(stringField, stringField)", + "query": "row var = mv_count(to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField))", + "query": "row var = mv_count(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_zip(booleanField, booleanField)", - "error": [ - "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]", - "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]" - ], + "query": "row mv_count(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | sort mv_zip(stringField, stringField)", + "query": "row var = mv_count(to_string(true))", "error": [], "warning": [] }, { - "query": "row var = now()", + "query": "row var = mv_count(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row now()", + "query": "row mv_count(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = now()", + "query": "row var = mv_count(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval now()", + "query": "from a_index | where mv_count(booleanField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval now(extraArg)", + "query": "from a_index | where mv_count(counterDoubleField) > 0", "error": [ - "Error: [now] function expects exactly 0 arguments, got 1." + "Argument of [mv_count] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | sort now()", + "query": "from a_index | where mv_count(cartesianPointField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval now()", + "query": "from a_index | where mv_count(cartesianShapeField) > 0", "error": [], "warning": [] }, { - "query": "row var = pi()", + "query": "from a_index | where mv_count(dateField) > 0", "error": [], "warning": [] }, { - "query": "row pi()", + "query": "from a_index | where mv_count(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where pi() > 0", + "query": "from a_index | where mv_count(geoPointField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = pi()", + "query": "from a_index | where mv_count(geoShapeField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval pi()", + "query": "from a_index | where mv_count(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval pi(extraArg)", - "error": [ - "Error: [pi] function expects exactly 0 arguments, got 1." - ], - "warning": [] - }, - { - "query": "from a_index | sort pi()", + "query": "from a_index | where mv_count(ipField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval pi()", + "query": "from a_index | where mv_count(keywordField) > 0", "error": [], "warning": [] }, { - "query": "row var = pow(5, 5)", + "query": "from a_index | where mv_count(longField) > 0", "error": [], "warning": [] }, { - "query": "row pow(5, 5)", + "query": "from a_index | where mv_count(textField) > 0", "error": [], "warning": [] }, { - "query": "row var = pow(to_integer(\"a\"), to_integer(\"a\"))", + "query": "from a_index | where mv_count(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = pow(\"a\", \"a\")", - "error": [ - "Argument of [pow] must be [number], found value [\"a\"] type [string]", - "Argument of [pow] must be [number], found value [\"a\"] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | where pow(numberField, numberField) > 0", + "query": "from a_index | where mv_count(versionField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where pow(stringField, stringField) > 0", - "error": [ - "Argument of [pow] must be [number], found value [stringField] type [string]", - "Argument of [pow] must be [number], found value [stringField] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = pow(numberField, numberField)", + "query": "from a_index | eval var = mv_count(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval pow(numberField, numberField)", + "query": "from a_index | eval mv_count(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = pow(to_integer(stringField), to_integer(stringField))", + "query": "from a_index | eval var = mv_count(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval pow(stringField, stringField)", + "query": "from a_index | eval mv_count(counterDoubleField)", "error": [ - "Argument of [pow] must be [number], found value [stringField] type [string]", - "Argument of [pow] must be [number], found value [stringField] type [string]" + "Argument of [mv_count] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | eval pow(numberField, numberField, extraArg)", + "query": "from a_index | eval var = mv_count(*)", "error": [ - "Error: [pow] function expects exactly 2 arguments, got 3." + "Using wildcards (*) in mv_count is not allowed" ], "warning": [] }, { - "query": "from a_index | sort pow(numberField, numberField)", + "query": "from a_index | eval var = mv_count(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = pow(to_integer(true), to_integer(true))", + "query": "from a_index | eval mv_count(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = pow(true, true)", - "error": [ - "Argument of [pow] must be [number], found value [true] type [boolean]", - "Argument of [pow] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | eval var = mv_count(to_cartesianpoint(cartesianPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | where pow(booleanField, booleanField) > 0", - "error": [ - "Argument of [pow] must be [number], found value [booleanField] type [boolean]", - "Argument of [pow] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_count(cartesianShapeField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = pow(to_integer(booleanField), to_integer(booleanField))", + "query": "from a_index | eval mv_count(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval pow(booleanField, booleanField)", - "error": [ - "Argument of [pow] must be [number], found value [booleanField] type [boolean]", - "Argument of [pow] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_count(to_cartesianshape(cartesianPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval pow(null, null)", + "query": "from a_index | eval var = mv_count(dateField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval pow(nullVar, nullVar)", + "query": "from a_index | eval mv_count(dateField)", "error": [], "warning": [] }, { - "query": "row var = replace(\"a\", \"a\", \"a\")", + "query": "from a_index | eval var = mv_count(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row replace(\"a\", \"a\", \"a\")", + "query": "from a_index | eval var = mv_count(doubleField)", "error": [], "warning": [] }, { - "query": "row var = replace(to_string(\"a\"), to_string(\"a\"), to_string(\"a\"))", + "query": "from a_index | eval mv_count(doubleField)", "error": [], "warning": [] }, { - "query": "row var = replace(5, 5, 5)", - "error": [ - "Argument of [replace] must be [string], found value [5] type [number]", - "Argument of [replace] must be [string], found value [5] type [number]", - "Argument of [replace] must be [string], found value [5] type [number]" - ], + "query": "from a_index | eval var = mv_count(to_double(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | where length(replace(stringField, stringField, stringField)) > 0", + "query": "from a_index | eval var = mv_count(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(replace(numberField, numberField, numberField)) > 0", - "error": [ - "Argument of [replace] must be [string], found value [numberField] type [number]", - "Argument of [replace] must be [string], found value [numberField] type [number]", - "Argument of [replace] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval mv_count(geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = replace(stringField, stringField, stringField)", + "query": "from a_index | eval var = mv_count(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval replace(stringField, stringField, stringField)", + "query": "from a_index | eval var = mv_count(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = replace(to_string(stringField), to_string(stringField), to_string(stringField))", + "query": "from a_index | eval mv_count(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval replace(numberField, numberField, numberField)", - "error": [ - "Argument of [replace] must be [string], found value [numberField] type [number]", - "Argument of [replace] must be [string], found value [numberField] type [number]", - "Argument of [replace] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval var = mv_count(to_geoshape(geoPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval replace(stringField, stringField, stringField, extraArg)", - "error": [ - "Error: [replace] function expects exactly 3 arguments, got 4." - ], + "query": "from a_index | eval var = mv_count(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort replace(stringField, stringField, stringField)", + "query": "from a_index | eval mv_count(integerField)", "error": [], "warning": [] }, { - "query": "row var = replace(to_string(true), to_string(true), to_string(true))", + "query": "from a_index | eval var = mv_count(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = replace(true, true, true)", - "error": [ - "Argument of [replace] must be [string], found value [true] type [boolean]", - "Argument of [replace] must be [string], found value [true] type [boolean]", - "Argument of [replace] must be [string], found value [true] type [boolean]" - ], + "query": "from a_index | eval var = mv_count(ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(replace(booleanField, booleanField, booleanField)) > 0", - "error": [ - "Argument of [replace] must be [string], found value [booleanField] type [boolean]", - "Argument of [replace] must be [string], found value [booleanField] type [boolean]", - "Argument of [replace] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval mv_count(ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = replace(to_string(booleanField), to_string(booleanField), to_string(booleanField))", + "query": "from a_index | eval var = mv_count(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "from a_index | eval replace(booleanField, booleanField, booleanField)", - "error": [ - "Argument of [replace] must be [string], found value [booleanField] type [boolean]", - "Argument of [replace] must be [string], found value [booleanField] type [boolean]", - "Argument of [replace] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_count(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval replace(null, null, null)", + "query": "from a_index | eval mv_count(keywordField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval replace(nullVar, nullVar, nullVar)", + "query": "from a_index | eval var = mv_count(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = right(\"a\", 5)", + "query": "from a_index | eval var = mv_count(longField)", "error": [], "warning": [] }, { - "query": "row right(\"a\", 5)", + "query": "from a_index | eval mv_count(longField)", "error": [], "warning": [] }, { - "query": "row var = right(to_string(\"a\"), to_integer(\"a\"))", + "query": "from a_index | eval var = mv_count(textField)", "error": [], "warning": [] }, { - "query": "row var = right(5, \"a\")", - "error": [ - "Argument of [right] must be [string], found value [5] type [number]", - "Argument of [right] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval mv_count(textField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(right(stringField, numberField)) > 0", + "query": "from a_index | eval var = mv_count(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(right(numberField, stringField)) > 0", - "error": [ - "Argument of [right] must be [string], found value [numberField] type [number]", - "Argument of [right] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval mv_count(unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = right(stringField, numberField)", + "query": "from a_index | eval var = mv_count(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval right(stringField, numberField)", + "query": "from a_index | eval mv_count(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = right(to_string(stringField), to_integer(stringField))", + "query": "from a_index | eval var = mv_count(to_version(keywordField))", "error": [], "warning": [] }, { - "query": "from a_index | eval right(numberField, stringField)", + "query": "from a_index | eval mv_count(booleanField, extraArg)", "error": [ - "Argument of [right] must be [string], found value [numberField] type [number]", - "Argument of [right] must be [number], found value [stringField] type [string]" + "Error: [mv_count] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval right(stringField, numberField, extraArg)", - "error": [ - "Error: [right] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort right(stringField, numberField)", + "query": "from a_index | sort mv_count(booleanField)", "error": [], "warning": [] }, { - "query": "row var = right(to_string(true), to_integer(true))", + "query": "from a_index | eval mv_count(null)", "error": [], "warning": [] }, { - "query": "row var = right(true, true)", - "error": [ - "Argument of [right] must be [string], found value [true] type [boolean]", - "Argument of [right] must be [number], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where length(right(booleanField, booleanField)) > 0", - "error": [ - "Argument of [right] must be [string], found value [booleanField] type [boolean]", - "Argument of [right] must be [number], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = right(to_string(booleanField), to_integer(booleanField))", + "query": "row nullVar = null | eval mv_count(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval right(booleanField, booleanField)", - "error": [ - "Argument of [right] must be [string], found value [booleanField] type [boolean]", - "Argument of [right] must be [number], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval right(null, null)", + "query": "from a_index | eval mv_count(\"2022\")", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval right(nullVar, nullVar)", + "query": "from a_index | eval mv_count(concat(\"20\", \"22\"))", "error": [], "warning": [] }, { - "query": "row var = round(5, 5)", + "query": "row var = mv_dedupe(true)", "error": [], "warning": [] }, { - "query": "row round(5, 5)", + "query": "row mv_dedupe(true)", "error": [], "warning": [] }, { - "query": "row var = round(to_integer(\"a\"), to_integer(\"a\"))", + "query": "row var = mv_dedupe(to_boolean(true))", "error": [], "warning": [] }, { - "query": "row var = round(\"a\", \"a\")", + "query": "row var = mv_dedupe(cartesianPointField)", "error": [ - "Argument of [round] must be [number], found value [\"a\"] type [string]", - "Argument of [round] must be [number], found value [\"a\"] type [string]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | where round(numberField, numberField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where round(stringField, stringField) > 0", + "query": "row mv_dedupe(cartesianPointField)", "error": [ - "Argument of [round] must be [number], found value [stringField] type [string]", - "Argument of [round] must be [number], found value [stringField] type [string]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = round(numberField, numberField)", - "error": [], + "query": "row var = mv_dedupe(to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval round(numberField, numberField)", + "query": "row var = mv_dedupe(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = round(to_integer(stringField), to_integer(stringField))", + "query": "row mv_dedupe(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval round(stringField, stringField)", + "query": "row var = mv_dedupe(to_cartesianshape(cartesianPointField))", "error": [ - "Argument of [round] must be [number], found value [stringField] type [string]", - "Argument of [round] must be [number], found value [stringField] type [string]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval round(numberField, numberField, extraArg)", - "error": [ - "Error: [round] function expects no more than 2 arguments, got 3." - ], + "query": "row var = mv_dedupe(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | sort round(numberField, numberField)", + "query": "row mv_dedupe(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "row var = round(5)", + "query": "row var = mv_dedupe(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", "error": [], "warning": [] }, { - "query": "row round(5)", + "query": "row var = mv_dedupe(5.5)", "error": [], "warning": [] }, { - "query": "row var = round(to_integer(true))", + "query": "row mv_dedupe(5.5)", "error": [], "warning": [] }, { - "query": "row var = round(to_integer(true), to_integer(true))", + "query": "row var = mv_dedupe(to_double(true))", "error": [], "warning": [] }, { - "query": "row var = round(true, true)", + "query": "row var = mv_dedupe(geoPointField)", "error": [ - "Argument of [round] must be [number], found value [true] type [boolean]", - "Argument of [round] must be [number], found value [true] type [boolean]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | where round(numberField) > 0", - "error": [], + "query": "row mv_dedupe(geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | where round(booleanField) > 0", + "query": "row var = mv_dedupe(to_geopoint(geoPointField))", "error": [ - "Argument of [round] must be [number], found value [booleanField] type [boolean]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | where round(booleanField, booleanField) > 0", + "query": "row var = mv_dedupe(to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row mv_dedupe(to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = mv_dedupe(to_geoshape(geoPointField))", "error": [ - "Argument of [round] must be [number], found value [booleanField] type [boolean]", - "Argument of [round] must be [number], found value [booleanField] type [boolean]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = round(numberField)", + "query": "row var = mv_dedupe(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval round(numberField)", + "query": "row mv_dedupe(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = round(to_integer(booleanField))", + "query": "row var = mv_dedupe(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval round(booleanField)", - "error": [ - "Argument of [round] must be [number], found value [booleanField] type [boolean]" - ], + "query": "row var = mv_dedupe(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = round(*)", - "error": [ - "Using wildcards (*) in round is not allowed" - ], + "query": "row mv_dedupe(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = round(to_integer(booleanField), to_integer(booleanField))", + "query": "row var = mv_dedupe(to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval round(booleanField, booleanField)", - "error": [ - "Argument of [round] must be [number], found value [booleanField] type [boolean]", - "Argument of [round] must be [number], found value [booleanField] type [boolean]" - ], + "query": "row var = mv_dedupe(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | sort round(numberField)", + "query": "row mv_dedupe(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval round(null, null)", + "query": "row var = mv_dedupe(to_string(true))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval round(nullVar, nullVar)", + "query": "row var = mv_dedupe(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row var = rtrim(\"a\")", + "query": "row mv_dedupe(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row rtrim(\"a\")", + "query": "row var = mv_dedupe(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = rtrim(to_string(\"a\"))", + "query": "from a_index | where mv_dedupe(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = rtrim(5)", + "query": "from a_index | where mv_dedupe(counterDoubleField) > 0", "error": [ - "Argument of [rtrim] must be [string], found value [5] type [number]" + "Argument of [mv_dedupe] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | where length(rtrim(stringField)) > 0", + "query": "from a_index | where mv_dedupe(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where length(rtrim(numberField)) > 0", - "error": [ - "Argument of [rtrim] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | where mv_dedupe(longField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = rtrim(stringField)", + "query": "from a_index | eval var = mv_dedupe(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval rtrim(stringField)", + "query": "from a_index | eval mv_dedupe(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = rtrim(to_string(stringField))", + "query": "from a_index | eval var = mv_dedupe(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval rtrim(numberField)", + "query": "from a_index | eval mv_dedupe(counterDoubleField)", "error": [ - "Argument of [rtrim] must be [string], found value [numberField] type [number]" + "Argument of [mv_dedupe] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | eval rtrim(stringField, extraArg)", + "query": "from a_index | eval var = mv_dedupe(*)", "error": [ - "Error: [rtrim] function expects exactly one argument, got 2." + "Using wildcards (*) in mv_dedupe is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = rtrim(*)", - "error": [ - "Using wildcards (*) in rtrim is not allowed" - ], + "query": "from a_index | eval var = mv_dedupe(cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort rtrim(stringField)", + "query": "from a_index | eval mv_dedupe(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = rtrim(to_string(true))", + "query": "from a_index | eval var = mv_dedupe(to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row var = rtrim(true)", - "error": [ - "Argument of [rtrim] must be [string], found value [true] type [boolean]" - ], + "query": "from a_index | eval var = mv_dedupe(cartesianShapeField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(rtrim(booleanField)) > 0", - "error": [ - "Argument of [rtrim] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval mv_dedupe(cartesianShapeField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = rtrim(to_string(booleanField))", + "query": "from a_index | eval var = mv_dedupe(to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval rtrim(booleanField)", - "error": [ - "Argument of [rtrim] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_dedupe(dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval rtrim(null)", + "query": "from a_index | eval mv_dedupe(dateField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval rtrim(nullVar)", + "query": "from a_index | eval var = mv_dedupe(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row var = signum(5)", + "query": "from a_index | eval var = mv_dedupe(doubleField)", "error": [], "warning": [] }, { - "query": "row signum(5)", + "query": "from a_index | eval mv_dedupe(doubleField)", "error": [], "warning": [] }, { - "query": "row var = signum(to_integer(\"a\"))", + "query": "from a_index | eval var = mv_dedupe(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = signum(\"a\")", - "error": [ - "Argument of [signum] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval var = mv_dedupe(geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | where signum(numberField) > 0", + "query": "from a_index | eval mv_dedupe(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | where signum(stringField) > 0", - "error": [ - "Argument of [signum] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = mv_dedupe(to_geopoint(geoPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = signum(numberField)", + "query": "from a_index | eval var = mv_dedupe(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval signum(numberField)", + "query": "from a_index | eval mv_dedupe(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = signum(to_integer(stringField))", + "query": "from a_index | eval var = mv_dedupe(to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval signum(stringField)", - "error": [ - "Argument of [signum] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = mv_dedupe(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval signum(numberField, extraArg)", - "error": [ - "Error: [signum] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval mv_dedupe(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = signum(*)", - "error": [ - "Using wildcards (*) in signum is not allowed" - ], + "query": "from a_index | eval var = mv_dedupe(to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort signum(numberField)", + "query": "from a_index | eval var = mv_dedupe(ipField)", "error": [], "warning": [] }, { - "query": "row var = signum(to_integer(true))", + "query": "from a_index | eval mv_dedupe(ipField)", "error": [], "warning": [] }, { - "query": "row var = signum(true)", - "error": [ - "Argument of [signum] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | eval var = mv_dedupe(to_ip(ipField))", + "error": [], "warning": [] }, { - "query": "from a_index | where signum(booleanField) > 0", - "error": [ - "Argument of [signum] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_dedupe(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = signum(to_integer(booleanField))", + "query": "from a_index | eval mv_dedupe(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval signum(booleanField)", - "error": [ - "Argument of [signum] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_dedupe(to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval signum(null)", + "query": "from a_index | eval var = mv_dedupe(longField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval signum(nullVar)", + "query": "from a_index | eval mv_dedupe(longField)", "error": [], "warning": [] }, { - "query": "row var = sin(5)", + "query": "from a_index | eval var = mv_dedupe(textField)", "error": [], "warning": [] }, { - "query": "row sin(5)", + "query": "from a_index | eval mv_dedupe(textField)", "error": [], "warning": [] }, { - "query": "row var = sin(to_integer(\"a\"))", + "query": "from a_index | eval var = mv_dedupe(versionField)", "error": [], "warning": [] }, { - "query": "row var = sin(\"a\")", - "error": [ - "Argument of [sin] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval mv_dedupe(versionField)", + "error": [], "warning": [] }, { - "query": "from a_index | where sin(numberField) > 0", + "query": "from a_index | eval var = mv_dedupe(to_version(keywordField))", "error": [], "warning": [] }, { - "query": "from a_index | where sin(stringField) > 0", + "query": "from a_index | eval mv_dedupe(booleanField, extraArg)", "error": [ - "Argument of [sin] must be [number], found value [stringField] type [string]" + "Error: [mv_dedupe] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = sin(numberField)", + "query": "from a_index | sort mv_dedupe(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval sin(numberField)", + "query": "from a_index | eval mv_dedupe(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = sin(to_integer(stringField))", + "query": "row nullVar = null | eval mv_dedupe(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval sin(stringField)", - "error": [ - "Argument of [sin] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval mv_dedupe(\"2022\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval sin(numberField, extraArg)", - "error": [ - "Error: [sin] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval mv_dedupe(concat(\"20\", \"22\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sin(*)", - "error": [ - "Using wildcards (*) in sin is not allowed" - ], + "query": "row var = mv_first(true)", + "error": [], "warning": [] }, { - "query": "from a_index | sort sin(numberField)", + "query": "row mv_first(true)", "error": [], "warning": [] }, { - "query": "row var = sin(to_integer(true))", + "query": "row var = mv_first(to_boolean(true))", "error": [], "warning": [] }, { - "query": "row var = sin(true)", + "query": "row var = mv_first(cartesianPointField)", "error": [ - "Argument of [sin] must be [number], found value [true] type [boolean]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | where sin(booleanField) > 0", + "query": "row mv_first(cartesianPointField)", "error": [ - "Argument of [sin] must be [number], found value [booleanField] type [boolean]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = sin(to_integer(booleanField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval sin(booleanField)", + "query": "row var = mv_first(to_cartesianpoint(cartesianPointField))", "error": [ - "Argument of [sin] must be [number], found value [booleanField] type [boolean]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval sin(null)", + "query": "row var = mv_first(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval sin(nullVar)", + "query": "row mv_first(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = sinh(5)", - "error": [], + "query": "row var = mv_first(to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row sinh(5)", + "query": "row var = mv_first(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "row var = sinh(to_integer(\"a\"))", + "query": "row mv_first(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "row var = sinh(\"a\")", - "error": [ - "Argument of [sinh] must be [number], found value [\"a\"] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | where sinh(numberField) > 0", + "query": "row var = mv_first(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", "error": [], "warning": [] }, { - "query": "from a_index | where sinh(stringField) > 0", - "error": [ - "Argument of [sinh] must be [number], found value [stringField] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sinh(numberField)", + "query": "row var = mv_first(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval sinh(numberField)", + "query": "row mv_first(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = sinh(to_integer(stringField))", + "query": "row var = mv_first(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval sinh(stringField)", + "query": "row var = mv_first(geoPointField)", "error": [ - "Argument of [sinh] must be [number], found value [stringField] type [string]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval sinh(numberField, extraArg)", + "query": "row mv_first(geoPointField)", "error": [ - "Error: [sinh] function expects exactly one argument, got 2." + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = sinh(*)", + "query": "row var = mv_first(to_geopoint(geoPointField))", "error": [ - "Using wildcards (*) in sinh is not allowed" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | sort sinh(numberField)", + "query": "row var = mv_first(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = sinh(to_integer(true))", + "query": "row mv_first(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = sinh(true)", + "query": "row var = mv_first(to_geoshape(geoPointField))", "error": [ - "Argument of [sinh] must be [number], found value [true] type [boolean]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | where sinh(booleanField) > 0", - "error": [ - "Argument of [sinh] must be [number], found value [booleanField] type [boolean]" - ], + "query": "row var = mv_first(5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sinh(to_integer(booleanField))", + "query": "row mv_first(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval sinh(booleanField)", - "error": [ - "Argument of [sinh] must be [number], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval sinh(null)", + "query": "row var = mv_first(to_integer(true))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval sinh(nullVar)", + "query": "row var = mv_first(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "row var = split(\"a\", \"a\")", + "query": "row mv_first(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "row split(\"a\", \"a\")", + "query": "row var = mv_first(to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "row var = split(to_string(\"a\"), to_string(\"a\"))", + "query": "row var = mv_first(\"a\")", "error": [], "warning": [] }, { - "query": "row var = split(5, 5)", - "error": [ - "Argument of [split] must be [string], found value [5] type [number]", - "Argument of [split] must be [string], found value [5] type [number]" - ], + "query": "row mv_first(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | where length(split(stringField, stringField)) > 0", + "query": "row var = mv_first(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | where length(split(numberField, numberField)) > 0", - "error": [ - "Argument of [split] must be [string], found value [numberField] type [number]", - "Argument of [split] must be [string], found value [numberField] type [number]" - ], + "query": "row var = mv_first(to_version(\"1.0.0\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = split(stringField, stringField)", + "query": "row mv_first(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval split(stringField, stringField)", + "query": "row var = mv_first(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = split(to_string(stringField), to_string(stringField))", + "query": "from a_index | where mv_first(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval split(numberField, numberField)", + "query": "from a_index | where mv_first(counterDoubleField) > 0", "error": [ - "Argument of [split] must be [string], found value [numberField] type [number]", - "Argument of [split] must be [string], found value [numberField] type [number]" + "Argument of [mv_first] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | eval split(stringField, stringField, extraArg)", - "error": [ - "Error: [split] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | where mv_first(integerField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | sort split(stringField, stringField)", + "query": "from a_index | where mv_first(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = split(to_string(true), to_string(true))", + "query": "from a_index | where mv_first(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = split(true, true)", - "error": [ - "Argument of [split] must be [string], found value [true] type [boolean]", - "Argument of [split] must be [string], found value [true] type [boolean]" - ], + "query": "from a_index | eval var = mv_first(booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(split(booleanField, booleanField)) > 0", - "error": [ - "Argument of [split] must be [string], found value [booleanField] type [boolean]", - "Argument of [split] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval mv_first(booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = split(to_string(booleanField), to_string(booleanField))", + "query": "from a_index | eval var = mv_first(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval split(booleanField, booleanField)", + "query": "from a_index | eval mv_first(counterDoubleField)", "error": [ - "Argument of [split] must be [string], found value [booleanField] type [boolean]", - "Argument of [split] must be [string], found value [booleanField] type [boolean]" + "Argument of [mv_first] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | eval split(null, null)", - "error": [], + "query": "from a_index | eval var = mv_first(*)", + "error": [ + "Using wildcards (*) in mv_first is not allowed" + ], "warning": [] }, { - "query": "row nullVar = null | eval split(nullVar, nullVar)", + "query": "from a_index | eval var = mv_first(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = sqrt(5)", + "query": "from a_index | eval mv_first(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row sqrt(5)", + "query": "from a_index | eval var = mv_first(to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row var = sqrt(to_integer(\"a\"))", + "query": "from a_index | eval var = mv_first(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = sqrt(\"a\")", - "error": [ - "Argument of [sqrt] must be [number], found value [\"a\"] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | where sqrt(numberField) > 0", + "query": "from a_index | eval mv_first(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | where sqrt(stringField) > 0", - "error": [ - "Argument of [sqrt] must be [number], found value [stringField] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = sqrt(numberField)", + "query": "from a_index | eval var = mv_first(to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval sqrt(numberField)", + "query": "from a_index | eval var = mv_first(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = sqrt(to_integer(stringField))", + "query": "from a_index | eval mv_first(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval sqrt(stringField)", - "error": [ - "Argument of [sqrt] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = mv_first(to_datetime(dateField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval sqrt(numberField, extraArg)", - "error": [ - "Error: [sqrt] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = mv_first(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sqrt(*)", - "error": [ - "Using wildcards (*) in sqrt is not allowed" - ], + "query": "from a_index | eval mv_first(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort sqrt(numberField)", + "query": "from a_index | eval var = mv_first(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = sqrt(to_integer(true))", + "query": "from a_index | eval var = mv_first(geoPointField)", "error": [], "warning": [] }, { - "query": "row var = sqrt(true)", - "error": [ - "Argument of [sqrt] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | eval mv_first(geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | where sqrt(booleanField) > 0", - "error": [ - "Argument of [sqrt] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_first(to_geopoint(geoPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sqrt(to_integer(booleanField))", + "query": "from a_index | eval var = mv_first(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval sqrt(booleanField)", - "error": [ - "Argument of [sqrt] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval mv_first(geoShapeField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval sqrt(null)", + "query": "from a_index | eval var = mv_first(to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval sqrt(nullVar)", + "query": "from a_index | eval var = mv_first(integerField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_first(integerField)", "error": [], "warning": [] }, { - "query": "row st_contains(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_first(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "query": "from a_index | eval var = mv_first(ipField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(\"a\", \"a\")", - "error": [ - "Argument of [st_contains] must be [cartesian_point], found value [\"a\"] type [string]", - "Argument of [st_contains] must be [cartesian_point], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval mv_first(ipField)", + "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_first(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "row st_contains(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_first(keywordField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_first(keywordField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_first(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_first(longField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", + "query": "from a_index | eval mv_first(longField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_first(textField)", "error": [], "warning": [] }, { - "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_first(textField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_first(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_first(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = mv_first(versionField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_first(versionField)", "error": [], "warning": [] }, { - "query": "row st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_first(to_version(keywordField))", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval mv_first(booleanField, extraArg)", + "error": [ + "Error: [mv_first] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | sort mv_first(booleanField)", "error": [], "warning": [] }, { - "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_first(null)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "query": "row nullVar = null | eval mv_first(nullVar)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_first(\"2022\")", "error": [], "warning": [] }, { - "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_first(concat(\"20\", \"22\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(geoPointField, geoPointField)", + "query": "row var = mv_last(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoPointField, geoPointField)", + "query": "row mv_last(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_geopoint(stringField), to_geopoint(stringField))", + "query": "row var = mv_last(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(stringField, stringField)", + "query": "row var = mv_last(cartesianPointField)", "error": [ - "Argument of [st_contains] must be [cartesian_point], found value [stringField] type [string]", - "Argument of [st_contains] must be [cartesian_point], found value [stringField] type [string]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval st_contains(geoPointField, geoPointField, extraArg)", + "query": "row mv_last(cartesianPointField)", "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(geoPointField, geoShapeField)", - "error": [], + "query": "row var = mv_last(to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval st_contains(geoPointField, geoShapeField)", + "query": "row var = mv_last(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_geopoint(stringField), geoShapeField)", + "query": "row mv_last(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoPointField, geoShapeField, extraArg)", + "query": "row var = mv_last(to_cartesianshape(cartesianPointField))", "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(geoShapeField, geoPointField)", + "query": "row var = mv_last(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoShapeField, geoPointField)", + "query": "row mv_last(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(geoShapeField, to_geopoint(stringField))", + "query": "row var = mv_last(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoShapeField, geoPointField, extraArg)", - "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_last(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(geoShapeField, geoShapeField)", + "query": "row mv_last(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoShapeField, geoShapeField)", + "query": "row var = mv_last(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoShapeField, geoShapeField, extraArg)", + "query": "row var = mv_last(geoPointField)", "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(cartesianPointField, cartesianPointField)", - "error": [], + "query": "row mv_last(geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField)", + "query": "row var = mv_last(to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]" + ], + "warning": [] + }, + { + "query": "row var = mv_last(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", + "query": "row mv_last(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField, extraArg)", + "query": "row var = mv_last(to_geoshape(geoPointField))", "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(cartesianPointField, cartesianShapeField)", + "query": "row var = mv_last(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianShapeField)", + "query": "row mv_last(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_cartesianpoint(stringField), cartesianShapeField)", + "query": "row var = mv_last(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianShapeField, extraArg)", - "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_last(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(cartesianShapeField, cartesianPointField)", + "query": "row mv_last(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianShapeField, cartesianPointField)", + "query": "row var = mv_last(to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(cartesianShapeField, to_cartesianpoint(stringField))", + "query": "row var = mv_last(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianShapeField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." - ], + "query": "row mv_last(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(cartesianShapeField, cartesianShapeField)", + "query": "row var = mv_last(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianShapeField, cartesianShapeField)", + "query": "row var = mv_last(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianShapeField, cartesianShapeField, extraArg)", - "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." - ], + "query": "row mv_last(to_version(\"1.0.0\"))", + "error": [], "warning": [] }, { - "query": "from a_index | sort st_contains(geoPointField, geoPointField)", + "query": "row var = mv_last(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | where mv_last(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], + "query": "from a_index | where mv_last(counterDoubleField) > 0", + "error": [ + "Argument of [mv_last] must be [boolean], found value [counterDoubleField] type [counter_double]" + ], "warning": [] }, { - "query": "row var = st_contains(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | where mv_last(integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | where mv_last(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | where mv_last(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = mv_last(booleanField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval mv_last(booleanField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = mv_last(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_contains(true, true)", + "query": "from a_index | eval mv_last(counterDoubleField)", "error": [ - "Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]", - "Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]" + "Argument of [mv_last] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(booleanField, booleanField)", + "query": "from a_index | eval var = mv_last(*)", "error": [ - "Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]", - "Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]" + "Using wildcards (*) in mv_last is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "query": "from a_index | eval var = mv_last(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "query": "from a_index | eval mv_last(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "query": "from a_index | eval var = mv_last(to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "query": "from a_index | eval var = mv_last(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "query": "from a_index | eval mv_last(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geopoint(geoPointField))", + "query": "from a_index | eval var = mv_last(to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "query": "from a_index | eval var = mv_last(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | sort st_contains(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval mv_last(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(null, null)", + "query": "from a_index | eval var = mv_last(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval st_contains(nullVar, nullVar)", + "query": "from a_index | eval var = mv_last(doubleField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_last(doubleField)", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "query": "from a_index | eval var = mv_last(geoPointField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(\"a\", \"a\")", - "error": [ - "Argument of [st_disjoint] must be [cartesian_point], found value [\"a\"] type [string]", - "Argument of [st_disjoint] must be [cartesian_point], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval mv_last(geoPointField)", + "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_last(geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(integerField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", + "query": "from a_index | eval mv_last(integerField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(ipField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_last(ipField)", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = mv_last(keywordField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_last(keywordField)", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(longField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_last(longField)", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(textField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | eval mv_last(textField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_last(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_last(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(geoPointField, geoPointField)", + "query": "from a_index | eval var = mv_last(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoPointField, geoPointField)", + "query": "from a_index | eval mv_last(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_geopoint(stringField), to_geopoint(stringField))", + "query": "from a_index | eval var = mv_last(to_version(keywordField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(stringField, stringField)", + "query": "from a_index | eval mv_last(booleanField, extraArg)", "error": [ - "Argument of [st_disjoint] must be [cartesian_point], found value [stringField] type [string]", - "Argument of [st_disjoint] must be [cartesian_point], found value [stringField] type [string]" + "Error: [mv_last] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoPointField, geoPointField, extraArg)", - "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." - ], - "warning": [] + "query": "from a_index | sort mv_last(booleanField)", + "error": [], + "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(geoPointField, geoShapeField)", + "query": "from a_index | eval mv_last(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoPointField, geoShapeField)", + "query": "row nullVar = null | eval mv_last(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_geopoint(stringField), geoShapeField)", + "query": "from a_index | eval mv_last(\"2022\")", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoPointField, geoShapeField, extraArg)", - "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | eval mv_last(concat(\"20\", \"22\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(geoShapeField, geoPointField)", + "query": "row var = mv_max(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoShapeField, geoPointField)", + "query": "row mv_max(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(geoShapeField, to_geopoint(stringField))", + "query": "row var = mv_max(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoShapeField, geoPointField, extraArg)", - "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_max(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(geoShapeField, geoShapeField)", + "query": "row mv_max(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoShapeField, geoShapeField)", + "query": "row var = mv_max(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoShapeField, geoShapeField, extraArg)", - "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_max(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(cartesianPointField, cartesianPointField)", + "query": "row mv_max(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField)", + "query": "row var = mv_max(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", + "query": "row var = mv_max(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." - ], + "query": "row mv_max(5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(cartesianPointField, cartesianShapeField)", + "query": "row var = mv_max(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField)", + "query": "row var = mv_max(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(stringField), cartesianShapeField)", + "query": "row mv_max(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField, extraArg)", - "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_max(to_ip(to_ip(\"127.0.0.1\")))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(cartesianShapeField, cartesianPointField)", + "query": "row var = mv_max(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField)", + "query": "row mv_max(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(cartesianShapeField, to_cartesianpoint(stringField))", + "query": "row var = mv_max(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_max(to_version(\"1.0.0\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(cartesianShapeField, cartesianShapeField)", + "query": "row mv_max(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField)", + "query": "row var = mv_max(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField, extraArg)", + "query": "row var = mv_max(to_cartesianpoint(\"POINT (30 10)\"))", "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + "Argument of [mv_max] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | sort st_disjoint(geoPointField, geoPointField)", - "error": [], - "warning": [] - }, - { - "query": "row var = st_disjoint(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | where mv_max(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], + "query": "from a_index | where mv_max(cartesianPointField) > 0", + "error": [ + "Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | where mv_max(integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | where mv_max(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | where mv_max(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = mv_max(booleanField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval mv_max(booleanField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = mv_max(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(true, true)", + "query": "from a_index | eval mv_max(cartesianPointField)", "error": [ - "Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]", - "Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]" + "Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_disjoint(booleanField, booleanField)", + "query": "from a_index | eval var = mv_max(*)", "error": [ - "Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]", - "Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]" + "Using wildcards (*) in mv_max is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "query": "from a_index | eval var = mv_max(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "query": "from a_index | eval mv_max(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "query": "from a_index | eval var = mv_max(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "query": "from a_index | eval var = mv_max(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "query": "from a_index | eval mv_max(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geopoint(geoPointField))", + "query": "from a_index | eval var = mv_max(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "query": "from a_index | eval var = mv_max(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | sort st_disjoint(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval mv_max(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(null, null)", + "query": "from a_index | eval var = mv_max(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval st_disjoint(nullVar, nullVar)", + "query": "from a_index | eval var = mv_max(ipField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_max(ipField)", "error": [], "warning": [] }, { - "query": "row st_intersects(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_max(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "query": "from a_index | eval var = mv_max(keywordField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(\"a\", \"a\")", - "error": [ - "Argument of [st_intersects] must be [cartesian_point], found value [\"a\"] type [string]", - "Argument of [st_intersects] must be [cartesian_point], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval mv_max(keywordField)", + "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_max(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row st_intersects(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_max(longField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_max(longField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_max(textField)", "error": [], "warning": [] }, { - "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_max(textField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", + "query": "from a_index | eval var = mv_max(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_max(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_max(versionField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_max(versionField)", "error": [], "warning": [] }, { - "query": "row st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_max(to_version(keywordField))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", - "error": [], + "query": "from a_index | eval mv_max(booleanField, extraArg)", + "error": [ + "Error: [mv_max] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | sort mv_max(booleanField)", "error": [], "warning": [] }, { - "query": "row st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_max(null)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row nullVar = null | eval mv_max(nullVar)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_max(\"2022\")", "error": [], "warning": [] }, { - "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_max(concat(\"20\", \"22\"))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "query": "row var = mv_median(5.5)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row mv_median(5.5)", "error": [], "warning": [] }, { - "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row var = mv_median(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(geoPointField, geoPointField)", + "query": "row var = mv_median(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoPointField, geoPointField)", + "query": "row mv_median(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_geopoint(stringField), to_geopoint(stringField))", + "query": "row var = mv_median(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(stringField, stringField)", + "query": "row var = mv_median(true)", "error": [ - "Argument of [st_intersects] must be [cartesian_point], found value [stringField] type [string]", - "Argument of [st_intersects] must be [cartesian_point], found value [stringField] type [string]" + "Argument of [mv_median] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoPointField, geoPointField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | where mv_median(doubleField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(geoPointField, geoShapeField)", - "error": [], + "query": "from a_index | where mv_median(booleanField) > 0", + "error": [ + "Argument of [mv_median] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoPointField, geoShapeField)", + "query": "from a_index | where mv_median(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_geopoint(stringField), geoShapeField)", + "query": "from a_index | where mv_median(longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoPointField, geoShapeField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | where mv_median(unsignedLongField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(geoShapeField, geoPointField)", + "query": "from a_index | eval var = mv_median(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoShapeField, geoPointField)", + "query": "from a_index | eval mv_median(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(geoShapeField, to_geopoint(stringField))", + "query": "from a_index | eval var = mv_median(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoShapeField, geoPointField, extraArg)", + "query": "from a_index | eval mv_median(booleanField)", "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." + "Argument of [mv_median] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(geoShapeField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_intersects(geoShapeField, geoShapeField, extraArg)", + "query": "from a_index | eval var = mv_median(*)", "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." + "Using wildcards (*) in mv_median is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval var = mv_median(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval mv_median(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", + "query": "from a_index | eval var = mv_median(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | eval var = mv_median(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(cartesianPointField, cartesianShapeField)", + "query": "from a_index | eval mv_median(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianShapeField)", + "query": "from a_index | eval var = mv_median(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_cartesianpoint(stringField), cartesianShapeField)", + "query": "from a_index | eval mv_median(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianShapeField, extraArg)", + "query": "from a_index | eval mv_median(doubleField, extraArg)", "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." + "Error: [mv_median] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(cartesianShapeField, cartesianPointField)", + "query": "from a_index | sort mv_median(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianPointField)", + "query": "from a_index | eval mv_median(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(cartesianShapeField, to_cartesianpoint(stringField))", + "query": "row nullVar = null | eval mv_median(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_min(true)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(cartesianShapeField, cartesianShapeField)", + "query": "row mv_min(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField)", + "query": "row var = mv_min(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_min(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | sort st_intersects(geoPointField, geoPointField)", + "query": "row mv_min(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row var = mv_min(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row var = mv_min(5.5)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row mv_min(5.5)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row var = mv_min(to_double(true))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "row var = mv_min(5)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "row mv_min(5)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "row var = mv_min(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "row var = mv_min(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(true, true)", - "error": [ - "Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]", - "Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]" - ], + "query": "row mv_min(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "query": "row var = mv_min(to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(booleanField, booleanField)", - "error": [ - "Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]", - "Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]" - ], + "query": "row var = mv_min(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "query": "row mv_min(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "query": "row var = mv_min(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "query": "row var = mv_min(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "query": "row mv_min(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "query": "row var = mv_min(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geopoint(geoPointField))", - "error": [], + "query": "row var = mv_min(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [mv_min] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "query": "from a_index | where mv_min(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | sort st_intersects(cartesianPointField, cartesianPointField)", + "query": "from a_index | where mv_min(cartesianPointField) > 0", + "error": [ + "Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where mv_min(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(null, null)", + "query": "from a_index | where mv_min(longField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval st_intersects(nullVar, nullVar)", + "query": "from a_index | where mv_min(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(booleanField)", "error": [], "warning": [] }, { - "query": "row st_within(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_min(booleanField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "query": "from a_index | eval var = mv_min(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_within(\"a\", \"a\")", + "query": "from a_index | eval mv_min(cartesianPointField)", "error": [ - "Argument of [st_within] must be [cartesian_point], found value [\"a\"] type [string]", - "Argument of [st_within] must be [cartesian_point], found value [\"a\"] type [string]" + "Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "row var = st_within(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval var = mv_min(*)", + "error": [ + "Using wildcards (*) in mv_min is not allowed" + ], "warning": [] }, { - "query": "row st_within(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(dateField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_min(dateField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(doubleField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", + "query": "from a_index | eval mv_min(doubleField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row st_within(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(integerField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_min(integerField)", "error": [], "warning": [] }, { - "query": "row st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = mv_min(ipField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_min(ipField)", "error": [], "warning": [] }, { - "query": "row st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(keywordField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_min(keywordField)", "error": [], "warning": [] }, { - "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = mv_min(longField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_min(longField)", "error": [], "warning": [] }, { - "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_min(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(geoPointField, geoPointField)", + "query": "from a_index | eval mv_min(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoPointField, geoPointField)", + "query": "from a_index | eval var = mv_min(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_geopoint(stringField), to_geopoint(stringField))", + "query": "from a_index | eval mv_min(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(stringField, stringField)", - "error": [ - "Argument of [st_within] must be [cartesian_point], found value [stringField] type [string]", - "Argument of [st_within] must be [cartesian_point], found value [stringField] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | eval st_within(geoPointField, geoPointField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(geoPointField, geoShapeField)", + "query": "from a_index | eval var = mv_min(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoPointField, geoShapeField)", + "query": "from a_index | eval mv_min(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_geopoint(stringField), geoShapeField)", + "query": "from a_index | eval var = mv_min(to_version(keywordField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoPointField, geoShapeField, extraArg)", + "query": "from a_index | eval mv_min(booleanField, extraArg)", "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." + "Error: [mv_min] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = st_within(geoShapeField, geoPointField)", + "query": "from a_index | sort mv_min(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoShapeField, geoPointField)", + "query": "from a_index | eval mv_min(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(geoShapeField, to_geopoint(stringField))", + "query": "row nullVar = null | eval mv_min(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoShapeField, geoPointField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(geoShapeField, geoShapeField)", + "query": "from a_index | eval mv_min(\"2022\")", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoShapeField, geoShapeField)", + "query": "from a_index | eval mv_min(concat(\"20\", \"22\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoShapeField, geoShapeField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_slice(true, 5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(cartesianPointField, cartesianPointField)", + "query": "row mv_slice(true, 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField)", + "query": "row var = mv_slice(to_boolean(true), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", - "error": [], + "query": "row var = mv_slice(cartesianPointField, 5, 5)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField, extraArg)", + "query": "row mv_slice(cartesianPointField, 5, 5)", "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = st_within(cartesianPointField, cartesianShapeField)", - "error": [], + "query": "row var = mv_slice(to_cartesianpoint(cartesianPointField), to_integer(true), to_integer(true))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianPointField, cartesianShapeField)", + "query": "row var = mv_slice(to_cartesianshape(\"POINT (30 10)\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_cartesianpoint(stringField), cartesianShapeField)", + "query": "row mv_slice(to_cartesianshape(\"POINT (30 10)\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianPointField, cartesianShapeField, extraArg)", + "query": "row var = mv_slice(to_cartesianshape(cartesianPointField), to_integer(true), to_integer(true))", "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = st_within(cartesianShapeField, cartesianPointField)", + "query": "row var = mv_slice(to_datetime(\"2021-01-01T00:00:00Z\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianShapeField, cartesianPointField)", + "query": "row mv_slice(to_datetime(\"2021-01-01T00:00:00Z\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(cartesianShapeField, to_cartesianpoint(stringField))", + "query": "row var = mv_slice(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianShapeField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_slice(5.5, 5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(cartesianShapeField, cartesianShapeField)", + "query": "row mv_slice(5.5, 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianShapeField, cartesianShapeField)", + "query": "row var = mv_slice(to_double(true), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianShapeField, cartesianShapeField, extraArg)", + "query": "row var = mv_slice(geoPointField, 5, 5)", "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | sort st_within(geoPointField, geoPointField)", - "error": [], + "query": "row mv_slice(geoPointField, 5, 5)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = st_within(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], + "query": "row var = mv_slice(to_geopoint(geoPointField), to_integer(true), to_integer(true))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = st_within(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row var = mv_slice(to_geoshape(\"POINT (30 10)\"), 5, 5)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row mv_slice(to_geoshape(\"POINT (30 10)\"), 5, 5)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", - "error": [], + "query": "row var = mv_slice(to_geoshape(geoPointField), to_integer(true), to_integer(true))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = st_within(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "row var = mv_slice(5, 5, 5)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "row mv_slice(5, 5, 5)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "row var = mv_slice(to_integer(true), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "row var = mv_slice(to_ip(\"127.0.0.1\"), 5, 5)", "error": [], "warning": [] }, { - "query": "row var = st_within(true, true)", - "error": [ - "Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]", - "Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]" - ], + "query": "row mv_slice(to_ip(\"127.0.0.1\"), 5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "query": "row var = mv_slice(to_ip(to_ip(\"127.0.0.1\")), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(booleanField, booleanField)", - "error": [ - "Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]", - "Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]" - ], + "query": "row var = mv_slice(\"a\", 5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "query": "row mv_slice(\"a\", 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "query": "row var = mv_slice(to_string(true), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "query": "row var = mv_slice(5, to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "query": "row var = mv_slice(to_version(\"1.0.0\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "query": "row mv_slice(to_version(\"1.0.0\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_geoshape(geoPointField), to_geopoint(geoPointField))", + "query": "row var = mv_slice(to_version(\"a\"), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_geoshape(geoPointField), to_geoshape(geoPointField))", - "error": [], + "query": "row var = mv_slice(5.5, true, true)", + "error": [ + "Argument of [mv_slice] must be [integer], found value [true] type [boolean]", + "Argument of [mv_slice] must be [integer], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | sort st_within(cartesianPointField, cartesianPointField)", + "query": "from a_index | where mv_slice(doubleField, integerField, integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(null, null)", + "query": "from a_index | where mv_slice(counterDoubleField, booleanField, booleanField) > 0", + "error": [ + "Argument of [mv_slice] must be [boolean], found value [counterDoubleField] type [counter_double]", + "Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where mv_slice(integerField, integerField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval st_within(nullVar, nullVar)", + "query": "from a_index | where mv_slice(longField, integerField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_x(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_slice(booleanField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row st_x(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_slice(booleanField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = st_x(to_geopoint(\"a\"))", + "query": "from a_index | eval var = mv_slice(to_boolean(booleanField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_x(\"a\")", + "query": "from a_index | eval mv_slice(counterDoubleField, booleanField, booleanField)", "error": [ - "Argument of [st_x] must be [cartesian_point], found value [\"a\"] type [string]" + "Argument of [mv_slice] must be [boolean], found value [counterDoubleField] type [counter_double]", + "Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "row var = st_x(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_slice(cartesianPointField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row st_x(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_slice(cartesianPointField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = st_x(to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = mv_slice(to_cartesianpoint(cartesianPointField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(geoPointField)", + "query": "from a_index | eval var = mv_slice(cartesianShapeField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(geoPointField)", + "query": "from a_index | eval mv_slice(cartesianShapeField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(to_geopoint(stringField))", + "query": "from a_index | eval var = mv_slice(to_cartesianshape(cartesianPointField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(stringField)", - "error": [ - "Argument of [st_x] must be [cartesian_point], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = mv_slice(dateField, integerField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(geoPointField, extraArg)", - "error": [ - "Error: [st_x] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval mv_slice(dateField, integerField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(*)", - "error": [ - "Using wildcards (*) in st_x is not allowed" - ], + "query": "from a_index | eval var = mv_slice(to_datetime(dateField), to_integer(booleanField), to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(cartesianPointField)", + "query": "from a_index | eval var = mv_slice(doubleField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(cartesianPointField)", + "query": "from a_index | eval mv_slice(doubleField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(to_cartesianpoint(stringField))", + "query": "from a_index | eval var = mv_slice(to_double(booleanField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(cartesianPointField, extraArg)", - "error": [ - "Error: [st_x] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = mv_slice(geoPointField, integerField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort st_x(geoPointField)", + "query": "from a_index | eval mv_slice(geoPointField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = st_x(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = mv_slice(to_geopoint(geoPointField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_x(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = mv_slice(geoShapeField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = st_x(true)", - "error": [ - "Argument of [st_x] must be [cartesian_point], found value [true] type [boolean]" - ], + "query": "from a_index | eval mv_slice(geoShapeField, integerField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(to_cartesianpoint(cartesianPointField))", + "query": "from a_index | eval var = mv_slice(to_geoshape(geoPointField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(booleanField)", - "error": [ - "Argument of [st_x] must be [cartesian_point], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_slice(integerField, integerField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(to_geopoint(geoPointField))", + "query": "from a_index | eval mv_slice(integerField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | sort st_x(cartesianPointField)", + "query": "from a_index | eval var = mv_slice(to_integer(booleanField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(null)", + "query": "from a_index | eval var = mv_slice(ipField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval st_x(nullVar)", + "query": "from a_index | eval mv_slice(ipField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = st_y(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_slice(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row st_y(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_slice(keywordField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = st_y(to_geopoint(\"a\"))", + "query": "from a_index | eval mv_slice(keywordField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = st_y(\"a\")", - "error": [ - "Argument of [st_y] must be [cartesian_point], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval var = mv_slice(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "row var = st_y(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_slice(longField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row st_y(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_slice(longField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = st_y(to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = mv_slice(longField, to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_y(geoPointField)", + "query": "from a_index | eval var = mv_slice(textField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(geoPointField)", + "query": "from a_index | eval mv_slice(textField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_y(to_geopoint(stringField))", + "query": "from a_index | eval var = mv_slice(versionField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(stringField)", - "error": [ - "Argument of [st_y] must be [cartesian_point], found value [stringField] type [string]" - ], + "query": "from a_index | eval mv_slice(versionField, integerField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(geoPointField, extraArg)", - "error": [ - "Error: [st_y] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = mv_slice(to_version(keywordField), to_integer(booleanField), to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_y(*)", + "query": "from a_index | eval mv_slice(booleanField, integerField, integerField, extraArg)", "error": [ - "Using wildcards (*) in st_y is not allowed" + "Error: [mv_slice] function expects no more than 3 arguments, got 4." ], "warning": [] }, { - "query": "from a_index | eval var = st_y(cartesianPointField)", + "query": "from a_index | sort mv_slice(booleanField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(cartesianPointField)", + "query": "from a_index | eval mv_slice(null, null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_y(to_cartesianpoint(stringField))", + "query": "row nullVar = null | eval mv_slice(nullVar, nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(cartesianPointField, extraArg)", - "error": [ - "Error: [st_y] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort st_y(geoPointField)", + "query": "from a_index | eval mv_slice(\"2022\", integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = st_y(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval mv_slice(concat(\"20\", \"22\"), integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = st_y(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "row var = mv_sort(true, \"asc\")", "error": [], "warning": [] }, { - "query": "row var = st_y(true)", - "error": [ - "Argument of [st_y] must be [cartesian_point], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_y(to_cartesianpoint(cartesianPointField))", + "query": "row mv_sort(true, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(booleanField)", - "error": [ - "Argument of [st_y] must be [cartesian_point], found value [booleanField] type [boolean]" - ], + "query": "row var = mv_sort(to_datetime(\"2021-01-01T00:00:00Z\"), \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_y(to_geopoint(geoPointField))", + "query": "row mv_sort(to_datetime(\"2021-01-01T00:00:00Z\"), \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | sort st_y(cartesianPointField)", + "query": "row var = mv_sort(5.5, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(null)", + "query": "row mv_sort(5.5, \"asc\")", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval st_y(nullVar)", + "query": "row var = mv_sort(5, \"asc\")", "error": [], "warning": [] }, { - "query": "row var = starts_with(\"a\", \"a\")", + "query": "row mv_sort(5, \"asc\")", "error": [], "warning": [] }, { - "query": "row starts_with(\"a\", \"a\")", + "query": "row var = mv_sort(to_ip(\"127.0.0.1\"), \"asc\")", "error": [], "warning": [] }, { - "query": "row var = starts_with(to_string(\"a\"), to_string(\"a\"))", + "query": "row mv_sort(to_ip(\"127.0.0.1\"), \"asc\")", "error": [], "warning": [] }, { - "query": "row var = starts_with(5, 5)", - "error": [ - "Argument of [starts_with] must be [string], found value [5] type [number]", - "Argument of [starts_with] must be [string], found value [5] type [number]" - ], + "query": "row var = mv_sort(\"a\", \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = starts_with(stringField, stringField)", + "query": "row mv_sort(\"a\", \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | eval starts_with(stringField, stringField)", + "query": "row var = mv_sort(to_version(\"1.0.0\"), \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = starts_with(to_string(stringField), to_string(stringField))", + "query": "row mv_sort(to_version(\"1.0.0\"), \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | eval starts_with(numberField, numberField)", + "query": "row var = mv_sort(to_cartesianpoint(\"POINT (30 10)\"), true)", "error": [ - "Argument of [starts_with] must be [string], found value [numberField] type [number]", - "Argument of [starts_with] must be [string], found value [numberField] type [number]" + "Argument of [mv_sort] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", + "Argument of [mv_sort] must be [keyword], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval starts_with(stringField, stringField, extraArg)", - "error": [ - "Error: [starts_with] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | eval var = mv_sort(booleanField, \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | sort starts_with(stringField, stringField)", + "query": "from a_index | eval mv_sort(booleanField, \"asc\")", "error": [], "warning": [] }, { - "query": "row var = starts_with(to_string(true), to_string(true))", + "query": "from a_index | eval var = mv_sort(dateField, \"asc\")", "error": [], "warning": [] }, { - "query": "row var = starts_with(true, true)", - "error": [ - "Argument of [starts_with] must be [string], found value [true] type [boolean]", - "Argument of [starts_with] must be [string], found value [true] type [boolean]" - ], + "query": "from a_index | eval mv_sort(dateField, \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = starts_with(to_string(booleanField), to_string(booleanField))", + "query": "from a_index | eval var = mv_sort(doubleField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | eval starts_with(booleanField, booleanField)", - "error": [ - "Argument of [starts_with] must be [string], found value [booleanField] type [boolean]", - "Argument of [starts_with] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval mv_sort(doubleField, \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval starts_with(null, null)", + "query": "from a_index | eval var = mv_sort(integerField, \"asc\")", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval starts_with(nullVar, nullVar)", + "query": "from a_index | eval mv_sort(integerField, \"asc\")", "error": [], "warning": [] }, { - "query": "row var = substring(\"a\", 5, 5)", + "query": "from a_index | eval var = mv_sort(ipField, \"asc\")", "error": [], "warning": [] }, { - "query": "row var = substring(\"a\", 5)", + "query": "from a_index | eval mv_sort(ipField, \"asc\")", "error": [], "warning": [] }, { - "query": "row substring(\"a\", 5, 5)", + "query": "from a_index | eval var = mv_sort(keywordField, \"asc\")", "error": [], "warning": [] }, { - "query": "row substring(\"a\", 5)", + "query": "from a_index | eval mv_sort(keywordField, \"asc\")", "error": [], "warning": [] }, { - "query": "row var = substring(to_string(\"a\"), to_integer(\"a\"), to_integer(\"a\"))", + "query": "from a_index | eval var = mv_sort(longField, \"asc\")", "error": [], "warning": [] }, { - "query": "row var = substring(5, \"a\", \"a\")", - "error": [ - "Argument of [substring] must be [string], found value [5] type [number]", - "Argument of [substring] must be [number], found value [\"a\"] type [string]", - "Argument of [substring] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval mv_sort(longField, \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | where length(substring(stringField, numberField, numberField)) > 0", + "query": "from a_index | eval var = mv_sort(textField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | where length(substring(numberField, stringField, stringField)) > 0", - "error": [ - "Argument of [substring] must be [string], found value [numberField] type [number]", - "Argument of [substring] must be [number], found value [stringField] type [string]", - "Argument of [substring] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval mv_sort(textField, \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = substring(stringField, numberField, numberField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval substring(stringField, numberField, numberField)", + "query": "from a_index | eval var = mv_sort(versionField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = substring(to_string(stringField), to_integer(stringField), to_integer(stringField))", + "query": "from a_index | eval mv_sort(versionField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | eval substring(numberField, stringField, stringField)", + "query": "from a_index | eval mv_sort(booleanField, \"asc\", extraArg)", "error": [ - "Argument of [substring] must be [string], found value [numberField] type [number]", - "Argument of [substring] must be [number], found value [stringField] type [string]", - "Argument of [substring] must be [number], found value [stringField] type [string]" + "Error: [mv_sort] function expects no more than 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | eval substring(stringField, numberField, numberField, extraArg)", - "error": [ - "Error: [substring] function expects no more than 3 arguments, got 4." - ], + "query": "from a_index | sort mv_sort(booleanField, \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | sort substring(stringField, numberField, numberField)", + "query": "from a_index | eval mv_sort(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | sort substring(stringField, numberField)", + "query": "row nullVar = null | eval mv_sort(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row var = substring(to_string(true), to_integer(true), to_integer(true))", + "query": "from a_index | eval mv_sort(\"2022\", \"asc\")", "error": [], "warning": [] }, { - "query": "row var = substring(true, true, true)", - "error": [ - "Argument of [substring] must be [string], found value [true] type [boolean]", - "Argument of [substring] must be [number], found value [true] type [boolean]", - "Argument of [substring] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | eval mv_sort(concat(\"20\", \"22\"), \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | where length(substring(booleanField, booleanField, booleanField)) > 0", - "error": [ - "Argument of [substring] must be [string], found value [booleanField] type [boolean]", - "Argument of [substring] must be [number], found value [booleanField] type [boolean]", - "Argument of [substring] must be [number], found value [booleanField] type [boolean]" - ], + "query": "row var = mv_sum(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = substring(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))", + "query": "row mv_sum(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval substring(booleanField, booleanField, booleanField)", - "error": [ - "Argument of [substring] must be [string], found value [booleanField] type [boolean]", - "Argument of [substring] must be [number], found value [booleanField] type [boolean]", - "Argument of [substring] must be [number], found value [booleanField] type [boolean]" - ], + "query": "row var = mv_sum(to_double(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval substring(null, null, null)", + "query": "row var = mv_sum(5)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval substring(nullVar, nullVar, nullVar)", + "query": "row mv_sum(5)", "error": [], "warning": [] }, { - "query": "row var = tan(5)", + "query": "row var = mv_sum(to_integer(true))", "error": [], "warning": [] }, { - "query": "row tan(5)", - "error": [], + "query": "row var = mv_sum(true)", + "error": [ + "Argument of [mv_sum] must be [double], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = tan(to_integer(\"a\"))", + "query": "from a_index | where mv_sum(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = tan(\"a\")", + "query": "from a_index | where mv_sum(booleanField) > 0", "error": [ - "Argument of [tan] must be [number], found value [\"a\"] type [string]" + "Argument of [mv_sum] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where tan(numberField) > 0", + "query": "from a_index | where mv_sum(integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where tan(stringField) > 0", - "error": [ - "Argument of [tan] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | where mv_sum(longField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = tan(numberField)", + "query": "from a_index | where mv_sum(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval tan(numberField)", + "query": "from a_index | eval var = mv_sum(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = tan(to_integer(stringField))", + "query": "from a_index | eval mv_sum(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval tan(stringField)", - "error": [ - "Argument of [tan] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = mv_sum(to_double(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval tan(numberField, extraArg)", + "query": "from a_index | eval mv_sum(booleanField)", "error": [ - "Error: [tan] function expects exactly one argument, got 2." + "Argument of [mv_sum] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = tan(*)", + "query": "from a_index | eval var = mv_sum(*)", "error": [ - "Using wildcards (*) in tan is not allowed" + "Using wildcards (*) in mv_sum is not allowed" ], "warning": [] }, { - "query": "from a_index | sort tan(numberField)", + "query": "from a_index | eval var = mv_sum(integerField)", "error": [], "warning": [] }, { - "query": "row var = tan(to_integer(true))", + "query": "from a_index | eval mv_sum(integerField)", "error": [], "warning": [] }, { - "query": "row var = tan(true)", - "error": [ - "Argument of [tan] must be [number], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where tan(booleanField) > 0", - "error": [ - "Argument of [tan] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_sum(to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = tan(to_integer(booleanField))", + "query": "from a_index | eval var = mv_sum(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval tan(booleanField)", - "error": [ - "Argument of [tan] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval mv_sum(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval tan(null)", + "query": "from a_index | eval var = mv_sum(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval tan(nullVar)", + "query": "from a_index | eval mv_sum(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = tanh(5)", - "error": [], + "query": "from a_index | eval mv_sum(doubleField, extraArg)", + "error": [ + "Error: [mv_sum] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row tanh(5)", + "query": "from a_index | sort mv_sum(doubleField)", "error": [], "warning": [] }, { - "query": "row var = tanh(to_integer(\"a\"))", + "query": "from a_index | eval mv_sum(null)", "error": [], "warning": [] }, { - "query": "row var = tanh(\"a\")", - "error": [ - "Argument of [tanh] must be [number], found value [\"a\"] type [string]" - ], + "query": "row nullVar = null | eval mv_sum(nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | where tanh(numberField) > 0", + "query": "row var = mv_zip(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | where tanh(stringField) > 0", - "error": [ - "Argument of [tanh] must be [number], found value [stringField] type [string]" - ], + "query": "row mv_zip(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = tanh(numberField)", + "query": "row var = mv_zip(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval tanh(numberField)", + "query": "row var = mv_zip(\"a\", \"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = tanh(to_integer(stringField))", + "query": "row mv_zip(\"a\", \"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval tanh(stringField)", - "error": [ - "Argument of [tanh] must be [number], found value [stringField] type [string]" - ], + "query": "row var = mv_zip(to_string(true), to_string(true), to_string(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval tanh(numberField, extraArg)", + "query": "row var = mv_zip(true, true, true)", "error": [ - "Error: [tanh] function expects exactly one argument, got 2." + "Argument of [mv_zip] must be [keyword], found value [true] type [boolean]", + "Argument of [mv_zip] must be [keyword], found value [true] type [boolean]", + "Argument of [mv_zip] must be [keyword], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = tanh(*)", - "error": [ - "Using wildcards (*) in tanh is not allowed" - ], + "query": "from a_index | eval var = mv_zip(keywordField, keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort tanh(numberField)", + "query": "from a_index | eval mv_zip(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = tanh(to_integer(true))", + "query": "from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = tanh(true)", + "query": "from a_index | eval mv_zip(booleanField, booleanField)", "error": [ - "Argument of [tanh] must be [number], found value [true] type [boolean]" + "Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where tanh(booleanField) > 0", - "error": [ - "Argument of [tanh] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = mv_zip(keywordField, keywordField, keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = tanh(to_integer(booleanField))", + "query": "from a_index | eval mv_zip(keywordField, keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval tanh(booleanField)", + "query": "from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField), to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval mv_zip(booleanField, booleanField, booleanField)", "error": [ - "Argument of [tanh] must be [number], found value [booleanField] type [boolean]" + "Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval tanh(null)", + "query": "from a_index | eval var = mv_zip(keywordField, keywordField, textField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval tanh(nullVar)", + "query": "from a_index | eval mv_zip(keywordField, keywordField, textField)", "error": [], "warning": [] }, { - "query": "row var = tau()", + "query": "from a_index | eval var = mv_zip(keywordField, textField)", "error": [], "warning": [] }, { - "query": "row tau()", + "query": "from a_index | eval mv_zip(keywordField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | where tau() > 0", + "query": "from a_index | eval var = mv_zip(keywordField, textField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = tau()", + "query": "from a_index | eval mv_zip(keywordField, textField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval tau()", + "query": "from a_index | eval var = mv_zip(keywordField, textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval tau(extraArg)", - "error": [ - "Error: [tau] function expects exactly 0 arguments, got 1." - ], + "query": "from a_index | eval mv_zip(keywordField, textField, textField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort tau()", + "query": "from a_index | eval var = mv_zip(textField, keywordField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval tau()", + "query": "from a_index | eval mv_zip(textField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = to_boolean(\"a\")", + "query": "from a_index | eval var = mv_zip(textField, keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row to_boolean(\"a\")", + "query": "from a_index | eval mv_zip(textField, keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = to_bool(\"a\")", + "query": "from a_index | eval var = mv_zip(textField, keywordField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_boolean(stringField)", + "query": "from a_index | eval mv_zip(textField, keywordField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_boolean(stringField)", + "query": "from a_index | eval var = mv_zip(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_bool(stringField)", + "query": "from a_index | eval mv_zip(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_boolean(*)", - "error": [ - "Using wildcards (*) in to_boolean is not allowed" - ], + "query": "from a_index | eval var = mv_zip(textField, textField, keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_boolean(stringField)", + "query": "from a_index | eval mv_zip(textField, textField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = to_boolean(true)", + "query": "from a_index | eval var = mv_zip(textField, textField, textField)", "error": [], "warning": [] }, { - "query": "row to_boolean(true)", + "query": "from a_index | eval mv_zip(textField, textField, textField)", "error": [], "warning": [] }, { - "query": "row var = to_bool(true)", + "query": "from a_index | eval mv_zip(keywordField, keywordField, keywordField, extraArg)", + "error": [ + "Error: [mv_zip] function expects no more than 3 arguments, got 4." + ], + "warning": [] + }, + { + "query": "from a_index | sort mv_zip(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = to_boolean(to_boolean(true))", + "query": "from a_index | eval mv_zip(null, null, null)", "error": [], "warning": [] }, { - "query": "row var = to_boolean(5)", + "query": "row nullVar = null | eval mv_zip(nullVar, nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row to_boolean(5)", + "query": "row var = now()", "error": [], "warning": [] }, { - "query": "row var = to_bool(5)", + "query": "row now()", "error": [], "warning": [] }, { - "query": "row var = to_boolean(to_integer(true))", + "query": "from a_index | eval var = now()", "error": [], "warning": [] }, { - "query": "row var = to_boolean(to_string(true))", + "query": "from a_index | eval now()", "error": [], "warning": [] }, { - "query": "row var = to_boolean(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval now(extraArg)", "error": [ - "Argument of [to_boolean] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + "Error: [now] function expects exactly 0 arguments, got 1." ], "warning": [] }, { - "query": "from a_index | eval var = to_boolean(booleanField)", + "query": "from a_index | sort now()", "error": [], "warning": [] }, { - "query": "from a_index | eval to_boolean(booleanField)", + "query": "row nullVar = null | eval now()", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_bool(booleanField)", + "query": "row var = pi()", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_boolean(to_boolean(booleanField))", + "query": "row pi()", "error": [], "warning": [] }, { - "query": "from a_index | eval to_boolean(cartesianPointField)", - "error": [ - "Argument of [to_boolean] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | where pi() > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_boolean(numberField)", + "query": "from a_index | eval var = pi()", "error": [], "warning": [] }, { - "query": "from a_index | eval to_boolean(numberField)", + "query": "from a_index | eval pi()", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_bool(numberField)", - "error": [], + "query": "from a_index | eval pi(extraArg)", + "error": [ + "Error: [pi] function expects exactly 0 arguments, got 1." + ], "warning": [] }, { - "query": "from a_index | eval var = to_boolean(to_integer(booleanField))", + "query": "from a_index | sort pi()", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_boolean(to_string(booleanField))", + "query": "row nullVar = null | eval pi()", "error": [], "warning": [] }, { - "query": "from a_index | eval to_boolean(booleanField, extraArg)", - "error": [ - "Error: [to_boolean] function expects exactly one argument, got 2." - ], + "query": "row var = pow(5.5, 5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_boolean(booleanField)", + "query": "row pow(5.5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_boolean(null)", + "query": "row var = pow(to_double(true), to_double(true))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_boolean(nullVar)", + "query": "row var = pow(5.5, 5)", "error": [], "warning": [] }, { - "query": "row var = to_cartesianpoint(\"a\")", + "query": "row pow(5.5, 5)", "error": [], "warning": [] }, { - "query": "row to_cartesianpoint(\"a\")", + "query": "row var = pow(to_double(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianpoint(stringField)", + "query": "row var = pow(to_double(true), 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianpoint(stringField)", + "query": "row var = pow(5, 5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianpoint(*)", - "error": [ - "Using wildcards (*) in to_cartesianpoint is not allowed" - ], + "query": "row pow(5, 5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_cartesianpoint(stringField)", + "query": "row var = pow(to_integer(true), to_double(true))", "error": [], "warning": [] }, { - "query": "row var = to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row var = pow(5, 5)", "error": [], "warning": [] }, { - "query": "row to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row pow(5, 5)", "error": [], "warning": [] }, { - "query": "row var = to_cartesianpoint(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row var = pow(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = to_cartesianpoint(to_string(true))", + "query": "row var = pow(to_integer(true), 5)", "error": [], "warning": [] }, { - "query": "row var = to_cartesianpoint(true)", - "error": [ - "Argument of [to_cartesianpoint] must be [cartesian_point], found value [true] type [boolean]" - ], + "query": "row var = pow(5, to_double(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianpoint(cartesianPointField)", + "query": "row var = pow(5, to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianpoint(cartesianPointField)", - "error": [], + "query": "row var = pow(true, true)", + "error": [ + "Argument of [pow] must be [double], found value [true] type [boolean]", + "Argument of [pow] must be [double], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianpoint(to_cartesianpoint(cartesianPointField))", + "query": "from a_index | where pow(doubleField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianpoint(booleanField)", + "query": "from a_index | where pow(booleanField, booleanField) > 0", "error": [ - "Argument of [to_cartesianpoint] must be [cartesian_point], found value [booleanField] type [boolean]" + "Argument of [pow] must be [double], found value [booleanField] type [boolean]", + "Argument of [pow] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianpoint(to_string(booleanField))", + "query": "from a_index | where pow(doubleField, integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianpoint(cartesianPointField, extraArg)", - "error": [ - "Error: [to_cartesianpoint] function expects exactly one argument, got 2." - ], + "query": "from a_index | where pow(doubleField, longField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_cartesianpoint(cartesianPointField)", + "query": "from a_index | where pow(doubleField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianpoint(null)", + "query": "from a_index | where pow(integerField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_cartesianpoint(nullVar)", + "query": "from a_index | where pow(integerField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_cartesianshape(\"a\")", + "query": "from a_index | where pow(integerField, longField) > 0", "error": [], "warning": [] }, { - "query": "row to_cartesianshape(\"a\")", + "query": "from a_index | where pow(integerField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianshape(stringField)", + "query": "from a_index | where pow(longField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianshape(stringField)", + "query": "from a_index | where pow(longField, integerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianshape(*)", - "error": [ - "Using wildcards (*) in to_cartesianshape is not allowed" - ], + "query": "from a_index | where pow(longField, longField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_cartesianshape(stringField)", + "query": "from a_index | where pow(longField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | where pow(unsignedLongField, doubleField) > 0", "error": [], "warning": [] }, { - "query": "row to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | where pow(unsignedLongField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_cartesianshape(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | where pow(unsignedLongField, longField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_cartesianshape(to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | where pow(unsignedLongField, unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row to_cartesianshape(to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = pow(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_cartesianshape(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval pow(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_cartesianshape(to_string(true))", + "query": "from a_index | eval var = pow(to_double(booleanField), to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_cartesianshape(true)", + "query": "from a_index | eval pow(booleanField, booleanField)", "error": [ - "Argument of [to_cartesianshape] must be [cartesian_point], found value [true] type [boolean]" + "Argument of [pow] must be [double], found value [booleanField] type [boolean]", + "Argument of [pow] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianshape(cartesianPointField)", + "query": "from a_index | eval var = pow(doubleField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianshape(cartesianPointField)", + "query": "from a_index | eval pow(doubleField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianshape(to_cartesianpoint(cartesianPointField))", + "query": "from a_index | eval var = pow(to_double(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianshape(booleanField)", - "error": [ - "Argument of [to_cartesianshape] must be [cartesian_point], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = pow(doubleField, longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianshape(cartesianShapeField)", + "query": "from a_index | eval pow(doubleField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianshape(cartesianShapeField)", + "query": "from a_index | eval var = pow(to_double(booleanField), longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianshape(to_cartesianshape(cartesianPointField))", + "query": "from a_index | eval var = pow(doubleField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianshape(to_string(booleanField))", + "query": "from a_index | eval pow(doubleField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianshape(cartesianPointField, extraArg)", - "error": [ - "Error: [to_cartesianshape] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = pow(to_double(booleanField), unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_cartesianshape(cartesianPointField)", + "query": "from a_index | eval var = pow(integerField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianshape(null)", + "query": "from a_index | eval pow(integerField, doubleField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_cartesianshape(nullVar)", + "query": "from a_index | eval var = pow(to_integer(booleanField), to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_datetime(\"a\")", + "query": "from a_index | eval var = pow(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row to_datetime(\"a\")", + "query": "from a_index | eval pow(integerField, integerField)", "error": [], "warning": [] }, { - "query": "row var = to_dt(\"a\")", + "query": "from a_index | eval var = pow(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_datetime(stringField)", + "query": "from a_index | eval var = pow(integerField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_datetime(stringField)", + "query": "from a_index | eval pow(integerField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_dt(stringField)", + "query": "from a_index | eval var = pow(to_integer(booleanField), longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_datetime(*)", - "error": [ - "Using wildcards (*) in to_datetime is not allowed" - ], + "query": "from a_index | eval var = pow(integerField, unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_datetime(stringField)", + "query": "from a_index | eval pow(integerField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = to_datetime(now())", + "query": "from a_index | eval var = pow(to_integer(booleanField), unsignedLongField)", "error": [], "warning": [] }, { - "query": "row to_datetime(now())", + "query": "from a_index | eval var = pow(longField, doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_dt(now())", + "query": "from a_index | eval pow(longField, doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_datetime(to_datetime(now()))", + "query": "from a_index | eval var = pow(longField, to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_datetime(5)", + "query": "from a_index | eval var = pow(longField, integerField)", "error": [], "warning": [] }, { - "query": "row to_datetime(5)", + "query": "from a_index | eval pow(longField, integerField)", "error": [], "warning": [] }, { - "query": "row var = to_dt(5)", + "query": "from a_index | eval var = pow(longField, to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_datetime(to_integer(true))", + "query": "from a_index | eval var = pow(longField, longField)", "error": [], "warning": [] }, { - "query": "row var = to_datetime(to_string(true))", + "query": "from a_index | eval pow(longField, longField)", "error": [], "warning": [] }, { - "query": "row var = to_datetime(true)", - "error": [ - "Argument of [to_datetime] must be [date], found value [true] type [boolean]" - ], + "query": "from a_index | eval var = pow(longField, unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_datetime(dateField)", + "query": "from a_index | eval pow(longField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_datetime(dateField)", + "query": "from a_index | eval var = pow(unsignedLongField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_dt(dateField)", + "query": "from a_index | eval pow(unsignedLongField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_datetime(to_datetime(dateField))", + "query": "from a_index | eval var = pow(unsignedLongField, to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_datetime(booleanField)", - "error": [ - "Argument of [to_datetime] must be [date], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = pow(unsignedLongField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_datetime(numberField)", + "query": "from a_index | eval pow(unsignedLongField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_datetime(numberField)", + "query": "from a_index | eval var = pow(unsignedLongField, to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_dt(numberField)", + "query": "from a_index | eval var = pow(unsignedLongField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_datetime(to_integer(booleanField))", + "query": "from a_index | eval pow(unsignedLongField, longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_datetime(to_string(booleanField))", + "query": "from a_index | eval var = pow(unsignedLongField, unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_datetime(dateField, extraArg)", + "query": "from a_index | eval pow(unsignedLongField, unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval pow(doubleField, doubleField, extraArg)", "error": [ - "Error: [to_datetime] function expects exactly one argument, got 2." + "Error: [pow] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | sort to_datetime(dateField)", + "query": "from a_index | sort pow(doubleField, doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_datetime(null)", + "query": "from a_index | eval pow(null, null)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_datetime(nullVar)", + "query": "row nullVar = null | eval pow(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row var = to_degrees(5)", + "query": "row var = repeat(\"a\", 5)", "error": [], "warning": [] }, { - "query": "row to_degrees(5)", + "query": "row repeat(\"a\", 5)", "error": [], "warning": [] }, { - "query": "row var = to_degrees(to_integer(\"a\"))", + "query": "row var = repeat(to_string(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = to_degrees(\"a\")", + "query": "row var = repeat(true, true)", "error": [ - "Argument of [to_degrees] must be [number], found value [\"a\"] type [string]" + "Argument of [repeat] must be [keyword], found value [true] type [boolean]", + "Argument of [repeat] must be [integer], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where to_degrees(numberField) > 0", + "query": "from a_index | eval var = repeat(keywordField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | where to_degrees(stringField) > 0", - "error": [ - "Argument of [to_degrees] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval repeat(keywordField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_degrees(numberField)", + "query": "from a_index | eval var = repeat(to_string(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_degrees(numberField)", - "error": [], + "query": "from a_index | eval repeat(booleanField, booleanField)", + "error": [ + "Argument of [repeat] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [repeat] must be [integer], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_degrees(to_integer(stringField))", + "query": "from a_index | eval var = repeat(textField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_degrees(stringField)", - "error": [ - "Argument of [to_degrees] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval repeat(textField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval to_degrees(numberField, extraArg)", + "query": "from a_index | eval repeat(keywordField, integerField, extraArg)", "error": [ - "Error: [to_degrees] function expects exactly one argument, got 2." + "Error: [repeat] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | eval var = to_degrees(*)", - "error": [ - "Using wildcards (*) in to_degrees is not allowed" - ], + "query": "from a_index | sort repeat(keywordField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_degrees(numberField)", + "query": "from a_index | eval repeat(null, null)", "error": [], "warning": [] }, { - "query": "row var = to_degrees(to_integer(true))", + "query": "row nullVar = null | eval repeat(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row var = to_degrees(true)", - "error": [ - "Argument of [to_degrees] must be [number], found value [true] type [boolean]" - ], + "query": "row var = replace(\"a\", \"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | where to_degrees(booleanField) > 0", - "error": [ - "Argument of [to_degrees] must be [number], found value [booleanField] type [boolean]" - ], + "query": "row replace(\"a\", \"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_degrees(to_integer(booleanField))", + "query": "row var = replace(to_string(true), to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_degrees(booleanField)", + "query": "row var = replace(true, true, true)", "error": [ - "Argument of [to_degrees] must be [number], found value [booleanField] type [boolean]" + "Argument of [replace] must be [keyword], found value [true] type [boolean]", + "Argument of [replace] must be [keyword], found value [true] type [boolean]", + "Argument of [replace] must be [keyword], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval to_degrees(null)", + "query": "from a_index | eval var = replace(keywordField, keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_degrees(nullVar)", + "query": "from a_index | eval replace(keywordField, keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = to_double(\"a\")", + "query": "from a_index | eval var = replace(to_string(booleanField), to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row to_double(\"a\")", - "error": [], + "query": "from a_index | eval replace(booleanField, booleanField, booleanField)", + "error": [ + "Argument of [replace] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [replace] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [replace] must be [keyword], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = to_dbl(\"a\")", + "query": "from a_index | eval var = replace(keywordField, keywordField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_double(stringField)", + "query": "from a_index | eval replace(keywordField, keywordField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_double(stringField)", + "query": "from a_index | eval var = replace(keywordField, textField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_dbl(stringField)", + "query": "from a_index | eval replace(keywordField, textField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_double(*)", - "error": [ - "Using wildcards (*) in to_double is not allowed" - ], + "query": "from a_index | eval var = replace(keywordField, textField, textField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_double(stringField)", + "query": "from a_index | eval replace(keywordField, textField, textField)", "error": [], "warning": [] }, { - "query": "row var = to_double(true)", + "query": "from a_index | eval var = replace(textField, keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row to_double(true)", + "query": "from a_index | eval replace(textField, keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = to_dbl(true)", + "query": "from a_index | eval var = replace(textField, keywordField, textField)", "error": [], "warning": [] }, { - "query": "row var = to_double(to_boolean(true))", + "query": "from a_index | eval replace(textField, keywordField, textField)", "error": [], "warning": [] }, { - "query": "row var = to_double(5)", + "query": "from a_index | eval var = replace(textField, textField, keywordField)", "error": [], "warning": [] }, { - "query": "row to_double(5)", + "query": "from a_index | eval replace(textField, textField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = to_dbl(5)", + "query": "from a_index | eval var = replace(textField, textField, textField)", "error": [], "warning": [] }, { - "query": "row var = to_double(to_integer(true))", + "query": "from a_index | eval replace(textField, textField, textField)", "error": [], "warning": [] }, { - "query": "row var = to_double(now())", - "error": [], + "query": "from a_index | eval replace(keywordField, keywordField, keywordField, extraArg)", + "error": [ + "Error: [replace] function expects exactly 3 arguments, got 4." + ], "warning": [] }, { - "query": "row to_double(now())", + "query": "from a_index | sort replace(keywordField, keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = to_dbl(now())", + "query": "from a_index | eval replace(null, null, null)", "error": [], "warning": [] }, { - "query": "row var = to_double(to_datetime(now()))", + "query": "row nullVar = null | eval replace(nullVar, nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row var = to_double(to_string(true))", + "query": "row var = right(\"a\", 5)", "error": [], "warning": [] }, { - "query": "row var = to_double(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [to_double] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], + "query": "row right(\"a\", 5)", + "error": [], "warning": [] }, { - "query": "from a_index | where to_double(booleanField) > 0", + "query": "row var = right(to_string(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | where to_double(cartesianPointField) > 0", + "query": "row var = right(true, true)", "error": [ - "Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Argument of [right] must be [keyword], found value [true] type [boolean]", + "Argument of [right] must be [integer], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where to_double(numberField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_double(dateField) > 0", + "query": "from a_index | eval var = right(keywordField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | where to_double(stringField) > 0", + "query": "from a_index | eval right(keywordField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_double(booleanField)", + "query": "from a_index | eval var = right(to_string(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_double(booleanField)", - "error": [], + "query": "from a_index | eval right(booleanField, booleanField)", + "error": [ + "Argument of [right] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [right] must be [integer], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_dbl(booleanField)", + "query": "from a_index | eval var = right(textField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_double(to_boolean(booleanField))", + "query": "from a_index | eval right(textField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_double(cartesianPointField)", + "query": "from a_index | eval right(keywordField, integerField, extraArg)", "error": [ - "Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Error: [right] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | eval var = to_double(numberField)", + "query": "from a_index | sort right(keywordField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_double(numberField)", + "query": "from a_index | eval right(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_dbl(numberField)", + "query": "row nullVar = null | eval right(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_double(to_integer(booleanField))", + "query": "row var = round(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_double(dateField)", + "query": "row round(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_double(dateField)", + "query": "row var = round(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_dbl(dateField)", + "query": "row var = round(5.5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_double(to_datetime(dateField))", + "query": "row round(5.5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_double(to_string(booleanField))", + "query": "row var = round(to_double(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_double(booleanField, extraArg)", - "error": [ - "Error: [to_double] function expects exactly one argument, got 2." - ], + "query": "row var = round(5)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_double(booleanField)", + "query": "row round(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_double(null)", + "query": "row var = round(to_integer(true))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_double(nullVar)", + "query": "row var = round(5, 5)", "error": [], "warning": [] }, { - "query": "row var = to_geopoint(\"a\")", + "query": "row round(5, 5)", "error": [], "warning": [] }, { - "query": "row to_geopoint(\"a\")", + "query": "row var = round(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geopoint(stringField)", + "query": "row var = round(5, to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geopoint(stringField)", + "query": "row var = round(true, true)", + "error": [ + "Argument of [round] must be [double], found value [true] type [boolean]", + "Argument of [round] must be [integer], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where round(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geopoint(*)", + "query": "from a_index | where round(booleanField) > 0", "error": [ - "Using wildcards (*) in to_geopoint is not allowed" + "Argument of [round] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort to_geopoint(stringField)", + "query": "from a_index | where round(doubleField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_geopoint(to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | where round(booleanField, booleanField) > 0", + "error": [ + "Argument of [round] must be [double], found value [booleanField] type [boolean]", + "Argument of [round] must be [integer], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row to_geopoint(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | where round(integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_geopoint(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | where round(integerField, integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_geopoint(to_string(true))", + "query": "from a_index | where round(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_geopoint(true)", - "error": [ - "Argument of [to_geopoint] must be [geo_point], found value [true] type [boolean]" - ], + "query": "from a_index | where round(longField, integerField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geopoint(geoPointField)", + "query": "from a_index | where round(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geopoint(geoPointField)", + "query": "from a_index | eval var = round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geopoint(to_geopoint(geoPointField))", + "query": "from a_index | eval round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geopoint(booleanField)", - "error": [ - "Argument of [to_geopoint] must be [geo_point], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = round(to_double(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geopoint(to_string(booleanField))", - "error": [], + "query": "from a_index | eval round(booleanField)", + "error": [ + "Argument of [round] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval to_geopoint(geoPointField, extraArg)", + "query": "from a_index | eval var = round(*)", "error": [ - "Error: [to_geopoint] function expects exactly one argument, got 2." + "Using wildcards (*) in round is not allowed" ], "warning": [] }, { - "query": "from a_index | sort to_geopoint(geoPointField)", + "query": "from a_index | eval var = round(doubleField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geopoint(null)", + "query": "from a_index | eval round(doubleField, integerField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_geopoint(nullVar)", + "query": "from a_index | eval var = round(to_double(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_geoshape(\"a\")", + "query": "from a_index | eval round(booleanField, booleanField)", + "error": [ + "Argument of [round] must be [double], found value [booleanField] type [boolean]", + "Argument of [round] must be [integer], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = round(integerField)", "error": [], "warning": [] }, { - "query": "row to_geoshape(\"a\")", + "query": "from a_index | eval round(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geoshape(stringField)", + "query": "from a_index | eval var = round(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geoshape(stringField)", + "query": "from a_index | eval var = round(integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geoshape(*)", - "error": [ - "Using wildcards (*) in to_geoshape is not allowed" - ], + "query": "from a_index | eval round(integerField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_geoshape(stringField)", + "query": "from a_index | eval var = round(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_geoshape(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = round(longField)", "error": [], "warning": [] }, { - "query": "row to_geoshape(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval round(longField)", "error": [], "warning": [] }, { - "query": "row var = to_geoshape(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = round(longField, integerField)", "error": [], "warning": [] }, { - "query": "row var = to_geoshape(to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval round(longField, integerField)", "error": [], "warning": [] }, { - "query": "row to_geoshape(to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = round(longField, to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_geoshape(to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = round(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = to_geoshape(to_string(true))", + "query": "from a_index | eval round(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = to_geoshape(true)", + "query": "from a_index | eval round(doubleField, integerField, extraArg)", "error": [ - "Argument of [to_geoshape] must be [geo_point], found value [true] type [boolean]" + "Error: [round] function expects no more than 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | eval var = to_geoshape(geoPointField)", + "query": "from a_index | sort round(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geoshape(geoPointField)", + "query": "from a_index | eval round(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geoshape(to_geopoint(geoPointField))", + "query": "row nullVar = null | eval round(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geoshape(booleanField)", - "error": [ - "Argument of [to_geoshape] must be [geo_point], found value [booleanField] type [boolean]" - ], + "query": "row var = rtrim(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geoshape(geoShapeField)", + "query": "row rtrim(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geoshape(geoShapeField)", + "query": "row var = rtrim(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geoshape(to_geoshape(geoPointField))", - "error": [], + "query": "row var = rtrim(true)", + "error": [ + "Argument of [rtrim] must be [keyword], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_geoshape(to_string(booleanField))", + "query": "from a_index | eval var = rtrim(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geoshape(geoPointField, extraArg)", - "error": [ - "Error: [to_geoshape] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval rtrim(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_geoshape(geoPointField)", + "query": "from a_index | eval var = rtrim(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geoshape(null)", - "error": [], + "query": "from a_index | eval rtrim(booleanField)", + "error": [ + "Argument of [rtrim] must be [keyword], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row nullVar = null | eval to_geoshape(nullVar)", - "error": [], + "query": "from a_index | eval var = rtrim(*)", + "error": [ + "Using wildcards (*) in rtrim is not allowed" + ], "warning": [] }, { - "query": "row var = to_integer(\"a\")", + "query": "from a_index | eval var = rtrim(textField)", "error": [], "warning": [] }, { - "query": "row to_integer(\"a\")", + "query": "from a_index | eval rtrim(textField)", "error": [], "warning": [] }, { - "query": "row var = to_int(\"a\")", - "error": [], + "query": "from a_index | eval rtrim(keywordField, extraArg)", + "error": [ + "Error: [rtrim] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "from a_index | eval var = to_integer(stringField)", + "query": "from a_index | sort rtrim(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_integer(stringField)", + "query": "from a_index | eval rtrim(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_int(stringField)", + "query": "row nullVar = null | eval rtrim(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_integer(*)", - "error": [ - "Using wildcards (*) in to_integer is not allowed" - ], + "query": "row var = signum(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_integer(stringField)", + "query": "row signum(5.5)", "error": [], "warning": [] }, { - "query": "row var = to_integer(true)", + "query": "row var = signum(to_double(true))", "error": [], "warning": [] }, { - "query": "row to_integer(true)", + "query": "row var = signum(5)", "error": [], "warning": [] }, { - "query": "row var = to_int(true)", + "query": "row signum(5)", "error": [], "warning": [] }, { - "query": "row var = to_integer(to_boolean(true))", + "query": "row var = signum(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = to_integer(5)", - "error": [], + "query": "row var = signum(true)", + "error": [ + "Argument of [signum] must be [double], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row to_integer(5)", + "query": "from a_index | where signum(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_int(5)", - "error": [], + "query": "from a_index | where signum(booleanField) > 0", + "error": [ + "Argument of [signum] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = to_integer(to_integer(true))", + "query": "from a_index | where signum(integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_integer(now())", + "query": "from a_index | where signum(longField) > 0", "error": [], "warning": [] }, { - "query": "row to_integer(now())", + "query": "from a_index | where signum(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_int(now())", + "query": "from a_index | eval var = signum(doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_integer(to_datetime(now()))", + "query": "from a_index | eval signum(doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_integer(to_string(true))", + "query": "from a_index | eval var = signum(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_integer(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval signum(booleanField)", "error": [ - "Argument of [to_integer] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + "Argument of [signum] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where to_integer(booleanField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where to_integer(cartesianPointField) > 0", + "query": "from a_index | eval var = signum(*)", "error": [ - "Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Using wildcards (*) in signum is not allowed" ], "warning": [] }, { - "query": "from a_index | where to_integer(numberField) > 0", + "query": "from a_index | eval var = signum(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | where to_integer(dateField) > 0", + "query": "from a_index | eval signum(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | where to_integer(stringField) > 0", + "query": "from a_index | eval var = signum(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_integer(booleanField)", + "query": "from a_index | eval var = signum(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_integer(booleanField)", + "query": "from a_index | eval signum(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_int(booleanField)", + "query": "from a_index | eval var = signum(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_integer(to_boolean(booleanField))", + "query": "from a_index | eval signum(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_integer(cartesianPointField)", + "query": "from a_index | eval signum(doubleField, extraArg)", "error": [ - "Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Error: [signum] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = to_integer(numberField)", + "query": "from a_index | sort signum(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_integer(numberField)", + "query": "from a_index | eval signum(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_int(numberField)", + "query": "row nullVar = null | eval signum(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_integer(to_integer(booleanField))", + "query": "row var = sin(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_integer(dateField)", + "query": "row sin(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_integer(dateField)", + "query": "row var = sin(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_int(dateField)", + "query": "row var = sin(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_integer(to_datetime(dateField))", + "query": "row sin(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_integer(to_string(booleanField))", + "query": "row var = sin(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_integer(booleanField, extraArg)", + "query": "row var = sin(true)", "error": [ - "Error: [to_integer] function expects exactly one argument, got 2." + "Argument of [sin] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort to_integer(booleanField)", + "query": "from a_index | where sin(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval to_integer(null)", + "query": "from a_index | where sin(booleanField) > 0", + "error": [ + "Argument of [sin] must be [double], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where sin(integerField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_integer(nullVar)", + "query": "from a_index | where sin(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_ip(\"a\")", + "query": "from a_index | where sin(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row to_ip(\"a\")", + "query": "from a_index | eval var = sin(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ip(stringField)", + "query": "from a_index | eval sin(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_ip(stringField)", + "query": "from a_index | eval var = sin(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ip(*)", + "query": "from a_index | eval sin(booleanField)", "error": [ - "Using wildcards (*) in to_ip is not allowed" + "Argument of [sin] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort to_ip(stringField)", - "error": [], + "query": "from a_index | eval var = sin(*)", + "error": [ + "Using wildcards (*) in sin is not allowed" + ], "warning": [] }, { - "query": "row var = to_ip(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = sin(integerField)", "error": [], "warning": [] }, { - "query": "row to_ip(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval sin(integerField)", "error": [], "warning": [] }, { - "query": "row var = to_ip(to_ip(to_ip(\"127.0.0.1\")))", + "query": "from a_index | eval var = sin(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_ip(to_string(true))", + "query": "from a_index | eval var = sin(longField)", "error": [], "warning": [] }, { - "query": "row var = to_ip(true)", - "error": [ - "Argument of [to_ip] must be [ip], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_ip(ipField)", + "query": "from a_index | eval sin(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_ip(ipField)", + "query": "from a_index | eval var = sin(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ip(to_ip(ipField))", + "query": "from a_index | eval sin(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_ip(booleanField)", + "query": "from a_index | eval sin(doubleField, extraArg)", "error": [ - "Argument of [to_ip] must be [ip], found value [booleanField] type [boolean]" + "Error: [sin] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = to_ip(to_string(booleanField))", + "query": "from a_index | sort sin(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_ip(ipField, extraArg)", - "error": [ - "Error: [to_ip] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval sin(null)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_ip(ipField)", + "query": "row nullVar = null | eval sin(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_ip(null)", + "query": "row var = sinh(5.5)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_ip(nullVar)", + "query": "row sinh(5.5)", "error": [], "warning": [] }, { - "query": "row var = to_long(\"a\")", + "query": "row var = sinh(to_double(true))", "error": [], "warning": [] }, { - "query": "row to_long(\"a\")", + "query": "row var = sinh(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(stringField)", + "query": "row sinh(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_long(stringField)", + "query": "row var = sinh(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(*)", + "query": "row var = sinh(true)", "error": [ - "Using wildcards (*) in to_long is not allowed" + "Argument of [sinh] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort to_long(stringField)", + "query": "from a_index | where sinh(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_long(true)", - "error": [], + "query": "from a_index | where sinh(booleanField) > 0", + "error": [ + "Argument of [sinh] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row to_long(true)", + "query": "from a_index | where sinh(integerField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_long(to_boolean(true))", + "query": "from a_index | where sinh(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_long(5)", + "query": "from a_index | where sinh(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row to_long(5)", + "query": "from a_index | eval var = sinh(doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_long(to_integer(true))", + "query": "from a_index | eval sinh(doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_long(now())", + "query": "from a_index | eval var = sinh(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row to_long(now())", - "error": [], + "query": "from a_index | eval sinh(booleanField)", + "error": [ + "Argument of [sinh] must be [double], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = to_long(to_datetime(now()))", - "error": [], + "query": "from a_index | eval var = sinh(*)", + "error": [ + "Using wildcards (*) in sinh is not allowed" + ], "warning": [] }, { - "query": "row var = to_long(to_string(true))", + "query": "from a_index | eval var = sinh(integerField)", "error": [], "warning": [] }, { - "query": "row var = to_long(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [ - "Argument of [to_long] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" - ], + "query": "from a_index | eval sinh(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | where to_long(booleanField) > 0", + "query": "from a_index | eval var = sinh(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where to_long(cartesianPointField) > 0", - "error": [ - "Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "from a_index | eval var = sinh(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | where to_long(numberField) > 0", + "query": "from a_index | eval sinh(longField)", "error": [], "warning": [] }, { - "query": "from a_index | where to_long(dateField) > 0", + "query": "from a_index | eval var = sinh(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | where to_long(stringField) > 0", + "query": "from a_index | eval sinh(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(booleanField)", - "error": [], + "query": "from a_index | eval sinh(doubleField, extraArg)", + "error": [ + "Error: [sinh] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "from a_index | eval to_long(booleanField)", + "query": "from a_index | sort sinh(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(to_boolean(booleanField))", + "query": "from a_index | eval sinh(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_long(cartesianPointField)", - "error": [ - "Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "row nullVar = null | eval sinh(nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(numberField)", + "query": "row var = split(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval to_long(numberField)", + "query": "row split(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(to_integer(booleanField))", + "query": "row var = split(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(dateField)", - "error": [], + "query": "row var = split(true, true)", + "error": [ + "Argument of [split] must be [keyword], found value [true] type [boolean]", + "Argument of [split] must be [keyword], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval to_long(dateField)", + "query": "from a_index | eval var = split(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(to_datetime(dateField))", + "query": "from a_index | eval split(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(to_string(booleanField))", + "query": "from a_index | eval var = split(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_long(booleanField, extraArg)", + "query": "from a_index | eval split(booleanField, booleanField)", "error": [ - "Error: [to_long] function expects exactly one argument, got 2." + "Argument of [split] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [split] must be [keyword], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort to_long(booleanField)", + "query": "from a_index | eval var = split(keywordField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_long(null)", + "query": "from a_index | eval split(keywordField, textField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_long(nullVar)", + "query": "from a_index | eval var = split(textField, keywordField)", "error": [], "warning": [] }, { - "query": "row var = to_lower(\"a\")", + "query": "from a_index | eval split(textField, keywordField)", "error": [], "warning": [] }, { - "query": "row to_lower(\"a\")", + "query": "from a_index | eval var = split(textField, textField)", "error": [], "warning": [] }, { - "query": "row var = to_lower(to_string(\"a\"))", + "query": "from a_index | eval split(textField, textField)", "error": [], "warning": [] }, { - "query": "row var = to_lower(5)", + "query": "from a_index | eval split(keywordField, keywordField, extraArg)", "error": [ - "Argument of [to_lower] must be [string], found value [5] type [number]" + "Error: [split] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | where length(to_lower(stringField)) > 0", + "query": "from a_index | sort split(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(to_lower(numberField)) > 0", - "error": [ - "Argument of [to_lower] must be [string], found value [numberField] type [number]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = to_lower(stringField)", + "query": "from a_index | eval split(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_lower(stringField)", + "query": "row nullVar = null | eval split(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_lower(to_string(stringField))", + "query": "row var = sqrt(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_lower(numberField)", - "error": [ - "Argument of [to_lower] must be [string], found value [numberField] type [number]" - ], - "warning": [] - }, - { - "query": "from a_index | eval to_lower(stringField, extraArg)", - "error": [ - "Error: [to_lower] function expects exactly one argument, got 2." - ], + "query": "row sqrt(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_lower(*)", - "error": [ - "Using wildcards (*) in to_lower is not allowed" - ], + "query": "row var = sqrt(to_double(true))", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_lower(stringField)", + "query": "row var = sqrt(5)", "error": [], "warning": [] }, { - "query": "row var = to_lower(to_string(true))", + "query": "row sqrt(5)", "error": [], "warning": [] }, { - "query": "row var = to_lower(true)", - "error": [ - "Argument of [to_lower] must be [string], found value [true] type [boolean]" - ], + "query": "row var = sqrt(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | where length(to_lower(booleanField)) > 0", + "query": "row var = sqrt(true)", "error": [ - "Argument of [to_lower] must be [string], found value [booleanField] type [boolean]" + "Argument of [sqrt] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = to_lower(to_string(booleanField))", + "query": "from a_index | where sqrt(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval to_lower(booleanField)", + "query": "from a_index | where sqrt(booleanField) > 0", "error": [ - "Argument of [to_lower] must be [string], found value [booleanField] type [boolean]" + "Argument of [sqrt] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval to_lower(null)", + "query": "from a_index | where sqrt(integerField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_lower(nullVar)", + "query": "from a_index | where sqrt(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = to_radians(5)", + "query": "from a_index | where sqrt(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row to_radians(5)", + "query": "from a_index | eval var = sqrt(doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_radians(to_integer(\"a\"))", + "query": "from a_index | eval sqrt(doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_radians(\"a\")", - "error": [ - "Argument of [to_radians] must be [number], found value [\"a\"] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | where to_radians(numberField) > 0", + "query": "from a_index | eval var = sqrt(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where to_radians(stringField) > 0", + "query": "from a_index | eval sqrt(booleanField)", "error": [ - "Argument of [to_radians] must be [number], found value [stringField] type [string]" + "Argument of [sqrt] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = to_radians(numberField)", - "error": [], + "query": "from a_index | eval var = sqrt(*)", + "error": [ + "Using wildcards (*) in sqrt is not allowed" + ], "warning": [] }, { - "query": "from a_index | eval to_radians(numberField)", + "query": "from a_index | eval var = sqrt(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_radians(to_integer(stringField))", + "query": "from a_index | eval sqrt(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_radians(stringField)", - "error": [ - "Argument of [to_radians] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = sqrt(to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval to_radians(numberField, extraArg)", - "error": [ - "Error: [to_radians] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = sqrt(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_radians(*)", + "query": "from a_index | eval sqrt(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = sqrt(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sqrt(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sqrt(doubleField, extraArg)", "error": [ - "Using wildcards (*) in to_radians is not allowed" + "Error: [sqrt] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | sort to_radians(numberField)", + "query": "from a_index | sort sqrt(doubleField)", "error": [], "warning": [] }, { - "query": "row var = to_radians(to_integer(true))", + "query": "from a_index | eval sqrt(null)", "error": [], "warning": [] }, { - "query": "row var = to_radians(true)", + "query": "row nullVar = null | eval sqrt(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(cartesianPointField, cartesianPointField)", "error": [ - "Argument of [to_radians] must be [number], found value [true] type [boolean]" + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | where to_radians(booleanField) > 0", + "query": "row st_contains(cartesianPointField, cartesianPointField)", "error": [ - "Argument of [to_radians] must be [number], found value [booleanField] type [boolean]" + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = to_radians(to_integer(booleanField))", - "error": [], + "query": "row var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_radians(booleanField)", + "query": "row var = st_contains(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", "error": [ - "Argument of [to_radians] must be [number], found value [booleanField] type [boolean]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval to_radians(null)", - "error": [], + "query": "row st_contains(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row nullVar = null | eval to_radians(nullVar)", - "error": [], + "query": "row var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row var = to_string(\"a\")", - "error": [], + "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row to_string(\"a\")", - "error": [], + "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row var = to_str(\"a\")", - "error": [], + "query": "row var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_string(stringField)", + "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_string(stringField)", + "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_str(stringField)", - "error": [], + "query": "row var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_string(*)", + "query": "row var = st_contains(geoPointField, geoPointField)", "error": [ - "Using wildcards (*) in to_string is not allowed" + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | sort to_string(stringField)", - "error": [], + "query": "row st_contains(geoPointField, geoPointField)", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = to_string(true)", - "error": [], + "query": "row var = st_contains(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row to_string(true)", - "error": [], + "query": "row var = st_contains(geoPointField, to_geoshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = to_str(true)", - "error": [], + "query": "row st_contains(geoPointField, to_geoshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = to_string(to_boolean(true))", - "error": [], + "query": "row var = st_contains(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = to_string(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], + "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row to_string(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], + "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = to_str(to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], + "query": "row var = st_contains(to_geoshape(geoPointField), to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = to_string(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = to_string(to_cartesianshape(\"POINT (30 10)\"))", + "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row to_string(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], + "query": "row var = st_contains(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = to_str(to_cartesianshape(\"POINT (30 10)\"))", - "error": [], + "query": "row var = st_contains(true, true)", + "error": [ + "Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]", + "Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = to_string(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = st_contains(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = to_string(now())", + "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "row to_string(now())", + "query": "from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row var = to_str(now())", - "error": [], + "query": "from a_index | eval st_contains(booleanField, booleanField)", + "error": [ + "Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]", + "Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = to_string(to_datetime(now()))", + "query": "from a_index | eval var = st_contains(cartesianPointField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = to_string(5)", + "query": "from a_index | eval st_contains(cartesianPointField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row to_string(5)", + "query": "from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row var = to_str(5)", + "query": "from a_index | eval var = st_contains(cartesianShapeField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = to_string(to_integer(true))", + "query": "from a_index | eval st_contains(cartesianShapeField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = to_string(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row to_string(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = st_contains(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = to_str(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval st_contains(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = to_string(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row var = to_string(to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = st_contains(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "row to_string(to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval st_contains(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "row var = to_str(to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = to_string(to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = st_contains(geoPointField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = to_string(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval st_contains(geoPointField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row to_string(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = to_str(to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = st_contains(geoShapeField, geoPointField)", "error": [], "warning": [] }, { - "query": "row var = to_string(to_ip(to_ip(\"127.0.0.1\")))", + "query": "from a_index | eval st_contains(geoShapeField, geoPointField)", "error": [], "warning": [] }, { - "query": "row var = to_string(to_string(true))", + "query": "from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = to_string(to_version(\"1.0.0\"))", + "query": "from a_index | eval var = st_contains(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row to_string(to_version(\"1.0.0\"))", + "query": "from a_index | eval st_contains(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = to_str(to_version(\"1.0.0\"))", + "query": "from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = to_string(to_version(\"a\"))", - "error": [], + "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "from a_index | where length(to_string(booleanField)) > 0", + "query": "from a_index | sort st_contains(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(to_string(cartesianPointField)) > 0", + "query": "from a_index | eval st_contains(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | where length(to_string(cartesianShapeField)) > 0", + "query": "row nullVar = null | eval st_contains(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | where length(to_string(dateField)) > 0", - "error": [], + "query": "row var = st_disjoint(cartesianPointField, cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | where length(to_string(numberField)) > 0", - "error": [], + "query": "row st_disjoint(cartesianPointField, cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | where length(to_string(geoPointField)) > 0", - "error": [], + "query": "row var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | where length(to_string(geoShapeField)) > 0", - "error": [], + "query": "row var = st_disjoint(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | where length(to_string(ipField)) > 0", - "error": [], + "query": "row st_disjoint(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | where length(to_string(stringField)) > 0", - "error": [], + "query": "row var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | where length(to_string(versionField)) > 0", - "error": [], + "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_string(booleanField)", - "error": [], + "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_string(booleanField)", - "error": [], + "query": "row var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_str(booleanField)", + "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(to_boolean(booleanField))", + "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(cartesianPointField)", - "error": [], + "query": "row var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_string(cartesianPointField)", - "error": [], + "query": "row var = st_disjoint(geoPointField, geoPointField)", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_str(cartesianPointField)", - "error": [], + "query": "row st_disjoint(geoPointField, geoPointField)", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_string(to_cartesianpoint(cartesianPointField))", - "error": [], + "query": "row var = st_disjoint(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_string(cartesianShapeField)", - "error": [], + "query": "row var = st_disjoint(geoPointField, to_geoshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_string(cartesianShapeField)", - "error": [], + "query": "row st_disjoint(geoPointField, to_geoshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_str(cartesianShapeField)", - "error": [], + "query": "row var = st_disjoint(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_string(to_cartesianshape(cartesianPointField))", - "error": [], + "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_string(dateField)", - "error": [], + "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_string(dateField)", - "error": [], + "query": "row var = st_disjoint(to_geoshape(geoPointField), to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_str(dateField)", + "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(to_datetime(dateField))", + "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(numberField)", - "error": [], + "query": "row var = st_disjoint(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_string(numberField)", - "error": [], + "query": "row var = st_disjoint(true, true)", + "error": [ + "Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]", + "Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_str(numberField)", + "query": "from a_index | eval var = st_disjoint(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(to_integer(booleanField))", + "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(geoPointField)", + "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_string(geoPointField)", - "error": [], + "query": "from a_index | eval st_disjoint(booleanField, booleanField)", + "error": [ + "Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]", + "Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_str(geoPointField)", + "query": "from a_index | eval var = st_disjoint(cartesianPointField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(to_geopoint(geoPointField))", + "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(geoShapeField)", + "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_string(geoShapeField)", + "query": "from a_index | eval var = st_disjoint(cartesianShapeField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_str(geoShapeField)", + "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(to_geoshape(geoPointField))", + "query": "from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(ipField)", + "query": "from a_index | eval var = st_disjoint(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_string(ipField)", + "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_str(ipField)", + "query": "from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(to_ip(ipField))", + "query": "from a_index | eval var = st_disjoint(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(to_string(booleanField))", + "query": "from a_index | eval st_disjoint(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(versionField)", + "query": "from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_string(versionField)", + "query": "from a_index | eval var = st_disjoint(geoPointField, geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_str(versionField)", + "query": "from a_index | eval st_disjoint(geoPointField, geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(to_version(stringField))", + "query": "from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_string(booleanField, extraArg)", - "error": [ - "Error: [to_string] function expects exactly one argument, got 2." - ], - "warning": [] - }, - { - "query": "from a_index | sort to_string(booleanField)", + "query": "from a_index | eval var = st_disjoint(geoShapeField, geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_string(null)", + "query": "from a_index | eval st_disjoint(geoShapeField, geoPointField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_string(nullVar)", + "query": "from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = to_unsigned_long(\"a\")", + "query": "from a_index | eval var = st_disjoint(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row to_unsigned_long(\"a\")", + "query": "from a_index | eval st_disjoint(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = to_ul(\"a\")", + "query": "from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = to_ulong(\"a\")", - "error": [], + "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(stringField)", + "query": "from a_index | sort st_disjoint(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_unsigned_long(stringField)", + "query": "from a_index | eval st_disjoint(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ul(stringField)", + "query": "row nullVar = null | eval st_disjoint(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ulong(stringField)", - "error": [], + "query": "row var = st_distance(cartesianPointField, cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(*)", + "query": "row st_distance(cartesianPointField, cartesianPointField)", "error": [ - "Using wildcards (*) in to_unsigned_long is not allowed" + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | sort to_unsigned_long(stringField)", - "error": [], + "query": "row var = st_distance(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row var = to_unsigned_long(true)", - "error": [], + "query": "row var = st_distance(geoPointField, geoPointField)", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row to_unsigned_long(true)", - "error": [], + "query": "row st_distance(geoPointField, geoPointField)", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = to_ul(true)", - "error": [], + "query": "row var = st_distance(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row var = to_ulong(true)", - "error": [], + "query": "row var = st_distance(true, true)", + "error": [ + "Argument of [st_distance] must be [cartesian_point], found value [true] type [boolean]", + "Argument of [st_distance] must be [cartesian_point], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = to_unsigned_long(to_boolean(true))", + "query": "from a_index | eval var = st_distance(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = to_unsigned_long(now())", + "query": "from a_index | eval st_distance(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "row to_unsigned_long(now())", + "query": "from a_index | eval var = st_distance(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row var = to_ul(now())", - "error": [], + "query": "from a_index | eval st_distance(booleanField, booleanField)", + "error": [ + "Argument of [st_distance] must be [cartesian_point], found value [booleanField] type [boolean]", + "Argument of [st_distance] must be [cartesian_point], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = to_ulong(now())", + "query": "from a_index | eval var = st_distance(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "row var = to_unsigned_long(to_datetime(now()))", + "query": "from a_index | eval st_distance(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "row var = to_unsigned_long(5)", + "query": "from a_index | eval var = st_distance(to_geopoint(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row to_unsigned_long(5)", - "error": [], + "query": "from a_index | eval st_distance(cartesianPointField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_distance] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "row var = to_ul(5)", + "query": "from a_index | sort st_distance(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = to_ulong(5)", + "query": "from a_index | eval st_distance(null, null)", "error": [], "warning": [] }, { - "query": "row var = to_unsigned_long(to_integer(true))", + "query": "row nullVar = null | eval st_distance(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "row var = to_unsigned_long(to_string(true))", - "error": [], + "query": "row var = st_intersects(cartesianPointField, cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row var = to_unsigned_long(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row st_intersects(cartesianPointField, cartesianPointField)", "error": [ - "Argument of [to_unsigned_long] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | where to_unsigned_long(booleanField) > 0", - "error": [], + "query": "row var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | where to_unsigned_long(cartesianPointField) > 0", + "query": "row var = st_intersects(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", "error": [ - "Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | where to_unsigned_long(dateField) > 0", - "error": [], + "query": "row st_intersects(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | where to_unsigned_long(numberField) > 0", - "error": [], + "query": "row var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | where to_unsigned_long(stringField) > 0", - "error": [], + "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(booleanField)", - "error": [], + "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_unsigned_long(booleanField)", - "error": [], + "query": "row var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_ul(booleanField)", + "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ulong(booleanField)", + "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(to_boolean(booleanField))", - "error": [], + "query": "row var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_unsigned_long(cartesianPointField)", + "query": "row var = st_intersects(geoPointField, geoPointField)", "error": [ - "Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(dateField)", - "error": [], + "query": "row st_intersects(geoPointField, geoPointField)", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_unsigned_long(dateField)", - "error": [], + "query": "row var = st_intersects(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_ul(dateField)", - "error": [], + "query": "row var = st_intersects(geoPointField, to_geoshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_ulong(dateField)", - "error": [], + "query": "row st_intersects(geoPointField, to_geoshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(to_datetime(dateField))", - "error": [], + "query": "row var = st_intersects(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(numberField)", - "error": [], + "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_unsigned_long(numberField)", - "error": [], + "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_ul(numberField)", - "error": [], + "query": "row var = st_intersects(to_geoshape(geoPointField), to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_ulong(numberField)", + "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(to_integer(booleanField))", + "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(to_string(booleanField))", - "error": [], + "query": "row var = st_intersects(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_unsigned_long(booleanField, extraArg)", + "query": "row var = st_intersects(true, true)", "error": [ - "Error: [to_unsigned_long] function expects exactly one argument, got 2." + "Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]", + "Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort to_unsigned_long(booleanField)", + "query": "from a_index | eval var = st_intersects(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_unsigned_long(null)", + "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_unsigned_long(nullVar)", + "query": "from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row var = to_upper(\"a\")", - "error": [], + "query": "from a_index | eval st_intersects(booleanField, booleanField)", + "error": [ + "Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]", + "Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row to_upper(\"a\")", + "query": "from a_index | eval var = st_intersects(cartesianPointField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = to_upper(to_string(\"a\"))", + "query": "from a_index | eval st_intersects(cartesianPointField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = to_upper(5)", - "error": [ - "Argument of [to_upper] must be [string], found value [5] type [number]" - ], + "query": "from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | where length(to_upper(stringField)) > 0", + "query": "from a_index | eval var = st_intersects(cartesianShapeField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(to_upper(numberField)) > 0", - "error": [ - "Argument of [to_upper] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_upper(stringField)", + "query": "from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_upper(stringField)", + "query": "from a_index | eval var = st_intersects(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_upper(to_string(stringField))", + "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_upper(numberField)", - "error": [ - "Argument of [to_upper] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval to_upper(stringField, extraArg)", - "error": [ - "Error: [to_upper] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = st_intersects(geoPointField, geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_upper(*)", - "error": [ - "Using wildcards (*) in to_upper is not allowed" - ], + "query": "from a_index | eval st_intersects(geoPointField, geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_upper(stringField)", + "query": "from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = to_upper(to_string(true))", + "query": "from a_index | eval var = st_intersects(geoPointField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = to_upper(true)", - "error": [ - "Argument of [to_upper] must be [string], found value [true] type [boolean]" - ], + "query": "from a_index | eval st_intersects(geoPointField, geoShapeField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(to_upper(booleanField)) > 0", - "error": [ - "Argument of [to_upper] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_upper(to_string(booleanField))", + "query": "from a_index | eval var = st_intersects(geoShapeField, geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_upper(booleanField)", - "error": [ - "Argument of [to_upper] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval st_intersects(geoShapeField, geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval to_upper(null)", + "query": "from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_upper(nullVar)", + "query": "from a_index | eval var = st_intersects(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = to_version(\"a\")", + "query": "from a_index | eval st_intersects(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "row to_version(\"a\")", + "query": "from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = to_ver(\"a\")", - "error": [], + "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "from a_index | eval var = to_version(stringField)", + "query": "from a_index | sort st_intersects(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_version(stringField)", + "query": "from a_index | eval st_intersects(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ver(stringField)", + "query": "row nullVar = null | eval st_intersects(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_version(*)", + "query": "row var = st_within(cartesianPointField, cartesianPointField)", "error": [ - "Using wildcards (*) in to_version is not allowed" + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | sort to_version(stringField)", - "error": [], - "warning": [] - }, - { - "query": "row var = to_version(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row to_version(to_version(\"1.0.0\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = to_ver(to_version(\"1.0.0\"))", - "error": [], + "query": "row st_within(cartesianPointField, cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row var = to_version(true)", + "query": "row var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [ - "Argument of [to_version] must be [string], found value [true] type [boolean]" + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = to_version(versionField)", - "error": [], + "query": "row var = st_within(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_version(versionField)", - "error": [], + "query": "row st_within(cartesianPointField, to_cartesianshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = to_ver(versionField)", - "error": [], + "query": "row var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval to_version(stringField, extraArg)", + "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", "error": [ - "Error: [to_version] function expects exactly one argument, got 2." + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval to_version(null)", - "error": [], + "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row nullVar = null | eval to_version(nullVar)", - "error": [], + "query": "row var = st_within(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row var = trim(\"a\")", + "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row trim(\"a\")", + "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = trim(to_string(\"a\"))", - "error": [], + "query": "row var = st_within(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]", + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "row var = trim(5)", + "query": "row var = st_within(geoPointField, geoPointField)", "error": [ - "Argument of [trim] must be [string], found value [5] type [number]" + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | where length(trim(stringField)) > 0", - "error": [], + "query": "row st_within(geoPointField, geoPointField)", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | where length(trim(numberField)) > 0", + "query": "row var = st_within(to_geopoint(geoPointField), to_geopoint(geoPointField))", "error": [ - "Argument of [trim] must be [string], found value [numberField] type [number]" + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = trim(stringField)", - "error": [], + "query": "row var = st_within(geoPointField, to_geoshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval trim(stringField)", - "error": [], + "query": "row st_within(geoPointField, to_geoshape(\"POINT (30 10)\"))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval var = trim(to_string(stringField))", - "error": [], + "query": "row var = st_within(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "error": [ + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval trim(numberField)", + "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), geoPointField)", "error": [ - "Argument of [trim] must be [string], found value [numberField] type [number]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval trim(stringField, extraArg)", + "query": "row st_within(to_geoshape(\"POINT (30 10)\"), geoPointField)", "error": [ - "Error: [trim] function expects exactly one argument, got 2." + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = trim(*)", + "query": "row var = st_within(to_geoshape(geoPointField), to_geopoint(geoPointField))", "error": [ - "Using wildcards (*) in trim is not allowed" + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | sort trim(stringField)", + "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = trim(to_string(true))", + "query": "row st_within(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = trim(true)", + "query": "row var = st_within(to_geoshape(geoPointField), to_geoshape(geoPointField))", "error": [ - "Argument of [trim] must be [string], found value [true] type [boolean]" + "Unknown column [geoPointField]", + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | where length(trim(booleanField)) > 0", + "query": "row var = st_within(true, true)", "error": [ - "Argument of [trim] must be [string], found value [booleanField] type [boolean]" + "Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]", + "Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = trim(to_string(booleanField))", + "query": "from a_index | eval var = st_within(cartesianPointField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval trim(booleanField)", + "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(booleanField, booleanField)", "error": [ - "Argument of [trim] must be [string], found value [booleanField] type [boolean]" + "Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]", + "Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval trim(null)", + "query": "from a_index | eval var = st_within(cartesianPointField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval trim(nullVar)", + "query": "from a_index | eval st_within(cartesianPointField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = avg(numberField)", + "query": "from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField)", + "query": "from a_index | eval var = st_within(cartesianShapeField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(avg(numberField))", + "query": "from a_index | eval st_within(cartesianShapeField, cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(avg(numberField))", + "query": "from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(avg(numberField)) + avg(numberField)", + "query": "from a_index | eval var = st_within(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(avg(numberField)) + avg(numberField)", + "query": "from a_index | eval st_within(cartesianShapeField, cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField / 2)", + "query": "from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = avg(numberField / 2)", + "query": "from a_index | eval var = st_within(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), avg(numberField / 2)", + "query": "from a_index | eval st_within(geoPointField, geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = avg(numberField / 2)", + "query": "from a_index | eval var = st_within(to_geopoint(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = avg(numberField)", + "query": "from a_index | eval var = st_within(geoPointField, geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), avg(numberField)", + "query": "from a_index | eval st_within(geoPointField, geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = avg(numberField)", + "query": "from a_index | eval var = st_within(to_geopoint(geoPointField), to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField) by round(numberField / 2)", + "query": "from a_index | eval var = st_within(geoShapeField, geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = avg(numberField) by var1 = round(numberField / 2)", + "query": "from a_index | eval st_within(geoShapeField, geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), ipField", + "query": "from a_index | eval var = st_within(to_geoshape(geoPointField), to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), ipField", + "query": "from a_index | eval var = st_within(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), numberField / 2", + "query": "from a_index | eval st_within(geoShapeField, geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = st_within(to_geoshape(geoPointField), to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = avg(avg(numberField))", + "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField, extraArg)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Error: [st_within] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | stats avg(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | sort st_within(cartesianPointField, cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats avg(stringField)", - "error": [ - "Argument of [avg] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval st_within(null, null)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = avg(*)", - "error": [ - "Using wildcards (*) in avg is not allowed" - ], + "query": "row nullVar = null | eval st_within(nullVar, nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | sort avg(numberField)", + "query": "row var = st_x(cartesianPointField)", "error": [ - "SORT does not support function avg" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | where avg(numberField)", + "query": "row st_x(cartesianPointField)", "error": [ - "WHERE does not support function avg" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | where avg(numberField) > 0", + "query": "row var = st_x(to_cartesianpoint(cartesianPointField))", "error": [ - "WHERE does not support function avg" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = avg(numberField)", + "query": "row var = st_x(geoPointField)", "error": [ - "EVAL does not support function avg" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = avg(numberField) > 0", + "query": "row st_x(geoPointField)", "error": [ - "EVAL does not support function avg" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval avg(numberField)", + "query": "row var = st_x(to_geopoint(geoPointField))", "error": [ - "EVAL does not support function avg" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval avg(numberField) > 0", + "query": "row var = st_x(true)", "error": [ - "EVAL does not support function avg" + "Argument of [st_x] must be [cartesian_point], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats avg(booleanField)", - "error": [ - "Argument of [avg] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = st_x(cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats avg(null)", + "query": "from a_index | eval st_x(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats avg(nullVar)", + "query": "from a_index | eval var = st_x(to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = sum(numberField)", - "error": [], + "query": "from a_index | eval st_x(booleanField)", + "error": [ + "Argument of [st_x] must be [cartesian_point], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats sum(numberField)", - "error": [], + "query": "from a_index | eval var = st_x(*)", + "error": [ + "Using wildcards (*) in st_x is not allowed" + ], "warning": [] }, { - "query": "from a_index | stats var = round(sum(numberField))", + "query": "from a_index | eval var = st_x(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(sum(numberField))", + "query": "from a_index | eval st_x(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(sum(numberField)) + sum(numberField)", + "query": "from a_index | eval var = st_x(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(sum(numberField)) + sum(numberField)", - "error": [], + "query": "from a_index | eval st_x(cartesianPointField, extraArg)", + "error": [ + "Error: [st_x] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "from a_index | stats sum(numberField / 2)", + "query": "from a_index | sort st_x(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = sum(numberField / 2)", + "query": "from a_index | eval st_x(null)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), sum(numberField / 2)", + "query": "row nullVar = null | eval st_x(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = sum(numberField / 2)", - "error": [], + "query": "row var = st_y(cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | stats var0 = sum(numberField)", - "error": [], + "query": "row st_y(cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), sum(numberField)", - "error": [], + "query": "row var = st_y(to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = sum(numberField)", - "error": [], + "query": "row var = st_y(geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | stats sum(numberField) by round(numberField / 2)", - "error": [], + "query": "row st_y(geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | stats var0 = sum(numberField) by var1 = round(numberField / 2)", - "error": [], + "query": "row var = st_y(to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), ipField", - "error": [], + "query": "row var = st_y(true)", + "error": [ + "Argument of [st_y] must be [cartesian_point], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), ipField", + "query": "from a_index | eval var = st_y(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), numberField / 2", + "query": "from a_index | eval st_y(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = st_y(to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = sum(avg(numberField))", + "query": "from a_index | eval st_y(booleanField)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Argument of [st_y] must be [cartesian_point], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats sum(avg(numberField))", + "query": "from a_index | eval var = st_y(*)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Using wildcards (*) in st_y is not allowed" ], "warning": [] }, { - "query": "from a_index | stats sum(stringField)", - "error": [ - "Argument of [sum] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = st_y(geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = sum(*)", - "error": [ - "Using wildcards (*) in sum is not allowed" - ], + "query": "from a_index | eval st_y(geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort sum(numberField)", - "error": [ - "SORT does not support function sum" - ], + "query": "from a_index | eval var = st_y(to_geopoint(geoPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | where sum(numberField)", + "query": "from a_index | eval st_y(cartesianPointField, extraArg)", "error": [ - "WHERE does not support function sum" + "Error: [st_y] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | where sum(numberField) > 0", - "error": [ - "WHERE does not support function sum" - ], + "query": "from a_index | sort st_y(cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sum(numberField)", - "error": [ - "EVAL does not support function sum" - ], + "query": "from a_index | eval st_y(null)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sum(numberField) > 0", - "error": [ - "EVAL does not support function sum" - ], + "query": "row nullVar = null | eval st_y(nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | eval sum(numberField)", - "error": [ - "EVAL does not support function sum" - ], + "query": "row var = starts_with(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval sum(numberField) > 0", - "error": [ - "EVAL does not support function sum" - ], + "query": "row starts_with(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats sum(booleanField)", - "error": [ - "Argument of [sum] must be [number], found value [booleanField] type [boolean]" - ], + "query": "row var = starts_with(to_string(true), to_string(true))", + "error": [], "warning": [] }, { - "query": "from a_index | stats sum(null)", - "error": [], + "query": "row var = starts_with(true, true)", + "error": [ + "Argument of [starts_with] must be [keyword], found value [true] type [boolean]", + "Argument of [starts_with] must be [keyword], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row nullVar = null | stats sum(nullVar)", + "query": "from a_index | eval var = starts_with(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = median(numberField)", + "query": "from a_index | eval starts_with(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | stats median(numberField)", + "query": "from a_index | eval var = starts_with(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(median(numberField))", - "error": [], + "query": "from a_index | eval starts_with(booleanField, booleanField)", + "error": [ + "Argument of [starts_with] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [starts_with] must be [keyword], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats round(median(numberField))", + "query": "from a_index | eval var = starts_with(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(median(numberField)) + median(numberField)", + "query": "from a_index | eval starts_with(textField, textField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(median(numberField)) + median(numberField)", - "error": [], + "query": "from a_index | eval starts_with(keywordField, keywordField, extraArg)", + "error": [ + "Error: [starts_with] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "from a_index | stats median(numberField / 2)", + "query": "from a_index | sort starts_with(keywordField, keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median(numberField / 2)", + "query": "from a_index | eval starts_with(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median(numberField / 2)", + "query": "row nullVar = null | eval starts_with(nullVar, nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median(numberField / 2)", + "query": "row var = substring(\"a\", 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median(numberField)", + "query": "row substring(\"a\", 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median(numberField)", + "query": "row var = substring(to_string(true), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median(numberField)", - "error": [], + "query": "row var = substring(true, true, true)", + "error": [ + "Argument of [substring] must be [keyword], found value [true] type [boolean]", + "Argument of [substring] must be [integer], found value [true] type [boolean]", + "Argument of [substring] must be [integer], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats median(numberField) by round(numberField / 2)", + "query": "from a_index | eval var = substring(keywordField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median(numberField) by var1 = round(numberField / 2)", + "query": "from a_index | eval substring(keywordField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), ipField", + "query": "from a_index | eval var = substring(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), ipField", - "error": [], + "query": "from a_index | eval substring(booleanField, booleanField, booleanField)", + "error": [ + "Argument of [substring] must be [keyword], found value [booleanField] type [boolean]", + "Argument of [substring] must be [integer], found value [booleanField] type [boolean]", + "Argument of [substring] must be [integer], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = substring(textField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "from a_index | eval substring(textField, integerField, integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = median(avg(numberField))", + "query": "from a_index | eval substring(keywordField, integerField, integerField, extraArg)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Error: [substring] function expects no more than 3 arguments, got 4." ], "warning": [] }, { - "query": "from a_index | stats median(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | sort substring(keywordField, integerField, integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats median(stringField)", - "error": [ - "Argument of [median] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval substring(null, null, null)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = median(*)", - "error": [ - "Using wildcards (*) in median is not allowed" - ], + "query": "row nullVar = null | eval substring(nullVar, nullVar, nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | sort median(numberField)", - "error": [ - "SORT does not support function median" - ], + "query": "row var = tan(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | where median(numberField)", - "error": [ - "WHERE does not support function median" - ], + "query": "row tan(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | where median(numberField) > 0", - "error": [ - "WHERE does not support function median" - ], + "query": "row var = tan(to_double(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = median(numberField)", - "error": [ - "EVAL does not support function median" - ], + "query": "row var = tan(5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = median(numberField) > 0", - "error": [ - "EVAL does not support function median" - ], + "query": "row tan(5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval median(numberField)", - "error": [ - "EVAL does not support function median" - ], + "query": "row var = tan(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval median(numberField) > 0", + "query": "row var = tan(true)", "error": [ - "EVAL does not support function median" + "Argument of [tan] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats median(booleanField)", + "query": "from a_index | where tan(doubleField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where tan(booleanField) > 0", "error": [ - "Argument of [median] must be [number], found value [booleanField] type [boolean]" + "Argument of [tan] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats median(null)", + "query": "from a_index | where tan(integerField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats median(nullVar)", + "query": "from a_index | where tan(longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats var = median_absolute_deviation(numberField)", + "query": "from a_index | where tan(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(numberField)", + "query": "from a_index | eval var = tan(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(median_absolute_deviation(numberField))", + "query": "from a_index | eval tan(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(median_absolute_deviation(numberField))", + "query": "from a_index | eval var = tan(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)", - "error": [], + "query": "from a_index | eval tan(booleanField)", + "error": [ + "Argument of [tan] must be [double], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = tan(*)", + "error": [ + "Using wildcards (*) in tan is not allowed" + ], "warning": [] }, { - "query": "from a_index | stats round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)", + "query": "from a_index | eval var = tan(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(numberField / 2)", + "query": "from a_index | eval tan(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median_absolute_deviation(numberField / 2)", + "query": "from a_index | eval var = tan(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField / 2)", + "query": "from a_index | eval var = tan(longField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField / 2)", + "query": "from a_index | eval tan(longField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median_absolute_deviation(numberField)", + "query": "from a_index | eval var = tan(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField)", + "query": "from a_index | eval tan(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField)", + "query": "from a_index | eval tan(doubleField, extraArg)", + "error": [ + "Error: [tan] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort tan(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(numberField) by round(numberField / 2)", + "query": "from a_index | eval tan(null)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2)", + "query": "row nullVar = null | eval tan(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), ipField", + "query": "row var = tanh(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), ipField", + "query": "row tanh(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), numberField / 2", + "query": "row var = tanh(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "row var = tanh(5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = median_absolute_deviation(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "row tanh(5)", + "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "row var = tanh(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(stringField)", + "query": "row var = tanh(true)", "error": [ - "Argument of [median_absolute_deviation] must be [number], found value [stringField] type [string]" + "Argument of [tanh] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats var = median_absolute_deviation(*)", - "error": [ - "Using wildcards (*) in median_absolute_deviation is not allowed" - ], + "query": "from a_index | where tanh(doubleField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | sort median_absolute_deviation(numberField)", + "query": "from a_index | where tanh(booleanField) > 0", "error": [ - "SORT does not support function median_absolute_deviation" + "Argument of [tanh] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where median_absolute_deviation(numberField)", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], + "query": "from a_index | where tanh(integerField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | where median_absolute_deviation(numberField) > 0", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], + "query": "from a_index | where tanh(longField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = median_absolute_deviation(numberField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], + "query": "from a_index | where tanh(unsignedLongField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = median_absolute_deviation(numberField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], + "query": "from a_index | eval var = tanh(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval median_absolute_deviation(numberField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], + "query": "from a_index | eval tanh(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval median_absolute_deviation(numberField) > 0", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], + "query": "from a_index | eval var = tanh(to_double(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(booleanField)", + "query": "from a_index | eval tanh(booleanField)", "error": [ - "Argument of [median_absolute_deviation] must be [number], found value [booleanField] type [boolean]" + "Argument of [tanh] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(null)", - "error": [], + "query": "from a_index | eval var = tanh(*)", + "error": [ + "Using wildcards (*) in tanh is not allowed" + ], "warning": [] }, { - "query": "row nullVar = null | stats median_absolute_deviation(nullVar)", + "query": "from a_index | eval var = tanh(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = percentile(numberField, 5)", + "query": "from a_index | eval tanh(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats percentile(numberField, 5)", + "query": "from a_index | eval var = tanh(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(percentile(numberField, 5))", + "query": "from a_index | eval var = tanh(longField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(percentile(numberField, 5))", + "query": "from a_index | eval tanh(longField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(percentile(numberField, 5)) + percentile(numberField, 5)", + "query": "from a_index | eval var = tanh(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(percentile(numberField, 5)) + percentile(numberField, 5)", + "query": "from a_index | eval tanh(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | stats percentile(numberField, numberField)", + "query": "from a_index | eval tanh(doubleField, extraArg)", "error": [ - "Argument of [percentile] must be a constant, received [numberField]" + "Error: [tanh] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | stats percentile(numberField / 2, 5)", + "query": "from a_index | sort tanh(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = percentile(numberField / 2, 5)", + "query": "from a_index | eval tanh(null)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), percentile(numberField / 2, 5)", + "query": "row nullVar = null | eval tanh(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = percentile(numberField / 2, 5)", + "query": "row var = tau()", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = percentile(numberField, 5)", + "query": "row tau()", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), percentile(numberField, 5)", + "query": "from a_index | where tau() > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5)", + "query": "from a_index | eval var = tau()", "error": [], "warning": [] }, { - "query": "from a_index | stats percentile(numberField, 5) by round(numberField / 2)", + "query": "from a_index | eval tau()", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = percentile(numberField, 5) by var1 = round(numberField / 2)", - "error": [], + "query": "from a_index | eval tau(extraArg)", + "error": [ + "Error: [tau] function expects exactly 0 arguments, got 1." + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), ipField", + "query": "from a_index | sort tau()", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), ipField", + "query": "row nullVar = null | eval tau()", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), numberField / 2", + "query": "row var = to_base64(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), numberField / 2", + "query": "row to_base64(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var = percentile(avg(numberField), 5)", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "row var = to_base64(to_string(true))", + "error": [], "warning": [] }, { - "query": "from a_index | stats percentile(avg(numberField), 5)", + "query": "row var = to_base64(true)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Argument of [to_base64] must be [keyword], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats percentile(stringField, 5)", - "error": [ - "Argument of [percentile] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = to_base64(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort percentile(numberField, 5)", - "error": [ - "SORT does not support function percentile" - ], + "query": "from a_index | eval to_base64(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | where percentile(numberField, 5)", - "error": [ - "WHERE does not support function percentile" - ], + "query": "from a_index | eval var = to_base64(to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | where percentile(numberField, 5) > 0", + "query": "from a_index | eval to_base64(booleanField)", "error": [ - "WHERE does not support function percentile" + "Argument of [to_base64] must be [keyword], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = percentile(numberField, 5)", + "query": "from a_index | eval var = to_base64(*)", "error": [ - "EVAL does not support function percentile" + "Using wildcards (*) in to_base64 is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = percentile(numberField, 5) > 0", - "error": [ - "EVAL does not support function percentile" - ], + "query": "from a_index | eval var = to_base64(textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval percentile(numberField, 5)", - "error": [ - "EVAL does not support function percentile" - ], + "query": "from a_index | eval to_base64(textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval percentile(numberField, 5) > 0", + "query": "from a_index | eval to_base64(keywordField, extraArg)", "error": [ - "EVAL does not support function percentile" + "Error: [to_base64] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | stats percentile(booleanField, 5)", - "error": [ - "Argument of [percentile] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | sort to_base64(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats percentile(null, null)", + "query": "from a_index | eval to_base64(null)", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats percentile(nullVar, nullVar)", - "error": [ - "Argument of [percentile] must be a constant, received [nullVar]" - ], + "query": "row nullVar = null | eval to_base64(nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = max(numberField)", + "query": "row var = to_boolean(true)", "error": [], "warning": [] }, { - "query": "from a_index | stats max(numberField)", + "query": "row to_boolean(true)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(max(numberField))", + "query": "row var = to_bool(true)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(max(numberField))", + "query": "row var = to_boolean(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(max(numberField)) + max(numberField)", + "query": "row var = to_boolean(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(max(numberField)) + max(numberField)", + "query": "row to_boolean(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | stats max(numberField / 2)", + "query": "row var = to_bool(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = max(numberField / 2)", + "query": "row var = to_boolean(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), max(numberField / 2)", + "query": "row var = to_boolean(5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = max(numberField / 2)", + "query": "row to_boolean(5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = max(numberField)", + "query": "row var = to_bool(5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), max(numberField)", + "query": "row var = to_boolean(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = max(numberField)", + "query": "row var = to_boolean(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats max(numberField) by round(numberField / 2)", + "query": "row to_boolean(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = max(numberField) by var1 = round(numberField / 2)", + "query": "row var = to_bool(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), ipField", + "query": "row var = to_boolean(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), ipField", + "query": "row var = to_boolean(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [to_boolean] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_boolean(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), numberField / 2", + "query": "from a_index | eval to_boolean(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = to_bool(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = max(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | eval var = to_boolean(to_boolean(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | stats max(avg(numberField))", + "query": "from a_index | eval to_boolean(cartesianPointField)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Argument of [to_boolean] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | stats max(stringField)", + "query": "from a_index | eval var = to_boolean(*)", "error": [ - "Argument of [max] must be [number], found value [stringField] type [string]" + "Using wildcards (*) in to_boolean is not allowed" ], "warning": [] }, { - "query": "from a_index | stats var = max(*)", - "error": [ - "Using wildcards (*) in max is not allowed" - ], + "query": "from a_index | eval var = to_boolean(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = max(dateField)", + "query": "from a_index | eval to_boolean(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats max(dateField)", + "query": "from a_index | eval var = to_bool(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(max(dateField))", + "query": "from a_index | eval var = to_boolean(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(max(dateField))", + "query": "from a_index | eval var = to_boolean(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(max(dateField)) + max(dateField)", + "query": "from a_index | eval to_boolean(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(max(dateField)) + max(dateField)", + "query": "from a_index | eval var = to_bool(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | sort max(numberField)", - "error": [ - "SORT does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(numberField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(numberField) > 0", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(dateField)", - "error": [ - "WHERE does not support function max" - ], - "warning": [] - }, - { - "query": "from a_index | where max(dateField) > 0", - "error": [ - "WHERE does not support function max" - ], + "query": "from a_index | eval var = to_boolean(to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = max(numberField)", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval var = to_boolean(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = max(numberField) > 0", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval to_boolean(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval max(numberField)", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval var = to_bool(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval max(numberField) > 0", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval var = to_boolean(to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = max(dateField)", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval var = to_boolean(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = max(dateField) > 0", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval to_boolean(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval max(dateField)", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval var = to_bool(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval max(dateField) > 0", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval var = to_boolean(textField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats max(booleanField)", + "query": "from a_index | eval to_boolean(textField)", "error": [], "warning": [] }, { - "query": "from a_index | stats max(null)", + "query": "from a_index | eval var = to_bool(textField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats max(nullVar)", + "query": "from a_index | eval var = to_boolean(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | stats max(\"2022\")", + "query": "from a_index | eval to_boolean(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | stats max(concat(\"20\", \"22\"))", - "error": [ - "Argument of [max] must be [number], found value [concat(\"20\",\"22\")] type [string]" - ], + "query": "from a_index | eval var = to_bool(unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats max(cartesianPointField)", + "query": "from a_index | eval to_boolean(booleanField, extraArg)", "error": [ - "Argument of [max] must be [number], found value [cartesianPointField] type [cartesian_point]" + "Error: [to_boolean] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | stats var = max(booleanField)", + "query": "from a_index | sort to_boolean(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | where max(booleanField)", - "error": [ - "WHERE does not support function max" - ], + "query": "from a_index | eval to_boolean(null)", + "error": [], "warning": [] }, { - "query": "from a_index | where max(booleanField) > 0", - "error": [ - "WHERE does not support function max" - ], + "query": "row nullVar = null | eval to_boolean(nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = max(booleanField)", + "query": "row var = to_cartesianpoint(cartesianPointField)", "error": [ - "EVAL does not support function max" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = max(booleanField) > 0", + "query": "row to_cartesianpoint(cartesianPointField)", "error": [ - "EVAL does not support function max" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval max(booleanField)", + "query": "row var = to_cartesianpoint(to_cartesianpoint(cartesianPointField))", "error": [ - "EVAL does not support function max" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval max(booleanField) > 0", - "error": [ - "EVAL does not support function max" - ], + "query": "row var = to_cartesianpoint(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = max(ipField)", + "query": "row to_cartesianpoint(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats max(ipField)", + "query": "row var = to_cartesianpoint(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | where max(ipField)", + "query": "row var = to_cartesianpoint(true)", "error": [ - "WHERE does not support function max" + "Argument of [to_cartesianpoint] must be [cartesian_point], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where max(ipField) > 0", - "error": [ - "WHERE does not support function max" - ], + "query": "from a_index | eval var = to_cartesianpoint(cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = max(ipField)", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval to_cartesianpoint(cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = max(ipField) > 0", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval var = to_cartesianpoint(to_cartesianpoint(cartesianPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval max(ipField)", + "query": "from a_index | eval to_cartesianpoint(booleanField)", "error": [ - "EVAL does not support function max" + "Argument of [to_cartesianpoint] must be [cartesian_point], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval max(ipField) > 0", + "query": "from a_index | eval var = to_cartesianpoint(*)", "error": [ - "EVAL does not support function max" + "Using wildcards (*) in to_cartesianpoint is not allowed" ], "warning": [] }, { - "query": "from a_index | stats var = min(numberField)", + "query": "from a_index | eval var = to_cartesianpoint(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | stats min(numberField)", + "query": "from a_index | eval to_cartesianpoint(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(min(numberField))", + "query": "from a_index | eval var = to_cartesianpoint(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(min(numberField))", + "query": "from a_index | eval var = to_cartesianpoint(textField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(min(numberField)) + min(numberField)", + "query": "from a_index | eval to_cartesianpoint(textField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(min(numberField)) + min(numberField)", - "error": [], + "query": "from a_index | eval to_cartesianpoint(cartesianPointField, extraArg)", + "error": [ + "Error: [to_cartesianpoint] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "from a_index | stats min(numberField / 2)", + "query": "from a_index | sort to_cartesianpoint(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = min(numberField / 2)", + "query": "from a_index | eval to_cartesianpoint(null)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), min(numberField / 2)", + "query": "row nullVar = null | eval to_cartesianpoint(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = min(numberField / 2)", - "error": [], + "query": "row var = to_cartesianshape(cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | stats var0 = min(numberField)", - "error": [], + "query": "row to_cartesianshape(cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), min(numberField)", - "error": [], + "query": "row var = to_cartesianshape(to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = min(numberField)", + "query": "row var = to_cartesianshape(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | stats min(numberField) by round(numberField / 2)", + "query": "row to_cartesianshape(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = min(numberField) by var1 = round(numberField / 2)", - "error": [], + "query": "row var = to_cartesianshape(to_cartesianshape(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), ipField", + "query": "row var = to_cartesianshape(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), ipField", + "query": "row to_cartesianshape(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), numberField / 2", + "query": "row var = to_cartesianshape(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "row var = to_cartesianshape(true)", + "error": [ + "Argument of [to_cartesianshape] must be [cartesian_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianshape(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = min(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | eval to_cartesianshape(cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats min(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | eval var = to_cartesianshape(to_cartesianpoint(cartesianPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | stats min(stringField)", + "query": "from a_index | eval to_cartesianshape(booleanField)", "error": [ - "Argument of [min] must be [number], found value [stringField] type [string]" + "Argument of [to_cartesianshape] must be [cartesian_point], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats var = min(*)", + "query": "from a_index | eval var = to_cartesianshape(*)", "error": [ - "Using wildcards (*) in min is not allowed" + "Using wildcards (*) in to_cartesianshape is not allowed" ], "warning": [] }, { - "query": "from a_index | stats var = min(dateField)", + "query": "from a_index | eval var = to_cartesianshape(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats min(dateField)", + "query": "from a_index | eval to_cartesianshape(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(min(dateField))", + "query": "from a_index | eval var = to_cartesianshape(to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(min(dateField))", + "query": "from a_index | eval var = to_cartesianshape(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(min(dateField)) + min(dateField)", + "query": "from a_index | eval to_cartesianshape(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(min(dateField)) + min(dateField)", + "query": "from a_index | eval var = to_cartesianshape(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | sort min(numberField)", - "error": [ - "SORT does not support function min" - ], + "query": "from a_index | eval var = to_cartesianshape(textField)", + "error": [], "warning": [] }, { - "query": "from a_index | where min(numberField)", - "error": [ - "WHERE does not support function min" - ], + "query": "from a_index | eval to_cartesianshape(textField)", + "error": [], "warning": [] }, { - "query": "from a_index | where min(numberField) > 0", + "query": "from a_index | eval to_cartesianshape(cartesianPointField, extraArg)", "error": [ - "WHERE does not support function min" + "Error: [to_cartesianshape] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | where min(dateField)", - "error": [ - "WHERE does not support function min" - ], + "query": "from a_index | sort to_cartesianshape(cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | where min(dateField) > 0", - "error": [ - "WHERE does not support function min" - ], + "query": "from a_index | eval to_cartesianshape(null)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = min(numberField)", - "error": [ - "EVAL does not support function min" - ], + "query": "row nullVar = null | eval to_cartesianshape(nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = min(numberField) > 0", - "error": [ - "EVAL does not support function min" - ], + "query": "row var = to_datetime(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval min(numberField)", - "error": [ - "EVAL does not support function min" - ], + "query": "row to_datetime(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval min(numberField) > 0", - "error": [ - "EVAL does not support function min" - ], + "query": "row var = to_dt(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = min(dateField)", - "error": [ - "EVAL does not support function min" - ], + "query": "row var = to_datetime(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = min(dateField) > 0", - "error": [ - "EVAL does not support function min" - ], + "query": "row var = to_datetime(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval min(dateField)", - "error": [ - "EVAL does not support function min" - ], + "query": "row to_datetime(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval min(dateField) > 0", - "error": [ - "EVAL does not support function min" - ], + "query": "row var = to_dt(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | stats min(booleanField)", + "query": "row var = to_datetime(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats min(null)", + "query": "row var = to_datetime(5)", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats min(nullVar)", + "query": "row to_datetime(5)", "error": [], "warning": [] }, { - "query": "from a_index | stats min(\"2022\")", + "query": "row var = to_dt(5)", "error": [], "warning": [] }, { - "query": "from a_index | stats min(concat(\"20\", \"22\"))", - "error": [ - "Argument of [min] must be [number], found value [concat(\"20\",\"22\")] type [string]" - ], + "query": "row var = to_datetime(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | stats min(cartesianPointField)", - "error": [ - "Argument of [min] must be [number], found value [cartesianPointField] type [cartesian_point]" - ], + "query": "row var = to_datetime(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = min(booleanField)", + "query": "row to_datetime(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | where min(booleanField)", - "error": [ - "WHERE does not support function min" - ], + "query": "row var = to_dt(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | where min(booleanField) > 0", - "error": [ - "WHERE does not support function min" - ], + "query": "row var = to_datetime(to_string(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = min(booleanField)", + "query": "row var = to_datetime(true)", "error": [ - "EVAL does not support function min" + "Argument of [to_datetime] must be [date], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = min(booleanField) > 0", - "error": [ - "EVAL does not support function min" - ], + "query": "from a_index | eval var = to_datetime(dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval min(booleanField)", + "query": "from a_index | eval to_datetime(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_dt(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_datetime(to_datetime(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_datetime(booleanField)", "error": [ - "EVAL does not support function min" + "Argument of [to_datetime] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval min(booleanField) > 0", + "query": "from a_index | eval var = to_datetime(*)", "error": [ - "EVAL does not support function min" + "Using wildcards (*) in to_datetime is not allowed" ], "warning": [] }, { - "query": "from a_index | stats var = min(ipField)", + "query": "from a_index | eval var = to_datetime(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats min(ipField)", + "query": "from a_index | eval to_datetime(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | where min(ipField)", - "error": [ - "WHERE does not support function min" - ], + "query": "from a_index | eval var = to_dt(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | where min(ipField) > 0", - "error": [ - "WHERE does not support function min" - ], + "query": "from a_index | eval var = to_datetime(to_double(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = min(ipField)", - "error": [ - "EVAL does not support function min" - ], + "query": "from a_index | eval var = to_datetime(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = min(ipField) > 0", - "error": [ - "EVAL does not support function min" - ], + "query": "from a_index | eval to_datetime(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval min(ipField)", - "error": [ - "EVAL does not support function min" - ], + "query": "from a_index | eval var = to_dt(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval min(ipField) > 0", - "error": [ - "EVAL does not support function min" - ], + "query": "from a_index | eval var = to_datetime(to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = count(stringField)", + "query": "from a_index | eval var = to_datetime(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | stats count(stringField)", + "query": "from a_index | eval to_datetime(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(count(stringField))", + "query": "from a_index | eval var = to_dt(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(count(stringField))", + "query": "from a_index | eval var = to_datetime(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(count(stringField)) + count(stringField)", + "query": "from a_index | eval var = to_datetime(longField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(count(stringField)) + count(stringField)", + "query": "from a_index | eval to_datetime(longField)", "error": [], "warning": [] }, { - "query": "from a_index | sort count(stringField)", - "error": [ - "SORT does not support function count" - ], + "query": "from a_index | eval var = to_dt(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | where count(stringField)", - "error": [ - "WHERE does not support function count" - ], + "query": "from a_index | eval var = to_datetime(textField)", + "error": [], "warning": [] }, { - "query": "from a_index | where count(stringField) > 0", - "error": [ - "WHERE does not support function count" - ], + "query": "from a_index | eval to_datetime(textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = count(stringField)", - "error": [ - "EVAL does not support function count" - ], + "query": "from a_index | eval var = to_dt(textField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = count(stringField) > 0", - "error": [ - "EVAL does not support function count" - ], + "query": "from a_index | eval var = to_datetime(unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval count(stringField)", - "error": [ - "EVAL does not support function count" - ], + "query": "from a_index | eval to_datetime(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_dt(unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval count(stringField) > 0", + "query": "from a_index | eval to_datetime(dateField, extraArg)", "error": [ - "EVAL does not support function count" + "Error: [to_datetime] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | stats count(null)", + "query": "from a_index | sort to_datetime(dateField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats count(nullVar)", + "query": "from a_index | eval to_datetime(null)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = count_distinct(stringField, numberField)", + "query": "row nullVar = null | eval to_datetime(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | stats count_distinct(stringField, numberField)", + "query": "from a_index | eval to_datetime(\"2022\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(count_distinct(stringField, numberField))", + "query": "from a_index | eval to_datetime(concat(\"20\", \"22\"))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(count_distinct(stringField, numberField))", + "query": "row var = to_degrees(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(count_distinct(stringField, numberField)) + count_distinct(stringField, numberField)", + "query": "row to_degrees(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(count_distinct(stringField, numberField)) + count_distinct(stringField, numberField)", + "query": "row var = to_degrees(to_double(true))", "error": [], "warning": [] }, { - "query": "from a_index | sort count_distinct(stringField, numberField)", - "error": [ - "SORT does not support function count_distinct" - ], + "query": "row var = to_degrees(5)", + "error": [], "warning": [] }, { - "query": "from a_index | where count_distinct(stringField, numberField)", - "error": [ - "WHERE does not support function count_distinct" - ], + "query": "row to_degrees(5)", + "error": [], "warning": [] }, { - "query": "from a_index | where count_distinct(stringField, numberField) > 0", - "error": [ - "WHERE does not support function count_distinct" - ], + "query": "row var = to_degrees(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = count_distinct(stringField, numberField)", + "query": "row var = to_degrees(true)", "error": [ - "EVAL does not support function count_distinct" + "Argument of [to_degrees] must be [double], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = count_distinct(stringField, numberField) > 0", - "error": [ - "EVAL does not support function count_distinct" - ], + "query": "from a_index | where to_degrees(doubleField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval count_distinct(stringField, numberField)", + "query": "from a_index | where to_degrees(booleanField) > 0", "error": [ - "EVAL does not support function count_distinct" + "Argument of [to_degrees] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval count_distinct(stringField, numberField) > 0", - "error": [ - "EVAL does not support function count_distinct" - ], + "query": "from a_index | where to_degrees(integerField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | stats count_distinct(null, null)", + "query": "from a_index | where to_degrees(longField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats count_distinct(nullVar, nullVar)", + "query": "from a_index | where to_degrees(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats var = st_centroid_agg(cartesianPointField)", + "query": "from a_index | eval var = to_degrees(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats st_centroid_agg(cartesianPointField)", + "query": "from a_index | eval to_degrees(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = st_centroid_agg(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | eval var = to_degrees(to_double(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | stats st_centroid_agg(avg(numberField))", + "query": "from a_index | eval to_degrees(booleanField)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Argument of [to_degrees] must be [double], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats st_centroid_agg(stringField)", + "query": "from a_index | eval var = to_degrees(*)", "error": [ - "Argument of [st_centroid_agg] must be [cartesian_point], found value [stringField] type [string]" + "Using wildcards (*) in to_degrees is not allowed" ], "warning": [] }, { - "query": "from a_index | stats var = st_centroid_agg(*)", - "error": [ - "Using wildcards (*) in st_centroid_agg is not allowed" - ], + "query": "from a_index | eval var = to_degrees(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = st_centroid_agg(geoPointField)", + "query": "from a_index | eval to_degrees(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats st_centroid_agg(geoPointField)", + "query": "from a_index | eval var = to_degrees(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | sort st_centroid_agg(cartesianPointField)", - "error": [ - "SORT does not support function st_centroid_agg" - ], + "query": "from a_index | eval var = to_degrees(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | where st_centroid_agg(cartesianPointField)", - "error": [ - "WHERE does not support function st_centroid_agg" - ], + "query": "from a_index | eval to_degrees(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | where st_centroid_agg(cartesianPointField) > 0", - "error": [ - "WHERE does not support function st_centroid_agg" - ], + "query": "from a_index | eval var = to_degrees(unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | where st_centroid_agg(geoPointField)", - "error": [ - "WHERE does not support function st_centroid_agg" - ], + "query": "from a_index | eval to_degrees(unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | where st_centroid_agg(geoPointField) > 0", + "query": "from a_index | eval to_degrees(doubleField, extraArg)", "error": [ - "WHERE does not support function st_centroid_agg" + "Error: [to_degrees] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = st_centroid_agg(cartesianPointField)", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "from a_index | sort to_degrees(doubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_centroid_agg(cartesianPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "from a_index | eval to_degrees(null)", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_centroid_agg(cartesianPointField)", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "row nullVar = null | eval to_degrees(nullVar)", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_centroid_agg(cartesianPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "row var = to_double(true)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_centroid_agg(geoPointField)", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "row to_double(true)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_centroid_agg(geoPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "row var = to_dbl(true)", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_centroid_agg(geoPointField)", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "row var = to_double(to_boolean(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_centroid_agg(geoPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "row var = to_double(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | stats st_centroid_agg(booleanField)", - "error": [ - "Argument of [st_centroid_agg] must be [cartesian_point], found value [booleanField] type [boolean]" - ], + "query": "row to_double(5.5)", + "error": [], "warning": [] }, { - "query": "from a_index | stats st_centroid_agg(null)", + "query": "row var = to_dbl(5.5)", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats st_centroid_agg(nullVar)", + "query": "row var = to_double(5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = values(stringField)", + "query": "row to_double(5)", "error": [], "warning": [] }, { - "query": "from a_index | stats values(stringField)", + "query": "row var = to_dbl(5)", "error": [], "warning": [] }, { - "query": "from a_index | sort values(stringField)", - "error": [ - "SORT does not support function values" - ], + "query": "row var = to_double(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | where values(stringField)", - "error": [ - "WHERE does not support function values" - ], + "query": "row to_double(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | where values(stringField) > 0", - "error": [ - "WHERE does not support function values" - ], + "query": "row var = to_dbl(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = values(stringField)", - "error": [ - "EVAL does not support function values" - ], + "query": "row var = to_double(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = values(stringField) > 0", - "error": [ - "EVAL does not support function values" - ], + "query": "row var = to_double(to_double(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval values(stringField)", - "error": [ - "EVAL does not support function values" - ], + "query": "row var = to_double(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval values(stringField) > 0", - "error": [ - "EVAL does not support function values" - ], + "query": "row var = to_double(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats values(null)", + "query": "row to_double(\"a\")", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats values(nullVar)", + "query": "row var = to_dbl(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, 1 year)", + "query": "row var = to_double(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats by bin(dateField, 1 year)", - "error": [], + "query": "row var = to_double(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [to_double] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | stats by bucket(numberField, 5)", + "query": "from a_index | where to_double(booleanField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(numberField, numberField)", + "query": "from a_index | where to_double(cartesianPointField) > 0", "error": [ - "Argument of [bucket] must be a constant, received [numberField]" + "Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | stats by bin(numberField, 5)", + "query": "from a_index | where to_double(counterDoubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, 5, \"a\", \"a\")", + "query": "from a_index | where to_double(counterIntegerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, numberField, stringField, stringField)", - "error": [ - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [stringField]", - "Argument of [bucket] must be a constant, received [stringField]" - ], + "query": "from a_index | where to_double(counterLongField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | stats by bin(dateField, 5, \"a\", \"a\")", + "query": "from a_index | where to_double(dateField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, 5, now(), now())", + "query": "from a_index | where to_double(doubleField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, numberField, dateField, dateField)", - "error": [ - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [dateField]", - "Argument of [bucket] must be a constant, received [dateField]" - ], + "query": "from a_index | where to_double(integerField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | stats by bin(dateField, 5, now(), now())", + "query": "from a_index | where to_double(keywordField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, 5, \"a\", now())", + "query": "from a_index | where to_double(longField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, numberField, stringField, dateField)", - "error": [ - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [stringField]", - "Argument of [bucket] must be a constant, received [dateField]" - ], + "query": "from a_index | where to_double(textField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | stats by bin(dateField, 5, \"a\", now())", + "query": "from a_index | where to_double(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, 5, now(), \"a\")", + "query": "from a_index | eval var = to_double(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, numberField, dateField, stringField)", - "error": [ - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [dateField]", - "Argument of [bucket] must be a constant, received [stringField]" - ], + "query": "from a_index | eval to_double(booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats by bin(dateField, 5, now(), \"a\")", + "query": "from a_index | eval var = to_dbl(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(numberField, 5, 5, 5)", + "query": "from a_index | eval var = to_double(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(numberField, numberField, numberField, numberField)", + "query": "from a_index | eval to_double(cartesianPointField)", "error": [ - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [numberField]" + "Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | stats by bin(numberField, 5, 5, 5)", - "error": [], + "query": "from a_index | eval var = to_double(*)", + "error": [ + "Using wildcards (*) in to_double is not allowed" + ], "warning": [] }, { - "query": "from a_index | sort bucket(dateField, 1 year)", - "error": [ - "SORT does not support function bucket" - ], + "query": "from a_index | eval var = to_double(counterDoubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(null, null, null, null)", + "query": "from a_index | eval to_double(counterDoubleField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats bucket(nullVar, nullVar, nullVar, nullVar)", - "error": [ - "Argument of [bucket] must be a constant, received [nullVar]", - "Argument of [bucket] must be a constant, received [nullVar]", - "Argument of [bucket] must be a constant, received [nullVar]" - ], + "query": "from a_index | eval var = to_dbl(counterDoubleField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(\"2022\", 1 year)", + "query": "from a_index | eval var = to_double(counterIntegerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), 1 year)", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [string]" - ], + "query": "from a_index | eval to_double(counterIntegerField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(concat(\"20\", \"22\"), 1 year)", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [string]" - ], + "query": "from a_index | eval var = to_dbl(counterIntegerField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(\"2022\", 5, \"a\", \"a\")", + "query": "from a_index | eval var = to_double(counterLongField)", "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), 5, \"a\", \"a\")", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [string]" - ], + "query": "from a_index | eval to_double(counterLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(\"2022\", 5, \"2022\", \"2022\")", + "query": "from a_index | eval var = to_dbl(counterLongField)", "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), 5, concat(\"20\", \"22\"), concat(\"20\", \"22\"))", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [string]" - ], + "query": "from a_index | eval var = to_double(dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(\"2022\", 5, \"a\", \"2022\")", + "query": "from a_index | eval to_double(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), 5, \"a\", concat(\"20\", \"22\"))", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [string]" - ], + "query": "from a_index | eval var = to_dbl(dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(\"2022\", 5, \"2022\", \"a\")", + "query": "from a_index | eval var = to_double(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | stats bucket(concat(\"20\", \"22\"), 5, concat(\"20\", \"22\"), \"a\")", - "error": [ - "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [string]" - ], + "query": "from a_index | eval var = to_double(doubleField)", + "error": [], "warning": [] }, { - "query": "row var = cbrt(5)", + "query": "from a_index | eval to_double(doubleField)", "error": [], "warning": [] }, { - "query": "row cbrt(5)", + "query": "from a_index | eval var = to_dbl(doubleField)", "error": [], "warning": [] }, { - "query": "row var = cbrt(to_integer(true))", + "query": "from a_index | eval var = to_double(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = cbrt(true)", - "error": [ - "Argument of [cbrt] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | eval var = to_double(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | where cbrt(numberField) > 0", + "query": "from a_index | eval to_double(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | where cbrt(booleanField) > 0", - "error": [ - "Argument of [cbrt] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = to_dbl(integerField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cbrt(numberField)", + "query": "from a_index | eval var = to_double(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval cbrt(numberField)", + "query": "from a_index | eval var = to_double(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = cbrt(to_integer(booleanField))", + "query": "from a_index | eval to_double(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval cbrt(booleanField)", - "error": [ - "Argument of [cbrt] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = to_dbl(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cbrt(*)", - "error": [ - "Using wildcards (*) in cbrt is not allowed" - ], + "query": "from a_index | eval var = to_double(to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval cbrt(numberField, extraArg)", - "error": [ - "Error: [cbrt] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = to_double(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort cbrt(numberField)", + "query": "from a_index | eval to_double(longField)", "error": [], "warning": [] }, { - "query": "from a_index | eval cbrt(null)", + "query": "from a_index | eval var = to_dbl(longField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval cbrt(nullVar)", + "query": "from a_index | eval var = to_double(textField)", "error": [], "warning": [] }, { - "query": "row var = from_base64(\"a\")", + "query": "from a_index | eval to_double(textField)", "error": [], "warning": [] }, { - "query": "row from_base64(\"a\")", + "query": "from a_index | eval var = to_dbl(textField)", "error": [], "warning": [] }, { - "query": "row var = from_base64(to_string(true))", + "query": "from a_index | eval var = to_double(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = from_base64(true)", - "error": [ - "Argument of [from_base64] must be [string], found value [true] type [boolean]" - ], + "query": "from a_index | eval to_double(unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(from_base64(stringField)) > 0", + "query": "from a_index | eval var = to_dbl(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(from_base64(booleanField)) > 0", + "query": "from a_index | eval to_double(booleanField, extraArg)", "error": [ - "Argument of [from_base64] must be [string], found value [booleanField] type [boolean]" + "Error: [to_double] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = from_base64(stringField)", + "query": "from a_index | sort to_double(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval from_base64(stringField)", + "query": "from a_index | eval to_double(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = from_base64(to_string(booleanField))", + "query": "row nullVar = null | eval to_double(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval from_base64(booleanField)", - "error": [ - "Argument of [from_base64] must be [string], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval to_double(\"2022\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = from_base64(*)", - "error": [ - "Using wildcards (*) in from_base64 is not allowed" - ], + "query": "from a_index | eval to_double(concat(\"20\", \"22\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval from_base64(stringField, extraArg)", + "query": "row var = to_geopoint(geoPointField)", "error": [ - "Error: [from_base64] function expects exactly one argument, got 2." + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | sort from_base64(stringField)", - "error": [], + "query": "row to_geopoint(geoPointField)", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval from_base64(null)", - "error": [], + "query": "row var = to_geopoint(to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row nullVar = null | eval from_base64(nullVar)", + "query": "row var = to_geopoint(\"a\")", "error": [], "warning": [] }, { - "query": "row var = locate(\"a\", \"a\")", + "query": "row to_geopoint(\"a\")", "error": [], "warning": [] }, { - "query": "row locate(\"a\", \"a\")", + "query": "row var = to_geopoint(to_string(true))", "error": [], "warning": [] }, { - "query": "row var = locate(to_string(true), to_string(true))", - "error": [], + "query": "row var = to_geopoint(true)", + "error": [ + "Argument of [to_geopoint] must be [geo_point], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = locate(\"a\", \"a\", 5)", + "query": "from a_index | eval var = to_geopoint(geoPointField)", "error": [], "warning": [] }, { - "query": "row locate(\"a\", \"a\", 5)", + "query": "from a_index | eval to_geopoint(geoPointField)", "error": [], "warning": [] }, { - "query": "row var = locate(to_string(true), to_string(true), to_integer(true))", + "query": "from a_index | eval var = to_geopoint(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = locate(true, true, true)", + "query": "from a_index | eval to_geopoint(booleanField)", "error": [ - "Argument of [locate] must be [string], found value [true] type [boolean]", - "Argument of [locate] must be [string], found value [true] type [boolean]", - "Argument of [locate] must be [number], found value [true] type [boolean]" + "Argument of [to_geopoint] must be [geo_point], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where locate(stringField, stringField) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where locate(booleanField, booleanField) > 0", + "query": "from a_index | eval var = to_geopoint(*)", "error": [ - "Argument of [locate] must be [string], found value [booleanField] type [boolean]", - "Argument of [locate] must be [string], found value [booleanField] type [boolean]" + "Using wildcards (*) in to_geopoint is not allowed" ], "warning": [] }, { - "query": "from a_index | where locate(stringField, stringField, numberField) > 0", + "query": "from a_index | eval var = to_geopoint(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | where locate(booleanField, booleanField, booleanField) > 0", - "error": [ - "Argument of [locate] must be [string], found value [booleanField] type [boolean]", - "Argument of [locate] must be [string], found value [booleanField] type [boolean]", - "Argument of [locate] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval to_geopoint(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = locate(stringField, stringField)", + "query": "from a_index | eval var = to_geopoint(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval locate(stringField, stringField)", + "query": "from a_index | eval var = to_geopoint(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = locate(to_string(booleanField), to_string(booleanField))", + "query": "from a_index | eval to_geopoint(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval locate(booleanField, booleanField)", + "query": "from a_index | eval to_geopoint(geoPointField, extraArg)", "error": [ - "Argument of [locate] must be [string], found value [booleanField] type [boolean]", - "Argument of [locate] must be [string], found value [booleanField] type [boolean]" + "Error: [to_geopoint] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = locate(stringField, stringField, numberField)", + "query": "from a_index | sort to_geopoint(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval locate(stringField, stringField, numberField)", + "query": "from a_index | eval to_geopoint(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = locate(to_string(booleanField), to_string(booleanField), to_integer(booleanField))", + "query": "row nullVar = null | eval to_geopoint(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval locate(booleanField, booleanField, booleanField)", + "query": "row var = to_geoshape(geoPointField)", "error": [ - "Argument of [locate] must be [string], found value [booleanField] type [boolean]", - "Argument of [locate] must be [string], found value [booleanField] type [boolean]", - "Argument of [locate] must be [number], found value [booleanField] type [boolean]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval locate(stringField, stringField, numberField, extraArg)", + "query": "row to_geoshape(geoPointField)", "error": [ - "Error: [locate] function expects no more than 3 arguments, got 4." + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | sort locate(stringField, stringField)", - "error": [], + "query": "row var = to_geoshape(to_geopoint(geoPointField))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "from a_index | eval locate(null, null, null)", + "query": "row var = to_geoshape(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval locate(nullVar, nullVar, nullVar)", + "query": "row to_geoshape(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = to_base64(\"a\")", - "error": [], + "query": "row var = to_geoshape(to_geoshape(geoPointField))", + "error": [ + "Unknown column [geoPointField]" + ], "warning": [] }, { - "query": "row to_base64(\"a\")", + "query": "row var = to_geoshape(\"a\")", "error": [], "warning": [] }, { - "query": "row var = to_base64(to_string(true))", + "query": "row to_geoshape(\"a\")", "error": [], "warning": [] }, { - "query": "row var = to_base64(true)", - "error": [ - "Argument of [to_base64] must be [string], found value [true] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | where length(to_base64(stringField)) > 0", + "query": "row var = to_geoshape(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | where length(to_base64(booleanField)) > 0", + "query": "row var = to_geoshape(true)", "error": [ - "Argument of [to_base64] must be [string], found value [booleanField] type [boolean]" + "Argument of [to_geoshape] must be [geo_point], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = to_base64(stringField)", + "query": "from a_index | eval var = to_geoshape(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_base64(stringField)", + "query": "from a_index | eval to_geoshape(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_base64(to_string(booleanField))", + "query": "from a_index | eval var = to_geoshape(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_base64(booleanField)", + "query": "from a_index | eval to_geoshape(booleanField)", "error": [ - "Argument of [to_base64] must be [string], found value [booleanField] type [boolean]" + "Argument of [to_geoshape] must be [geo_point], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = to_base64(*)", + "query": "from a_index | eval var = to_geoshape(*)", "error": [ - "Using wildcards (*) in to_base64 is not allowed" + "Using wildcards (*) in to_geoshape is not allowed" ], "warning": [] }, { - "query": "from a_index | eval to_base64(stringField, extraArg)", - "error": [ - "Error: [to_base64] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = to_geoshape(geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_geoshape(geoShapeField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_base64(stringField)", + "query": "from a_index | eval var = to_geoshape(to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_base64(null)", + "query": "from a_index | eval var = to_geoshape(keywordField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval to_base64(nullVar)", + "query": "from a_index | eval to_geoshape(keywordField)", "error": [], "warning": [] }, { - "query": "row var = ip_prefix(to_ip(\"127.0.0.1\"), 5, 5)", + "query": "from a_index | eval var = to_geoshape(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row ip_prefix(to_ip(\"127.0.0.1\"), 5, 5)", + "query": "from a_index | eval var = to_geoshape(textField)", "error": [], "warning": [] }, { - "query": "row var = ip_prefix(to_ip(to_ip(\"127.0.0.1\")), to_integer(true), to_integer(true))", + "query": "from a_index | eval to_geoshape(textField)", "error": [], "warning": [] }, { - "query": "row var = ip_prefix(true, true, true)", + "query": "from a_index | eval to_geoshape(geoPointField, extraArg)", "error": [ - "Argument of [ip_prefix] must be [ip], found value [true] type [boolean]", - "Argument of [ip_prefix] must be [number], found value [true] type [boolean]", - "Argument of [ip_prefix] must be [number], found value [true] type [boolean]" + "Error: [to_geoshape] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = ip_prefix(ipField, numberField, numberField)", + "query": "from a_index | sort to_geoshape(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval ip_prefix(ipField, numberField, numberField)", + "query": "from a_index | eval to_geoshape(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = ip_prefix(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))", + "query": "row nullVar = null | eval to_geoshape(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval ip_prefix(booleanField, booleanField, booleanField)", + "query": "row var = to_integer(true)", + "error": [], + "warning": [] + }, + { + "query": "row to_integer(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_int(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_boolean(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_integer(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_int(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_integer(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_int(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row to_integer(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_int(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_double(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_integer(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_int(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_cartesianpoint(\"POINT (30 10)\"))", "error": [ - "Argument of [ip_prefix] must be [ip], found value [booleanField] type [boolean]", - "Argument of [ip_prefix] must be [number], found value [booleanField] type [boolean]", - "Argument of [ip_prefix] must be [number], found value [booleanField] type [boolean]" + "Argument of [to_integer] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | eval ip_prefix(ipField, numberField, numberField, extraArg)", + "query": "from a_index | where to_integer(booleanField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_integer(cartesianPointField) > 0", "error": [ - "Error: [ip_prefix] function expects exactly 3 arguments, got 4." + "Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | sort ip_prefix(ipField, numberField, numberField)", + "query": "from a_index | where to_integer(counterIntegerField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval ip_prefix(null, null, null)", + "query": "from a_index | where to_integer(dateField) > 0", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval ip_prefix(nullVar, nullVar, nullVar)", + "query": "from a_index | where to_integer(doubleField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_append(true, true)", + "query": "from a_index | where to_integer(integerField) > 0", "error": [], "warning": [] }, { - "query": "row mv_append(true, true)", + "query": "from a_index | where to_integer(keywordField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_boolean(true), to_boolean(true))", + "query": "from a_index | where to_integer(longField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | where to_integer(textField) > 0", "error": [], "warning": [] }, { - "query": "row mv_append(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | where to_integer(unsignedLongField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = to_integer(booleanField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval to_integer(booleanField)", "error": [], "warning": [] }, { - "query": "row mv_append(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = to_int(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(to_boolean(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_integer(cartesianPointField)", + "error": [ + "Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(*)", + "error": [ + "Using wildcards (*) in to_integer is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(counterIntegerField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval to_integer(counterIntegerField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(now(), now())", + "query": "from a_index | eval var = to_int(counterIntegerField)", "error": [], "warning": [] }, { - "query": "row mv_append(now(), now())", + "query": "from a_index | eval var = to_integer(dateField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_datetime(now()), to_datetime(now()))", + "query": "from a_index | eval to_integer(dateField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(5, 5)", + "query": "from a_index | eval var = to_int(dateField)", "error": [], "warning": [] }, { - "query": "row mv_append(5, 5)", + "query": "from a_index | eval var = to_integer(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_integer(true), to_integer(true))", + "query": "from a_index | eval var = to_integer(doubleField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval to_integer(doubleField)", "error": [], "warning": [] }, { - "query": "row mv_append(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = to_int(doubleField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = to_integer(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = to_integer(integerField)", "error": [], "warning": [] }, { - "query": "row mv_append(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval to_integer(integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = to_int(integerField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = to_integer(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row mv_append(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", + "query": "from a_index | eval var = to_integer(keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", + "query": "from a_index | eval to_integer(keywordField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(\"a\", \"a\")", + "query": "from a_index | eval var = to_int(keywordField)", "error": [], "warning": [] }, { - "query": "row mv_append(\"a\", \"a\")", + "query": "from a_index | eval var = to_integer(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_string(true), to_string(true))", + "query": "from a_index | eval var = to_integer(longField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", + "query": "from a_index | eval to_integer(longField)", "error": [], "warning": [] }, { - "query": "row mv_append(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", + "query": "from a_index | eval var = to_int(longField)", "error": [], "warning": [] }, { - "query": "row var = mv_append(to_version(\"a\"), to_version(\"a\"))", + "query": "from a_index | eval var = to_integer(textField)", "error": [], "warning": [] }, { - "query": "from a_index | where mv_append(numberField, numberField) > 0", + "query": "from a_index | eval to_integer(textField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_append(stringField, stringField)) > 0", + "query": "from a_index | eval var = to_int(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(booleanField, booleanField)", + "query": "from a_index | eval var = to_integer(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(booleanField, booleanField)", + "query": "from a_index | eval to_integer(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(to_boolean(booleanField), to_boolean(booleanField))", + "query": "from a_index | eval var = to_int(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval to_integer(booleanField, extraArg)", + "error": [ + "Error: [to_integer] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_integer(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval to_integer(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "query": "row nullVar = null | eval to_integer(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(cartesianShapeField, cartesianShapeField)", + "query": "from a_index | eval to_integer(\"2022\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(cartesianShapeField, cartesianShapeField)", + "query": "from a_index | eval to_integer(concat(\"20\", \"22\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "query": "row var = to_ip(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(dateField, dateField)", + "query": "row to_ip(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(dateField, dateField)", + "query": "row var = to_ip(to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(to_datetime(dateField), to_datetime(dateField))", + "query": "row var = to_ip(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(numberField, numberField)", + "query": "row to_ip(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(numberField, numberField)", + "query": "row var = to_ip(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(to_integer(booleanField), to_integer(booleanField))", + "query": "row var = to_ip(true)", + "error": [ + "Argument of [to_ip] must be [ip], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ip(ipField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(geoPointField, geoPointField)", + "query": "from a_index | eval to_ip(ipField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(geoPointField, geoPointField)", + "query": "from a_index | eval var = to_ip(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "query": "from a_index | eval to_ip(booleanField)", + "error": [ + "Argument of [to_ip] must be [ip], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ip(*)", + "error": [ + "Using wildcards (*) in to_ip is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ip(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(geoShapeField, geoShapeField)", + "query": "from a_index | eval to_ip(keywordField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(geoShapeField, geoShapeField)", + "query": "from a_index | eval var = to_ip(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "query": "from a_index | eval var = to_ip(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(ipField, ipField)", + "query": "from a_index | eval to_ip(textField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(ipField, ipField)", + "query": "from a_index | eval to_ip(ipField, extraArg)", + "error": [ + "Error: [to_ip] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_ip(ipField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(to_ip(ipField), to_ip(ipField))", + "query": "from a_index | eval to_ip(null)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(stringField, stringField)", + "query": "row nullVar = null | eval to_ip(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(stringField, stringField)", + "query": "row var = to_long(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(to_string(booleanField), to_string(booleanField))", + "query": "row to_long(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(versionField, versionField)", + "query": "row var = to_long(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(versionField, versionField)", + "query": "row var = to_long(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_append(to_version(stringField), to_version(stringField))", + "query": "row to_long(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(booleanField, booleanField, extraArg)", - "error": [ - "Error: [mv_append] function expects exactly 2 arguments, got 3." + "query": "row var = to_long(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_long(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row to_long(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(to_double(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_long(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [to_long] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_long(booleanField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(cartesianPointField) > 0", + "error": [ + "Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_long(counterIntegerField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(counterLongField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(dateField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(doubleField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(integerField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(keywordField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(longField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(textField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(unsignedLongField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(to_boolean(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(cartesianPointField)", + "error": [ + "Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(*)", + "error": [ + "Using wildcards (*) in to_long is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(to_datetime(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(to_double(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(booleanField, extraArg)", + "error": [ + "Error: [to_long] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | eval to_long(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(\"2022\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(concat(\"20\", \"22\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_lower(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_lower(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_lower(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_lower(true)", + "error": [ + "Argument of [to_lower] must be [keyword], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_lower(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_lower(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_lower(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_lower(booleanField)", + "error": [ + "Argument of [to_lower] must be [keyword], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_lower(*)", + "error": [ + "Using wildcards (*) in to_lower is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_lower(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_lower(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_lower(keywordField, extraArg)", + "error": [ + "Error: [to_lower] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_lower(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_lower(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | eval to_lower(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_radians(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row to_radians(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_radians(to_double(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_radians(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_radians(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_radians(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_radians(true)", + "error": [ + "Argument of [to_radians] must be [double], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_radians(doubleField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_radians(booleanField) > 0", + "error": [ + "Argument of [to_radians] must be [double], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_radians(integerField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_radians(longField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_radians(unsignedLongField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(to_double(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(booleanField)", + "error": [ + "Argument of [to_radians] must be [double], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(*)", + "error": [ + "Using wildcards (*) in to_radians is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(doubleField, extraArg)", + "error": [ + "Error: [to_radians] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_radians(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | eval to_radians(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(true)", + "error": [], + "warning": [] + }, + { + "query": "row to_unsigned_long(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ul(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ulong(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_boolean(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_unsigned_long(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ul(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ulong(to_datetime(\"2021-01-01T00:00:00Z\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row to_unsigned_long(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ul(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ulong(5.5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_double(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_unsigned_long(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ul(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ulong(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_unsigned_long(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ul(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ulong(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [to_unsigned_long] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(booleanField) > 0", + "error": [ + "Argument of [>] must be [double], found value [to_unsigned_long(booleanField)] type [unsigned_long]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(cartesianPointField) > 0", + "error": [ + "Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [>] must be [double], found value [to_unsigned_long(cartesianPointField)] type [unsigned_long]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(dateField) > 0", + "error": [ + "Argument of [>] must be [double], found value [to_unsigned_long(dateField)] type [unsigned_long]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(doubleField) > 0", + "error": [ + "Argument of [>] must be [double], found value [to_unsigned_long(doubleField)] type [unsigned_long]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(integerField) > 0", + "error": [ + "Argument of [>] must be [double], found value [to_unsigned_long(integerField)] type [unsigned_long]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(keywordField) > 0", + "error": [ + "Argument of [>] must be [double], found value [to_unsigned_long(keywordField)] type [unsigned_long]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(longField) > 0", + "error": [ + "Argument of [>] must be [double], found value [to_unsigned_long(longField)] type [unsigned_long]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(textField) > 0", + "error": [ + "Argument of [>] must be [double], found value [to_unsigned_long(textField)] type [unsigned_long]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(unsignedLongField) > 0", + "error": [ + "Argument of [>] must be [double], found value [to_unsigned_long(unsignedLongField)] type [unsigned_long]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(to_boolean(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(cartesianPointField)", + "error": [ + "Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(*)", + "error": [ + "Using wildcards (*) in to_unsigned_long is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(to_datetime(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(to_double(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(booleanField, extraArg)", + "error": [ + "Error: [to_unsigned_long] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_unsigned_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | eval to_unsigned_long(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(\"2022\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(concat(\"20\", \"22\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_upper(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_upper(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_upper(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_upper(true)", + "error": [ + "Argument of [to_upper] must be [keyword], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_upper(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_upper(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_upper(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_upper(booleanField)", + "error": [ + "Argument of [to_upper] must be [keyword], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_upper(*)", + "error": [ + "Using wildcards (*) in to_upper is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_upper(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_upper(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_upper(keywordField, extraArg)", + "error": [ + "Error: [to_upper] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_upper(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_upper(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | eval to_upper(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_version(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_version(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ver(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_version(to_version(\"1.0.0\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_version(to_version(\"1.0.0\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ver(to_version(\"1.0.0\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_version(true)", + "error": [ + "Argument of [to_version] must be [keyword], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_version(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_version(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ver(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_version(*)", + "error": [ + "Using wildcards (*) in to_version is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_version(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_version(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ver(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_version(versionField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_version(versionField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ver(versionField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_version(keywordField, extraArg)", + "error": [ + "Error: [to_version] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_version(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_version(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | eval to_version(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "row var = trim(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row trim(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = trim(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = trim(true)", + "error": [ + "Argument of [trim] must be [keyword], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = trim(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval trim(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = trim(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval trim(booleanField)", + "error": [ + "Argument of [trim] must be [keyword], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = trim(*)", + "error": [ + "Using wildcards (*) in trim is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = trim(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval trim(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval trim(keywordField, extraArg)", + "error": [ + "Error: [trim] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort trim(keywordField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval trim(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | eval trim(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "row var = case(true, \"a\")", + "error": [], + "warning": [] + }, + { + "query": "row case(true, \"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = case(to_cartesianpoint(\"POINT (30 10)\"), true)", + "error": [ + "Argument of [case] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = case(booleanField, textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval case(booleanField, textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort case(booleanField, textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval case(null, null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | eval case(nullVar, nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(integerField)) + avg(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(integerField)) + avg(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(integerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(integerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(integerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(integerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(integerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(booleanField)", + "error": [ + "Argument of [avg] must be [integer], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(*)", + "error": [ + "Using wildcards (*) in avg is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(counterIntegerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(counterIntegerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(counterIntegerField)) + avg(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(counterIntegerField)) + avg(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(counterIntegerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(counterIntegerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(counterIntegerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(counterIntegerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(counterIntegerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(doubleField)) + avg(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(doubleField)) + avg(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(doubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(doubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(doubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(doubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(unsignedLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(unsignedLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(unsignedLongField)) + avg(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(unsignedLongField)) + avg(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(unsignedLongField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(unsignedLongField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(unsignedLongField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(unsignedLongField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(unsignedLongField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(longField)) + avg(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(longField)) + avg(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(longField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(longField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(longField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(longField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(longField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(counterLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(counterLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(counterLongField)) + avg(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(counterLongField)) + avg(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(counterLongField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(counterLongField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(counterLongField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(counterLongField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(counterLongField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(counterLongField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(counterDoubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(counterDoubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(counterDoubleField)) + avg(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(counterDoubleField)) + avg(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(counterDoubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(counterDoubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(counterDoubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(counterDoubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), avg(counterDoubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = avg(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort avg(integerField)", + "error": [ + "SORT does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(integerField)", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(integerField) > 0", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(counterIntegerField)", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(counterIntegerField) > 0", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(doubleField)", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(doubleField) > 0", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(unsignedLongField)", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(unsignedLongField) > 0", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(longField)", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(longField) > 0", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(counterLongField)", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(counterLongField) > 0", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(counterDoubleField)", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(counterDoubleField) > 0", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(integerField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(integerField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(integerField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(integerField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(counterIntegerField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(counterIntegerField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(counterIntegerField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(counterIntegerField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(doubleField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(doubleField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(doubleField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(doubleField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(unsignedLongField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(unsignedLongField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(unsignedLongField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(unsignedLongField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(longField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(longField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(longField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(longField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(counterLongField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(counterLongField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(counterLongField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(counterLongField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(counterDoubleField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(counterDoubleField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(counterDoubleField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(counterDoubleField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats avg(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(integerField)) + sum(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(integerField)) + sum(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(integerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(integerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(integerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(integerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(integerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats sum(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats sum(booleanField)", + "error": [ + "Argument of [sum] must be [integer], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(*)", + "error": [ + "Using wildcards (*) in sum is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(counterIntegerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(counterIntegerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(counterIntegerField)) + sum(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(counterIntegerField)) + sum(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(counterIntegerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(counterIntegerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(counterIntegerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(counterIntegerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(counterIntegerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(doubleField)) + sum(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(doubleField)) + sum(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(doubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(doubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(doubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(doubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(doubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(unsignedLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(unsignedLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(unsignedLongField)) + sum(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(unsignedLongField)) + sum(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(unsignedLongField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(unsignedLongField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(unsignedLongField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(unsignedLongField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(unsignedLongField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(longField)) + sum(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(longField)) + sum(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(longField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(longField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(longField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(longField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(longField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(counterLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(counterLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(counterLongField)) + sum(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(counterLongField)) + sum(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(counterLongField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(counterLongField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(counterLongField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(counterLongField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(counterLongField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(counterLongField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(counterDoubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(counterDoubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(counterDoubleField)) + sum(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(counterDoubleField)) + sum(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(counterDoubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(counterDoubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(counterDoubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(counterDoubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), sum(counterDoubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = sum(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort sum(integerField)", + "error": [ + "SORT does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(integerField)", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(integerField) > 0", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(counterIntegerField)", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(counterIntegerField) > 0", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(doubleField)", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(doubleField) > 0", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(unsignedLongField)", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(unsignedLongField) > 0", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(longField)", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(longField) > 0", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(counterLongField)", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(counterLongField) > 0", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(counterDoubleField)", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(counterDoubleField) > 0", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(integerField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(integerField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(integerField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(integerField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(counterIntegerField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(counterIntegerField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(counterIntegerField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(counterIntegerField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(doubleField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(doubleField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(doubleField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(doubleField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(unsignedLongField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(unsignedLongField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(unsignedLongField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(unsignedLongField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(longField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(longField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(longField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(longField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(counterLongField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(counterLongField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(counterLongField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(counterLongField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(counterDoubleField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(counterDoubleField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(counterDoubleField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(counterDoubleField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | stats sum(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats sum(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(integerField)) + median(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(integerField)) + median(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(integerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(integerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(integerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(integerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(integerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats median(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats median(booleanField)", + "error": [ + "Argument of [median] must be [integer], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = median(*)", + "error": [ + "Using wildcards (*) in median is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = median(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(counterIntegerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(counterIntegerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(counterIntegerField)) + median(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(counterIntegerField)) + median(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(counterIntegerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(counterIntegerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(counterIntegerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(counterIntegerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(counterIntegerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(doubleField)) + median(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(doubleField)) + median(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(doubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(doubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(doubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(doubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(doubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(unsignedLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(unsignedLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(unsignedLongField)) + median(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(unsignedLongField)) + median(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(unsignedLongField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(unsignedLongField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(unsignedLongField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(unsignedLongField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(unsignedLongField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(longField)) + median(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(longField)) + median(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(longField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(longField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(longField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(longField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(longField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(counterLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(counterLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(counterLongField)) + median(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(counterLongField)) + median(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(counterLongField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(counterLongField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(counterLongField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(counterLongField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(counterLongField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(counterLongField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(counterDoubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(counterDoubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(counterDoubleField)) + median(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(counterDoubleField)) + median(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(counterDoubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(counterDoubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(counterDoubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(counterDoubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median(counterDoubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort median(integerField)", + "error": [ + "SORT does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(integerField)", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(integerField) > 0", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(counterIntegerField)", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(counterIntegerField) > 0", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(doubleField)", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(doubleField) > 0", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(unsignedLongField)", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(unsignedLongField) > 0", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(longField)", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(longField) > 0", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(counterLongField)", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(counterLongField) > 0", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(counterDoubleField)", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(counterDoubleField) > 0", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(integerField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(integerField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(integerField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(integerField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(counterIntegerField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(counterIntegerField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(counterIntegerField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(counterIntegerField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(doubleField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(doubleField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(doubleField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(doubleField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(unsignedLongField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(unsignedLongField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(unsignedLongField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(unsignedLongField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(longField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(longField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(longField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(longField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(counterLongField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(counterLongField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(counterLongField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(counterLongField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(counterDoubleField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(counterDoubleField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(counterDoubleField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(counterDoubleField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | stats median(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats median(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(integerField)) + median_absolute_deviation(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(integerField)) + median_absolute_deviation(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(integerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(integerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(integerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(integerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(integerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(booleanField)", + "error": [ + "Argument of [median_absolute_deviation] must be [integer], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(*)", + "error": [ + "Using wildcards (*) in median_absolute_deviation is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(counterIntegerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(counterIntegerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(counterIntegerField)) + median_absolute_deviation(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(counterIntegerField)) + median_absolute_deviation(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterIntegerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(counterIntegerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(counterIntegerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterIntegerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterIntegerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterIntegerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(doubleField)) + median_absolute_deviation(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(doubleField)) + median_absolute_deviation(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(doubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(doubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(doubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(doubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(unsignedLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(unsignedLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(unsignedLongField)) + median_absolute_deviation(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(unsignedLongField)) + median_absolute_deviation(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(unsignedLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(unsignedLongField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(unsignedLongField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(unsignedLongField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(unsignedLongField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(unsignedLongField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(longField)) + median_absolute_deviation(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(longField)) + median_absolute_deviation(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(longField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(longField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(longField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(longField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(longField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(counterLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(counterLongField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(counterLongField)) + median_absolute_deviation(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(counterLongField)) + median_absolute_deviation(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterLongField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(counterLongField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(counterLongField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterLongField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterLongField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterLongField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterLongField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(counterDoubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(counterDoubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(counterDoubleField)) + median_absolute_deviation(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(counterDoubleField)) + median_absolute_deviation(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterDoubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(counterDoubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(counterDoubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterDoubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterDoubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), median_absolute_deviation(counterDoubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort median_absolute_deviation(integerField)", + "error": [ + "SORT does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(integerField)", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(integerField) > 0", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(counterIntegerField)", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(counterIntegerField) > 0", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(doubleField)", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(doubleField) > 0", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(unsignedLongField)", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(unsignedLongField) > 0", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(longField)", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(longField) > 0", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(counterLongField)", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(counterLongField) > 0", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(counterDoubleField)", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(counterDoubleField) > 0", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(integerField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(integerField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(integerField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(integerField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(counterIntegerField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(counterIntegerField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(counterIntegerField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(counterIntegerField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(doubleField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(doubleField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(doubleField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(doubleField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(unsignedLongField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(unsignedLongField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(unsignedLongField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(unsignedLongField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(longField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(longField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(longField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(longField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(counterLongField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(counterLongField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(counterLongField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(counterLongField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(counterDoubleField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(counterDoubleField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(counterDoubleField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(counterDoubleField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats median_absolute_deviation(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = max(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(max(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(max(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(max(doubleField)) + max(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(max(doubleField)) + max(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = max(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), max(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = max(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = max(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), max(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = max(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(doubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = max(doubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), max(doubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = max(doubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), max(doubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = max(doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = max(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats max(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats max(cartesianPointField)", + "error": [ + "Argument of [max] must be [double], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = max(*)", + "error": [ + "Using wildcards (*) in max is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = max(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(max(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(max(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(max(longField)) + max(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(max(longField)) + max(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = max(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), max(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = max(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(longField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = max(longField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), max(longField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = max(longField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), max(longField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = max(longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = max(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(max(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(max(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(max(integerField)) + max(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(max(integerField)) + max(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = max(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), max(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = max(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(integerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = max(integerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), max(integerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = max(integerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), max(integerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = max(integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = max(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = max(datePeriodField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(datePeriodField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = max(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = max(ipField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(ipField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort max(doubleField)", + "error": [ + "SORT does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(doubleField)", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(doubleField) > 0", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(longField)", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(longField) > 0", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(integerField)", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(integerField) > 0", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(dateField)", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(dateField) > 0", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(datePeriodField)", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(datePeriodField) > 0", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(booleanField)", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(booleanField) > 0", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(ipField)", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(ipField) > 0", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(doubleField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(doubleField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(doubleField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(doubleField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(longField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(longField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(longField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(longField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(integerField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(integerField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(integerField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(integerField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(dateField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(dateField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(dateField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(dateField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(datePeriodField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(datePeriodField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(datePeriodField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(datePeriodField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(booleanField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(booleanField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(booleanField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(booleanField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(ipField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(ipField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(ipField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(ipField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | stats max(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats max(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(\"2022\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(concat(\"20\", \"22\"))", + "error": [ + "Argument of [max] must be [double], found value [concat(\"20\",\"22\")] type [keyword]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = min(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(min(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(min(doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(min(doubleField)) + min(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(min(doubleField)) + min(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = min(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), min(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = min(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = min(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), min(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = min(doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(doubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = min(doubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), min(doubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = min(doubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), min(doubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = min(doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = min(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats min(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats min(cartesianPointField)", + "error": [ + "Argument of [min] must be [double], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = min(*)", + "error": [ + "Using wildcards (*) in min is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = min(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(min(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(min(longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(min(longField)) + min(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(min(longField)) + min(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = min(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), min(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = min(longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(longField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = min(longField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), min(longField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = min(longField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), min(longField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = min(longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = min(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(min(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(min(integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(min(integerField)) + min(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(min(integerField)) + min(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = min(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), min(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = min(integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(integerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = min(integerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), min(integerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = min(integerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), min(integerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = min(integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = min(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = min(datePeriodField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(datePeriodField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = min(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = min(ipField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(ipField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort min(doubleField)", + "error": [ + "SORT does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(doubleField)", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(doubleField) > 0", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(longField)", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(longField) > 0", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(integerField)", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(integerField) > 0", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(dateField)", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(dateField) > 0", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(datePeriodField)", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(datePeriodField) > 0", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(booleanField)", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(booleanField) > 0", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(ipField)", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(ipField) > 0", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(doubleField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(doubleField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(doubleField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(doubleField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(longField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(longField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(longField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(longField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(integerField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(integerField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(integerField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(integerField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(dateField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(dateField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(dateField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(dateField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(datePeriodField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(datePeriodField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(datePeriodField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(datePeriodField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(booleanField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(booleanField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(booleanField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(booleanField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(ipField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(ipField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(ipField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(ipField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | stats min(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats min(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(\"2022\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(concat(\"20\", \"22\"))", + "error": [ + "Argument of [min] must be [double], found value [concat(\"20\",\"22\")] type [keyword]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = count(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats count(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(count(textField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(count(textField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(count(textField)) + count(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(count(textField)) + count(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort count(textField)", + "error": [ + "SORT does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | where count(textField)", + "error": [ + "WHERE does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | where count(textField) > 0", + "error": [ + "WHERE does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = count(textField)", + "error": [ + "EVAL does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = count(textField) > 0", + "error": [ + "EVAL does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | eval count(textField)", + "error": [ + "EVAL does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | eval count(textField) > 0", + "error": [ + "EVAL does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | stats count(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats count(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats count_distinct(null, null, null, null, null, null, null, null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats count_distinct(nullVar, nullVar, nullVar, nullVar, nullVar, nullVar, nullVar, nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = st_centroid_agg(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats st_centroid_agg(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = st_centroid_agg(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats st_centroid_agg(avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats st_centroid_agg(booleanField)", + "error": [ + "Argument of [st_centroid_agg] must be [cartesian_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = st_centroid_agg(*)", + "error": [ + "Using wildcards (*) in st_centroid_agg is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = st_centroid_agg(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats st_centroid_agg(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort st_centroid_agg(cartesianPointField)", + "error": [ + "SORT does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | where st_centroid_agg(cartesianPointField)", + "error": [ + "WHERE does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | where st_centroid_agg(cartesianPointField) > 0", + "error": [ + "WHERE does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | where st_centroid_agg(geoPointField)", + "error": [ + "WHERE does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | where st_centroid_agg(geoPointField) > 0", + "error": [ + "WHERE does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_centroid_agg(cartesianPointField)", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_centroid_agg(cartesianPointField) > 0", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_centroid_agg(cartesianPointField)", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_centroid_agg(cartesianPointField) > 0", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_centroid_agg(geoPointField)", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_centroid_agg(geoPointField) > 0", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_centroid_agg(geoPointField)", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_centroid_agg(geoPointField) > 0", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | stats st_centroid_agg(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats st_centroid_agg(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = values(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats values(textField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort values(textField)", + "error": [ + "SORT does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | where values(textField)", + "error": [ + "WHERE does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | where values(textField) > 0", + "error": [ + "WHERE does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = values(textField)", + "error": [ + "EVAL does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = values(textField) > 0", + "error": [ + "EVAL does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | eval values(textField)", + "error": [ + "EVAL does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | eval values(textField) > 0", + "error": [ + "EVAL does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | stats values(null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats values(nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = top(textField, integerField, textField)", + "error": [ + "Argument of [=] must be a constant, received [top(textField,integerField,textField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats top(textField, integerField, textField)", + "error": [ + "Argument of [top] must be a constant, received [integerField]", + "Argument of [top] must be a constant, received [textField]" + ], + "warning": [] + }, + { + "query": "from a_index | sort top(textField, integerField, textField)", + "error": [ + "SORT does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | where top(textField, integerField, textField)", + "error": [ + "WHERE does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | where top(textField, integerField, textField) > 0", + "error": [ + "WHERE does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = top(textField, integerField, textField)", + "error": [ + "EVAL does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = top(textField, integerField, textField) > 0", + "error": [ + "EVAL does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | eval top(textField, integerField, textField)", + "error": [ + "EVAL does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | eval top(textField, integerField, textField) > 0", + "error": [ + "EVAL does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | stats top(null, null, null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats top(nullVar, nullVar, nullVar)", + "error": [ + "Argument of [top] must be a constant, received [nullVar]", + "Argument of [top] must be a constant, received [nullVar]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = top(textField, integerField, \"asc\")", + "error": [ + "Argument of [=] must be a constant, received [top(textField,integerField,\"asc\")]" + ], + "warning": [] + }, + { + "query": "from a_index | stats top(textField, integerField, \"asc\")", + "error": [ + "Argument of [top] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | sort top(textField, integerField, \"asc\")", + "error": [ + "SORT does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | where top(textField, integerField, \"asc\")", + "error": [ + "WHERE does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | where top(textField, integerField, \"asc\") > 0", + "error": [ + "WHERE does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = top(textField, integerField, \"asc\")", + "error": [ + "EVAL does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = top(textField, integerField, \"asc\") > 0", + "error": [ + "EVAL does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | eval top(textField, integerField, \"asc\")", + "error": [ + "EVAL does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | eval top(textField, integerField, \"asc\") > 0", + "error": [ + "EVAL does not support function top" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = weighted_avg(doubleField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(doubleField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(doubleField, doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(doubleField, doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(doubleField, doubleField)) + weighted_avg(doubleField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(doubleField, doubleField)) + weighted_avg(doubleField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(doubleField / 2, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(doubleField / 2, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField / 2, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField / 2, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(doubleField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(doubleField, doubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(doubleField, doubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, doubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, doubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, doubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = weighted_avg(avg(integerField), avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(avg(integerField), avg(integerField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(booleanField, booleanField)", + "error": [ + "Argument of [weighted_avg] must be [double], found value [booleanField] type [boolean]", + "Argument of [weighted_avg] must be [double], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | sort weighted_avg(doubleField, doubleField)", + "error": [ + "SORT does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(doubleField, doubleField)", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(doubleField, doubleField) > 0", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(doubleField, doubleField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(doubleField, doubleField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(doubleField, doubleField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(doubleField, doubleField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(null, null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats weighted_avg(nullVar, nullVar)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = weighted_avg(doubleField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(doubleField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(doubleField, longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(doubleField, longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(doubleField, longField)) + weighted_avg(doubleField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(doubleField, longField)) + weighted_avg(doubleField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(doubleField / 2, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(doubleField / 2, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField / 2, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField / 2, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(doubleField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(doubleField, longField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(doubleField, longField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, longField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, longField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, longField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = weighted_avg(doubleField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(doubleField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(doubleField, integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(doubleField, integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(doubleField, integerField)) + weighted_avg(doubleField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(doubleField, integerField)) + weighted_avg(doubleField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(doubleField / 2, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(doubleField / 2, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField / 2, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField / 2, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(doubleField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(doubleField, integerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(doubleField, integerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, integerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, integerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(doubleField, integerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = weighted_avg(longField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(longField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(longField, doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(longField, doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(longField, doubleField)) + weighted_avg(longField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(longField, doubleField)) + weighted_avg(longField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(longField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(longField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(longField, doubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(longField, doubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(longField, doubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, doubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(longField, doubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = weighted_avg(longField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(longField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(longField, longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(longField, longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(longField, longField)) + weighted_avg(longField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(longField, longField)) + weighted_avg(longField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(longField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(longField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(longField, longField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(longField, longField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(longField, longField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, longField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(longField, longField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = weighted_avg(longField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(longField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(longField, integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(longField, integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(longField, integerField)) + weighted_avg(longField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(longField, integerField)) + weighted_avg(longField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(longField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(longField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(longField, integerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(longField, integerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(longField, integerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, integerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(longField, integerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(longField, integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = weighted_avg(integerField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(integerField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(integerField, doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(integerField, doubleField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(integerField, doubleField)) + weighted_avg(integerField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(integerField, doubleField)) + weighted_avg(integerField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(integerField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, doubleField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(integerField, doubleField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(integerField, doubleField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, doubleField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, doubleField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, doubleField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = weighted_avg(integerField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(integerField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(integerField, longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(integerField, longField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(integerField, longField)) + weighted_avg(integerField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(integerField, longField)) + weighted_avg(integerField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(integerField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, longField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(integerField, longField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(integerField, longField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, longField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, longField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, longField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = weighted_avg(integerField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(integerField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(integerField, integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(integerField, integerField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(weighted_avg(integerField, integerField)) + weighted_avg(integerField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(weighted_avg(integerField, integerField)) + weighted_avg(integerField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(integerField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, integerField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats weighted_avg(integerField, integerField) by round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = weighted_avg(integerField, integerField) by var1 = round(doubleField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, integerField) by round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, integerField) by var1 = round(doubleField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), weighted_avg(integerField, integerField) by round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(doubleField, longField)", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(doubleField, longField) > 0", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(doubleField, integerField)", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(doubleField, integerField) > 0", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(longField, doubleField)", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(longField, doubleField) > 0", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(longField, longField)", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(longField, longField) > 0", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(longField, integerField)", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(longField, integerField) > 0", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(integerField, doubleField)", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(integerField, doubleField) > 0", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(integerField, longField)", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(integerField, longField) > 0", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(integerField, integerField)", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | where weighted_avg(integerField, integerField) > 0", + "error": [ + "WHERE does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(doubleField, longField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(doubleField, longField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(doubleField, longField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(doubleField, longField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(doubleField, integerField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(doubleField, integerField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(doubleField, integerField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(doubleField, integerField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(longField, doubleField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(longField, doubleField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(longField, doubleField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(longField, doubleField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(longField, longField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(longField, longField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(longField, longField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(longField, longField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(longField, integerField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(longField, integerField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(longField, integerField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(longField, integerField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(integerField, doubleField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(integerField, doubleField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(integerField, doubleField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(integerField, doubleField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(integerField, longField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(integerField, longField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(integerField, longField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(integerField, longField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(integerField, integerField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = weighted_avg(integerField, integerField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(integerField, integerField)", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval weighted_avg(integerField, integerField) > 0", + "error": [ + "EVAL does not support function weighted_avg" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(dateField, 1 year)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats by bin(dateField, 1 year)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(integerField, integerField)", + "error": [ + "Argument of [bucket] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bin(integerField, integerField)", + "error": [ + "Argument of [bin] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(dateField, integerField, textField, textField)", + "error": [ + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [textField]", + "Argument of [bucket] must be a constant, received [textField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bin(dateField, integerField, textField, textField)", + "error": [ + "Argument of [bin] must be a constant, received [integerField]", + "Argument of [bin] must be a constant, received [textField]", + "Argument of [bin] must be a constant, received [textField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(dateField, integerField, dateField, dateField)", + "error": [ + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [dateField]", + "Argument of [bucket] must be a constant, received [dateField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bin(dateField, integerField, dateField, dateField)", + "error": [ + "Argument of [bin] must be a constant, received [integerField]", + "Argument of [bin] must be a constant, received [dateField]", + "Argument of [bin] must be a constant, received [dateField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(dateField, integerField, textField, dateField)", + "error": [ + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [textField]", + "Argument of [bucket] must be a constant, received [dateField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bin(dateField, integerField, textField, dateField)", + "error": [ + "Argument of [bin] must be a constant, received [integerField]", + "Argument of [bin] must be a constant, received [textField]", + "Argument of [bin] must be a constant, received [dateField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(dateField, integerField, dateField, textField)", + "error": [ + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [dateField]", + "Argument of [bucket] must be a constant, received [textField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bin(dateField, integerField, dateField, textField)", + "error": [ + "Argument of [bin] must be a constant, received [integerField]", + "Argument of [bin] must be a constant, received [dateField]", + "Argument of [bin] must be a constant, received [textField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(integerField, integerField, integerField, integerField)", + "error": [ + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bin(integerField, integerField, integerField, integerField)", + "error": [ + "Argument of [bin] must be a constant, received [integerField]", + "Argument of [bin] must be a constant, received [integerField]", + "Argument of [bin] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | sort bucket(dateField, 1 year)", + "error": [ + "SORT does not support function bucket" + ], + "warning": [] + }, + { + "query": "from a_index | stats bucket(null, null, null, null)", + "error": [], + "warning": [] + }, + { + "query": "row nullVar = null | stats bucket(nullVar, nullVar, nullVar, nullVar)", + "error": [ + "Argument of [bucket] must be a constant, received [nullVar]", + "Argument of [bucket] must be a constant, received [nullVar]", + "Argument of [bucket] must be a constant, received [nullVar]" + ], + "warning": [] + }, + { + "query": "from a_index | stats bucket(\"2022\", 1 year)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats bucket(concat(\"20\", \"22\"), 1 year)", + "error": [ + "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" + ], + "warning": [] + }, + { + "query": "from a_index | stats bucket(\"2022\", integerField, textField, textField)", + "error": [ + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [textField]", + "Argument of [bucket] must be a constant, received [textField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats bucket(concat(\"20\", \"22\"), integerField, textField, textField)", + "error": [ + "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [textField]", + "Argument of [bucket] must be a constant, received [textField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats bucket(\"2022\", integerField, \"2022\", \"2022\")", + "error": [ + "Argument of [bucket] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats bucket(concat(\"20\", \"22\"), integerField, concat(\"20\", \"22\"), concat(\"20\", \"22\"))", + "error": [ + "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", + "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" + ], + "warning": [] + }, + { + "query": "from a_index | stats bucket(\"2022\", integerField, textField, \"2022\")", + "error": [ + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [textField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats bucket(concat(\"20\", \"22\"), integerField, textField, concat(\"20\", \"22\"))", + "error": [ + "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [textField]", + "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]" + ], + "warning": [] + }, + { + "query": "from a_index | stats bucket(\"2022\", integerField, \"2022\", textField)", + "error": [ + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be a constant, received [textField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats bucket(concat(\"20\", \"22\"), integerField, concat(\"20\", \"22\"), textField)", + "error": [ + "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", + "Argument of [bucket] must be a constant, received [integerField]", + "Argument of [bucket] must be [date], found value [concat(\"20\",\"22\")] type [keyword]", + "Argument of [bucket] must be a constant, received [textField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(doubleField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(doubleField, doubleField)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(doubleField, doubleField))", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(doubleField,doubleField))]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(doubleField, doubleField))", + "error": [ + "Argument of [round] must be a constant, received [percentile(doubleField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(doubleField, doubleField)) + percentile(doubleField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(doubleField,doubleField))+percentile(doubleField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(doubleField, doubleField)) + percentile(doubleField, doubleField)", + "error": [ + "Argument of [+] must be a constant, received [round(percentile(doubleField,doubleField))]", + "Argument of [+] must be a constant, received [percentile(doubleField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(doubleField / 2, doubleField)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(doubleField / 2, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField/2,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField / 2, doubleField)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField / 2, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField/2,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(doubleField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField, doubleField)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(doubleField, doubleField) by round(doubleField / 2)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(doubleField, doubleField) by var1 = round(doubleField / 2)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField, doubleField) by round(doubleField / 2), ipField", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, doubleField) by var1 = round(doubleField / 2), ipField", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField, doubleField) by round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(avg(integerField), avg(integerField))", + "error": [ + "Argument of [=] must be a constant, received [percentile(avg(integerField),avg(integerField))]", + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(avg(integerField), avg(integerField))", + "error": [ + "Argument of [percentile] must be a constant, received [avg(integerField)]", + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(booleanField, )", + "error": [ + "SyntaxError: no viable alternative at input 'percentile(booleanField, )'", + "SyntaxError: mismatched input ')' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", + "At least one aggregation or grouping expression required in [STATS]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(doubleField, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(doubleField, longField)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(doubleField, longField))", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(doubleField,longField))]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(doubleField, longField))", + "error": [ + "Argument of [round] must be a constant, received [percentile(doubleField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(doubleField, longField)) + percentile(doubleField, longField)", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(doubleField,longField))+percentile(doubleField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(doubleField, longField)) + percentile(doubleField, longField)", + "error": [ + "Argument of [+] must be a constant, received [round(percentile(doubleField,longField))]", + "Argument of [+] must be a constant, received [percentile(doubleField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(doubleField / 2, longField)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(doubleField / 2, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField/2,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField / 2, longField)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField / 2, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField/2,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(doubleField, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField, longField)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(doubleField, longField) by round(doubleField / 2)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(doubleField, longField) by var1 = round(doubleField / 2)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField, longField) by round(doubleField / 2), ipField", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, longField) by var1 = round(doubleField / 2), ipField", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField, longField) by round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(doubleField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(doubleField, integerField)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(doubleField, integerField))", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(doubleField,integerField))]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(doubleField, integerField))", + "error": [ + "Argument of [round] must be a constant, received [percentile(doubleField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(doubleField, integerField)) + percentile(doubleField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(doubleField,integerField))+percentile(doubleField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(doubleField, integerField)) + percentile(doubleField, integerField)", + "error": [ + "Argument of [+] must be a constant, received [round(percentile(doubleField,integerField))]", + "Argument of [+] must be a constant, received [percentile(doubleField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(doubleField / 2, integerField)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(doubleField / 2, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField/2,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField / 2, integerField)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField / 2, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField/2,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(doubleField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField, integerField)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(doubleField, integerField) by round(doubleField / 2)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(doubleField, integerField) by var1 = round(doubleField / 2)", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField, integerField) by round(doubleField / 2), ipField", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, integerField) by var1 = round(doubleField / 2), ipField", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(doubleField, integerField) by round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(doubleField, integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [=] must be a constant, received [percentile(doubleField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(longField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(longField, doubleField)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(longField, doubleField))", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(longField,doubleField))]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(longField, doubleField))", + "error": [ + "Argument of [round] must be a constant, received [percentile(longField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(longField, doubleField)) + percentile(longField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(longField,doubleField))+percentile(longField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(longField, doubleField)) + percentile(longField, doubleField)", + "error": [ + "Argument of [+] must be a constant, received [round(percentile(longField,doubleField))]", + "Argument of [+] must be a constant, received [percentile(longField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(longField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(longField, doubleField)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(longField, doubleField) by round(doubleField / 2)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(longField, doubleField) by var1 = round(doubleField / 2)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(longField, doubleField) by round(doubleField / 2), ipField", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, doubleField) by var1 = round(doubleField / 2), ipField", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(longField, doubleField) by round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(longField, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(longField, longField)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(longField, longField))", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(longField,longField))]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(longField, longField))", + "error": [ + "Argument of [round] must be a constant, received [percentile(longField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(longField, longField)) + percentile(longField, longField)", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(longField,longField))+percentile(longField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(longField, longField)) + percentile(longField, longField)", + "error": [ + "Argument of [+] must be a constant, received [round(percentile(longField,longField))]", + "Argument of [+] must be a constant, received [percentile(longField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(longField, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(longField, longField)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(longField, longField) by round(doubleField / 2)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(longField, longField) by var1 = round(doubleField / 2)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(longField, longField) by round(doubleField / 2), ipField", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, longField) by var1 = round(doubleField / 2), ipField", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(longField, longField) by round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(longField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(longField, integerField)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(longField, integerField))", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(longField,integerField))]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(longField, integerField))", + "error": [ + "Argument of [round] must be a constant, received [percentile(longField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(longField, integerField)) + percentile(longField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(longField,integerField))+percentile(longField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(longField, integerField)) + percentile(longField, integerField)", + "error": [ + "Argument of [+] must be a constant, received [round(percentile(longField,integerField))]", + "Argument of [+] must be a constant, received [percentile(longField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(longField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(longField, integerField)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(longField, integerField) by round(doubleField / 2)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(longField, integerField) by var1 = round(doubleField / 2)", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(longField, integerField) by round(doubleField / 2), ipField", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, integerField) by var1 = round(doubleField / 2), ipField", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(longField, integerField) by round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(longField, integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [=] must be a constant, received [percentile(longField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(integerField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(integerField, doubleField)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(integerField, doubleField))", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(integerField,doubleField))]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(integerField, doubleField))", + "error": [ + "Argument of [round] must be a constant, received [percentile(integerField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(integerField, doubleField)) + percentile(integerField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(integerField,doubleField))+percentile(integerField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(integerField, doubleField)) + percentile(integerField, doubleField)", + "error": [ + "Argument of [+] must be a constant, received [round(percentile(integerField,doubleField))]", + "Argument of [+] must be a constant, received [percentile(integerField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(integerField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(integerField, doubleField)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, doubleField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(integerField, doubleField) by round(doubleField / 2)", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(integerField, doubleField) by var1 = round(doubleField / 2)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(integerField, doubleField) by round(doubleField / 2), ipField", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, doubleField) by var1 = round(doubleField / 2), ipField", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(integerField, doubleField) by round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [percentile] must be a constant, received [doubleField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, doubleField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,doubleField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(integerField, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(integerField, longField)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(integerField, longField))", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(integerField,longField))]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(integerField, longField))", + "error": [ + "Argument of [round] must be a constant, received [percentile(integerField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(integerField, longField)) + percentile(integerField, longField)", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(integerField,longField))+percentile(integerField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(integerField, longField)) + percentile(integerField, longField)", + "error": [ + "Argument of [+] must be a constant, received [round(percentile(integerField,longField))]", + "Argument of [+] must be a constant, received [percentile(integerField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(integerField, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(integerField, longField)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, longField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(integerField, longField) by round(doubleField / 2)", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(integerField, longField) by var1 = round(doubleField / 2)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(integerField, longField) by round(doubleField / 2), ipField", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, longField) by var1 = round(doubleField / 2), ipField", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(integerField, longField) by round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [percentile] must be a constant, received [longField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, longField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,longField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(integerField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(integerField, integerField)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(integerField, integerField))", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(integerField,integerField))]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(integerField, integerField))", + "error": [ + "Argument of [round] must be a constant, received [percentile(integerField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(integerField, integerField)) + percentile(integerField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [round(percentile(integerField,integerField))+percentile(integerField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(integerField, integerField)) + percentile(integerField, integerField)", + "error": [ + "Argument of [+] must be a constant, received [round(percentile(integerField,integerField))]", + "Argument of [+] must be a constant, received [percentile(integerField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(integerField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(integerField, integerField)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, integerField)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(integerField, integerField) by round(doubleField / 2)", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(integerField, integerField) by var1 = round(doubleField / 2)", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(integerField, integerField) by round(doubleField / 2), ipField", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, integerField) by var1 = round(doubleField / 2), ipField", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), percentile(integerField, integerField) by round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [percentile] must be a constant, received [integerField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(doubleField), var0 = percentile(integerField, integerField) by var1 = round(doubleField / 2), doubleField / 2", + "error": [ + "Argument of [=] must be a constant, received [percentile(integerField,integerField)]" + ], + "warning": [] + }, + { + "query": "from a_index | sort percentile(doubleField, doubleField)", + "error": [ + "SORT does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(doubleField, doubleField)", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(doubleField, doubleField) > 0", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(doubleField, longField)", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(doubleField, longField) > 0", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(doubleField, integerField)", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(doubleField, integerField) > 0", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(longField, doubleField)", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(longField, doubleField) > 0", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(longField, longField)", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(longField, longField) > 0", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(longField, integerField)", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(longField, integerField) > 0", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(integerField, doubleField)", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(integerField, doubleField) > 0", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(integerField, longField)", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(integerField, longField) > 0", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(integerField, integerField)", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(integerField, integerField) > 0", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(doubleField, doubleField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(doubleField, doubleField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(doubleField, doubleField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(doubleField, doubleField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(doubleField, longField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(doubleField, longField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(doubleField, longField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(doubleField, longField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(doubleField, integerField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(doubleField, integerField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(doubleField, integerField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(doubleField, integerField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(longField, doubleField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(longField, doubleField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(longField, doubleField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(longField, doubleField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(longField, longField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(longField, longField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(longField, longField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(longField, longField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(longField, integerField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(longField, integerField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(longField, integerField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(longField, integerField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(integerField, doubleField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(integerField, doubleField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(integerField, doubleField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(integerField, doubleField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(integerField, longField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(integerField, longField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(integerField, longField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(integerField, longField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(integerField, integerField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(integerField, integerField) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(integerField, integerField)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(integerField, integerField) > 0", + "error": [ + "EVAL does not support function percentile" ], "warning": [] }, { - "query": "from a_index | sort mv_append(booleanField, booleanField)", + "query": "from a_index | stats percentile(null, null)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_append(null, null)", - "error": [], + "query": "row nullVar = null | stats percentile(nullVar, nullVar)", + "error": [ + "Argument of [percentile] must be a constant, received [nullVar]" + ], "warning": [] }, { - "query": "row nullVar = null | eval mv_append(nullVar, nullVar)", + "query": "row var = to_string(true)", "error": [], "warning": [] }, { - "query": "row var = repeat(\"a\", 5)", + "query": "row to_string(true)", "error": [], "warning": [] }, { - "query": "row repeat(\"a\", 5)", + "query": "row var = to_str(true)", "error": [], "warning": [] }, { - "query": "row var = repeat(to_string(true), to_integer(true))", + "query": "row var = to_string(to_boolean(true))", "error": [], "warning": [] }, { - "query": "row var = repeat(true, true)", + "query": "row var = to_string(cartesianPointField)", "error": [ - "Argument of [repeat] must be [string], found value [true] type [boolean]", - "Argument of [repeat] must be [number], found value [true] type [boolean]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | where length(repeat(stringField, numberField)) > 0", - "error": [], + "query": "row to_string(cartesianPointField)", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | where length(repeat(booleanField, booleanField)) > 0", + "query": "row var = to_str(cartesianPointField)", "error": [ - "Argument of [repeat] must be [string], found value [booleanField] type [boolean]", - "Argument of [repeat] must be [number], found value [booleanField] type [boolean]" + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | eval var = repeat(stringField, numberField)", - "error": [], + "query": "row var = to_string(to_cartesianpoint(cartesianPointField))", + "error": [ + "Unknown column [cartesianPointField]" + ], "warning": [] }, { - "query": "from a_index | eval repeat(stringField, numberField)", + "query": "row var = to_string(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = repeat(to_string(booleanField), to_integer(booleanField))", + "query": "row to_string(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval repeat(booleanField, booleanField)", - "error": [ - "Argument of [repeat] must be [string], found value [booleanField] type [boolean]", - "Argument of [repeat] must be [number], found value [booleanField] type [boolean]" - ], + "query": "row var = to_str(to_cartesianshape(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval repeat(stringField, numberField, extraArg)", + "query": "row var = to_string(to_cartesianshape(cartesianPointField))", "error": [ - "Error: [repeat] function expects exactly 2 arguments, got 3." + "Unknown column [cartesianPointField]" ], "warning": [] }, { - "query": "from a_index | sort repeat(stringField, numberField)", + "query": "row var = to_string(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval repeat(null, null)", + "query": "row to_string(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval repeat(nullVar, nullVar)", + "query": "row var = to_str(to_datetime(\"2021-01-01T00:00:00Z\"))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = top(stringField, 3, \"asc\")", + "query": "row var = to_string(to_datetime(to_datetime(\"2021-01-01T00:00:00Z\")))", "error": [], "warning": [] }, { - "query": "from a_index | stats top(stringField, 1, \"desc\")", + "query": "row var = to_string(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = top(stringField, 5, \"asc\")", + "query": "row to_string(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | stats top(stringField, 5, \"asc\")", + "query": "row var = to_str(5.5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = top(stringField, 3)", - "error": [ - "Error: [top] function expects exactly 3 arguments, got 2." - ], + "query": "row var = to_string(to_double(true))", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = top(stringField)", + "query": "row var = to_string(geoPointField)", "error": [ - "Error: [top] function expects exactly 3 arguments, got 1." + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | stats var = top(stringField, numberField, \"asc\")", + "query": "row to_string(geoPointField)", "error": [ - "Argument of [=] must be a constant, received [top(stringField,numberField,\"asc\")]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | stats var = top(stringField, 100 + numberField, \"asc\")", + "query": "row var = to_str(geoPointField)", "error": [ - "Argument of [=] must be a constant, received [top(stringField,100+numberField,\"asc\")]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | stats var = top(stringField, 1, stringField)", + "query": "row var = to_string(to_geopoint(geoPointField))", "error": [ - "Argument of [=] must be a constant, received [top(stringField,1,stringField)]" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | stats var = top(stringField, 1, \"asdf\")", + "query": "row var = to_string(to_geoshape(\"POINT (30 10)\"))", "error": [], - "warning": [ - "Invalid option [\"asdf\"] for top. Supported options: [\"asc\", \"desc\"]." - ] - }, - { - "query": "from a_index | sort top(stringField, numberField, \"asc\")", - "error": [ - "SORT does not support function top" - ], - "warning": [] - }, - { - "query": "from a_index | where top(stringField, numberField, \"asc\")", - "error": [ - "WHERE does not support function top" - ], "warning": [] }, { - "query": "from a_index | where top(stringField, numberField, \"asc\") > 0", - "error": [ - "WHERE does not support function top" - ], + "query": "row to_string(to_geoshape(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = top(stringField, numberField, \"asc\")", - "error": [ - "EVAL does not support function top" - ], + "query": "row var = to_str(to_geoshape(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = top(stringField, numberField, \"asc\") > 0", + "query": "row var = to_string(to_geoshape(geoPointField))", "error": [ - "EVAL does not support function top" + "Unknown column [geoPointField]" ], "warning": [] }, { - "query": "from a_index | eval top(stringField, numberField, \"asc\")", - "error": [ - "EVAL does not support function top" - ], + "query": "row var = to_string(5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval top(stringField, numberField, \"asc\") > 0", - "error": [ - "EVAL does not support function top" - ], + "query": "row to_string(5)", + "error": [], "warning": [] }, { - "query": "from a_index | sort top(stringField, 5, \"asc\")", - "error": [ - "SORT does not support function top" - ], + "query": "row var = to_str(5)", + "error": [], "warning": [] }, { - "query": "from a_index | where top(stringField, 5, \"asc\")", - "error": [ - "WHERE does not support function top" - ], + "query": "row var = to_string(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | where top(stringField, 5, \"asc\") > 0", - "error": [ - "WHERE does not support function top" - ], + "query": "row var = to_string(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = top(stringField, 5, \"asc\")", - "error": [ - "EVAL does not support function top" - ], + "query": "row to_string(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = top(stringField, 5, \"asc\") > 0", - "error": [ - "EVAL does not support function top" - ], + "query": "row var = to_str(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval top(stringField, 5, \"asc\")", - "error": [ - "EVAL does not support function top" - ], + "query": "row var = to_string(to_ip(to_ip(\"127.0.0.1\")))", + "error": [], "warning": [] }, { - "query": "from a_index | eval top(stringField, 5, \"asc\") > 0", - "error": [ - "EVAL does not support function top" - ], + "query": "row var = to_string(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = top(stringField, 5, \"asc\")", + "query": "row to_string(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats top(stringField, 5, \"asc\")", + "query": "row var = to_str(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats top(stringField, numberField, \"asc\")", - "error": [ - "Argument of [top] must be a constant, received [numberField]" - ], + "query": "row var = to_string(to_string(true))", + "error": [], "warning": [] }, { - "query": "from a_index | stats top(null, null, null)", + "query": "row var = to_string(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats top(nullVar, nullVar, nullVar)", - "error": [ - "Argument of [top] must be a constant, received [nullVar]", - "Argument of [top] must be a constant, received [nullVar]" - ], + "query": "row to_string(to_version(\"1.0.0\"))", + "error": [], "warning": [] }, { - "query": "row var = st_distance(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row var = to_str(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row st_distance(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row var = to_string(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = st_distance(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = to_string(booleanField)", "error": [], "warning": [] }, { - "query": "row var = st_distance(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval to_string(booleanField)", "error": [], "warning": [] }, { - "query": "row st_distance(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = to_str(booleanField)", "error": [], "warning": [] }, { - "query": "row var = st_distance(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "query": "from a_index | eval var = to_string(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_distance(true, true)", + "query": "from a_index | eval to_string(counterDoubleField)", "error": [ - "Argument of [st_distance] must be [cartesian_point], found value [true] type [boolean]", - "Argument of [st_distance] must be [cartesian_point], found value [true] type [boolean]" + "Argument of [to_string] must be [boolean], found value [counterDoubleField] type [counter_double]" ], "warning": [] }, { - "query": "from a_index | eval var = st_distance(cartesianPointField, cartesianPointField)", - "error": [], + "query": "from a_index | eval var = to_string(*)", + "error": [ + "Using wildcards (*) in to_string is not allowed" + ], "warning": [] }, { - "query": "from a_index | eval st_distance(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval var = to_string(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_distance(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "query": "from a_index | eval to_string(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_distance(booleanField, booleanField)", - "error": [ - "Argument of [st_distance] must be [cartesian_point], found value [booleanField] type [boolean]", - "Argument of [st_distance] must be [cartesian_point], found value [booleanField] type [boolean]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_distance(geoPointField, geoPointField)", + "query": "from a_index | eval var = to_str(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_distance(geoPointField, geoPointField)", + "query": "from a_index | eval var = to_string(to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_distance(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "query": "from a_index | eval var = to_string(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_distance(cartesianPointField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_distance] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | eval to_string(cartesianShapeField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort st_distance(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval var = to_str(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_distance(null, null)", + "query": "from a_index | eval var = to_string(to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval st_distance(nullVar, nullVar)", + "query": "from a_index | eval var = to_string(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = weighted_avg(numberField, numberField)", + "query": "from a_index | eval to_string(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | stats weighted_avg(numberField, numberField)", + "query": "from a_index | eval var = to_str(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(weighted_avg(numberField, numberField))", + "query": "from a_index | eval var = to_string(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(weighted_avg(numberField, numberField))", + "query": "from a_index | eval var = to_string(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(weighted_avg(numberField, numberField)) + weighted_avg(numberField, numberField)", + "query": "from a_index | eval to_string(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(weighted_avg(numberField, numberField)) + weighted_avg(numberField, numberField)", + "query": "from a_index | eval var = to_str(doubleField)", "error": [], "warning": [] }, { - "query": "from a_index | stats weighted_avg(numberField / 2, numberField)", + "query": "from a_index | eval var = to_string(to_double(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = weighted_avg(numberField / 2, numberField)", + "query": "from a_index | eval var = to_string(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), weighted_avg(numberField / 2, numberField)", + "query": "from a_index | eval to_string(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = weighted_avg(numberField / 2, numberField)", + "query": "from a_index | eval var = to_str(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = weighted_avg(numberField, numberField)", + "query": "from a_index | eval var = to_string(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), weighted_avg(numberField, numberField)", + "query": "from a_index | eval var = to_string(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = weighted_avg(numberField, numberField)", + "query": "from a_index | eval to_string(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats weighted_avg(numberField, numberField) by round(numberField / 2)", + "query": "from a_index | eval var = to_str(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = weighted_avg(numberField, numberField) by var1 = round(numberField / 2)", + "query": "from a_index | eval var = to_string(to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), weighted_avg(numberField, numberField) by round(numberField / 2), ipField", + "query": "from a_index | eval var = to_string(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = weighted_avg(numberField, numberField) by var1 = round(numberField / 2), ipField", + "query": "from a_index | eval to_string(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), weighted_avg(numberField, numberField) by round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = to_str(integerField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = weighted_avg(numberField, numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = to_string(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = weighted_avg(avg(numberField), avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | eval var = to_string(ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats weighted_avg(avg(numberField), avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | eval to_string(ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats weighted_avg(booleanField, booleanField)", - "error": [ - "Argument of [weighted_avg] must be [number], found value [booleanField] type [boolean]", - "Argument of [weighted_avg] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = to_str(ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort weighted_avg(numberField, numberField)", - "error": [ - "SORT does not support function weighted_avg" - ], + "query": "from a_index | eval var = to_string(to_ip(ipField))", + "error": [], "warning": [] }, { - "query": "from a_index | where weighted_avg(numberField, numberField)", - "error": [ - "WHERE does not support function weighted_avg" - ], + "query": "from a_index | eval var = to_string(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | where weighted_avg(numberField, numberField) > 0", - "error": [ - "WHERE does not support function weighted_avg" - ], + "query": "from a_index | eval to_string(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = weighted_avg(numberField, numberField)", - "error": [ - "EVAL does not support function weighted_avg" - ], + "query": "from a_index | eval var = to_str(keywordField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = weighted_avg(numberField, numberField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], + "query": "from a_index | eval var = to_string(to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval weighted_avg(numberField, numberField)", - "error": [ - "EVAL does not support function weighted_avg" - ], + "query": "from a_index | eval var = to_string(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval weighted_avg(numberField, numberField) > 0", - "error": [ - "EVAL does not support function weighted_avg" - ], + "query": "from a_index | eval to_string(longField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats weighted_avg(null, null)", + "query": "from a_index | eval var = to_str(longField)", "error": [], "warning": [] }, { - "query": "row nullVar = null | stats weighted_avg(nullVar, nullVar)", + "query": "from a_index | eval var = to_string(textField)", "error": [], "warning": [] }, { - "query": "row var = exp(5)", + "query": "from a_index | eval to_string(textField)", "error": [], "warning": [] }, { - "query": "row exp(5)", + "query": "from a_index | eval var = to_str(textField)", "error": [], "warning": [] }, { - "query": "row var = exp(to_integer(true))", + "query": "from a_index | eval var = to_string(unsignedLongField)", "error": [], "warning": [] }, { - "query": "row var = exp(true)", - "error": [ - "Argument of [exp] must be [number], found value [true] type [boolean]" - ], + "query": "from a_index | eval to_string(unsignedLongField)", + "error": [], "warning": [] }, { - "query": "from a_index | where exp(numberField) > 0", + "query": "from a_index | eval var = to_str(unsignedLongField)", "error": [], "warning": [] }, { - "query": "from a_index | where exp(booleanField) > 0", - "error": [ - "Argument of [exp] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval var = to_string(versionField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = exp(numberField)", + "query": "from a_index | eval to_string(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval exp(numberField)", + "query": "from a_index | eval var = to_str(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = exp(to_integer(booleanField))", + "query": "from a_index | eval var = to_string(to_version(keywordField))", "error": [], "warning": [] }, { - "query": "from a_index | eval exp(booleanField)", + "query": "from a_index | eval to_string(booleanField, extraArg)", "error": [ - "Argument of [exp] must be [number], found value [booleanField] type [boolean]" + "Error: [to_string] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = exp(*)", - "error": [ - "Using wildcards (*) in exp is not allowed" - ], + "query": "from a_index | sort to_string(booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval exp(numberField, extraArg)", - "error": [ - "Error: [exp] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval to_string(null)", + "error": [], "warning": [] }, { - "query": "from a_index | sort exp(numberField)", + "query": "row nullVar = null | eval to_string(nullVar)", "error": [], "warning": [] }, { - "query": "from a_index | eval exp(null)", + "query": "from a_index | eval to_string(\"2022\")", "error": [], "warning": [] }, { - "query": "row nullVar = null | eval exp(nullVar)", + "query": "from a_index | eval to_string(concat(\"20\", \"22\"))", "error": [], "warning": [] }, diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts b/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts index daeff58923f5c..f4c75ae1e63a0 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts @@ -35,26 +35,38 @@ const NESTED_DEPTHS = Array(NESTING_LEVELS) .fill(0) .map((_, i) => i + 1); +const toAvgSignature = statsAggregationFunctionDefinitions.find(({ name }) => name === 'avg')!; const toInteger = evalFunctionDefinitions.find(({ name }) => name === 'to_integer')!; +const toDoubleSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_double')!; const toStringSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_string')!; const toDateSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_datetime')!; const toBooleanSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_boolean')!; const toIpSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_ip')!; const toGeoPointSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_geopoint')!; +const toGeoShapeSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_geoshape')!; const toCartesianPointSignature = evalFunctionDefinitions.find( ({ name }) => name === 'to_cartesianpoint' )!; - -const toAvgSignature = statsAggregationFunctionDefinitions.find(({ name }) => name === 'avg')!; +const toCartesianShapeSignature = evalFunctionDefinitions.find( + ({ name }) => name === 'to_cartesianshape' +)!; +const toVersionSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_version')!; const nestedFunctions = { - number: prepareNestedFunction(toInteger), + double: prepareNestedFunction(toDoubleSignature), + integer: prepareNestedFunction(toInteger), string: prepareNestedFunction(toStringSignature), + text: prepareNestedFunction(toStringSignature), + keyword: prepareNestedFunction(toStringSignature), date: prepareNestedFunction(toDateSignature), boolean: prepareNestedFunction(toBooleanSignature), ip: prepareNestedFunction(toIpSignature), + version: prepareNestedFunction(toVersionSignature), geo_point: prepareNestedFunction(toGeoPointSignature), + geo_shape: prepareNestedFunction(toGeoShapeSignature), cartesian_point: prepareNestedFunction(toCartesianPointSignature), + cartesian_shape: prepareNestedFunction(toCartesianShapeSignature), + datetime: prepareNestedFunction(toDateSignature), }; const literals = { @@ -152,7 +164,7 @@ function getFieldMapping( ...rest, }; } - return { name: 'stringField', type, ...rest }; + return { name: 'textField', type, ...rest }; }); } @@ -351,7 +363,7 @@ describe('validation logic', () => { for (const op of ['>', '>=', '<', '<=', '==', '!=']) { testErrorsAndWarnings(`row var = 5 ${op} 0`, []); testErrorsAndWarnings(`row var = NOT 5 ${op} 0`, []); - testErrorsAndWarnings(`row var = (numberField ${op} 0)`, ['Unknown column [numberField]']); + testErrorsAndWarnings(`row var = (doubleField ${op} 0)`, ['Unknown column [doubleField]']); testErrorsAndWarnings(`row var = (NOT (5 ${op} 0))`, []); testErrorsAndWarnings(`row var = to_ip("127.0.0.1") ${op} to_ip("127.0.0.1")`, []); testErrorsAndWarnings(`row var = now() ${op} now()`, []); @@ -360,8 +372,8 @@ describe('validation logic', () => { ['==', '!='].includes(op) ? [] : [ - `Argument of [${op}] must be [number], found value [false] type [boolean]`, - `Argument of [${op}] must be [number], found value [false] type [boolean]`, + `Argument of [${op}] must be [date], found value [false] type [boolean]`, + `Argument of [${op}] must be [date], found value [false] type [boolean]`, ] ); for (const [valueTypeA, valueTypeB] of [['now()', '"2022"']]) { @@ -375,10 +387,10 @@ describe('validation logic', () => { testErrorsAndWarnings( `row var = now() ${op} now()`, ['+', '-'].includes(op) - ? [`Argument of [${op}] must be [time_literal], found value [now()] type [date]`] + ? [`Argument of [${op}] must be [date_period], found value [now()] type [date]`] : [ - `Argument of [${op}] must be [number], found value [now()] type [date]`, - `Argument of [${op}] must be [number], found value [now()] type [date]`, + `Argument of [${op}] must be [double], found value [now()] type [date]`, + `Argument of [${op}] must be [double], found value [now()] type [date]`, ] ); } @@ -389,16 +401,16 @@ describe('validation logic', () => { testErrorsAndWarnings(`row var = NOT "a" ${op} "?a"`, []); testErrorsAndWarnings(`row var = NOT "a" NOT ${op} "?a"`, []); testErrorsAndWarnings(`row var = 5 ${op} "?a"`, [ - `Argument of [${op}] must be [string], found value [5] type [number]`, + `Argument of [${op}] must be [text], found value [5] type [integer]`, ]); testErrorsAndWarnings(`row var = 5 NOT ${op} "?a"`, [ - `Argument of [not_${op}] must be [string], found value [5] type [number]`, + `Argument of [not_${op}] must be [text], found value [5] type [integer]`, ]); testErrorsAndWarnings(`row var = NOT 5 ${op} "?a"`, [ - `Argument of [${op}] must be [string], found value [5] type [number]`, + `Argument of [${op}] must be [text], found value [5] type [integer]`, ]); testErrorsAndWarnings(`row var = NOT 5 NOT ${op} "?a"`, [ - `Argument of [not_${op}] must be [string], found value [5] type [number]`, + `Argument of [not_${op}] must be [text], found value [5] type [integer]`, ]); } @@ -438,8 +450,8 @@ describe('validation logic', () => { ]); for (const op of ['*', '/', '%']) { testErrorsAndWarnings(`row var = now() ${op} 1 ${timeLiteral.name}`, [ - `Argument of [${op}] must be [number], found value [now()] type [date]`, - `Argument of [${op}] must be [number], found value [1 ${timeLiteral.name}] type [duration]`, + `Argument of [${op}] must be [double], found value [now()] type [date]`, + `Argument of [${op}] must be [double], found value [1 ${timeLiteral.name}] type [duration]`, ]); } } @@ -449,13 +461,13 @@ describe('validation logic', () => { describe('show', () => { testErrorsAndWarnings('show', ["SyntaxError: missing 'info' at ''"]); testErrorsAndWarnings('show info', []); - testErrorsAndWarnings('show numberField', [ - "SyntaxError: token recognition error at: 'n'", + testErrorsAndWarnings('show doubleField', [ + "SyntaxError: token recognition error at: 'd'", + "SyntaxError: token recognition error at: 'o'", "SyntaxError: token recognition error at: 'u'", - "SyntaxError: token recognition error at: 'm'", "SyntaxError: token recognition error at: 'b'", + "SyntaxError: token recognition error at: 'l'", "SyntaxError: token recognition error at: 'e'", - "SyntaxError: token recognition error at: 'r'", "SyntaxError: token recognition error at: 'F'", "SyntaxError: token recognition error at: 'ie'", "SyntaxError: token recognition error at: 'l'", @@ -475,11 +487,11 @@ describe('validation logic', () => { testErrorsAndWarnings('from index | limit a', [ "SyntaxError: mismatched input 'a' expecting INTEGER_LITERAL", ]); - testErrorsAndWarnings('from index | limit numberField', [ - "SyntaxError: mismatched input 'numberField' expecting INTEGER_LITERAL", + testErrorsAndWarnings('from index | limit doubleField', [ + "SyntaxError: mismatched input 'doubleField' expecting INTEGER_LITERAL", ]); - testErrorsAndWarnings('from index | limit stringField', [ - "SyntaxError: mismatched input 'stringField' expecting INTEGER_LITERAL", + testErrorsAndWarnings('from index | limit textField', [ + "SyntaxError: mismatched input 'textField' expecting INTEGER_LITERAL", ]); testErrorsAndWarnings('from index | limit 4', []); }); @@ -490,8 +502,14 @@ describe('validation logic', () => { describe('keep', () => { testErrorsAndWarnings('from index | keep ', ["SyntaxError: missing ID_PATTERN at ''"]); - testErrorsAndWarnings('from index | keep stringField, numberField, dateField', []); - testErrorsAndWarnings('from index | keep `stringField`, `numberField`, `dateField`', []); + testErrorsAndWarnings( + 'from index | keep keywordField, doubleField, integerField, dateField', + [] + ); + testErrorsAndWarnings( + 'from index | keep `keywordField`, `doubleField`, `integerField`, `dateField`', + [] + ); testErrorsAndWarnings('from index | keep 4.5', [ "SyntaxError: token recognition error at: '4'", "SyntaxError: token recognition error at: '5'", @@ -499,27 +517,27 @@ describe('validation logic', () => { "SyntaxError: missing ID_PATTERN at ''", ]); testErrorsAndWarnings('from index | keep `4.5`', ['Unknown column [4.5]']); - testErrorsAndWarnings('from index | keep missingField, numberField, dateField', [ + testErrorsAndWarnings('from index | keep missingField, doubleField, dateField', [ 'Unknown column [missingField]', ]); testErrorsAndWarnings('from index | keep `any#Char$Field`', []); testErrorsAndWarnings('from index | project ', [ "SyntaxError: mismatched input 'project' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'inlinestats', 'keep', 'limit', 'lookup', 'mv_expand', 'rename', 'sort', 'stats', 'where'}", ]); - testErrorsAndWarnings('from index | project stringField, numberField, dateField', [ + testErrorsAndWarnings('from index | project textField, doubleField, dateField', [ "SyntaxError: mismatched input 'project' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'inlinestats', 'keep', 'limit', 'lookup', 'mv_expand', 'rename', 'sort', 'stats', 'where'}", ]); - testErrorsAndWarnings('from index | PROJECT stringField, numberField, dateField', [ + testErrorsAndWarnings('from index | PROJECT textField, doubleField, dateField', [ "SyntaxError: mismatched input 'PROJECT' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'inlinestats', 'keep', 'limit', 'lookup', 'mv_expand', 'rename', 'sort', 'stats', 'where'}", ]); - testErrorsAndWarnings('from index | project missingField, numberField, dateField', [ + testErrorsAndWarnings('from index | project missingField, doubleField, dateField', [ "SyntaxError: mismatched input 'project' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'inlinestats', 'keep', 'limit', 'lookup', 'mv_expand', 'rename', 'sort', 'stats', 'where'}", ]); - testErrorsAndWarnings('from index | keep s*', []); + testErrorsAndWarnings('from index | keep k*', []); testErrorsAndWarnings('from index | keep *Field', []); - testErrorsAndWarnings('from index | keep s*Field', []); - testErrorsAndWarnings('from index | keep string*Field', []); - testErrorsAndWarnings('from index | keep s*, n*', []); + testErrorsAndWarnings('from index | keep k*Field', []); + testErrorsAndWarnings('from index | keep key*Field', []); + testErrorsAndWarnings('from index | keep k*, i*', []); testErrorsAndWarnings('from index | keep m*', ['Unknown column [m*]']); testErrorsAndWarnings('from index | keep *m', ['Unknown column [*m]']); testErrorsAndWarnings('from index | keep d*m', ['Unknown column [d*m]']); @@ -532,41 +550,41 @@ describe('validation logic', () => { ); testErrorsAndWarnings( - `FROM index | STATS ROUND(AVG(numberField * 1.5)), COUNT(*), MIN(numberField * 10) | KEEP \`MIN(numberField * 10)\``, + `FROM index | STATS ROUND(AVG(doubleField * 1.5)), COUNT(*), MIN(doubleField * 10) | KEEP \`MIN(doubleField * 10)\``, [] ); testErrorsAndWarnings( - `FROM index | STATS COUNT(*), MIN(numberField * 10), MAX(numberField)| KEEP \`COUNT(*)\``, + `FROM index | STATS COUNT(*), MIN(doubleField * 10), MAX(doubleField)| KEEP \`COUNT(*)\``, [] ); }); describe('drop', () => { testErrorsAndWarnings('from index | drop ', ["SyntaxError: missing ID_PATTERN at ''"]); - testErrorsAndWarnings('from index | drop stringField, numberField, dateField', []); + testErrorsAndWarnings('from index | drop textField, doubleField, dateField', []); testErrorsAndWarnings('from index | drop 4.5', [ "SyntaxError: token recognition error at: '4'", "SyntaxError: token recognition error at: '5'", "SyntaxError: missing ID_PATTERN at '.'", "SyntaxError: missing ID_PATTERN at ''", ]); - testErrorsAndWarnings('from index | drop missingField, numberField, dateField', [ + testErrorsAndWarnings('from index | drop missingField, doubleField, dateField', [ 'Unknown column [missingField]', ]); testErrorsAndWarnings('from index | drop `any#Char$Field`', []); - testErrorsAndWarnings('from index | drop s*', []); - testErrorsAndWarnings('from index | drop s**Field', []); + testErrorsAndWarnings('from index | drop t*', []); + testErrorsAndWarnings('from index | drop t**Field', []); testErrorsAndWarnings('from index | drop *Field*', []); - testErrorsAndWarnings('from index | drop s*F*d', []); + testErrorsAndWarnings('from index | drop t*F*d', []); testErrorsAndWarnings('from index | drop *Field', []); - testErrorsAndWarnings('from index | drop s*Field', []); - testErrorsAndWarnings('from index | drop string*Field', []); - testErrorsAndWarnings('from index | drop s*, n*', []); + testErrorsAndWarnings('from index | drop t*Field', []); + testErrorsAndWarnings('from index | drop textField', []); + testErrorsAndWarnings('from index | drop s*, d*', ['Unknown column [s*]']); testErrorsAndWarnings('from index | drop m*', ['Unknown column [m*]']); testErrorsAndWarnings('from index | drop *m', ['Unknown column [*m]']); testErrorsAndWarnings('from index | drop d*m', ['Unknown column [d*m]']); testErrorsAndWarnings('from index | drop *', ['Removing all fields is not allowed [*]']); - testErrorsAndWarnings('from index | drop stringField, *', [ + testErrorsAndWarnings('from index | drop textField, *', [ 'Removing all fields is not allowed [*]', ]); testErrorsAndWarnings( @@ -575,16 +593,16 @@ describe('validation logic', () => { ['Drop [@timestamp] will remove all time filters to the search results'] ); testErrorsAndWarnings( - 'from index | drop stringField, @timestamp', + 'from index | drop textField, @timestamp', [], ['Drop [@timestamp] will remove all time filters to the search results'] ); testErrorsAndWarnings( - `FROM index | STATS ROUND(AVG(numberField * 1.5)), COUNT(*), MIN(numberField * 10) | DROP \`MIN(numberField * 10)\``, + `FROM index | STATS ROUND(AVG(doubleField * 1.5)), COUNT(*), MIN(doubleField * 10) | DROP \`MIN(doubleField * 10)\``, [] ); testErrorsAndWarnings( - `FROM index | STATS COUNT(*), MIN(numberField * 10), MAX(numberField)| DROP \`COUNT(*)\``, + `FROM index | STATS COUNT(*), MIN(doubleField * 10), MAX(doubleField)| DROP \`COUNT(*)\``, [] ); }); @@ -593,11 +611,11 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | mv_expand ', [ "SyntaxError: missing {UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER} at ''", ]); - for (const type of ['string', 'number', 'date', 'boolean', 'ip']) { + for (const type of ['text', 'integer', 'date', 'boolean', 'ip']) { testErrorsAndWarnings(`from a_index | mv_expand ${type}Field`, []); } - testErrorsAndWarnings('from a_index | mv_expand numberField, b', [ + testErrorsAndWarnings('from a_index | mv_expand doubleField, b', [ "SyntaxError: token recognition error at: ','", "SyntaxError: extraneous input 'b' expecting ", ]); @@ -612,24 +630,24 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | rename', [ "SyntaxError: mismatched input '' expecting ID_PATTERN", ]); - testErrorsAndWarnings('from a_index | rename stringField', [ + testErrorsAndWarnings('from a_index | rename textField', [ "SyntaxError: mismatched input '' expecting 'as'", ]); testErrorsAndWarnings('from a_index | rename a', [ "SyntaxError: mismatched input '' expecting 'as'", 'Unknown column [a]', ]); - testErrorsAndWarnings('from a_index | rename stringField as', [ + testErrorsAndWarnings('from a_index | rename textField as', [ "SyntaxError: missing ID_PATTERN at ''", ]); testErrorsAndWarnings('from a_index | rename missingField as', [ "SyntaxError: missing ID_PATTERN at ''", 'Unknown column [missingField]', ]); - testErrorsAndWarnings('from a_index | rename stringField as b', []); - testErrorsAndWarnings('from a_index | rename stringField AS b', []); - testErrorsAndWarnings('from a_index | rename stringField As b', []); - testErrorsAndWarnings('from a_index | rename stringField As b, b AS c', []); + testErrorsAndWarnings('from a_index | rename textField as b', []); + testErrorsAndWarnings('from a_index | rename textField AS b', []); + testErrorsAndWarnings('from a_index | rename textField As b', []); + testErrorsAndWarnings('from a_index | rename textField As b, b AS c', []); testErrorsAndWarnings('from a_index | rename fn() as a', [ "SyntaxError: token recognition error at: '('", "SyntaxError: token recognition error at: ')'", @@ -637,18 +655,22 @@ describe('validation logic', () => { 'Unknown column [a]', ]); testErrorsAndWarnings( - 'from a_index | eval numberField + 1 | rename `numberField + 1` as a', + 'from a_index | eval doubleField + 1 | rename `doubleField + 1` as a', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField) | rename `avg(numberField)` as avg0', + 'from a_index | stats avg(doubleField) | rename `avg(doubleField)` as avg0', [] ); - testErrorsAndWarnings('from a_index |eval numberField + 1 | rename `numberField + 1` as ', [ + testErrorsAndWarnings('from a_index |eval doubleField + 1 | rename `doubleField + 1` as ', [ "SyntaxError: missing ID_PATTERN at ''", ]); + testErrorsAndWarnings('from a_index | rename key* as keywords', [ + 'Using wildcards (*) in RENAME is not allowed [key*]', + 'Unknown column [keywords]', + ]); testErrorsAndWarnings('from a_index | rename s* as strings', [ - 'Using wildcards (*) in RENAME is not allowed [s*]', + 'Unknown column [s*]', 'Unknown column [strings]', ]); testErrorsAndWarnings('row a = 10 | rename a as `this``is fine`', []); @@ -661,51 +683,48 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | dissect', [ "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", ]); - testErrorsAndWarnings('from a_index | dissect stringField', [ + testErrorsAndWarnings('from a_index | dissect textField', [ "SyntaxError: missing QUOTED_STRING at ''", ]); - testErrorsAndWarnings('from a_index | dissect stringField 2', [ + testErrorsAndWarnings('from a_index | dissect textField 2', [ "SyntaxError: mismatched input '2' expecting QUOTED_STRING", ]); - testErrorsAndWarnings('from a_index | dissect stringField .', [ + testErrorsAndWarnings('from a_index | dissect textField .', [ "SyntaxError: mismatched input '' expecting {UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", - 'Unknown column [stringField.]', + 'Unknown column [textField.]', ]); - testErrorsAndWarnings('from a_index | dissect stringField %a', [ + testErrorsAndWarnings('from a_index | dissect textField %a', [ "SyntaxError: mismatched input '%' expecting QUOTED_STRING", "SyntaxError: mismatched input '' expecting '='", ]); // Do not try to validate the dissect pattern string - testErrorsAndWarnings('from a_index | dissect stringField "%{firstWord}"', []); - testErrorsAndWarnings('from a_index | dissect numberField "%{firstWord}"', [ - 'DISSECT only supports string type values, found [numberField] of type [number]', + testErrorsAndWarnings('from a_index | dissect textField "%{firstWord}"', []); + testErrorsAndWarnings('from a_index | dissect doubleField "%{firstWord}"', [ + 'DISSECT only supports string type values, found [doubleField] of type [double]', ]); - testErrorsAndWarnings('from a_index | dissect stringField "%{firstWord}" option ', [ + testErrorsAndWarnings('from a_index | dissect textField "%{firstWord}" option ', [ "SyntaxError: mismatched input '' expecting '='", ]); - testErrorsAndWarnings('from a_index | dissect stringField "%{firstWord}" option = ', [ + testErrorsAndWarnings('from a_index | dissect textField "%{firstWord}" option = ', [ "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET}", 'Invalid option for DISSECT: [option]', ]); - testErrorsAndWarnings('from a_index | dissect stringField "%{firstWord}" option = 1', [ + testErrorsAndWarnings('from a_index | dissect textField "%{firstWord}" option = 1', [ 'Invalid option for DISSECT: [option]', ]); testErrorsAndWarnings( - 'from a_index | dissect stringField "%{firstWord}" append_separator = "-"', + 'from a_index | dissect textField "%{firstWord}" append_separator = "-"', [] ); testErrorsAndWarnings( - 'from a_index | dissect stringField "%{firstWord}" ignore_missing = true', + 'from a_index | dissect textField "%{firstWord}" ignore_missing = true', ['Invalid option for DISSECT: [ignore_missing]'] ); testErrorsAndWarnings( - 'from a_index | dissect stringField "%{firstWord}" append_separator = true', + 'from a_index | dissect textField "%{firstWord}" append_separator = true', ['Invalid value for DISSECT append_separator: expected a string, but was [true]'] ); - testErrorsAndWarnings( - 'from a_index | dissect stringField "%{firstWord}" | keep firstWord', - [] - ); + testErrorsAndWarnings('from a_index | dissect textField "%{firstWord}" | keep firstWord', []); // testErrorsAndWarnings('from a_index | dissect s* "%{a}"', [ // 'Using wildcards (*) in dissect is not allowed [s*]', // ]); @@ -715,25 +734,26 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | grok', [ "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", ]); - testErrorsAndWarnings('from a_index | grok stringField', [ + testErrorsAndWarnings('from a_index | grok textField', [ "SyntaxError: missing QUOTED_STRING at ''", ]); - testErrorsAndWarnings('from a_index | grok stringField 2', [ + testErrorsAndWarnings('from a_index | grok textField 2', [ "SyntaxError: mismatched input '2' expecting QUOTED_STRING", ]); - testErrorsAndWarnings('from a_index | grok stringField .', [ + testErrorsAndWarnings('from a_index | grok textField .', [ "SyntaxError: mismatched input '' expecting {UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", - 'Unknown column [stringField.]', + 'Unknown column [textField.]', ]); - testErrorsAndWarnings('from a_index | grok stringField %a', [ + testErrorsAndWarnings('from a_index | grok textField %a', [ "SyntaxError: mismatched input '%' expecting QUOTED_STRING", ]); + // @TODO: investigate // Do not try to validate the grok pattern string - testErrorsAndWarnings('from a_index | grok stringField "%{firstWord}"', []); - testErrorsAndWarnings('from a_index | grok numberField "%{firstWord}"', [ - 'GROK only supports string type values, found [numberField] of type [number]', + testErrorsAndWarnings('from a_index | grok textField "%{firstWord}"', []); + testErrorsAndWarnings('from a_index | grok doubleField "%{firstWord}"', [ + 'GROK only supports string type values, found [doubleField] of type [double]', ]); - testErrorsAndWarnings('from a_index | grok stringField "%{firstWord}" | keep firstWord', []); + testErrorsAndWarnings('from a_index | grok textField "%{firstWord}" | keep firstWord', []); // testErrorsAndWarnings('from a_index | grok s* "%{a}"', [ // 'Using wildcards (*) in grok is not allowed [s*]', // ]); @@ -750,20 +770,20 @@ describe('validation logic', () => { testErrorsAndWarnings(`from a_index | where NOT ${nValue} > 0`, []); } for (const op of ['>', '>=', '<', '<=', '==', '!=']) { - testErrorsAndWarnings(`from a_index | where numberField ${op} 0`, []); - testErrorsAndWarnings(`from a_index | where NOT numberField ${op} 0`, []); - testErrorsAndWarnings(`from a_index | where (numberField ${op} 0)`, []); - testErrorsAndWarnings(`from a_index | where (NOT (numberField ${op} 0))`, []); + testErrorsAndWarnings(`from a_index | where doubleField ${op} 0`, []); + testErrorsAndWarnings(`from a_index | where NOT doubleField ${op} 0`, []); + testErrorsAndWarnings(`from a_index | where (doubleField ${op} 0)`, []); + testErrorsAndWarnings(`from a_index | where (NOT (doubleField ${op} 0))`, []); testErrorsAndWarnings(`from a_index | where 1 ${op} 0`, []); - for (const type of ['string', 'number', 'date', 'boolean', 'ip']) { + for (const type of ['text', 'double', 'date', 'boolean', 'ip']) { testErrorsAndWarnings( `from a_index | where ${type}Field ${op} ${type}Field`, type !== 'boolean' || ['==', '!='].includes(op) ? [] : [ - `Argument of [${op}] must be [number], found value [${type}Field] type [${type}]`, - `Argument of [${op}] must be [number], found value [${type}Field] type [${type}]`, + `Argument of [${op}] must be [date], found value [${type}Field] type [${type}]`, + `Argument of [${op}] must be [date], found value [${type}Field] type [${type}]`, ] ); } @@ -778,17 +798,17 @@ describe('validation logic', () => { .fill('- ') .map((_, i) => (i % 2 ? oddOp : evenOp)) .join(''); - testErrorsAndWarnings(`from a_index | where ${unaryCombination} numberField > 0`, []); + testErrorsAndWarnings(`from a_index | where ${unaryCombination} doubleField > 0`, []); testErrorsAndWarnings( - `from a_index | where ${unaryCombination} round(numberField) > 0`, + `from a_index | where ${unaryCombination} round(doubleField) > 0`, [] ); testErrorsAndWarnings( - `from a_index | where 1 + ${unaryCombination} numberField > 0`, + `from a_index | where 1 + ${unaryCombination} doubleField > 0`, [] ); // still valid - testErrorsAndWarnings(`from a_index | where 1 ${unaryCombination} numberField > 0`, []); + testErrorsAndWarnings(`from a_index | where 1 ${unaryCombination} doubleField > 0`, []); } } testErrorsAndWarnings( @@ -797,52 +817,52 @@ describe('validation logic', () => { ); } for (const wrongOp of ['*', '/', '%']) { - testErrorsAndWarnings(`from a_index | where ${wrongOp}+ numberField`, [ + testErrorsAndWarnings(`from a_index | where ${wrongOp}+ doubleField`, [ `SyntaxError: extraneous input '${wrongOp}' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}`, ]); } // Skip these tests until the insensitive case equality gets restored back - testErrorsAndWarnings.skip(`from a_index | where numberField =~ 0`, [ - 'Argument of [=~] must be [string], found value [numberField] type [number]', - 'Argument of [=~] must be [string], found value [0] type [number]', + testErrorsAndWarnings.skip(`from a_index | where doubleField =~ 0`, [ + 'Argument of [=~] must be [text], found value [doubleField] type [double]', + 'Argument of [=~] must be [text], found value [0] type [number]', ]); - testErrorsAndWarnings.skip(`from a_index | where NOT numberField =~ 0`, [ - 'Argument of [=~] must be [string], found value [numberField] type [number]', - 'Argument of [=~] must be [string], found value [0] type [number]', + testErrorsAndWarnings.skip(`from a_index | where NOT doubleField =~ 0`, [ + 'Argument of [=~] must be [text], found value [doubleField] type [double]', + 'Argument of [=~] must be [text], found value [0] type [number]', ]); - testErrorsAndWarnings.skip(`from a_index | where (numberField =~ 0)`, [ - 'Argument of [=~] must be [string], found value [numberField] type [number]', - 'Argument of [=~] must be [string], found value [0] type [number]', + testErrorsAndWarnings.skip(`from a_index | where (doubleField =~ 0)`, [ + 'Argument of [=~] must be [text], found value [doubleField] type [double]', + 'Argument of [=~] must be [text], found value [0] type [number]', ]); - testErrorsAndWarnings.skip(`from a_index | where (NOT (numberField =~ 0))`, [ - 'Argument of [=~] must be [string], found value [numberField] type [number]', - 'Argument of [=~] must be [string], found value [0] type [number]', + testErrorsAndWarnings.skip(`from a_index | where (NOT (doubleField =~ 0))`, [ + 'Argument of [=~] must be [text], found value [doubleField] type [double]', + 'Argument of [=~] must be [text], found value [0] type [number]', ]); testErrorsAndWarnings.skip(`from a_index | where 1 =~ 0`, [ - 'Argument of [=~] must be [string], found value [1] type [number]', - 'Argument of [=~] must be [string], found value [0] type [number]', + 'Argument of [=~] must be [text], found value [1] type [number]', + 'Argument of [=~] must be [text], found value [0] type [number]', ]); - testErrorsAndWarnings.skip(`from a_index | eval stringField =~ 0`, [ - `Argument of [=~] must be [string], found value [0] type [number]`, + testErrorsAndWarnings.skip(`from a_index | eval textField =~ 0`, [ + `Argument of [=~] must be [text], found value [0] type [number]`, ]); for (const op of ['like', 'rlike']) { - testErrorsAndWarnings(`from a_index | where stringField ${op} "?a"`, []); - testErrorsAndWarnings(`from a_index | where stringField NOT ${op} "?a"`, []); - testErrorsAndWarnings(`from a_index | where NOT stringField ${op} "?a"`, []); - testErrorsAndWarnings(`from a_index | where NOT stringField NOT ${op} "?a"`, []); - testErrorsAndWarnings(`from a_index | where numberField ${op} "?a"`, [ - `Argument of [${op}] must be [string], found value [numberField] type [number]`, + testErrorsAndWarnings(`from a_index | where textField ${op} "?a"`, []); + testErrorsAndWarnings(`from a_index | where textField NOT ${op} "?a"`, []); + testErrorsAndWarnings(`from a_index | where NOT textField ${op} "?a"`, []); + testErrorsAndWarnings(`from a_index | where NOT textField NOT ${op} "?a"`, []); + testErrorsAndWarnings(`from a_index | where doubleField ${op} "?a"`, [ + `Argument of [${op}] must be [text], found value [doubleField] type [double]`, ]); - testErrorsAndWarnings(`from a_index | where numberField NOT ${op} "?a"`, [ - `Argument of [not_${op}] must be [string], found value [numberField] type [number]`, + testErrorsAndWarnings(`from a_index | where doubleField NOT ${op} "?a"`, [ + `Argument of [not_${op}] must be [text], found value [doubleField] type [double]`, ]); - testErrorsAndWarnings(`from a_index | where NOT numberField ${op} "?a"`, [ - `Argument of [${op}] must be [string], found value [numberField] type [number]`, + testErrorsAndWarnings(`from a_index | where NOT doubleField ${op} "?a"`, [ + `Argument of [${op}] must be [text], found value [doubleField] type [double]`, ]); - testErrorsAndWarnings(`from a_index | where NOT numberField NOT ${op} "?a"`, [ - `Argument of [not_${op}] must be [string], found value [numberField] type [number]`, + testErrorsAndWarnings(`from a_index | where NOT doubleField NOT ${op} "?a"`, [ + `Argument of [not_${op}] must be [text], found value [doubleField] type [double]`, ]); } @@ -866,21 +886,21 @@ describe('validation logic', () => { } // this is a scenario that was failing because "or" didn't accept "null" - testErrorsAndWarnings('from a_index | where stringField == "a" or null', []); + testErrorsAndWarnings('from a_index | where textField == "a" or null', []); }); describe('eval', () => { testErrorsAndWarnings('from a_index | eval ', [ "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", ]); - testErrorsAndWarnings('from a_index | eval stringField ', []); - testErrorsAndWarnings('from a_index | eval b = stringField', []); - testErrorsAndWarnings('from a_index | eval numberField + 1', []); - testErrorsAndWarnings('from a_index | eval numberField + ', [ - "SyntaxError: no viable alternative at input 'numberField + '", + testErrorsAndWarnings('from a_index | eval textField ', []); + testErrorsAndWarnings('from a_index | eval b = textField', []); + testErrorsAndWarnings('from a_index | eval doubleField + 1', []); + testErrorsAndWarnings('from a_index | eval doubleField + ', [ + "SyntaxError: no viable alternative at input 'doubleField + '", ]); - testErrorsAndWarnings('from a_index | eval stringField + 1', [ - 'Argument of [+] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval textField + 1', [ + 'Argument of [+] must be [double], found value [textField] type [text]', ]); testErrorsAndWarnings('from a_index | eval a=b', ['Unknown column [b]']); testErrorsAndWarnings('from a_index | eval a=b, ', [ @@ -891,24 +911,24 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval a=round(', [ "SyntaxError: no viable alternative at input 'round('", ]); - testErrorsAndWarnings('from a_index | eval a=round(numberField) ', []); - testErrorsAndWarnings('from a_index | eval a=round(numberField), ', [ + testErrorsAndWarnings('from a_index | eval a=round(doubleField) ', []); + testErrorsAndWarnings('from a_index | eval a=round(doubleField), ', [ "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", ]); - testErrorsAndWarnings('from a_index | eval a=round(numberField) + round(numberField) ', []); - testErrorsAndWarnings('from a_index | eval a=round(numberField) + round(stringField) ', [ - 'Argument of [round] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval a=round(doubleField) + round(doubleField) ', []); + testErrorsAndWarnings('from a_index | eval a=round(doubleField) + round(textField) ', [ + 'Argument of [round] must be [double], found value [textField] type [text]', ]); testErrorsAndWarnings( - 'from a_index | eval a=round(numberField) + round(stringField), numberField ', - ['Argument of [round] must be [number], found value [stringField] type [string]'] + 'from a_index | eval a=round(doubleField) + round(textField), doubleField ', + ['Argument of [round] must be [double], found value [textField] type [text]'] ); testErrorsAndWarnings( - 'from a_index | eval a=round(numberField) + round(numberField), numberField ', + 'from a_index | eval a=round(doubleField) + round(doubleField), doubleField ', [] ); testErrorsAndWarnings( - 'from a_index | eval a=round(numberField) + round(numberField), b = numberField ', + 'from a_index | eval a=round(doubleField) + round(doubleField), b = doubleField ', [] ); @@ -936,15 +956,15 @@ describe('validation logic', () => { .fill('- ') .map((_, i) => (i % 2 ? oddOp : evenOp)) .join(''); - testErrorsAndWarnings(`from a_index | eval ${unaryCombination} numberField`, []); - testErrorsAndWarnings(`from a_index | eval a=${unaryCombination} numberField`, []); + testErrorsAndWarnings(`from a_index | eval ${unaryCombination} doubleField`, []); + testErrorsAndWarnings(`from a_index | eval a=${unaryCombination} doubleField`, []); testErrorsAndWarnings( - `from a_index | eval a=${unaryCombination} round(numberField)`, + `from a_index | eval a=${unaryCombination} round(doubleField)`, [] ); - testErrorsAndWarnings(`from a_index | eval 1 + ${unaryCombination} numberField`, []); + testErrorsAndWarnings(`from a_index | eval 1 + ${unaryCombination} doubleField`, []); // still valid - testErrorsAndWarnings(`from a_index | eval 1 ${unaryCombination} numberField`, []); + testErrorsAndWarnings(`from a_index | eval 1 ${unaryCombination} doubleField`, []); } } @@ -955,7 +975,7 @@ describe('validation logic', () => { } for (const wrongOp of ['*', '/', '%']) { - testErrorsAndWarnings(`from a_index | eval ${wrongOp}+ numberField`, [ + testErrorsAndWarnings(`from a_index | eval ${wrongOp}+ doubleField`, [ `SyntaxError: extraneous input '${wrongOp}' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}`, ]); } @@ -991,46 +1011,58 @@ describe('validation logic', () => { ] ); for (const op of ['>', '>=', '<', '<=', '==', '!=']) { - testErrorsAndWarnings(`from a_index | eval numberField ${op} 0`, []); - testErrorsAndWarnings(`from a_index | eval NOT numberField ${op} 0`, []); - testErrorsAndWarnings(`from a_index | eval (numberField ${op} 0)`, []); - testErrorsAndWarnings(`from a_index | eval (NOT (numberField ${op} 0))`, []); + testErrorsAndWarnings(`from a_index | eval doubleField ${op} 0`, []); + testErrorsAndWarnings(`from a_index | eval NOT doubleField ${op} 0`, []); + testErrorsAndWarnings(`from a_index | eval (doubleField ${op} 0)`, []); + testErrorsAndWarnings(`from a_index | eval (NOT (doubleField ${op} 0))`, []); testErrorsAndWarnings(`from a_index | eval 1 ${op} 0`, []); - for (const type of ['string', 'number', 'date', 'boolean', 'ip']) { - testErrorsAndWarnings( - `from a_index | eval ${type}Field ${op} ${type}Field`, - type !== 'boolean' || ['==', '!='].includes(op) - ? [] - : [ - `Argument of [${op}] must be [number], found value [${type}Field] type [${type}]`, - `Argument of [${op}] must be [number], found value [${type}Field] type [${type}]`, - ] - ); + for (const type of ['text', 'double', 'date', 'boolean', 'ip']) { + if (type === 'boolean') { + testErrorsAndWarnings( + `from a_index | eval ${type}Field ${op} ${type}Field`, + type !== 'boolean' || ['==', '!='].includes(op) + ? [] + : [ + `Argument of [${op}] must be [date], found value [${type}Field] type [${type}]`, + `Argument of [${op}] must be [date], found value [${type}Field] type [${type}]`, + ] + ); + } else { + testErrorsAndWarnings( + `from a_index | eval ${type}Field ${op} ${type}Field`, + type !== 'boolean' || ['==', '!='].includes(op) + ? [] + : [ + `Argument of [${op}] must be [double], found value [${type}Field] type [${type}]`, + `Argument of [${op}] must be [double], found value [${type}Field] type [${type}]`, + ] + ); + } } // Implicit casting of literal values tests - testErrorsAndWarnings(`from a_index | eval numberField ${op} stringField`, [ - `Argument of [${op}] must be [number], found value [stringField] type [string]`, + testErrorsAndWarnings(`from a_index | eval doubleField ${op} textField`, [ + `Argument of [${op}] must be [double], found value [textField] type [text]`, ]); - testErrorsAndWarnings(`from a_index | eval stringField ${op} numberField`, [ - `Argument of [${op}] must be [number], found value [stringField] type [string]`, + testErrorsAndWarnings(`from a_index | eval keywordField ${op} doubleField`, [ + `Argument of [${op}] must be [double], found value [keywordField] type [keyword]`, ]); - testErrorsAndWarnings(`from a_index | eval numberField ${op} "2022"`, [ - `Argument of [${op}] must be [number], found value ["2022"] type [string]`, + testErrorsAndWarnings(`from a_index | eval doubleField ${op} "2022"`, [ + `Argument of [${op}] must be [date], found value [doubleField] type [double]`, ]); - testErrorsAndWarnings(`from a_index | eval dateField ${op} stringField`, [ - `Argument of [${op}] must be [string], found value [dateField] type [date]`, + testErrorsAndWarnings(`from a_index | eval dateField ${op} keywordField`, [ + `Argument of [${op}] must be [date], found value [keywordField] type [keyword]`, ]); - testErrorsAndWarnings(`from a_index | eval stringField ${op} dateField`, [ - `Argument of [${op}] must be [string], found value [dateField] type [date]`, + testErrorsAndWarnings(`from a_index | eval keywordField ${op} dateField`, [ + `Argument of [${op}] must be [date], found value [keywordField] type [keyword]`, ]); // Check that the implicit cast doesn't apply for fields - testErrorsAndWarnings(`from a_index | eval stringField ${op} 0`, [ - `Argument of [${op}] must be [number], found value [stringField] type [string]`, + testErrorsAndWarnings(`from a_index | eval textField ${op} 0`, [ + `Argument of [${op}] must be [double], found value [textField] type [text]`, ]); - testErrorsAndWarnings(`from a_index | eval stringField ${op} now()`, [ - `Argument of [${op}] must be [string], found value [now()] type [date]`, + testErrorsAndWarnings(`from a_index | eval textField ${op} now()`, [ + `Argument of [${op}] must be [date], found value [textField] type [text]`, ]); testErrorsAndWarnings(`from a_index | eval dateField ${op} "2022"`, []); @@ -1043,13 +1075,13 @@ describe('validation logic', () => { `from a_index | eval booleanField ${op} "true"`, ['==', '!='].includes(op) ? [] - : [`Argument of [${op}] must be [string], found value [booleanField] type [boolean]`] + : [`Argument of [${op}] must be [date], found value [booleanField] type [boolean]`] ); testErrorsAndWarnings( `from a_index | eval "true" ${op} booleanField`, ['==', '!='].includes(op) ? [] - : [`Argument of [${op}] must be [string], found value [booleanField] type [boolean]`] + : [`Argument of [${op}] must be [date], found value [booleanField] type [boolean]`] ); testErrorsAndWarnings(`from a_index | eval ipField ${op} "136.36.3.205"`, []); @@ -1072,25 +1104,31 @@ describe('validation logic', () => { ); for (const op of ['+', '-', '*', '/', '%']) { - testErrorsAndWarnings(`from a_index | eval numberField ${op} 1`, []); - testErrorsAndWarnings(`from a_index | eval (numberField ${op} 1)`, []); + testErrorsAndWarnings(`from a_index | eval doubleField ${op} 1`, []); + testErrorsAndWarnings(`from a_index | eval (doubleField ${op} 1)`, []); testErrorsAndWarnings(`from a_index | eval 1 ${op} 1`, []); testErrorsAndWarnings( `from a_index | eval now() ${op} now()`, ['+', '-'].includes(op) - ? [`Argument of [${op}] must be [time_literal], found value [now()] type [date]`] + ? [`Argument of [${op}] must be [date_period], found value [now()] type [date]`] : [ - `Argument of [${op}] must be [number], found value [now()] type [date]`, - `Argument of [${op}] must be [number], found value [now()] type [date]`, + `Argument of [${op}] must be [double], found value [now()] type [date]`, + `Argument of [${op}] must be [double], found value [now()] type [date]`, ] ); - testErrorsAndWarnings(`from a_index | eval 1 ${op} "1"`, [ - `Argument of [${op}] must be [number], found value [\"1\"] type [string]`, - ]); - testErrorsAndWarnings(`from a_index | eval "1" ${op} 1`, [ - `Argument of [${op}] must be [number], found value [\"1\"] type [string]`, - ]); + testErrorsAndWarnings( + `from a_index | eval 1 ${op} "1"`, + ['+', '-'].includes(op) + ? [`Argument of [${op}] must be [date_period], found value [1] type [integer]`] + : [`Argument of [${op}] must be [double], found value [\"1\"] type [string]`] + ); + testErrorsAndWarnings( + `from a_index | eval "1" ${op} 1`, + ['+', '-'].includes(op) + ? [`Argument of [${op}] must be [date_period], found value [1] type [integer]`] + : [`Argument of [${op}] must be [double], found value [\"1\"] type [string]`] + ); // TODO: enable when https://github.com/elastic/elasticsearch/issues/108432 is complete // testErrorsAndWarnings(`from a_index | eval "2022" ${op} 1 day`, []); } @@ -1109,54 +1147,51 @@ describe('validation logic', () => { ); } for (const op of ['like', 'rlike']) { - testErrorsAndWarnings(`from a_index | eval stringField ${op} "?a"`, []); - testErrorsAndWarnings(`from a_index | eval stringField NOT ${op} "?a"`, []); - testErrorsAndWarnings(`from a_index | eval NOT stringField ${op} "?a"`, []); - testErrorsAndWarnings(`from a_index | eval NOT stringField NOT ${op} "?a"`, []); - testErrorsAndWarnings(`from a_index | eval numberField ${op} "?a"`, [ - `Argument of [${op}] must be [string], found value [numberField] type [number]`, + testErrorsAndWarnings(`from a_index | eval textField ${op} "?a"`, []); + testErrorsAndWarnings(`from a_index | eval textField NOT ${op} "?a"`, []); + testErrorsAndWarnings(`from a_index | eval NOT textField ${op} "?a"`, []); + testErrorsAndWarnings(`from a_index | eval NOT textField NOT ${op} "?a"`, []); + testErrorsAndWarnings(`from a_index | eval doubleField ${op} "?a"`, [ + `Argument of [${op}] must be [text], found value [doubleField] type [double]`, ]); - testErrorsAndWarnings(`from a_index | eval numberField NOT ${op} "?a"`, [ - `Argument of [not_${op}] must be [string], found value [numberField] type [number]`, + testErrorsAndWarnings(`from a_index | eval doubleField NOT ${op} "?a"`, [ + `Argument of [not_${op}] must be [text], found value [doubleField] type [double]`, ]); - testErrorsAndWarnings(`from a_index | eval NOT numberField ${op} "?a"`, [ - `Argument of [${op}] must be [string], found value [numberField] type [number]`, + testErrorsAndWarnings(`from a_index | eval NOT doubleField ${op} "?a"`, [ + `Argument of [${op}] must be [text], found value [doubleField] type [double]`, ]); - testErrorsAndWarnings(`from a_index | eval NOT numberField NOT ${op} "?a"`, [ - `Argument of [not_${op}] must be [string], found value [numberField] type [number]`, + testErrorsAndWarnings(`from a_index | eval NOT doubleField NOT ${op} "?a"`, [ + `Argument of [not_${op}] must be [text], found value [doubleField] type [double]`, ]); } // test lists testErrorsAndWarnings('from a_index | eval 1 in (1, 2, 3)', []); - testErrorsAndWarnings('from a_index | eval numberField in (1, 2, 3)', []); - testErrorsAndWarnings('from a_index | eval numberField not in (1, 2, 3)', []); - testErrorsAndWarnings('from a_index | eval numberField not in (1, 2, 3, numberField)', []); - testErrorsAndWarnings('from a_index | eval 1 in (1, 2, 3, round(numberField))', []); + testErrorsAndWarnings('from a_index | eval doubleField in (1, 2, 3)', []); + testErrorsAndWarnings('from a_index | eval doubleField not in (1, 2, 3)', []); + testErrorsAndWarnings('from a_index | eval doubleField not in (1, 2, 3, doubleField)', []); + testErrorsAndWarnings('from a_index | eval 1 in (1, 2, 3, round(doubleField))', []); testErrorsAndWarnings('from a_index | eval "a" in ("a", "b", "c")', []); - testErrorsAndWarnings('from a_index | eval stringField in ("a", "b", "c")', []); - testErrorsAndWarnings('from a_index | eval stringField not in ("a", "b", "c")', []); - testErrorsAndWarnings( - 'from a_index | eval stringField not in ("a", "b", "c", stringField)', - [] - ); + testErrorsAndWarnings('from a_index | eval textField in ("a", "b", "c")', []); + testErrorsAndWarnings('from a_index | eval textField not in ("a", "b", "c")', []); + testErrorsAndWarnings('from a_index | eval textField not in ("a", "b", "c", textField)', []); testErrorsAndWarnings('from a_index | eval 1 in ("a", "b", "c")', [ // 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', ]); - testErrorsAndWarnings('from a_index | eval numberField in ("a", "b", "c")', [ + testErrorsAndWarnings('from a_index | eval doubleField in ("a", "b", "c")', [ // 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', ]); - testErrorsAndWarnings('from a_index | eval numberField not in ("a", "b", "c")', [ + testErrorsAndWarnings('from a_index | eval doubleField not in ("a", "b", "c")', [ // 'Argument of [not_in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', ]); - testErrorsAndWarnings('from a_index | eval numberField not in (1, 2, 3, stringField)', [ - // 'Argument of [not_in] must be [number[]], found value [(1, 2, 3, stringField)] type [(number, number, number, string)]', + testErrorsAndWarnings('from a_index | eval doubleField not in (1, 2, 3, textField)', [ + // 'Argument of [not_in] must be [number[]], found value [(1, 2, 3, textField)] type [(number, number, number, string)]', ]); - testErrorsAndWarnings('from a_index | eval avg(numberField)', [ + testErrorsAndWarnings('from a_index | eval avg(doubleField)', [ 'EVAL does not support function avg', ]); testErrorsAndWarnings( - 'from a_index | stats avg(numberField) | eval `avg(numberField)` + 1', + 'from a_index | stats avg(doubleField) | eval `avg(doubleField)` + 1', [] ); testErrorsAndWarnings('from a_index | eval not', [ @@ -1167,17 +1202,17 @@ describe('validation logic', () => { "SyntaxError: mismatched input 'in' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", ]); - testErrorsAndWarnings('from a_index | eval stringField in stringField', [ - "SyntaxError: missing '(' at 'stringField'", + testErrorsAndWarnings('from a_index | eval textField in textField', [ + "SyntaxError: missing '(' at 'textField'", "SyntaxError: mismatched input '' expecting {',', ')'}", ]); - testErrorsAndWarnings('from a_index | eval stringField in stringField)', [ - "SyntaxError: missing '(' at 'stringField'", + testErrorsAndWarnings('from a_index | eval textField in textField)', [ + "SyntaxError: missing '(' at 'textField'", 'Error: [in] function expects exactly 2 arguments, got 1.', ]); - testErrorsAndWarnings('from a_index | eval stringField not in stringField', [ - "SyntaxError: missing '(' at 'stringField'", + testErrorsAndWarnings('from a_index | eval textField not in textField', [ + "SyntaxError: missing '(' at 'textField'", "SyntaxError: mismatched input '' expecting {',', ')'}", ]); @@ -1236,8 +1271,8 @@ describe('validation logic', () => { ]); for (const op of ['*', '/', '%']) { testErrorsAndWarnings(`from a_index | eval var = now() ${op} 1 ${unit}`, [ - `Argument of [${op}] must be [number], found value [now()] type [date]`, - `Argument of [${op}] must be [number], found value [1 ${unit}] type [duration]`, + `Argument of [${op}] must be [double], found value [now()] type [date]`, + `Argument of [${op}] must be [double], found value [1 ${unit}] type [duration]`, ]); } } @@ -1250,26 +1285,26 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort "field" ', []); testErrorsAndWarnings('from a_index | sort wrongField ', ['Unknown column [wrongField]']); - testErrorsAndWarnings('from a_index | sort numberField, ', [ + testErrorsAndWarnings('from a_index | sort doubleField, ', [ "SyntaxError: mismatched input '' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", ]); - testErrorsAndWarnings('from a_index | sort numberField, stringField', []); + testErrorsAndWarnings('from a_index | sort doubleField, textField', []); for (const dir of ['desc', 'asc']) { testErrorsAndWarnings(`from a_index | sort "field" ${dir} `, []); - testErrorsAndWarnings(`from a_index | sort numberField ${dir} `, []); - testErrorsAndWarnings(`from a_index | sort numberField ${dir} nulls `, [ + testErrorsAndWarnings(`from a_index | sort doubleField ${dir} `, []); + testErrorsAndWarnings(`from a_index | sort doubleField ${dir} nulls `, [ "SyntaxError: missing {'first', 'last'} at ''", ]); for (const nullDir of ['first', 'last']) { - testErrorsAndWarnings(`from a_index | sort numberField ${dir} nulls ${nullDir}`, []); - testErrorsAndWarnings(`from a_index | sort numberField ${dir} ${nullDir}`, [ + testErrorsAndWarnings(`from a_index | sort doubleField ${dir} nulls ${nullDir}`, []); + testErrorsAndWarnings(`from a_index | sort doubleField ${dir} ${nullDir}`, [ `SyntaxError: extraneous input '${nullDir}' expecting `, ]); } } for (const nullDir of ['first', 'last']) { - testErrorsAndWarnings(`from a_index | sort numberField nulls ${nullDir}`, []); - testErrorsAndWarnings(`from a_index | sort numberField ${nullDir}`, [ + testErrorsAndWarnings(`from a_index | sort doubleField nulls ${nullDir}`, []); + testErrorsAndWarnings(`from a_index | sort doubleField ${nullDir}`, [ `SyntaxError: extraneous input '${nullDir}' expecting `, ]); } @@ -1279,18 +1314,18 @@ describe('validation logic', () => { describe('sorting by expressions', () => { // SORT accepts complex expressions testErrorsAndWarnings( - 'from a_index | sort abs(numberField) - to_long(stringField) desc nulls first', + 'from a_index | sort abs(doubleField) - to_long(textField) desc nulls first', [] ); // Expression parts are also validated - testErrorsAndWarnings('from a_index | sort sin(stringField)', [ - 'Argument of [sin] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | sort sin(textField)', [ + 'Argument of [sin] must be [double], found value [textField] type [text]', ]); // Expression parts are also validated - testErrorsAndWarnings('from a_index | sort numberField + stringField', [ - 'Argument of [+] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | sort doubleField + textField', [ + 'Argument of [+] must be [double], found value [textField] type [text]', ]); }); }); @@ -1364,52 +1399,52 @@ describe('validation logic', () => { "SyntaxError: mismatched input 'is' expecting ", 'Unknown column [this]', ]); - testErrorsAndWarnings(`from a_index | enrich policy on stringField with `, [ + testErrorsAndWarnings(`from a_index | enrich policy on textField with `, [ "SyntaxError: mismatched input '' expecting ID_PATTERN", ]); - testErrorsAndWarnings(`from a_index | enrich policy on stringField with var0 `, [ + testErrorsAndWarnings(`from a_index | enrich policy on textField with var0 `, [ 'Unknown column [var0]', ]); - testErrorsAndWarnings(`from a_index |enrich policy on numberField with var0 = `, [ + testErrorsAndWarnings(`from a_index |enrich policy on doubleField with var0 = `, [ "SyntaxError: missing ID_PATTERN at ''", 'Unknown column [var0]', ]); - testErrorsAndWarnings(`from a_index | enrich policy on stringField with var0 = c `, [ + testErrorsAndWarnings(`from a_index | enrich policy on textField with var0 = c `, [ 'Unknown column [var0]', `Unknown column [c]`, ]); // need to re-enable once the fields/variables become location aware - // testErrorsAndWarnings(`from a_index | enrich policy on stringField with var0 = stringField `, [ - // `Unknown column [stringField]`, + // testErrorsAndWarnings(`from a_index | enrich policy on textField with var0 = textField `, [ + // `Unknown column [textField]`, // ]); - testErrorsAndWarnings(`from a_index |enrich policy on numberField with var0 = , `, [ + testErrorsAndWarnings(`from a_index |enrich policy on doubleField with var0 = , `, [ "SyntaxError: missing ID_PATTERN at ','", "SyntaxError: mismatched input '' expecting ID_PATTERN", 'Unknown column [var0]', ]); testErrorsAndWarnings( - `from a_index | enrich policy on stringField with var0 = otherField, var1 `, + `from a_index | enrich policy on textField with var0 = otherField, var1 `, ['Unknown column [var1]'] ); testErrorsAndWarnings( - `from a_index | enrich policy on stringField with var0 = otherField `, + `from a_index | enrich policy on textField with var0 = otherField `, [] ); testErrorsAndWarnings( - `from a_index | enrich policy on stringField with var0 = otherField, yetAnotherField `, + `from a_index | enrich policy on textField with var0 = otherField, yetAnotherField `, [] ); testErrorsAndWarnings( - `from a_index |enrich policy on numberField with var0 = otherField, var1 = `, + `from a_index |enrich policy on doubleField with var0 = otherField, var1 = `, ["SyntaxError: missing ID_PATTERN at ''", 'Unknown column [var1]'] ); testErrorsAndWarnings( - `from a_index | enrich policy on stringField with var0 = otherField, var1 = yetAnotherField`, + `from a_index | enrich policy on textField with var0 = otherField, var1 = yetAnotherField`, [] ); testErrorsAndWarnings( - 'from a_index | enrich policy on stringField with var0 = otherField, `this``is fine` = yetAnotherField', + 'from a_index | enrich policy on textField with var0 = otherField, `this``is fine` = yetAnotherField', [] ); testErrorsAndWarnings(`from a_index | enrich policy with `, [ @@ -1425,14 +1460,14 @@ describe('validation logic', () => { describe('shadowing', () => { testErrorsAndWarnings( - 'from a_index | eval stringField = 5', + 'from a_index | eval textField = 5', [], - ['Column [stringField] of type string has been overwritten as new type: number'] + ['Column [textField] of type text has been overwritten as new type: integer'] ); testErrorsAndWarnings( - 'from a_index | eval numberField = "5"', + 'from a_index | eval doubleField = "5"', [], - ['Column [numberField] of type number has been overwritten as new type: string'] + ['Column [doubleField] of type double has been overwritten as new type: string'] ); }); @@ -1469,7 +1504,7 @@ describe('validation logic', () => { for (const nesting of NESTED_DEPTHS) { // start with a quotable expression - const expr = 'round(numberField) + 1'; + const expr = 'round(doubleField) + 1'; const startingQuery = `from a_index | eval ${expr}`; // now pipe for each nesting level a new eval command that appends a +1 to the previous quoted expression const finalQuery = `${startingQuery} | ${Array(nesting) @@ -1554,7 +1589,7 @@ describe('validation logic', () => { it(`should not crash if no callbacks are available`, async () => { try { await validateQuery( - `from a_index | eval b = a | enrich policy | dissect stringField "%{firstWord}"`, + `from a_index | eval b = a | enrich policy | dissect textField "%{firstWord}"`, getAstAndSyntaxErrors, undefined, { @@ -1571,7 +1606,7 @@ describe('validation logic', () => { it(`should not crash if no callbacks are passed`, async () => { try { await validateQuery( - `from a_index | eval b = a | enrich policy | dissect stringField "%{firstWord}"`, + `from a_index | eval b = a | enrich policy | dissect textField "%{firstWord}"`, getAstAndSyntaxErrors ); } catch { @@ -1582,40 +1617,47 @@ describe('validation logic', () => { describe('inline casting', () => { // accepts casting - testErrorsAndWarnings('from a_index | eval 1::string', []); + testErrorsAndWarnings('from a_index | eval 1::keyword', []); // errors if the cast type is invalid // testErrorsAndWarnings('from a_index | eval 1::foo', ['Invalid type [foo] for casting']); // accepts casting with multiple types - testErrorsAndWarnings('from a_index | eval 1::string::long::double', []); + testErrorsAndWarnings('from a_index | eval 1::keyword::long::double', []); // takes into account casting in function arguments testErrorsAndWarnings('from a_index | eval trim("23"::double)', [ - 'Argument of [trim] must be [string], found value ["23"::double] type [double]', + 'Argument of [trim] must be [keyword], found value ["23"::double] type [double]', ]); - testErrorsAndWarnings('from a_index | eval trim(23::string)', []); + testErrorsAndWarnings('from a_index | eval trim(23::keyword)', []); testErrorsAndWarnings('from a_index | eval 1 + "2"::long', []); + testErrorsAndWarnings('from a_index | eval 1 + "2"::LONG', []); + testErrorsAndWarnings('from a_index | eval 1 + "2"::Long', []); + testErrorsAndWarnings('from a_index | eval 1 + "2"::LoNg', []); + testErrorsAndWarnings('from a_index | eval 1 + "2"', [ // just a counter-case to make sure the previous test is meaningful - 'Argument of [+] must be [number], found value ["2"] type [string]', + 'Argument of [+] must be [date_period], found value [1] type [integer]', ]); testErrorsAndWarnings( - 'from a_index | eval trim(to_double("23")::string::double::long::string::double)', + 'from a_index | eval trim(to_double("23")::keyword::double::long::keyword::double)', [ - 'Argument of [trim] must be [string], found value [to_double("23")::string::double::long::string::double] type [double]', + 'Argument of [trim] must be [keyword], found value [to_double("23")::keyword::double::long::keyword::double] type [double]', ] ); - // accepts elasticsearch subtypes and type aliases like int and keyword - // (once https://github.com/elastic/kibana/issues/174710 is done this won't be a special case anymore) testErrorsAndWarnings('from a_index | eval CEIL(23::long)', []); testErrorsAndWarnings('from a_index | eval CEIL(23::unsigned_long)', []); testErrorsAndWarnings('from a_index | eval CEIL(23::int)', []); testErrorsAndWarnings('from a_index | eval CEIL(23::integer)', []); + testErrorsAndWarnings('from a_index | eval CEIL(23::Integer)', []); testErrorsAndWarnings('from a_index | eval CEIL(23::double)', []); + testErrorsAndWarnings('from a_index | eval CEIL(23::DOUBLE)', []); + testErrorsAndWarnings('from a_index | eval CEIL(23::doubla)', [ + 'Argument of [ceil] must be [double], found value [23::doubla] type [doubla]', + ]); - testErrorsAndWarnings('from a_index | eval TRIM(23::string)', []); + testErrorsAndWarnings('from a_index | eval TRIM(23::keyword)', []); testErrorsAndWarnings('from a_index | eval TRIM(23::text)', []); testErrorsAndWarnings('from a_index | eval TRIM(23::keyword)', []); @@ -1630,439 +1672,501 @@ describe('validation logic', () => { // testErrorsAndWarnings('from a_index | eval 23::cartesian_point', ['wrong type!']); // still validates nested functions when they are casted - testErrorsAndWarnings('from a_index | eval to_lower(trim(numberField)::string)', [ - 'Argument of [trim] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('from a_index | eval to_lower(trim(doubleField)::keyword)', [ + 'Argument of [trim] must be [keyword], found value [doubleField] type [double]', ]); testErrorsAndWarnings( - 'from a_index | eval to_upper(trim(numberField)::string::string::string::string)', - ['Argument of [trim] must be [string], found value [numberField] type [number]'] + 'from a_index | eval to_upper(trim(doubleField)::keyword::keyword::keyword::keyword)', + ['Argument of [trim] must be [keyword], found value [doubleField] type [double]'] ); testErrorsAndWarnings( - 'from a_index | eval to_lower(to_upper(trim(numberField)::string)::string)', - ['Argument of [trim] must be [string], found value [numberField] type [number]'] + 'from a_index | eval to_lower(to_upper(trim(doubleField)::keyword)::keyword)', + ['Argument of [trim] must be [keyword], found value [doubleField] type [double]'] ); }); describe(FUNCTION_DESCRIBE_BLOCK_NAME, () => { - describe('date_diff', () => { - testErrorsAndWarnings( - `row var = date_diff("month", "2023-12-02T11:00:00.000Z", "2023-12-02T11:00:00.000Z")`, - [] - ); - - testErrorsAndWarnings( - `row var = date_diff("mm", "2023-12-02T11:00:00.000Z", "2023-12-02T11:00:00.000Z")`, - [] - ); - - testErrorsAndWarnings( - `row var = date_diff("bogus", "2023-12-02T11:00:00.000Z", "2023-12-02T11:00:00.000Z")`, - [], - [ - 'Invalid option ["bogus"] for date_diff. Supported options: ["year", "years", "yy", "yyyy", "quarter", "quarters", "qq", "q", "month", "months", "mm", "m", "dayofyear", "dy", "y", "day", "days", "dd", "d", "week", "weeks", "wk", "ww", "weekday", "weekdays", "dw", "hour", "hours", "hh", "minute", "minutes", "mi", "n", "second", "seconds", "ss", "s", "millisecond", "milliseconds", "ms", "microsecond", "microseconds", "mcs", "nanosecond", "nanoseconds", "ns"].', - ] - ); - - testErrorsAndWarnings( - `from a_index | eval date_diff(stringField, "2023-12-02T11:00:00.000Z", "2023-12-02T11:00:00.000Z")`, - [] - ); - - testErrorsAndWarnings( - `from a_index | eval date_diff("month", dateField, "2023-12-02T11:00:00.000Z")`, - [] - ); - - testErrorsAndWarnings( - `from a_index | eval date_diff("month", "2023-12-02T11:00:00.000Z", dateField)`, - [] - ); - - testErrorsAndWarnings(`from a_index | eval date_diff("month", stringField, dateField)`, [ - 'Argument of [date_diff] must be [date], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings(`from a_index | eval date_diff("month", dateField, stringField)`, [ - 'Argument of [date_diff] must be [date], found value [stringField] type [string]', - ]); - testErrorsAndWarnings( - 'from a_index | eval var = date_diff("year", dateField, dateField)', - [] - ); - testErrorsAndWarnings('from a_index | eval date_diff("year", dateField, dateField)', []); - - testErrorsAndWarnings( - 'from a_index | eval var = date_diff("year", to_datetime(stringField), to_datetime(stringField))', - [] - ); - - testErrorsAndWarnings( - 'from a_index | eval date_diff(numberField, stringField, stringField)', - [ - 'Argument of [date_diff] must be [string], found value [numberField] type [number]', - 'Argument of [date_diff] must be [date], found value [stringField] type [string]', - 'Argument of [date_diff] must be [date], found value [stringField] type [string]', - ] - ); - - testErrorsAndWarnings( - 'from a_index | eval date_diff("year", dateField, dateField, extraArg)', - ['Error: [date_diff] function expects exactly 3 arguments, got 4.'] - ); - - testErrorsAndWarnings('from a_index | sort date_diff("year", dateField, dateField)', []); - - testErrorsAndWarnings( - 'from a_index | eval var = date_diff("year", to_datetime(dateField), to_datetime(dateField))', - [] - ); - - testErrorsAndWarnings( - 'from a_index | eval date_diff(booleanField, booleanField, booleanField)', - [ - 'Argument of [date_diff] must be [string], found value [booleanField] type [boolean]', - 'Argument of [date_diff] must be [date], found value [booleanField] type [boolean]', - 'Argument of [date_diff] must be [date], found value [booleanField] type [boolean]', - ] - ); - testErrorsAndWarnings('from a_index | eval date_diff(null, null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval date_diff(nullVar, nullVar, nullVar)', []); - - testErrorsAndWarnings('from a_index | eval date_diff("year", "2022", "2022")', []); - testErrorsAndWarnings( - 'from a_index | eval date_diff("year", concat("20", "22"), concat("20", "22"))', - [ - 'Argument of [date_diff] must be [date], found value [concat("20","22")] type [string]', - 'Argument of [date_diff] must be [date], found value [concat("20","22")] type [string]', - ] - ); - }); - describe('abs', () => { + testErrorsAndWarnings('row var = abs(5.5)', []); + testErrorsAndWarnings('row abs(5.5)', []); + testErrorsAndWarnings('row var = abs(to_double(true))', []); testErrorsAndWarnings('row var = abs(5)', []); testErrorsAndWarnings('row abs(5)', []); - testErrorsAndWarnings('row var = abs(to_integer("a"))', []); + testErrorsAndWarnings('row var = abs(to_integer(true))', []); - testErrorsAndWarnings('row var = abs("a")', [ - 'Argument of [abs] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('row var = abs(true)', [ + 'Argument of [abs] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where abs(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where abs(doubleField) > 0', []); - testErrorsAndWarnings('from a_index | where abs(stringField) > 0', [ - 'Argument of [abs] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where abs(booleanField) > 0', [ + 'Argument of [abs] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = abs(numberField)', []); - testErrorsAndWarnings('from a_index | eval abs(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = abs(to_integer(stringField))', []); - - testErrorsAndWarnings('from a_index | eval abs(stringField)', [ - 'Argument of [abs] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings('from a_index | where abs(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where abs(longField) > 0', []); + testErrorsAndWarnings('from a_index | where abs(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = abs(doubleField)', []); + testErrorsAndWarnings('from a_index | eval abs(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = abs(to_double(booleanField))', []); - testErrorsAndWarnings('from a_index | eval abs(numberField, extraArg)', [ - 'Error: [abs] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval abs(booleanField)', [ + 'Argument of [abs] must be [double], found value [booleanField] type [boolean]', ]); testErrorsAndWarnings('from a_index | eval var = abs(*)', [ 'Using wildcards (*) in abs is not allowed', ]); - testErrorsAndWarnings('from a_index | sort abs(numberField)', []); - testErrorsAndWarnings('row var = abs(to_integer(true))', []); - - testErrorsAndWarnings('row var = abs(true)', [ - 'Argument of [abs] must be [number], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where abs(booleanField) > 0', [ - 'Argument of [abs] must be [number], found value [booleanField] type [boolean]', - ]); - + testErrorsAndWarnings('from a_index | eval var = abs(integerField)', []); + testErrorsAndWarnings('from a_index | eval abs(integerField)', []); testErrorsAndWarnings('from a_index | eval var = abs(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = abs(longField)', []); + testErrorsAndWarnings('from a_index | eval abs(longField)', []); + testErrorsAndWarnings('from a_index | eval var = abs(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval abs(unsignedLongField)', []); - testErrorsAndWarnings('from a_index | eval abs(booleanField)', [ - 'Argument of [abs] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval abs(doubleField, extraArg)', [ + 'Error: [abs] function expects exactly one argument, got 2.', ]); + + testErrorsAndWarnings('from a_index | sort abs(doubleField)', []); testErrorsAndWarnings('from a_index | eval abs(null)', []); testErrorsAndWarnings('row nullVar = null | eval abs(nullVar)', []); }); describe('acos', () => { + testErrorsAndWarnings('row var = acos(5.5)', []); + testErrorsAndWarnings('row acos(5.5)', []); + testErrorsAndWarnings('row var = acos(to_double(true))', []); testErrorsAndWarnings('row var = acos(5)', []); testErrorsAndWarnings('row acos(5)', []); - testErrorsAndWarnings('row var = acos(to_integer("a"))', []); + testErrorsAndWarnings('row var = acos(to_integer(true))', []); - testErrorsAndWarnings('row var = acos("a")', [ - 'Argument of [acos] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('row var = acos(true)', [ + 'Argument of [acos] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where acos(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where acos(doubleField) > 0', []); - testErrorsAndWarnings('from a_index | where acos(stringField) > 0', [ - 'Argument of [acos] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where acos(booleanField) > 0', [ + 'Argument of [acos] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = acos(numberField)', []); - testErrorsAndWarnings('from a_index | eval acos(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = acos(to_integer(stringField))', []); - - testErrorsAndWarnings('from a_index | eval acos(stringField)', [ - 'Argument of [acos] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings('from a_index | where acos(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where acos(longField) > 0', []); + testErrorsAndWarnings('from a_index | where acos(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = acos(doubleField)', []); + testErrorsAndWarnings('from a_index | eval acos(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = acos(to_double(booleanField))', []); - testErrorsAndWarnings('from a_index | eval acos(numberField, extraArg)', [ - 'Error: [acos] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval acos(booleanField)', [ + 'Argument of [acos] must be [double], found value [booleanField] type [boolean]', ]); testErrorsAndWarnings('from a_index | eval var = acos(*)', [ 'Using wildcards (*) in acos is not allowed', ]); - testErrorsAndWarnings('from a_index | sort acos(numberField)', []); - testErrorsAndWarnings('row var = acos(to_integer(true))', []); - - testErrorsAndWarnings('row var = acos(true)', [ - 'Argument of [acos] must be [number], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where acos(booleanField) > 0', [ - 'Argument of [acos] must be [number], found value [booleanField] type [boolean]', - ]); - + testErrorsAndWarnings('from a_index | eval var = acos(integerField)', []); + testErrorsAndWarnings('from a_index | eval acos(integerField)', []); testErrorsAndWarnings('from a_index | eval var = acos(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = acos(longField)', []); + testErrorsAndWarnings('from a_index | eval acos(longField)', []); + testErrorsAndWarnings('from a_index | eval var = acos(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval acos(unsignedLongField)', []); - testErrorsAndWarnings('from a_index | eval acos(booleanField)', [ - 'Argument of [acos] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval acos(doubleField, extraArg)', [ + 'Error: [acos] function expects exactly one argument, got 2.', ]); + + testErrorsAndWarnings('from a_index | sort acos(doubleField)', []); testErrorsAndWarnings('from a_index | eval acos(null)', []); testErrorsAndWarnings('row nullVar = null | eval acos(nullVar)', []); }); describe('asin', () => { + testErrorsAndWarnings('row var = asin(5.5)', []); + testErrorsAndWarnings('row asin(5.5)', []); + testErrorsAndWarnings('row var = asin(to_double(true))', []); testErrorsAndWarnings('row var = asin(5)', []); testErrorsAndWarnings('row asin(5)', []); - testErrorsAndWarnings('row var = asin(to_integer("a"))', []); + testErrorsAndWarnings('row var = asin(to_integer(true))', []); - testErrorsAndWarnings('row var = asin("a")', [ - 'Argument of [asin] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('row var = asin(true)', [ + 'Argument of [asin] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where asin(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where asin(doubleField) > 0', []); - testErrorsAndWarnings('from a_index | where asin(stringField) > 0', [ - 'Argument of [asin] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where asin(booleanField) > 0', [ + 'Argument of [asin] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = asin(numberField)', []); - testErrorsAndWarnings('from a_index | eval asin(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = asin(to_integer(stringField))', []); - - testErrorsAndWarnings('from a_index | eval asin(stringField)', [ - 'Argument of [asin] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings('from a_index | where asin(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where asin(longField) > 0', []); + testErrorsAndWarnings('from a_index | where asin(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = asin(doubleField)', []); + testErrorsAndWarnings('from a_index | eval asin(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = asin(to_double(booleanField))', []); - testErrorsAndWarnings('from a_index | eval asin(numberField, extraArg)', [ - 'Error: [asin] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval asin(booleanField)', [ + 'Argument of [asin] must be [double], found value [booleanField] type [boolean]', ]); testErrorsAndWarnings('from a_index | eval var = asin(*)', [ 'Using wildcards (*) in asin is not allowed', ]); - testErrorsAndWarnings('from a_index | sort asin(numberField)', []); - testErrorsAndWarnings('row var = asin(to_integer(true))', []); - - testErrorsAndWarnings('row var = asin(true)', [ - 'Argument of [asin] must be [number], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where asin(booleanField) > 0', [ - 'Argument of [asin] must be [number], found value [booleanField] type [boolean]', - ]); - + testErrorsAndWarnings('from a_index | eval var = asin(integerField)', []); + testErrorsAndWarnings('from a_index | eval asin(integerField)', []); testErrorsAndWarnings('from a_index | eval var = asin(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = asin(longField)', []); + testErrorsAndWarnings('from a_index | eval asin(longField)', []); + testErrorsAndWarnings('from a_index | eval var = asin(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval asin(unsignedLongField)', []); - testErrorsAndWarnings('from a_index | eval asin(booleanField)', [ - 'Argument of [asin] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval asin(doubleField, extraArg)', [ + 'Error: [asin] function expects exactly one argument, got 2.', ]); + + testErrorsAndWarnings('from a_index | sort asin(doubleField)', []); testErrorsAndWarnings('from a_index | eval asin(null)', []); testErrorsAndWarnings('row nullVar = null | eval asin(nullVar)', []); }); describe('atan', () => { + testErrorsAndWarnings('row var = atan(5.5)', []); + testErrorsAndWarnings('row atan(5.5)', []); + testErrorsAndWarnings('row var = atan(to_double(true))', []); testErrorsAndWarnings('row var = atan(5)', []); testErrorsAndWarnings('row atan(5)', []); - testErrorsAndWarnings('row var = atan(to_integer("a"))', []); + testErrorsAndWarnings('row var = atan(to_integer(true))', []); - testErrorsAndWarnings('row var = atan("a")', [ - 'Argument of [atan] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('row var = atan(true)', [ + 'Argument of [atan] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where atan(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where atan(doubleField) > 0', []); - testErrorsAndWarnings('from a_index | where atan(stringField) > 0', [ - 'Argument of [atan] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where atan(booleanField) > 0', [ + 'Argument of [atan] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = atan(numberField)', []); - testErrorsAndWarnings('from a_index | eval atan(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = atan(to_integer(stringField))', []); - - testErrorsAndWarnings('from a_index | eval atan(stringField)', [ - 'Argument of [atan] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings('from a_index | where atan(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where atan(longField) > 0', []); + testErrorsAndWarnings('from a_index | where atan(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = atan(doubleField)', []); + testErrorsAndWarnings('from a_index | eval atan(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = atan(to_double(booleanField))', []); - testErrorsAndWarnings('from a_index | eval atan(numberField, extraArg)', [ - 'Error: [atan] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval atan(booleanField)', [ + 'Argument of [atan] must be [double], found value [booleanField] type [boolean]', ]); testErrorsAndWarnings('from a_index | eval var = atan(*)', [ 'Using wildcards (*) in atan is not allowed', ]); - testErrorsAndWarnings('from a_index | sort atan(numberField)', []); - testErrorsAndWarnings('row var = atan(to_integer(true))', []); - - testErrorsAndWarnings('row var = atan(true)', [ - 'Argument of [atan] must be [number], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where atan(booleanField) > 0', [ - 'Argument of [atan] must be [number], found value [booleanField] type [boolean]', - ]); - + testErrorsAndWarnings('from a_index | eval var = atan(integerField)', []); + testErrorsAndWarnings('from a_index | eval atan(integerField)', []); testErrorsAndWarnings('from a_index | eval var = atan(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = atan(longField)', []); + testErrorsAndWarnings('from a_index | eval atan(longField)', []); + testErrorsAndWarnings('from a_index | eval var = atan(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval atan(unsignedLongField)', []); - testErrorsAndWarnings('from a_index | eval atan(booleanField)', [ - 'Argument of [atan] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval atan(doubleField, extraArg)', [ + 'Error: [atan] function expects exactly one argument, got 2.', ]); + + testErrorsAndWarnings('from a_index | sort atan(doubleField)', []); testErrorsAndWarnings('from a_index | eval atan(null)', []); testErrorsAndWarnings('row nullVar = null | eval atan(nullVar)', []); }); describe('atan2', () => { + testErrorsAndWarnings('row var = atan2(5.5, 5.5)', []); + testErrorsAndWarnings('row atan2(5.5, 5.5)', []); + testErrorsAndWarnings('row var = atan2(to_double(true), to_double(true))', []); + testErrorsAndWarnings('row var = atan2(5.5, 5)', []); + testErrorsAndWarnings('row atan2(5.5, 5)', []); + testErrorsAndWarnings('row var = atan2(to_double(true), to_integer(true))', []); + testErrorsAndWarnings('row var = atan2(to_double(true), 5)', []); + testErrorsAndWarnings('row var = atan2(5, 5.5)', []); + testErrorsAndWarnings('row atan2(5, 5.5)', []); + testErrorsAndWarnings('row var = atan2(to_integer(true), to_double(true))', []); testErrorsAndWarnings('row var = atan2(5, 5)', []); testErrorsAndWarnings('row atan2(5, 5)', []); - testErrorsAndWarnings('row var = atan2(to_integer("a"), to_integer("a"))', []); + testErrorsAndWarnings('row var = atan2(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = atan2(to_integer(true), 5)', []); + testErrorsAndWarnings('row var = atan2(5, to_double(true))', []); + testErrorsAndWarnings('row var = atan2(5, to_integer(true))', []); - testErrorsAndWarnings('row var = atan2("a", "a")', [ - 'Argument of [atan2] must be [number], found value ["a"] type [string]', - 'Argument of [atan2] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('row var = atan2(true, true)', [ + 'Argument of [atan2] must be [double], found value [true] type [boolean]', + 'Argument of [atan2] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where atan2(numberField, numberField) > 0', []); + testErrorsAndWarnings('from a_index | where atan2(doubleField, doubleField) > 0', []); - testErrorsAndWarnings('from a_index | where atan2(stringField, stringField) > 0', [ - 'Argument of [atan2] must be [number], found value [stringField] type [string]', - 'Argument of [atan2] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where atan2(booleanField, booleanField) > 0', [ + 'Argument of [atan2] must be [double], found value [booleanField] type [boolean]', + 'Argument of [atan2] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = atan2(numberField, numberField)', []); - testErrorsAndWarnings('from a_index | eval atan2(numberField, numberField)', []); - + testErrorsAndWarnings('from a_index | where atan2(doubleField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where atan2(doubleField, longField) > 0', []); + testErrorsAndWarnings('from a_index | where atan2(doubleField, unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | where atan2(integerField, doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where atan2(integerField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where atan2(integerField, longField) > 0', []); testErrorsAndWarnings( - 'from a_index | eval var = atan2(to_integer(stringField), to_integer(stringField))', + 'from a_index | where atan2(integerField, unsignedLongField) > 0', [] ); + testErrorsAndWarnings('from a_index | where atan2(longField, doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where atan2(longField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where atan2(longField, longField) > 0', []); + testErrorsAndWarnings('from a_index | where atan2(longField, unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | where atan2(unsignedLongField, doubleField) > 0', []); + testErrorsAndWarnings( + 'from a_index | where atan2(unsignedLongField, integerField) > 0', + [] + ); + testErrorsAndWarnings('from a_index | where atan2(unsignedLongField, longField) > 0', []); + testErrorsAndWarnings( + 'from a_index | where atan2(unsignedLongField, unsignedLongField) > 0', + [] + ); + testErrorsAndWarnings('from a_index | eval var = atan2(doubleField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval atan2(doubleField, doubleField)', []); - testErrorsAndWarnings('from a_index | eval atan2(stringField, stringField)', [ - 'Argument of [atan2] must be [number], found value [stringField] type [string]', - 'Argument of [atan2] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval atan2(numberField, numberField, extraArg)', [ - 'Error: [atan2] function expects exactly 2 arguments, got 3.', - ]); - - testErrorsAndWarnings('from a_index | sort atan2(numberField, numberField)', []); - testErrorsAndWarnings('row var = atan2(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(to_double(booleanField), to_double(booleanField))', + [] + ); - testErrorsAndWarnings('row var = atan2(true, true)', [ - 'Argument of [atan2] must be [number], found value [true] type [boolean]', - 'Argument of [atan2] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval atan2(booleanField, booleanField)', [ + 'Argument of [atan2] must be [double], found value [booleanField] type [boolean]', + 'Argument of [atan2] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where atan2(booleanField, booleanField) > 0', [ - 'Argument of [atan2] must be [number], found value [booleanField] type [boolean]', - 'Argument of [atan2] must be [number], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | eval var = atan2(doubleField, integerField)', []); + testErrorsAndWarnings('from a_index | eval atan2(doubleField, integerField)', []); testErrorsAndWarnings( - 'from a_index | eval var = atan2(to_integer(booleanField), to_integer(booleanField))', + 'from a_index | eval var = atan2(to_double(booleanField), to_integer(booleanField))', [] ); - testErrorsAndWarnings('from a_index | eval atan2(booleanField, booleanField)', [ - 'Argument of [atan2] must be [number], found value [booleanField] type [boolean]', - 'Argument of [atan2] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval atan2(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval atan2(nullVar, nullVar)', []); - }); + testErrorsAndWarnings('from a_index | eval var = atan2(doubleField, longField)', []); + testErrorsAndWarnings('from a_index | eval atan2(doubleField, longField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(to_double(booleanField), longField)', + [] + ); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(doubleField, unsignedLongField)', + [] + ); + testErrorsAndWarnings('from a_index | eval atan2(doubleField, unsignedLongField)', []); - describe('case', () => { - testErrorsAndWarnings('row var = case(true, "a")', []); - testErrorsAndWarnings('row case(true, "a")', []); - testErrorsAndWarnings('from a_index | eval var = case(booleanField, stringField)', []); - testErrorsAndWarnings('from a_index | eval case(booleanField, stringField)', []); - testErrorsAndWarnings('from a_index | sort case(booleanField, stringField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(to_double(booleanField), unsignedLongField)', + [] + ); - testErrorsAndWarnings('row var = case(to_cartesianpoint("POINT (30 10)"), true)', [ - 'Argument of [case] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', - ]); - testErrorsAndWarnings('from a_index | eval case(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval case(nullVar, nullVar)', []); - }); + testErrorsAndWarnings('from a_index | eval var = atan2(integerField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval atan2(integerField, doubleField)', []); - describe('ceil', () => { - testErrorsAndWarnings('row var = ceil(5)', []); - testErrorsAndWarnings('row ceil(5)', []); - testErrorsAndWarnings('row var = ceil(to_integer("a"))', []); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(to_integer(booleanField), to_double(booleanField))', + [] + ); - testErrorsAndWarnings('row var = ceil("a")', [ - 'Argument of [ceil] must be [number], found value ["a"] type [string]', - ]); + testErrorsAndWarnings('from a_index | eval var = atan2(integerField, integerField)', []); + testErrorsAndWarnings('from a_index | eval atan2(integerField, integerField)', []); - testErrorsAndWarnings('from a_index | where ceil(numberField) > 0', []); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(to_integer(booleanField), to_integer(booleanField))', + [] + ); - testErrorsAndWarnings('from a_index | where ceil(stringField) > 0', [ - 'Argument of [ceil] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings('from a_index | eval var = atan2(integerField, longField)', []); + testErrorsAndWarnings('from a_index | eval atan2(integerField, longField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(to_integer(booleanField), longField)', + [] + ); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(integerField, unsignedLongField)', + [] + ); + testErrorsAndWarnings('from a_index | eval atan2(integerField, unsignedLongField)', []); - testErrorsAndWarnings('from a_index | eval var = ceil(numberField)', []); - testErrorsAndWarnings('from a_index | eval ceil(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = ceil(to_integer(stringField))', []); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(to_integer(booleanField), unsignedLongField)', + [] + ); - testErrorsAndWarnings('from a_index | eval ceil(stringField)', [ - 'Argument of [ceil] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval var = atan2(longField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval atan2(longField, doubleField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(longField, to_double(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = atan2(longField, integerField)', []); + testErrorsAndWarnings('from a_index | eval atan2(longField, integerField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(longField, to_integer(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = atan2(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval atan2(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval var = atan2(longField, unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval atan2(longField, unsignedLongField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = atan2(unsignedLongField, doubleField)', + [] + ); + testErrorsAndWarnings('from a_index | eval atan2(unsignedLongField, doubleField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = atan2(unsignedLongField, to_double(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = atan2(unsignedLongField, integerField)', + [] + ); + testErrorsAndWarnings('from a_index | eval atan2(unsignedLongField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = atan2(unsignedLongField, to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = atan2(unsignedLongField, longField)', []); + testErrorsAndWarnings('from a_index | eval atan2(unsignedLongField, longField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = atan2(unsignedLongField, unsignedLongField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval atan2(unsignedLongField, unsignedLongField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval atan2(doubleField, doubleField, extraArg)', [ + 'Error: [atan2] function expects exactly 2 arguments, got 3.', ]); - testErrorsAndWarnings('from a_index | eval ceil(numberField, extraArg)', [ - 'Error: [ceil] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | sort atan2(doubleField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval atan2(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval atan2(nullVar, nullVar)', []); + }); + + describe('cbrt', () => { + testErrorsAndWarnings('row var = cbrt(5.5)', []); + testErrorsAndWarnings('row cbrt(5.5)', []); + testErrorsAndWarnings('row var = cbrt(to_double(true))', []); + testErrorsAndWarnings('row var = cbrt(5)', []); + testErrorsAndWarnings('row cbrt(5)', []); + testErrorsAndWarnings('row var = cbrt(to_integer(true))', []); + + testErrorsAndWarnings('row var = cbrt(true)', [ + 'Argument of [cbrt] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = ceil(*)', [ - 'Using wildcards (*) in ceil is not allowed', + testErrorsAndWarnings('from a_index | where cbrt(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where cbrt(booleanField) > 0', [ + 'Argument of [cbrt] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where cbrt(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where cbrt(longField) > 0', []); + testErrorsAndWarnings('from a_index | where cbrt(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = cbrt(doubleField)', []); + testErrorsAndWarnings('from a_index | eval cbrt(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = cbrt(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval cbrt(booleanField)', [ + 'Argument of [cbrt] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = cbrt(*)', [ + 'Using wildcards (*) in cbrt is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = cbrt(integerField)', []); + testErrorsAndWarnings('from a_index | eval cbrt(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = cbrt(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = cbrt(longField)', []); + testErrorsAndWarnings('from a_index | eval cbrt(longField)', []); + testErrorsAndWarnings('from a_index | eval var = cbrt(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval cbrt(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval cbrt(doubleField, extraArg)', [ + 'Error: [cbrt] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | sort ceil(numberField)', []); + testErrorsAndWarnings('from a_index | sort cbrt(doubleField)', []); + testErrorsAndWarnings('from a_index | eval cbrt(null)', []); + testErrorsAndWarnings('row nullVar = null | eval cbrt(nullVar)', []); + }); + + describe('ceil', () => { + testErrorsAndWarnings('row var = ceil(5.5)', []); + testErrorsAndWarnings('row ceil(5.5)', []); + testErrorsAndWarnings('row var = ceil(to_double(true))', []); + testErrorsAndWarnings('row var = ceil(5)', []); + testErrorsAndWarnings('row ceil(5)', []); testErrorsAndWarnings('row var = ceil(to_integer(true))', []); testErrorsAndWarnings('row var = ceil(true)', [ - 'Argument of [ceil] must be [number], found value [true] type [boolean]', + 'Argument of [ceil] must be [double], found value [true] type [boolean]', ]); + testErrorsAndWarnings('from a_index | where ceil(doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where ceil(booleanField) > 0', [ - 'Argument of [ceil] must be [number], found value [booleanField] type [boolean]', + 'Argument of [ceil] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = ceil(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | where ceil(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where ceil(longField) > 0', []); + testErrorsAndWarnings('from a_index | where ceil(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = ceil(doubleField)', []); + testErrorsAndWarnings('from a_index | eval ceil(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = ceil(to_double(booleanField))', []); testErrorsAndWarnings('from a_index | eval ceil(booleanField)', [ - 'Argument of [ceil] must be [number], found value [booleanField] type [boolean]', + 'Argument of [ceil] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = ceil(*)', [ + 'Using wildcards (*) in ceil is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = ceil(integerField)', []); + testErrorsAndWarnings('from a_index | eval ceil(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = ceil(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = ceil(longField)', []); + testErrorsAndWarnings('from a_index | eval ceil(longField)', []); + testErrorsAndWarnings('from a_index | eval var = ceil(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval ceil(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval ceil(doubleField, extraArg)', [ + 'Error: [ceil] function expects exactly one argument, got 2.', ]); + + testErrorsAndWarnings('from a_index | sort ceil(doubleField)', []); testErrorsAndWarnings('from a_index | eval ceil(null)', []); testErrorsAndWarnings('row nullVar = null | eval ceil(nullVar)', []); }); @@ -2070,27 +2174,6 @@ describe('validation logic', () => { describe('cidr_match', () => { testErrorsAndWarnings('row var = cidr_match(to_ip("127.0.0.1"), "a")', []); testErrorsAndWarnings('row cidr_match(to_ip("127.0.0.1"), "a")', []); - testErrorsAndWarnings('row var = cidr_match(to_ip("a"), to_string("a"))', []); - - testErrorsAndWarnings('row var = cidr_match("a", 5)', [ - 'Argument of [cidr_match] must be [ip], found value ["a"] type [string]', - 'Argument of [cidr_match] must be [string], found value [5] type [number]', - ]); - - testErrorsAndWarnings('from a_index | eval var = cidr_match(ipField, stringField)', []); - testErrorsAndWarnings('from a_index | eval cidr_match(ipField, stringField)', []); - - testErrorsAndWarnings( - 'from a_index | eval var = cidr_match(to_ip(stringField), to_string(stringField))', - [] - ); - - testErrorsAndWarnings('from a_index | eval cidr_match(stringField, numberField)', [ - 'Argument of [cidr_match] must be [ip], found value [stringField] type [string]', - 'Argument of [cidr_match] must be [string], found value [numberField] type [number]', - ]); - - testErrorsAndWarnings('from a_index | sort cidr_match(ipField, stringField)', []); testErrorsAndWarnings( 'row var = cidr_match(to_ip(to_ip("127.0.0.1")), to_string(true))', [] @@ -2098,9 +2181,12 @@ describe('validation logic', () => { testErrorsAndWarnings('row var = cidr_match(true, true)', [ 'Argument of [cidr_match] must be [ip], found value [true] type [boolean]', - 'Argument of [cidr_match] must be [string], found value [true] type [boolean]', + 'Argument of [cidr_match] must be [keyword], found value [true] type [boolean]', ]); + testErrorsAndWarnings('from a_index | eval var = cidr_match(ipField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval cidr_match(ipField, keywordField)', []); + testErrorsAndWarnings( 'from a_index | eval var = cidr_match(to_ip(ipField), to_string(booleanField))', [] @@ -2108,181 +2194,146 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval cidr_match(booleanField, booleanField)', [ 'Argument of [cidr_match] must be [ip], found value [booleanField] type [boolean]', - 'Argument of [cidr_match] must be [string], found value [booleanField] type [boolean]', + 'Argument of [cidr_match] must be [keyword], found value [booleanField] type [boolean]', ]); + + testErrorsAndWarnings('from a_index | eval var = cidr_match(ipField, textField)', []); + testErrorsAndWarnings('from a_index | eval cidr_match(ipField, textField)', []); + testErrorsAndWarnings('from a_index | sort cidr_match(ipField, keywordField)', []); testErrorsAndWarnings('from a_index | eval cidr_match(null, null)', []); testErrorsAndWarnings('row nullVar = null | eval cidr_match(nullVar, nullVar)', []); }); describe('coalesce', () => { - testErrorsAndWarnings('row var = coalesce(5)', []); - testErrorsAndWarnings('row coalesce(5)', []); - testErrorsAndWarnings('row var = coalesce(to_integer(true))', []); - testErrorsAndWarnings('row var = coalesce(5, 5)', []); - testErrorsAndWarnings('row coalesce(5, 5)', []); - testErrorsAndWarnings('row var = coalesce(to_integer(true), to_integer(true))', []); - testErrorsAndWarnings('row var = coalesce(now())', []); - testErrorsAndWarnings('row coalesce(now())', []); - testErrorsAndWarnings('row var = coalesce(to_datetime(now()))', []); - testErrorsAndWarnings('row var = coalesce(now(), now())', []); - testErrorsAndWarnings('row coalesce(now(), now())', []); - testErrorsAndWarnings('row var = coalesce(to_datetime(now()), to_datetime(now()))', []); - testErrorsAndWarnings('row var = coalesce("a")', []); - testErrorsAndWarnings('row coalesce("a")', []); - testErrorsAndWarnings('row var = coalesce(to_string(true))', []); - testErrorsAndWarnings('row var = coalesce("a", "a")', []); - testErrorsAndWarnings('row coalesce("a", "a")', []); - testErrorsAndWarnings('row var = coalesce(to_string(true), to_string(true))', []); testErrorsAndWarnings('row var = coalesce(true)', []); testErrorsAndWarnings('row coalesce(true)', []); testErrorsAndWarnings('row var = coalesce(to_boolean(true))', []); testErrorsAndWarnings('row var = coalesce(true, true)', []); testErrorsAndWarnings('row coalesce(true, true)', []); testErrorsAndWarnings('row var = coalesce(to_boolean(true), to_boolean(true))', []); - testErrorsAndWarnings('row var = coalesce(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row coalesce(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row var = coalesce(to_ip(to_ip("127.0.0.1")))', []); - testErrorsAndWarnings('row var = coalesce(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row coalesce(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); - - testErrorsAndWarnings( - 'row var = coalesce(to_ip(to_ip("127.0.0.1")), to_ip(to_ip("127.0.0.1")))', - [] - ); - - testErrorsAndWarnings('row var = coalesce(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row coalesce(to_cartesianpoint("POINT (30 10)"))', []); - - testErrorsAndWarnings( - 'row var = coalesce(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', - [] - ); - - testErrorsAndWarnings( - 'row var = coalesce(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', - [] - ); + testErrorsAndWarnings('row var = coalesce(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row coalesce(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); testErrorsAndWarnings( - 'row coalesce(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', - [] + 'row var = coalesce(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] ); testErrorsAndWarnings( - 'row var = coalesce(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'row var = coalesce(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', [] ); - testErrorsAndWarnings('row var = coalesce(to_cartesianshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row coalesce(to_cartesianshape("POINT (30 10)"))', []); - testErrorsAndWarnings( - 'row var = coalesce(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'row coalesce(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', [] ); testErrorsAndWarnings( - 'row var = coalesce(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', - [] + 'row var = coalesce(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] ); testErrorsAndWarnings( - 'row coalesce(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'row var = coalesce(to_datetime("2021-01-01T00:00:00Z"), to_datetime("2021-01-01T00:00:00Z"))', [] ); testErrorsAndWarnings( - 'row var = coalesce(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'row coalesce(to_datetime("2021-01-01T00:00:00Z"), to_datetime("2021-01-01T00:00:00Z"))', [] ); - testErrorsAndWarnings('row var = coalesce(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row coalesce(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = coalesce(to_geopoint(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings( - 'row var = coalesce(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'row var = coalesce(to_datetime(to_datetime("2021-01-01T00:00:00Z")), to_datetime(to_datetime("2021-01-01T00:00:00Z")))', [] ); + testErrorsAndWarnings('row var = coalesce(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row coalesce(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); testErrorsAndWarnings( - 'row coalesce(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', - [] + 'row var = coalesce(to_geopoint(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] ); testErrorsAndWarnings( - 'row var = coalesce(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + 'row var = coalesce(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', [] ); - testErrorsAndWarnings('row var = coalesce(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row coalesce(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = coalesce(to_geoshape(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings( - 'row var = coalesce(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'row coalesce(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', [] ); testErrorsAndWarnings( - 'row coalesce(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', - [] + 'row var = coalesce(to_geoshape(geoPointField), to_geoshape(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] ); + testErrorsAndWarnings('row var = coalesce(5)', []); + testErrorsAndWarnings('row coalesce(5)', []); + testErrorsAndWarnings('row var = coalesce(to_integer(true))', []); + testErrorsAndWarnings('row var = coalesce(5, 5)', []); + testErrorsAndWarnings('row coalesce(5, 5)', []); + testErrorsAndWarnings('row var = coalesce(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = coalesce(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row coalesce(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); testErrorsAndWarnings( - 'row var = coalesce(to_geoshape(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + 'row var = coalesce(to_ip(to_ip("127.0.0.1")), to_ip(to_ip("127.0.0.1")))', [] ); - testErrorsAndWarnings('row var = coalesce(to_version("1.0.0"))', []); - testErrorsAndWarnings('row coalesce(to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = coalesce(to_version("a"))', []); + testErrorsAndWarnings('row var = coalesce("a")', []); + testErrorsAndWarnings('row coalesce("a")', []); + testErrorsAndWarnings('row var = coalesce(to_string(true))', []); + testErrorsAndWarnings('row var = coalesce("a", "a")', []); + testErrorsAndWarnings('row coalesce("a", "a")', []); + testErrorsAndWarnings('row var = coalesce(to_string(true), to_string(true))', []); testErrorsAndWarnings('row var = coalesce(to_version("1.0.0"), to_version("1.0.0"))', []); testErrorsAndWarnings('row coalesce(to_version("1.0.0"), to_version("1.0.0"))', []); testErrorsAndWarnings('row var = coalesce(to_version("a"), to_version("a"))', []); - testErrorsAndWarnings('from a_index | where coalesce(numberField) > 0', []); - testErrorsAndWarnings('from a_index | where coalesce(numberField, numberField) > 0', []); - testErrorsAndWarnings('from a_index | where length(coalesce(stringField)) > 0', []); - testErrorsAndWarnings( - 'from a_index | where length(coalesce(stringField, stringField)) > 0', - [] - ); - testErrorsAndWarnings('from a_index | eval var = coalesce(numberField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(numberField, numberField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(numberField, numberField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = coalesce(to_integer(booleanField), to_integer(booleanField))', - [] - ); + testErrorsAndWarnings('row var = coalesce(5.5, 5.5)', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(dateField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(dateField, dateField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(dateField, dateField)', []); + testErrorsAndWarnings('from a_index | where coalesce(integerField) > 0', []); - testErrorsAndWarnings( - 'from a_index | eval var = coalesce(to_datetime(dateField), to_datetime(dateField))', - [] - ); + testErrorsAndWarnings('from a_index | where coalesce(counterDoubleField) > 0', [ + 'Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]', + ]); - testErrorsAndWarnings('from a_index | eval var = coalesce(stringField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(stringField, stringField)', []); + testErrorsAndWarnings('from a_index | where coalesce(integerField, integerField) > 0', []); testErrorsAndWarnings( - 'from a_index | eval var = coalesce(to_string(booleanField), to_string(booleanField))', - [] + 'from a_index | where coalesce(counterDoubleField, counterDoubleField) > 0', + [ + 'Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]', + 'Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]', + ] ); + testErrorsAndWarnings('from a_index | where coalesce(longField) > 0', []); + testErrorsAndWarnings('from a_index | where coalesce(longField, longField) > 0', []); testErrorsAndWarnings('from a_index | eval var = coalesce(booleanField)', []); testErrorsAndWarnings('from a_index | eval coalesce(booleanField)', []); testErrorsAndWarnings('from a_index | eval var = coalesce(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval coalesce(counterDoubleField)', [ + 'Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]', + ]); + testErrorsAndWarnings('from a_index | eval var = coalesce(booleanField, booleanField)', []); testErrorsAndWarnings('from a_index | eval coalesce(booleanField, booleanField)', []); @@ -2291,21 +2342,12 @@ describe('validation logic', () => { [] ); - testErrorsAndWarnings('from a_index | eval var = coalesce(ipField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(ipField)', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(to_ip(ipField))', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(ipField, ipField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(ipField, ipField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = coalesce(to_ip(ipField), to_ip(ipField))', - [] - ); - testErrorsAndWarnings('from a_index | eval var = coalesce(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(cartesianPointField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = coalesce(to_cartesianpoint(cartesianPointField))', - [] + 'from a_index | eval coalesce(counterDoubleField, counterDoubleField)', + [ + 'Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]', + 'Argument of [coalesce] must be [boolean], found value [counterDoubleField] type [counter_double]', + ] ); testErrorsAndWarnings( @@ -2323,32 +2365,29 @@ describe('validation logic', () => { [] ); - testErrorsAndWarnings('from a_index | eval var = coalesce(cartesianShapeField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(cartesianShapeField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField))', + 'from a_index | eval var = coalesce(cartesianShapeField, cartesianShapeField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = coalesce(cartesianShapeField, cartesianShapeField)', + 'from a_index | eval coalesce(cartesianShapeField, cartesianShapeField)', [] ); testErrorsAndWarnings( - 'from a_index | eval coalesce(cartesianShapeField, cartesianShapeField)', + 'from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', [] ); + testErrorsAndWarnings('from a_index | eval var = coalesce(dateField, dateField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(dateField, dateField)', []); + testErrorsAndWarnings( - 'from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + 'from a_index | eval var = coalesce(to_datetime(dateField), to_datetime(dateField))', [] ); - testErrorsAndWarnings('from a_index | eval var = coalesce(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(to_geopoint(geoPointField))', []); testErrorsAndWarnings( 'from a_index | eval var = coalesce(geoPointField, geoPointField)', [] @@ -2360,9 +2399,6 @@ describe('validation logic', () => { [] ); - testErrorsAndWarnings('from a_index | eval var = coalesce(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(to_geoshape(geoPointField))', []); testErrorsAndWarnings( 'from a_index | eval var = coalesce(geoShapeField, geoShapeField)', [] @@ -2374,71 +2410,73 @@ describe('validation logic', () => { [] ); - testErrorsAndWarnings('from a_index | eval var = coalesce(versionField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(versionField)', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(to_version(stringField))', []); - testErrorsAndWarnings('from a_index | eval var = coalesce(versionField, versionField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(versionField, versionField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(integerField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(integerField, integerField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(integerField, integerField)', []); testErrorsAndWarnings( - 'from a_index | eval var = coalesce(to_version(stringField), to_version(stringField))', + 'from a_index | eval var = coalesce(to_integer(booleanField), to_integer(booleanField))', [] ); - testErrorsAndWarnings('from a_index | sort coalesce(numberField)', []); - testErrorsAndWarnings('from a_index | eval coalesce(null)', []); - testErrorsAndWarnings('row nullVar = null | eval coalesce(nullVar)', []); - testErrorsAndWarnings('from a_index | sort coalesce(booleanField)', []); - }); + testErrorsAndWarnings('from a_index | eval var = coalesce(ipField, ipField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(ipField, ipField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_ip(ipField), to_ip(ipField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = coalesce(keywordField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(keywordField, keywordField)', []); - describe('concat', () => { - testErrorsAndWarnings('row var = concat("a", "a")', []); - testErrorsAndWarnings('row concat("a", "a")', []); - testErrorsAndWarnings('row var = concat(to_string("a"), to_string("a"))', []); + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_string(booleanField), to_string(booleanField))', + [] + ); - testErrorsAndWarnings('row var = concat(5, 5)', [ - 'Argument of [concat] must be [string], found value [5] type [number]', - 'Argument of [concat] must be [string], found value [5] type [number]', - ]); + testErrorsAndWarnings('from a_index | eval var = coalesce(longField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(longField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(textField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(textField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(versionField, versionField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(versionField, versionField)', []); testErrorsAndWarnings( - 'from a_index | where length(concat(stringField, stringField)) > 0', + 'from a_index | eval var = coalesce(to_version(keywordField), to_version(keywordField))', [] ); - testErrorsAndWarnings('from a_index | where length(concat(numberField, numberField)) > 0', [ - 'Argument of [concat] must be [string], found value [numberField] type [number]', - 'Argument of [concat] must be [string], found value [numberField] type [number]', - ]); - - testErrorsAndWarnings('from a_index | eval var = concat(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval concat(stringField, stringField)', []); + testErrorsAndWarnings('from a_index | sort coalesce(booleanField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(null)', []); + testErrorsAndWarnings('row nullVar = null | eval coalesce(nullVar)', []); + testErrorsAndWarnings('from a_index | eval coalesce("2022", "2022")', []); testErrorsAndWarnings( - 'from a_index | eval var = concat(to_string(stringField), to_string(stringField))', + 'from a_index | eval coalesce(concat("20", "22"), concat("20", "22"))', [] ); + }); - testErrorsAndWarnings('from a_index | eval concat(numberField, numberField)', [ - 'Argument of [concat] must be [string], found value [numberField] type [number]', - 'Argument of [concat] must be [string], found value [numberField] type [number]', - ]); - - testErrorsAndWarnings('from a_index | sort concat(stringField, stringField)', []); + describe('concat', () => { + testErrorsAndWarnings('row var = concat("a", "a")', []); + testErrorsAndWarnings('row concat("a", "a")', []); testErrorsAndWarnings('row var = concat(to_string(true), to_string(true))', []); testErrorsAndWarnings('row var = concat(true, true)', [ - 'Argument of [concat] must be [string], found value [true] type [boolean]', - 'Argument of [concat] must be [string], found value [true] type [boolean]', + 'Argument of [concat] must be [keyword], found value [true] type [boolean]', + 'Argument of [concat] must be [keyword], found value [true] type [boolean]', ]); - testErrorsAndWarnings( - 'from a_index | where length(concat(booleanField, booleanField)) > 0', - [ - 'Argument of [concat] must be [string], found value [booleanField] type [boolean]', - 'Argument of [concat] must be [string], found value [booleanField] type [boolean]', - ] - ); + testErrorsAndWarnings('from a_index | eval var = concat(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval concat(keywordField, keywordField)', []); testErrorsAndWarnings( 'from a_index | eval var = concat(to_string(booleanField), to_string(booleanField))', @@ -2446,169 +2484,245 @@ describe('validation logic', () => { ); testErrorsAndWarnings('from a_index | eval concat(booleanField, booleanField)', [ - 'Argument of [concat] must be [string], found value [booleanField] type [boolean]', - 'Argument of [concat] must be [string], found value [booleanField] type [boolean]', + 'Argument of [concat] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [concat] must be [keyword], found value [booleanField] type [boolean]', ]); + + testErrorsAndWarnings('from a_index | eval var = concat(keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval concat(keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval var = concat(textField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval concat(textField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = concat(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval concat(textField, textField)', []); + testErrorsAndWarnings('from a_index | sort concat(keywordField, keywordField)', []); testErrorsAndWarnings('from a_index | eval concat(null, null)', []); testErrorsAndWarnings('row nullVar = null | eval concat(nullVar, nullVar)', []); }); describe('cos', () => { + testErrorsAndWarnings('row var = cos(5.5)', []); + testErrorsAndWarnings('row cos(5.5)', []); + testErrorsAndWarnings('row var = cos(to_double(true))', []); testErrorsAndWarnings('row var = cos(5)', []); testErrorsAndWarnings('row cos(5)', []); - testErrorsAndWarnings('row var = cos(to_integer("a"))', []); + testErrorsAndWarnings('row var = cos(to_integer(true))', []); - testErrorsAndWarnings('row var = cos("a")', [ - 'Argument of [cos] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('row var = cos(true)', [ + 'Argument of [cos] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where cos(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where cos(doubleField) > 0', []); - testErrorsAndWarnings('from a_index | where cos(stringField) > 0', [ - 'Argument of [cos] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where cos(booleanField) > 0', [ + 'Argument of [cos] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = cos(numberField)', []); - testErrorsAndWarnings('from a_index | eval cos(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = cos(to_integer(stringField))', []); - - testErrorsAndWarnings('from a_index | eval cos(stringField)', [ - 'Argument of [cos] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings('from a_index | where cos(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where cos(longField) > 0', []); + testErrorsAndWarnings('from a_index | where cos(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = cos(doubleField)', []); + testErrorsAndWarnings('from a_index | eval cos(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = cos(to_double(booleanField))', []); - testErrorsAndWarnings('from a_index | eval cos(numberField, extraArg)', [ - 'Error: [cos] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval cos(booleanField)', [ + 'Argument of [cos] must be [double], found value [booleanField] type [boolean]', ]); testErrorsAndWarnings('from a_index | eval var = cos(*)', [ 'Using wildcards (*) in cos is not allowed', ]); - testErrorsAndWarnings('from a_index | sort cos(numberField)', []); - testErrorsAndWarnings('row var = cos(to_integer(true))', []); - - testErrorsAndWarnings('row var = cos(true)', [ - 'Argument of [cos] must be [number], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where cos(booleanField) > 0', [ - 'Argument of [cos] must be [number], found value [booleanField] type [boolean]', - ]); - + testErrorsAndWarnings('from a_index | eval var = cos(integerField)', []); + testErrorsAndWarnings('from a_index | eval cos(integerField)', []); testErrorsAndWarnings('from a_index | eval var = cos(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = cos(longField)', []); + testErrorsAndWarnings('from a_index | eval cos(longField)', []); + testErrorsAndWarnings('from a_index | eval var = cos(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval cos(unsignedLongField)', []); - testErrorsAndWarnings('from a_index | eval cos(booleanField)', [ - 'Argument of [cos] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval cos(doubleField, extraArg)', [ + 'Error: [cos] function expects exactly one argument, got 2.', ]); + + testErrorsAndWarnings('from a_index | sort cos(doubleField)', []); testErrorsAndWarnings('from a_index | eval cos(null)', []); testErrorsAndWarnings('row nullVar = null | eval cos(nullVar)', []); }); describe('cosh', () => { + testErrorsAndWarnings('row var = cosh(5.5)', []); + testErrorsAndWarnings('row cosh(5.5)', []); + testErrorsAndWarnings('row var = cosh(to_double(true))', []); testErrorsAndWarnings('row var = cosh(5)', []); testErrorsAndWarnings('row cosh(5)', []); - testErrorsAndWarnings('row var = cosh(to_integer("a"))', []); + testErrorsAndWarnings('row var = cosh(to_integer(true))', []); - testErrorsAndWarnings('row var = cosh("a")', [ - 'Argument of [cosh] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('row var = cosh(true)', [ + 'Argument of [cosh] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where cosh(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where cosh(doubleField) > 0', []); - testErrorsAndWarnings('from a_index | where cosh(stringField) > 0', [ - 'Argument of [cosh] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where cosh(booleanField) > 0', [ + 'Argument of [cosh] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = cosh(numberField)', []); - testErrorsAndWarnings('from a_index | eval cosh(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = cosh(to_integer(stringField))', []); - - testErrorsAndWarnings('from a_index | eval cosh(stringField)', [ - 'Argument of [cosh] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings('from a_index | where cosh(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where cosh(longField) > 0', []); + testErrorsAndWarnings('from a_index | where cosh(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = cosh(doubleField)', []); + testErrorsAndWarnings('from a_index | eval cosh(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = cosh(to_double(booleanField))', []); - testErrorsAndWarnings('from a_index | eval cosh(numberField, extraArg)', [ - 'Error: [cosh] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval cosh(booleanField)', [ + 'Argument of [cosh] must be [double], found value [booleanField] type [boolean]', ]); testErrorsAndWarnings('from a_index | eval var = cosh(*)', [ 'Using wildcards (*) in cosh is not allowed', ]); - testErrorsAndWarnings('from a_index | sort cosh(numberField)', []); - testErrorsAndWarnings('row var = cosh(to_integer(true))', []); - - testErrorsAndWarnings('row var = cosh(true)', [ - 'Argument of [cosh] must be [number], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where cosh(booleanField) > 0', [ - 'Argument of [cosh] must be [number], found value [booleanField] type [boolean]', - ]); - + testErrorsAndWarnings('from a_index | eval var = cosh(integerField)', []); + testErrorsAndWarnings('from a_index | eval cosh(integerField)', []); testErrorsAndWarnings('from a_index | eval var = cosh(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = cosh(longField)', []); + testErrorsAndWarnings('from a_index | eval cosh(longField)', []); + testErrorsAndWarnings('from a_index | eval var = cosh(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval cosh(unsignedLongField)', []); - testErrorsAndWarnings('from a_index | eval cosh(booleanField)', [ - 'Argument of [cosh] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval cosh(doubleField, extraArg)', [ + 'Error: [cosh] function expects exactly one argument, got 2.', ]); + + testErrorsAndWarnings('from a_index | sort cosh(doubleField)', []); testErrorsAndWarnings('from a_index | eval cosh(null)', []); testErrorsAndWarnings('row nullVar = null | eval cosh(nullVar)', []); }); - describe('date_extract', () => { - testErrorsAndWarnings('row var = date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", now())', []); - testErrorsAndWarnings('row date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", now())', []); + describe('date_diff', () => { testErrorsAndWarnings( - 'from a_index | eval date_extract("SOME_RANDOM_STRING", now())', - [], + 'from a_index | eval var = date_diff("year", dateField, dateField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval date_diff("year", dateField, dateField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = date_diff("year", to_datetime(dateField), to_datetime(dateField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval date_diff(booleanField, booleanField, booleanField)', [ - 'Invalid option ["SOME_RANDOM_STRING"] for date_extract. Supported options: ["ALIGNED_DAY_OF_WEEK_IN_MONTH", "ALIGNED_DAY_OF_WEEK_IN_YEAR", "ALIGNED_WEEK_OF_MONTH", "ALIGNED_WEEK_OF_YEAR", "AMPM_OF_DAY", "CLOCK_HOUR_OF_AMPM", "CLOCK_HOUR_OF_DAY", "DAY_OF_MONTH", "DAY_OF_WEEK", "DAY_OF_YEAR", "EPOCH_DAY", "ERA", "HOUR_OF_AMPM", "HOUR_OF_DAY", "INSTANT_SECONDS", "MICRO_OF_DAY", "MICRO_OF_SECOND", "MILLI_OF_DAY", "MILLI_OF_SECOND", "MINUTE_OF_DAY", "MINUTE_OF_HOUR", "MONTH_OF_YEAR", "NANO_OF_DAY", "NANO_OF_SECOND", "OFFSET_SECONDS", "PROLEPTIC_MONTH", "SECOND_OF_DAY", "SECOND_OF_MINUTE", "YEAR", "YEAR_OF_ERA"].', + 'Argument of [date_diff] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [date_diff] must be [date], found value [booleanField] type [boolean]', + 'Argument of [date_diff] must be [date], found value [booleanField] type [boolean]', ] ); testErrorsAndWarnings( - 'from a_index | eval var = date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", dateField)', + 'from a_index | eval var = date_diff(textField, dateField, dateField)', [] ); + testErrorsAndWarnings('from a_index | eval date_diff(textField, dateField, dateField)', []); + testErrorsAndWarnings( - 'from a_index | eval date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", dateField)', + 'from a_index | eval var = date_diff(to_string(booleanField), to_datetime(dateField), to_datetime(dateField))', [] ); testErrorsAndWarnings( - 'from a_index | eval var = date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", to_datetime(stringField))', - [] + 'from a_index | eval date_diff("year", dateField, dateField, extraArg)', + ['Error: [date_diff] function expects exactly 3 arguments, got 4.'] ); - testErrorsAndWarnings('from a_index | eval date_extract(stringField, stringField)', [ - 'Argument of [date_extract] must be [date], found value [stringField] type [string]', - ]); + testErrorsAndWarnings('from a_index | sort date_diff("year", dateField, dateField)', []); + + testErrorsAndWarnings('from a_index | eval date_diff(null, null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval date_diff(nullVar, nullVar, nullVar)', []); + testErrorsAndWarnings('from a_index | eval date_diff("year", "2022", "2022")', []); testErrorsAndWarnings( - 'from a_index | eval date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", dateField, extraArg)', - ['Error: [date_extract] function expects exactly 2 arguments, got 3.'] + 'from a_index | eval date_diff("year", concat("20", "22"), concat("20", "22"))', + [ + 'Argument of [date_diff] must be [date], found value [concat("20","22")] type [keyword]', + 'Argument of [date_diff] must be [date], found value [concat("20","22")] type [keyword]', + ] ); + testErrorsAndWarnings('from a_index | eval date_diff(textField, "2022", "2022")', []); + testErrorsAndWarnings( - 'from a_index | sort date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", dateField)', + 'from a_index | eval date_diff(textField, concat("20", "22"), concat("20", "22"))', + [ + 'Argument of [date_diff] must be [date], found value [concat("20","22")] type [keyword]', + 'Argument of [date_diff] must be [date], found value [concat("20","22")] type [keyword]', + ] + ); + }); + + describe('date_extract', () => { + testErrorsAndWarnings( + 'row var = date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", to_datetime("2021-01-01T00:00:00Z"))', + [] + ); + + testErrorsAndWarnings( + 'row date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", to_datetime("2021-01-01T00:00:00Z"))', + [] + ); + + testErrorsAndWarnings( + 'row var = date_extract("a", to_datetime("2021-01-01T00:00:00Z"))', [] ); + testErrorsAndWarnings('row date_extract("a", to_datetime("2021-01-01T00:00:00Z"))', []); testErrorsAndWarnings('row var = date_extract(true, true)', [ - 'Argument of [date_extract] must be [string], found value [true] type [boolean]', + 'Argument of [date_extract] must be [keyword], found value [true] type [boolean]', 'Argument of [date_extract] must be [date], found value [true] type [boolean]', ]); + testErrorsAndWarnings( + 'from a_index | eval var = date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", dateField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", dateField)', + [] + ); + testErrorsAndWarnings( 'from a_index | eval var = date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", to_datetime(dateField))', [] ); testErrorsAndWarnings('from a_index | eval date_extract(booleanField, booleanField)', [ - 'Argument of [date_extract] must be [string], found value [booleanField] type [boolean]', + 'Argument of [date_extract] must be [keyword], found value [booleanField] type [boolean]', 'Argument of [date_extract] must be [date], found value [booleanField] type [boolean]', ]); + + testErrorsAndWarnings('from a_index | eval var = date_extract(textField, dateField)', []); + testErrorsAndWarnings('from a_index | eval date_extract(textField, dateField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = date_extract(to_string(booleanField), to_datetime(dateField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", dateField, extraArg)', + ['Error: [date_extract] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", dateField)', + [] + ); + testErrorsAndWarnings('from a_index | eval date_extract(null, null)', []); testErrorsAndWarnings('row nullVar = null | eval date_extract(nullVar, nullVar)', []); @@ -2620,134 +2734,128 @@ describe('validation logic', () => { testErrorsAndWarnings( 'from a_index | eval date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", concat("20", "22"))', [ - 'Argument of [date_extract] must be [date], found value [concat("20","22")] type [string]', + 'Argument of [date_extract] must be [date], found value [concat("20","22")] type [keyword]', ] ); + + testErrorsAndWarnings('from a_index | eval date_extract(textField, "2022")', []); + testErrorsAndWarnings('from a_index | eval date_extract(textField, concat("20", "22"))', [ + 'Argument of [date_extract] must be [date], found value [concat("20","22")] type [keyword]', + ]); }); describe('date_format', () => { - testErrorsAndWarnings('row var = date_format("a", now())', []); - testErrorsAndWarnings('row date_format("a", now())', []); - testErrorsAndWarnings('from a_index | eval var = date_format(stringField, dateField)', []); - testErrorsAndWarnings('from a_index | eval date_format(stringField, dateField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = date_format(to_string(stringField), to_datetime(stringField))', + 'row var = date_format("a", to_datetime("2021-01-01T00:00:00Z"))', [] ); - - testErrorsAndWarnings('from a_index | eval date_format(stringField, numberField)', [ - 'Argument of [date_format] must be [date], found value [numberField] type [number]', - ]); - - testErrorsAndWarnings('from a_index | eval date_format(stringField, dateField, extraArg)', [ - 'Error: [date_format] function expects no more than 2 arguments, got 3.', - ]); - - testErrorsAndWarnings('from a_index | sort date_format(stringField, dateField)', []); + testErrorsAndWarnings('row date_format("a", to_datetime("2021-01-01T00:00:00Z"))', []); testErrorsAndWarnings('row var = date_format(true, true)', [ - 'Argument of [date_format] must be [string], found value [true] type [boolean]', + 'Argument of [date_format] must be [keyword], found value [true] type [boolean]', 'Argument of [date_format] must be [date], found value [true] type [boolean]', ]); + testErrorsAndWarnings('from a_index | eval var = date_format(keywordField, dateField)', []); + testErrorsAndWarnings('from a_index | eval date_format(keywordField, dateField)', []); + testErrorsAndWarnings( 'from a_index | eval var = date_format(to_string(booleanField), to_datetime(dateField))', [] ); testErrorsAndWarnings('from a_index | eval date_format(booleanField, booleanField)', [ - 'Argument of [date_format] must be [string], found value [booleanField] type [boolean]', + 'Argument of [date_format] must be [keyword], found value [booleanField] type [boolean]', 'Argument of [date_format] must be [date], found value [booleanField] type [boolean]', ]); + + testErrorsAndWarnings('from a_index | eval var = date_format(textField, dateField)', []); + testErrorsAndWarnings('from a_index | eval date_format(textField, dateField)', []); + + testErrorsAndWarnings( + 'from a_index | eval date_format(keywordField, dateField, extraArg)', + ['Error: [date_format] function expects no more than 2 arguments, got 3.'] + ); + + testErrorsAndWarnings('from a_index | sort date_format(keywordField, dateField)', []); testErrorsAndWarnings('from a_index | eval date_format(null, null)', []); testErrorsAndWarnings('row nullVar = null | eval date_format(nullVar, nullVar)', []); - testErrorsAndWarnings('from a_index | eval date_format(stringField, "2022")', []); - testErrorsAndWarnings('from a_index | eval date_format(stringField, concat("20", "22"))', [ - 'Argument of [date_format] must be [date], found value [concat("20","22")] type [string]', + testErrorsAndWarnings('from a_index | eval date_format(keywordField, "2022")', []); + + testErrorsAndWarnings('from a_index | eval date_format(keywordField, concat("20", "22"))', [ + 'Argument of [date_format] must be [date], found value [concat("20","22")] type [keyword]', + ]); + + testErrorsAndWarnings('from a_index | eval date_format(textField, "2022")', []); + testErrorsAndWarnings('from a_index | eval date_format(textField, concat("20", "22"))', [ + 'Argument of [date_format] must be [date], found value [concat("20","22")] type [keyword]', ]); }); describe('date_parse', () => { testErrorsAndWarnings('row var = date_parse("a", "a")', []); - testErrorsAndWarnings('row var = date_parse("a")', []); testErrorsAndWarnings('row date_parse("a", "a")', []); - testErrorsAndWarnings('row var = date_parse(to_string("a"), to_string("a"))', []); + testErrorsAndWarnings('row var = date_parse(to_string(true), to_string(true))', []); - testErrorsAndWarnings('row var = date_parse(5, 5)', [ - 'Argument of [date_parse] must be [string], found value [5] type [number]', - 'Argument of [date_parse] must be [string], found value [5] type [number]', + testErrorsAndWarnings('row var = date_parse(true, true)', [ + 'Argument of [date_parse] must be [keyword], found value [true] type [boolean]', + 'Argument of [date_parse] must be [keyword], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = date_parse(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = date_parse(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval date_parse(stringField, stringField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = date_parse(to_string(stringField), to_string(stringField))', + 'from a_index | eval var = date_parse(keywordField, keywordField)', [] ); - - testErrorsAndWarnings('from a_index | eval date_parse(numberField, numberField)', [ - 'Argument of [date_parse] must be [string], found value [numberField] type [number]', - 'Argument of [date_parse] must be [string], found value [numberField] type [number]', - ]); + testErrorsAndWarnings('from a_index | eval date_parse(keywordField, keywordField)', []); testErrorsAndWarnings( - 'from a_index | eval date_parse(stringField, stringField, extraArg)', - ['Error: [date_parse] function expects no more than 2 arguments, got 3.'] + 'from a_index | eval var = date_parse(to_string(booleanField), to_string(booleanField))', + [] ); - testErrorsAndWarnings('from a_index | sort date_parse(stringField, stringField)', []); - testErrorsAndWarnings('row var = date_parse(to_string(true), to_string(true))', []); - - testErrorsAndWarnings('row var = date_parse(true, true)', [ - 'Argument of [date_parse] must be [string], found value [true] type [boolean]', - 'Argument of [date_parse] must be [string], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval date_parse(booleanField, booleanField)', [ + 'Argument of [date_parse] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [date_parse] must be [keyword], found value [booleanField] type [boolean]', ]); + testErrorsAndWarnings('from a_index | eval var = date_parse(keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval date_parse(keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval var = date_parse(textField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval date_parse(textField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = date_parse(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval date_parse(textField, textField)', []); + testErrorsAndWarnings( - 'from a_index | eval var = date_parse(to_string(booleanField), to_string(booleanField))', - [] + 'from a_index | eval date_parse(keywordField, keywordField, extraArg)', + ['Error: [date_parse] function expects no more than 2 arguments, got 3.'] ); - testErrorsAndWarnings('from a_index | eval date_parse(booleanField, booleanField)', [ - 'Argument of [date_parse] must be [string], found value [booleanField] type [boolean]', - 'Argument of [date_parse] must be [string], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | sort date_parse(keywordField, keywordField)', []); testErrorsAndWarnings('from a_index | eval date_parse(null, null)', []); testErrorsAndWarnings('row nullVar = null | eval date_parse(nullVar, nullVar)', []); }); describe('date_trunc', () => { - testErrorsAndWarnings('row var = date_trunc(1 year, now())', []); - testErrorsAndWarnings('row date_trunc(1 year, now())', []); - testErrorsAndWarnings('from a_index | eval var = date_trunc(1 year, dateField)', []); - testErrorsAndWarnings('from a_index | eval date_trunc(1 year, dateField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = date_trunc(1 year, to_datetime(stringField))', + 'row var = date_trunc(1 year, to_datetime("2021-01-01T00:00:00Z"))', [] ); - - testErrorsAndWarnings('from a_index | eval date_trunc(stringField, stringField)', [ - 'Argument of [date_trunc] must be [time_literal], found value [stringField] type [string]', - 'Argument of [date_trunc] must be [date], found value [stringField] type [string]', + testErrorsAndWarnings('row date_trunc(1 year, to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row var = date_trunc("a", to_datetime("2021-01-01T00:00:00Z"))', [ + 'Argument of [date_trunc] must be [time_literal], found value ["a"] type [string]', ]); - - testErrorsAndWarnings('from a_index | eval date_trunc(1 year, dateField, extraArg)', [ - 'Error: [date_trunc] function expects exactly 2 arguments, got 3.', + testErrorsAndWarnings('row date_trunc("a", to_datetime("2021-01-01T00:00:00Z"))', [ + 'Argument of [date_trunc] must be [time_literal], found value ["a"] type [string]', ]); - testErrorsAndWarnings('from a_index | sort date_trunc(1 year, dateField)', []); - testErrorsAndWarnings('row var = date_trunc(now(), now())', []); - testErrorsAndWarnings('row date_trunc(now(), now())', []); - testErrorsAndWarnings('row var = date_trunc(true, true)', [ 'Argument of [date_trunc] must be [time_literal], found value [true] type [boolean]', 'Argument of [date_trunc] must be [date], found value [true] type [boolean]', ]); + testErrorsAndWarnings('from a_index | eval var = date_trunc(1 year, dateField)', []); + testErrorsAndWarnings('from a_index | eval date_trunc(1 year, dateField)', []); + testErrorsAndWarnings( 'from a_index | eval var = date_trunc(1 year, to_datetime(dateField))', [] @@ -2758,28 +2866,36 @@ describe('validation logic', () => { 'Argument of [date_trunc] must be [date], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = date_trunc(dateField, dateField)', []); - testErrorsAndWarnings('from a_index | eval date_trunc(dateField, dateField)', []); + testErrorsAndWarnings('from a_index | eval var = date_trunc(textField, dateField)', [ + 'Argument of [date_trunc] must be [time_literal], found value [textField] type [text]', + ]); + testErrorsAndWarnings('from a_index | eval date_trunc(textField, dateField)', [ + 'Argument of [date_trunc] must be [time_literal], found value [textField] type [text]', + ]); testErrorsAndWarnings( - 'from a_index | eval var = date_trunc(to_datetime(dateField), to_datetime(dateField))', - [] + 'from a_index | eval var = date_trunc(textField, to_datetime(dateField))', + ['Argument of [date_trunc] must be [time_literal], found value [textField] type [text]'] ); + + testErrorsAndWarnings('from a_index | eval date_trunc(1 year, dateField, extraArg)', [ + 'Error: [date_trunc] function expects exactly 2 arguments, got 3.', + ]); + + testErrorsAndWarnings('from a_index | sort date_trunc(1 year, dateField)', []); testErrorsAndWarnings('from a_index | eval date_trunc(null, null)', []); testErrorsAndWarnings('row nullVar = null | eval date_trunc(nullVar, nullVar)', []); testErrorsAndWarnings('from a_index | eval date_trunc(1 year, "2022")', []); testErrorsAndWarnings('from a_index | eval date_trunc(1 year, concat("20", "22"))', [ - 'Argument of [date_trunc] must be [date], found value [concat("20","22")] type [string]', + 'Argument of [date_trunc] must be [date], found value [concat("20","22")] type [keyword]', + ]); + testErrorsAndWarnings('from a_index | eval date_trunc(textField, "2022")', [ + 'Argument of [date_trunc] must be [time_literal], found value [textField] type [text]', + ]); + testErrorsAndWarnings('from a_index | eval date_trunc(textField, concat("20", "22"))', [ + 'Argument of [date_trunc] must be [time_literal], found value [textField] type [text]', + 'Argument of [date_trunc] must be [date], found value [concat("20","22")] type [keyword]', ]); - testErrorsAndWarnings('from a_index | eval date_trunc("2022", "2022")', []); - - testErrorsAndWarnings( - 'from a_index | eval date_trunc(concat("20", "22"), concat("20", "22"))', - [ - 'Argument of [date_trunc] must be [time_literal], found value [concat("20","22")] type [string]', - 'Argument of [date_trunc] must be [date], found value [concat("20","22")] type [string]', - ] - ); }); describe('e', () => { @@ -2800,37 +2916,18 @@ describe('validation logic', () => { describe('ends_with', () => { testErrorsAndWarnings('row var = ends_with("a", "a")', []); testErrorsAndWarnings('row ends_with("a", "a")', []); - testErrorsAndWarnings('row var = ends_with(to_string("a"), to_string("a"))', []); + testErrorsAndWarnings('row var = ends_with(to_string(true), to_string(true))', []); - testErrorsAndWarnings('row var = ends_with(5, 5)', [ - 'Argument of [ends_with] must be [string], found value [5] type [number]', - 'Argument of [ends_with] must be [string], found value [5] type [number]', + testErrorsAndWarnings('row var = ends_with(true, true)', [ + 'Argument of [ends_with] must be [keyword], found value [true] type [boolean]', + 'Argument of [ends_with] must be [keyword], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = ends_with(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval ends_with(stringField, stringField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = ends_with(to_string(stringField), to_string(stringField))', + 'from a_index | eval var = ends_with(keywordField, keywordField)', [] ); - - testErrorsAndWarnings('from a_index | eval ends_with(numberField, numberField)', [ - 'Argument of [ends_with] must be [string], found value [numberField] type [number]', - 'Argument of [ends_with] must be [string], found value [numberField] type [number]', - ]); - - testErrorsAndWarnings('from a_index | eval ends_with(stringField, stringField, extraArg)', [ - 'Error: [ends_with] function expects exactly 2 arguments, got 3.', - ]); - - testErrorsAndWarnings('from a_index | sort ends_with(stringField, stringField)', []); - testErrorsAndWarnings('row var = ends_with(to_string(true), to_string(true))', []); - - testErrorsAndWarnings('row var = ends_with(true, true)', [ - 'Argument of [ends_with] must be [string], found value [true] type [boolean]', - 'Argument of [ends_with] must be [string], found value [true] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | eval ends_with(keywordField, keywordField)', []); testErrorsAndWarnings( 'from a_index | eval var = ends_with(to_string(booleanField), to_string(booleanField))', @@ -2838,82 +2935,172 @@ describe('validation logic', () => { ); testErrorsAndWarnings('from a_index | eval ends_with(booleanField, booleanField)', [ - 'Argument of [ends_with] must be [string], found value [booleanField] type [boolean]', - 'Argument of [ends_with] must be [string], found value [booleanField] type [boolean]', + 'Argument of [ends_with] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [ends_with] must be [keyword], found value [booleanField] type [boolean]', ]); + + testErrorsAndWarnings('from a_index | eval var = ends_with(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval ends_with(textField, textField)', []); + + testErrorsAndWarnings( + 'from a_index | eval ends_with(keywordField, keywordField, extraArg)', + ['Error: [ends_with] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings('from a_index | sort ends_with(keywordField, keywordField)', []); testErrorsAndWarnings('from a_index | eval ends_with(null, null)', []); testErrorsAndWarnings('row nullVar = null | eval ends_with(nullVar, nullVar)', []); }); - describe('floor', () => { - testErrorsAndWarnings('row var = floor(5)', []); - testErrorsAndWarnings('row floor(5)', []); - testErrorsAndWarnings('row var = floor(to_integer("a"))', []); + describe('exp', () => { + testErrorsAndWarnings('row var = exp(5.5)', []); + testErrorsAndWarnings('row exp(5.5)', []); + testErrorsAndWarnings('row var = exp(to_double(true))', []); + testErrorsAndWarnings('row var = exp(5)', []); + testErrorsAndWarnings('row exp(5)', []); + testErrorsAndWarnings('row var = exp(to_integer(true))', []); - testErrorsAndWarnings('row var = floor("a")', [ - 'Argument of [floor] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('row var = exp(true)', [ + 'Argument of [exp] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where floor(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where exp(doubleField) > 0', []); - testErrorsAndWarnings('from a_index | where floor(stringField) > 0', [ - 'Argument of [floor] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where exp(booleanField) > 0', [ + 'Argument of [exp] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = floor(numberField)', []); - testErrorsAndWarnings('from a_index | eval floor(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = floor(to_integer(stringField))', []); + testErrorsAndWarnings('from a_index | where exp(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where exp(longField) > 0', []); + testErrorsAndWarnings('from a_index | where exp(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = exp(doubleField)', []); + testErrorsAndWarnings('from a_index | eval exp(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = exp(to_double(booleanField))', []); - testErrorsAndWarnings('from a_index | eval floor(stringField)', [ - 'Argument of [floor] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval exp(booleanField)', [ + 'Argument of [exp] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval floor(numberField, extraArg)', [ - 'Error: [floor] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval var = exp(*)', [ + 'Using wildcards (*) in exp is not allowed', ]); - testErrorsAndWarnings('from a_index | eval var = floor(*)', [ - 'Using wildcards (*) in floor is not allowed', + testErrorsAndWarnings('from a_index | eval var = exp(integerField)', []); + testErrorsAndWarnings('from a_index | eval exp(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = exp(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = exp(longField)', []); + testErrorsAndWarnings('from a_index | eval exp(longField)', []); + testErrorsAndWarnings('from a_index | eval var = exp(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval exp(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval exp(doubleField, extraArg)', [ + 'Error: [exp] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | sort floor(numberField)', []); + testErrorsAndWarnings('from a_index | sort exp(doubleField)', []); + testErrorsAndWarnings('from a_index | eval exp(null)', []); + testErrorsAndWarnings('row nullVar = null | eval exp(nullVar)', []); + }); + + describe('floor', () => { + testErrorsAndWarnings('row var = floor(5.5)', []); + testErrorsAndWarnings('row floor(5.5)', []); + testErrorsAndWarnings('row var = floor(to_double(true))', []); + testErrorsAndWarnings('row var = floor(5)', []); + testErrorsAndWarnings('row floor(5)', []); testErrorsAndWarnings('row var = floor(to_integer(true))', []); testErrorsAndWarnings('row var = floor(true)', [ - 'Argument of [floor] must be [number], found value [true] type [boolean]', + 'Argument of [floor] must be [double], found value [true] type [boolean]', ]); + testErrorsAndWarnings('from a_index | where floor(doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where floor(booleanField) > 0', [ - 'Argument of [floor] must be [number], found value [booleanField] type [boolean]', + 'Argument of [floor] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = floor(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | where floor(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where floor(longField) > 0', []); + testErrorsAndWarnings('from a_index | where floor(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = floor(doubleField)', []); + testErrorsAndWarnings('from a_index | eval floor(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = floor(to_double(booleanField))', []); testErrorsAndWarnings('from a_index | eval floor(booleanField)', [ - 'Argument of [floor] must be [number], found value [booleanField] type [boolean]', + 'Argument of [floor] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = floor(*)', [ + 'Using wildcards (*) in floor is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = floor(integerField)', []); + testErrorsAndWarnings('from a_index | eval floor(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = floor(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = floor(longField)', []); + testErrorsAndWarnings('from a_index | eval floor(longField)', []); + testErrorsAndWarnings('from a_index | eval var = floor(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval floor(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval floor(doubleField, extraArg)', [ + 'Error: [floor] function expects exactly one argument, got 2.', ]); + + testErrorsAndWarnings('from a_index | sort floor(doubleField)', []); testErrorsAndWarnings('from a_index | eval floor(null)', []); testErrorsAndWarnings('row nullVar = null | eval floor(nullVar)', []); }); + describe('from_base64', () => { + testErrorsAndWarnings('row var = from_base64("a")', []); + testErrorsAndWarnings('row from_base64("a")', []); + testErrorsAndWarnings('row var = from_base64(to_string(true))', []); + + testErrorsAndWarnings('row var = from_base64(true)', [ + 'Argument of [from_base64] must be [keyword], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = from_base64(keywordField)', []); + testErrorsAndWarnings('from a_index | eval from_base64(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = from_base64(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval from_base64(booleanField)', [ + 'Argument of [from_base64] must be [keyword], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = from_base64(*)', [ + 'Using wildcards (*) in from_base64 is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = from_base64(textField)', []); + testErrorsAndWarnings('from a_index | eval from_base64(textField)', []); + + testErrorsAndWarnings('from a_index | eval from_base64(keywordField, extraArg)', [ + 'Error: [from_base64] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort from_base64(keywordField)', []); + testErrorsAndWarnings('from a_index | eval from_base64(null)', []); + testErrorsAndWarnings('row nullVar = null | eval from_base64(nullVar)', []); + }); + describe('greatest', () => { - testErrorsAndWarnings('row var = greatest("a")', []); - testErrorsAndWarnings('row greatest("a")', []); - testErrorsAndWarnings('from a_index | eval var = greatest(stringField)', []); - testErrorsAndWarnings('from a_index | eval greatest(stringField)', []); - testErrorsAndWarnings('from a_index | sort greatest(stringField)', []); testErrorsAndWarnings('row var = greatest(true)', []); testErrorsAndWarnings('row greatest(true)', []); testErrorsAndWarnings('row var = greatest(to_boolean(true))', []); testErrorsAndWarnings('row var = greatest(true, true)', []); testErrorsAndWarnings('row greatest(true, true)', []); testErrorsAndWarnings('row var = greatest(to_boolean(true), to_boolean(true))', []); - testErrorsAndWarnings('row var = greatest(5, 5)', []); - testErrorsAndWarnings('row greatest(5, 5)', []); - testErrorsAndWarnings('row var = greatest(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = greatest(5.5, 5.5)', []); + testErrorsAndWarnings('row greatest(5.5, 5.5)', []); + testErrorsAndWarnings('row var = greatest(to_double(true), to_double(true))', []); testErrorsAndWarnings('row var = greatest(5)', []); testErrorsAndWarnings('row greatest(5)', []); testErrorsAndWarnings('row var = greatest(to_integer(true))', []); + testErrorsAndWarnings('row var = greatest(5, 5)', []); + testErrorsAndWarnings('row greatest(5, 5)', []); + testErrorsAndWarnings('row var = greatest(to_integer(true), to_integer(true))', []); testErrorsAndWarnings('row var = greatest(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); testErrorsAndWarnings('row greatest(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); @@ -2922,6 +3109,8 @@ describe('validation logic', () => { [] ); + testErrorsAndWarnings('row var = greatest("a")', []); + testErrorsAndWarnings('row greatest("a")', []); testErrorsAndWarnings('row var = greatest(to_string(true))', []); testErrorsAndWarnings('row var = greatest("a", "a")', []); testErrorsAndWarnings('row greatest("a", "a")', []); @@ -2938,41 +3127,17 @@ describe('validation logic', () => { ] ); - testErrorsAndWarnings('from a_index | where greatest(numberField, numberField) > 0', []); + testErrorsAndWarnings('from a_index | where greatest(doubleField, doubleField) > 0', []); - testErrorsAndWarnings( - 'from a_index | where greatest(cartesianPointField, cartesianPointField) > 0', - [ - 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - ] - ); - - testErrorsAndWarnings('from a_index | where greatest(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where greatest(integerField) > 0', []); testErrorsAndWarnings('from a_index | where greatest(cartesianPointField) > 0', [ 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', ]); - testErrorsAndWarnings('from a_index | where length(greatest(stringField)) > 0', []); - - testErrorsAndWarnings('from a_index | where length(greatest(cartesianPointField)) > 0', [ - 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - ]); - - testErrorsAndWarnings( - 'from a_index | where length(greatest(stringField, stringField)) > 0', - [] - ); - - testErrorsAndWarnings( - 'from a_index | where length(greatest(cartesianPointField, cartesianPointField)) > 0', - [ - 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - ] - ); - + testErrorsAndWarnings('from a_index | where greatest(integerField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where greatest(longField) > 0', []); + testErrorsAndWarnings('from a_index | where greatest(longField, longField) > 0', []); testErrorsAndWarnings('from a_index | eval var = greatest(booleanField)', []); testErrorsAndWarnings('from a_index | eval greatest(booleanField)', []); testErrorsAndWarnings('from a_index | eval var = greatest(to_boolean(booleanField))', []); @@ -2997,37 +3162,55 @@ describe('validation logic', () => { ] ); - testErrorsAndWarnings('from a_index | eval var = greatest(numberField, numberField)', []); - testErrorsAndWarnings('from a_index | eval greatest(numberField, numberField)', []); + testErrorsAndWarnings('from a_index | eval var = greatest(doubleField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval greatest(doubleField, doubleField)', []); testErrorsAndWarnings( - 'from a_index | eval var = greatest(to_integer(booleanField), to_integer(booleanField))', + 'from a_index | eval var = greatest(to_double(booleanField), to_double(booleanField))', [] ); - testErrorsAndWarnings('from a_index | eval var = greatest(numberField)', []); - testErrorsAndWarnings('from a_index | eval greatest(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = greatest(integerField)', []); + testErrorsAndWarnings('from a_index | eval greatest(integerField)', []); testErrorsAndWarnings('from a_index | eval var = greatest(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = greatest(integerField, integerField)', []); + testErrorsAndWarnings('from a_index | eval greatest(integerField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = greatest(to_integer(booleanField), to_integer(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = greatest(ipField, ipField)', []); testErrorsAndWarnings('from a_index | eval greatest(ipField, ipField)', []); testErrorsAndWarnings( 'from a_index | eval var = greatest(to_ip(ipField), to_ip(ipField))', [] ); + testErrorsAndWarnings('from a_index | eval var = greatest(keywordField)', []); + testErrorsAndWarnings('from a_index | eval greatest(keywordField)', []); testErrorsAndWarnings('from a_index | eval var = greatest(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = greatest(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval greatest(stringField, stringField)', []); + testErrorsAndWarnings('from a_index | eval var = greatest(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval greatest(keywordField, keywordField)', []); testErrorsAndWarnings( 'from a_index | eval var = greatest(to_string(booleanField), to_string(booleanField))', [] ); + testErrorsAndWarnings('from a_index | eval var = greatest(longField)', []); + testErrorsAndWarnings('from a_index | eval greatest(longField)', []); + testErrorsAndWarnings('from a_index | eval var = greatest(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval greatest(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval var = greatest(textField)', []); + testErrorsAndWarnings('from a_index | eval greatest(textField)', []); + testErrorsAndWarnings('from a_index | eval var = greatest(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval greatest(textField, textField)', []); testErrorsAndWarnings('from a_index | eval var = greatest(versionField, versionField)', []); testErrorsAndWarnings('from a_index | eval greatest(versionField, versionField)', []); testErrorsAndWarnings( - 'from a_index | eval var = greatest(to_version(stringField), to_version(stringField))', + 'from a_index | eval var = greatest(to_version(keywordField), to_version(keywordField))', [] ); @@ -3036,24 +3219,74 @@ describe('validation logic', () => { testErrorsAndWarnings('row nullVar = null | eval greatest(nullVar)', []); }); + describe('ip_prefix', () => { + testErrorsAndWarnings('row var = ip_prefix(to_ip("127.0.0.1"), 5, 5)', []); + testErrorsAndWarnings('row ip_prefix(to_ip("127.0.0.1"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = ip_prefix(to_ip(to_ip("127.0.0.1")), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = ip_prefix(true, true, true)', [ + 'Argument of [ip_prefix] must be [ip], found value [true] type [boolean]', + 'Argument of [ip_prefix] must be [integer], found value [true] type [boolean]', + 'Argument of [ip_prefix] must be [integer], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = ip_prefix(ipField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval ip_prefix(ipField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = ip_prefix(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval ip_prefix(booleanField, booleanField, booleanField)', + [ + 'Argument of [ip_prefix] must be [ip], found value [booleanField] type [boolean]', + 'Argument of [ip_prefix] must be [integer], found value [booleanField] type [boolean]', + 'Argument of [ip_prefix] must be [integer], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval ip_prefix(ipField, integerField, integerField, extraArg)', + ['Error: [ip_prefix] function expects exactly 3 arguments, got 4.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort ip_prefix(ipField, integerField, integerField)', + [] + ); + testErrorsAndWarnings('from a_index | eval ip_prefix(null, null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval ip_prefix(nullVar, nullVar, nullVar)', []); + }); + describe('least', () => { - testErrorsAndWarnings('row var = least("a")', []); - testErrorsAndWarnings('row least("a")', []); - testErrorsAndWarnings('from a_index | eval var = least(stringField)', []); - testErrorsAndWarnings('from a_index | eval least(stringField)', []); - testErrorsAndWarnings('from a_index | sort least(stringField)', []); testErrorsAndWarnings('row var = least(true)', []); testErrorsAndWarnings('row least(true)', []); testErrorsAndWarnings('row var = least(to_boolean(true))', []); testErrorsAndWarnings('row var = least(true, true)', []); testErrorsAndWarnings('row least(true, true)', []); testErrorsAndWarnings('row var = least(to_boolean(true), to_boolean(true))', []); - testErrorsAndWarnings('row var = least(5, 5)', []); - testErrorsAndWarnings('row least(5, 5)', []); - testErrorsAndWarnings('row var = least(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = least(5.5, 5.5)', []); + testErrorsAndWarnings('row least(5.5, 5.5)', []); + testErrorsAndWarnings('row var = least(to_double(true), to_double(true))', []); testErrorsAndWarnings('row var = least(5)', []); testErrorsAndWarnings('row least(5)', []); testErrorsAndWarnings('row var = least(to_integer(true))', []); + testErrorsAndWarnings('row var = least(5, 5)', []); + testErrorsAndWarnings('row least(5, 5)', []); + testErrorsAndWarnings('row var = least(to_integer(true), to_integer(true))', []); testErrorsAndWarnings('row var = least(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); testErrorsAndWarnings('row least(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); @@ -3062,6 +3295,8 @@ describe('validation logic', () => { [] ); + testErrorsAndWarnings('row var = least("a")', []); + testErrorsAndWarnings('row least("a")', []); testErrorsAndWarnings('row var = least(to_string(true))', []); testErrorsAndWarnings('row var = least("a", "a")', []); testErrorsAndWarnings('row least("a", "a")', []); @@ -3078,7 +3313,7 @@ describe('validation logic', () => { ] ); - testErrorsAndWarnings('from a_index | where least(numberField, numberField) > 0', []); + testErrorsAndWarnings('from a_index | where least(doubleField, doubleField) > 0', []); testErrorsAndWarnings( 'from a_index | where least(cartesianPointField, cartesianPointField) > 0', @@ -3088,31 +3323,15 @@ describe('validation logic', () => { ] ); - testErrorsAndWarnings('from a_index | where least(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where least(integerField) > 0', []); testErrorsAndWarnings('from a_index | where least(cartesianPointField) > 0', [ 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', ]); - testErrorsAndWarnings('from a_index | where length(least(stringField)) > 0', []); - - testErrorsAndWarnings('from a_index | where length(least(cartesianPointField)) > 0', [ - 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - ]); - - testErrorsAndWarnings( - 'from a_index | where length(least(stringField, stringField)) > 0', - [] - ); - - testErrorsAndWarnings( - 'from a_index | where length(least(cartesianPointField, cartesianPointField)) > 0', - [ - 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - ] - ); - + testErrorsAndWarnings('from a_index | where least(integerField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where least(longField) > 0', []); + testErrorsAndWarnings('from a_index | where least(longField, longField) > 0', []); testErrorsAndWarnings('from a_index | eval var = least(booleanField)', []); testErrorsAndWarnings('from a_index | eval least(booleanField)', []); testErrorsAndWarnings('from a_index | eval var = least(to_boolean(booleanField))', []); @@ -3137,37 +3356,55 @@ describe('validation logic', () => { ] ); - testErrorsAndWarnings('from a_index | eval var = least(numberField, numberField)', []); - testErrorsAndWarnings('from a_index | eval least(numberField, numberField)', []); + testErrorsAndWarnings('from a_index | eval var = least(doubleField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval least(doubleField, doubleField)', []); testErrorsAndWarnings( - 'from a_index | eval var = least(to_integer(booleanField), to_integer(booleanField))', + 'from a_index | eval var = least(to_double(booleanField), to_double(booleanField))', [] ); - testErrorsAndWarnings('from a_index | eval var = least(numberField)', []); - testErrorsAndWarnings('from a_index | eval least(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = least(integerField)', []); + testErrorsAndWarnings('from a_index | eval least(integerField)', []); testErrorsAndWarnings('from a_index | eval var = least(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = least(integerField, integerField)', []); + testErrorsAndWarnings('from a_index | eval least(integerField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = least(to_integer(booleanField), to_integer(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = least(ipField, ipField)', []); testErrorsAndWarnings('from a_index | eval least(ipField, ipField)', []); testErrorsAndWarnings( 'from a_index | eval var = least(to_ip(ipField), to_ip(ipField))', [] ); + testErrorsAndWarnings('from a_index | eval var = least(keywordField)', []); + testErrorsAndWarnings('from a_index | eval least(keywordField)', []); testErrorsAndWarnings('from a_index | eval var = least(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = least(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval least(stringField, stringField)', []); + testErrorsAndWarnings('from a_index | eval var = least(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval least(keywordField, keywordField)', []); testErrorsAndWarnings( 'from a_index | eval var = least(to_string(booleanField), to_string(booleanField))', [] ); + testErrorsAndWarnings('from a_index | eval var = least(longField)', []); + testErrorsAndWarnings('from a_index | eval least(longField)', []); + testErrorsAndWarnings('from a_index | eval var = least(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval least(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval var = least(textField)', []); + testErrorsAndWarnings('from a_index | eval least(textField)', []); + testErrorsAndWarnings('from a_index | eval var = least(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval least(textField, textField)', []); testErrorsAndWarnings('from a_index | eval var = least(versionField, versionField)', []); testErrorsAndWarnings('from a_index | eval least(versionField, versionField)', []); testErrorsAndWarnings( - 'from a_index | eval var = least(to_version(stringField), to_version(stringField))', + 'from a_index | eval var = least(to_version(keywordField), to_version(keywordField))', [] ); @@ -3179,52 +3416,15 @@ describe('validation logic', () => { describe('left', () => { testErrorsAndWarnings('row var = left("a", 5)', []); testErrorsAndWarnings('row left("a", 5)', []); - testErrorsAndWarnings('row var = left(to_string("a"), to_integer("a"))', []); - - testErrorsAndWarnings('row var = left(5, "a")', [ - 'Argument of [left] must be [string], found value [5] type [number]', - 'Argument of [left] must be [number], found value ["a"] type [string]', - ]); - - testErrorsAndWarnings( - 'from a_index | where length(left(stringField, numberField)) > 0', - [] - ); - - testErrorsAndWarnings('from a_index | where length(left(numberField, stringField)) > 0', [ - 'Argument of [left] must be [string], found value [numberField] type [number]', - 'Argument of [left] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval var = left(stringField, numberField)', []); - testErrorsAndWarnings('from a_index | eval left(stringField, numberField)', []); - - testErrorsAndWarnings( - 'from a_index | eval var = left(to_string(stringField), to_integer(stringField))', - [] - ); - - testErrorsAndWarnings('from a_index | eval left(numberField, stringField)', [ - 'Argument of [left] must be [string], found value [numberField] type [number]', - 'Argument of [left] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval left(stringField, numberField, extraArg)', [ - 'Error: [left] function expects exactly 2 arguments, got 3.', - ]); - - testErrorsAndWarnings('from a_index | sort left(stringField, numberField)', []); testErrorsAndWarnings('row var = left(to_string(true), to_integer(true))', []); testErrorsAndWarnings('row var = left(true, true)', [ - 'Argument of [left] must be [string], found value [true] type [boolean]', - 'Argument of [left] must be [number], found value [true] type [boolean]', + 'Argument of [left] must be [keyword], found value [true] type [boolean]', + 'Argument of [left] must be [integer], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where length(left(booleanField, booleanField)) > 0', [ - 'Argument of [left] must be [string], found value [booleanField] type [boolean]', - 'Argument of [left] must be [number], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | eval var = left(keywordField, integerField)', []); + testErrorsAndWarnings('from a_index | eval left(keywordField, integerField)', []); testErrorsAndWarnings( 'from a_index | eval var = left(to_string(booleanField), to_integer(booleanField))', @@ -3232,9 +3432,18 @@ describe('validation logic', () => { ); testErrorsAndWarnings('from a_index | eval left(booleanField, booleanField)', [ - 'Argument of [left] must be [string], found value [booleanField] type [boolean]', - 'Argument of [left] must be [number], found value [booleanField] type [boolean]', + 'Argument of [left] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [left] must be [integer], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = left(textField, integerField)', []); + testErrorsAndWarnings('from a_index | eval left(textField, integerField)', []); + + testErrorsAndWarnings('from a_index | eval left(keywordField, integerField, extraArg)', [ + 'Error: [left] function expects exactly 2 arguments, got 3.', ]); + + testErrorsAndWarnings('from a_index | sort left(keywordField, integerField)', []); testErrorsAndWarnings('from a_index | eval left(null, null)', []); testErrorsAndWarnings('row nullVar = null | eval left(nullVar, nullVar)', []); }); @@ -3242,7355 +3451,11003 @@ describe('validation logic', () => { describe('length', () => { testErrorsAndWarnings('row var = length("a")', []); testErrorsAndWarnings('row length("a")', []); - testErrorsAndWarnings('row var = length(to_string("a"))', []); - - testErrorsAndWarnings('row var = length(5)', [ - 'Argument of [length] must be [string], found value [5] type [number]', - ]); - - testErrorsAndWarnings('from a_index | where length(stringField) > 0', []); + testErrorsAndWarnings('row var = length(to_string(true))', []); - testErrorsAndWarnings('from a_index | where length(numberField) > 0', [ - 'Argument of [length] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('row var = length(true)', [ + 'Argument of [length] must be [keyword], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = length(stringField)', []); - testErrorsAndWarnings('from a_index | eval length(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = length(to_string(stringField))', []); - - testErrorsAndWarnings('from a_index | eval length(numberField)', [ - 'Argument of [length] must be [string], found value [numberField] type [number]', - ]); + testErrorsAndWarnings('from a_index | eval var = length(keywordField)', []); + testErrorsAndWarnings('from a_index | eval length(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = length(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval length(stringField, extraArg)', [ - 'Error: [length] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval length(booleanField)', [ + 'Argument of [length] must be [keyword], found value [booleanField] type [boolean]', ]); testErrorsAndWarnings('from a_index | eval var = length(*)', [ 'Using wildcards (*) in length is not allowed', ]); - testErrorsAndWarnings('from a_index | sort length(stringField)', []); - testErrorsAndWarnings('row var = length(to_string(true))', []); - - testErrorsAndWarnings('row var = length(true)', [ - 'Argument of [length] must be [string], found value [true] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | eval var = length(textField)', []); + testErrorsAndWarnings('from a_index | eval length(textField)', []); - testErrorsAndWarnings('from a_index | where length(booleanField) > 0', [ - 'Argument of [length] must be [string], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval length(keywordField, extraArg)', [ + 'Error: [length] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | eval var = length(to_string(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval length(booleanField)', [ - 'Argument of [length] must be [string], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | sort length(keywordField)', []); testErrorsAndWarnings('from a_index | eval length(null)', []); testErrorsAndWarnings('row nullVar = null | eval length(nullVar)', []); }); - describe('log', () => { - testErrorsAndWarnings('row var = log(5, 5)', []); - testErrorsAndWarnings('row log(5, 5)', []); - testErrorsAndWarnings('row var = log(to_integer("a"), to_integer("a"))', []); + describe('locate', () => { + testErrorsAndWarnings('row var = locate("a", "a")', []); + testErrorsAndWarnings('row locate("a", "a")', []); + testErrorsAndWarnings('row var = locate(to_string(true), to_string(true))', []); + testErrorsAndWarnings('row var = locate("a", "a", 5)', []); + testErrorsAndWarnings('row locate("a", "a", 5)', []); + testErrorsAndWarnings( + 'row var = locate(to_string(true), to_string(true), to_integer(true))', + [] + ); - testErrorsAndWarnings('row var = log("a", "a")', [ - 'Argument of [log] must be [number], found value ["a"] type [string]', - 'Argument of [log] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('row var = locate(true, true, true)', [ + 'Argument of [locate] must be [keyword], found value [true] type [boolean]', + 'Argument of [locate] must be [keyword], found value [true] type [boolean]', + 'Argument of [locate] must be [integer], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where log(numberField, numberField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = locate(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval locate(keywordField, keywordField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = locate(to_string(booleanField), to_string(booleanField))', + [] + ); - testErrorsAndWarnings('from a_index | where log(stringField, stringField) > 0', [ - 'Argument of [log] must be [number], found value [stringField] type [string]', - 'Argument of [log] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval locate(booleanField, booleanField)', [ + 'Argument of [locate] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [locate] must be [keyword], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = log(numberField, numberField)', []); - testErrorsAndWarnings('from a_index | eval log(numberField, numberField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = locate(keywordField, keywordField, integerField)', + [] + ); testErrorsAndWarnings( - 'from a_index | eval var = log(to_integer(stringField), to_integer(stringField))', + 'from a_index | eval locate(keywordField, keywordField, integerField)', [] ); - testErrorsAndWarnings('from a_index | eval log(stringField, stringField)', [ - 'Argument of [log] must be [number], found value [stringField] type [string]', - 'Argument of [log] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = locate(to_string(booleanField), to_string(booleanField), to_integer(booleanField))', + [] + ); - testErrorsAndWarnings('from a_index | eval log(numberField, numberField, extraArg)', [ - 'Error: [log] function expects no more than 2 arguments, got 3.', - ]); + testErrorsAndWarnings( + 'from a_index | eval locate(booleanField, booleanField, booleanField)', + [ + 'Argument of [locate] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [locate] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [locate] must be [integer], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings('from a_index | eval var = locate(keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval locate(keywordField, textField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = locate(keywordField, textField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval locate(keywordField, textField, integerField)', + [] + ); + testErrorsAndWarnings('from a_index | eval var = locate(textField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval locate(textField, keywordField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = locate(textField, keywordField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval locate(textField, keywordField, integerField)', + [] + ); + testErrorsAndWarnings('from a_index | eval var = locate(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval locate(textField, textField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = locate(textField, textField, integerField)', + [] + ); + testErrorsAndWarnings('from a_index | eval locate(textField, textField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval locate(keywordField, keywordField, integerField, extraArg)', + ['Error: [locate] function expects no more than 3 arguments, got 4.'] + ); - testErrorsAndWarnings('from a_index | sort log(numberField, numberField)', []); + testErrorsAndWarnings('from a_index | sort locate(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval locate(null, null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval locate(nullVar, nullVar, nullVar)', []); + }); + + describe('log', () => { + testErrorsAndWarnings('row var = log(5.5)', []); + testErrorsAndWarnings('row log(5.5)', []); + testErrorsAndWarnings('row var = log(to_double(true))', []); + testErrorsAndWarnings('row var = log(5.5, 5.5)', []); + testErrorsAndWarnings('row log(5.5, 5.5)', []); + testErrorsAndWarnings('row var = log(to_double(true), to_double(true))', []); + testErrorsAndWarnings('row var = log(5.5, 5)', []); + testErrorsAndWarnings('row log(5.5, 5)', []); + testErrorsAndWarnings('row var = log(to_double(true), to_integer(true))', []); + testErrorsAndWarnings('row var = log(to_double(true), 5)', []); testErrorsAndWarnings('row var = log(5)', []); testErrorsAndWarnings('row log(5)', []); testErrorsAndWarnings('row var = log(to_integer(true))', []); + testErrorsAndWarnings('row var = log(5, 5.5)', []); + testErrorsAndWarnings('row log(5, 5.5)', []); + testErrorsAndWarnings('row var = log(to_integer(true), to_double(true))', []); + testErrorsAndWarnings('row var = log(5, 5)', []); + testErrorsAndWarnings('row log(5, 5)', []); testErrorsAndWarnings('row var = log(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = log(to_integer(true), 5)', []); + testErrorsAndWarnings('row var = log(5, to_double(true))', []); + testErrorsAndWarnings('row var = log(5, to_integer(true))', []); testErrorsAndWarnings('row var = log(true, true)', [ - 'Argument of [log] must be [number], found value [true] type [boolean]', - 'Argument of [log] must be [number], found value [true] type [boolean]', + 'Argument of [log] must be [double], found value [true] type [boolean]', + 'Argument of [log] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where log(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where log(doubleField) > 0', []); testErrorsAndWarnings('from a_index | where log(booleanField) > 0', [ - 'Argument of [log] must be [number], found value [booleanField] type [boolean]', + 'Argument of [log] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where log(booleanField, booleanField) > 0', [ - 'Argument of [log] must be [number], found value [booleanField] type [boolean]', - 'Argument of [log] must be [number], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | where log(doubleField, doubleField) > 0', []); - testErrorsAndWarnings('from a_index | eval var = log(numberField)', []); - testErrorsAndWarnings('from a_index | eval log(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = log(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | where log(booleanField, booleanField) > 0', [ + 'Argument of [log] must be [double], found value [booleanField] type [boolean]', + 'Argument of [log] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where log(doubleField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where log(doubleField, longField) > 0', []); + testErrorsAndWarnings('from a_index | where log(doubleField, unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | where log(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where log(integerField, doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where log(integerField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where log(integerField, longField) > 0', []); + testErrorsAndWarnings('from a_index | where log(integerField, unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | where log(longField) > 0', []); + testErrorsAndWarnings('from a_index | where log(longField, doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where log(longField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where log(longField, longField) > 0', []); + testErrorsAndWarnings('from a_index | where log(longField, unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | where log(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | where log(unsignedLongField, doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where log(unsignedLongField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where log(unsignedLongField, longField) > 0', []); + testErrorsAndWarnings( + 'from a_index | where log(unsignedLongField, unsignedLongField) > 0', + [] + ); + testErrorsAndWarnings('from a_index | eval var = log(doubleField)', []); + testErrorsAndWarnings('from a_index | eval log(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = log(to_double(booleanField))', []); testErrorsAndWarnings('from a_index | eval log(booleanField)', [ - 'Argument of [log] must be [number], found value [booleanField] type [boolean]', + 'Argument of [log] must be [double], found value [booleanField] type [boolean]', ]); testErrorsAndWarnings('from a_index | eval var = log(*)', [ 'Using wildcards (*) in log is not allowed', ]); + testErrorsAndWarnings('from a_index | eval var = log(doubleField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval log(doubleField, doubleField)', []); + testErrorsAndWarnings( - 'from a_index | eval var = log(to_integer(booleanField), to_integer(booleanField))', + 'from a_index | eval var = log(to_double(booleanField), to_double(booleanField))', [] ); testErrorsAndWarnings('from a_index | eval log(booleanField, booleanField)', [ - 'Argument of [log] must be [number], found value [booleanField] type [boolean]', - 'Argument of [log] must be [number], found value [booleanField] type [boolean]', + 'Argument of [log] must be [double], found value [booleanField] type [boolean]', + 'Argument of [log] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | sort log(numberField)', []); - testErrorsAndWarnings('from a_index | eval log(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval log(nullVar, nullVar)', []); - }); - - describe('log10', () => { - testErrorsAndWarnings('row var = log10(5)', []); - testErrorsAndWarnings('row log10(5)', []); - testErrorsAndWarnings('row var = log10(to_integer("a"))', []); + testErrorsAndWarnings('from a_index | eval var = log(doubleField, integerField)', []); + testErrorsAndWarnings('from a_index | eval log(doubleField, integerField)', []); - testErrorsAndWarnings('row var = log10("a")', [ - 'Argument of [log10] must be [number], found value ["a"] type [string]', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = log(to_double(booleanField), to_integer(booleanField))', + [] + ); - testErrorsAndWarnings('from a_index | where log10(numberField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = log(doubleField, longField)', []); + testErrorsAndWarnings('from a_index | eval log(doubleField, longField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = log(to_double(booleanField), longField)', + [] + ); + testErrorsAndWarnings('from a_index | eval var = log(doubleField, unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval log(doubleField, unsignedLongField)', []); - testErrorsAndWarnings('from a_index | where log10(stringField) > 0', [ - 'Argument of [log10] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = log(to_double(booleanField), unsignedLongField)', + [] + ); - testErrorsAndWarnings('from a_index | eval var = log10(numberField)', []); - testErrorsAndWarnings('from a_index | eval log10(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = log10(to_integer(stringField))', []); + testErrorsAndWarnings('from a_index | eval var = log(integerField)', []); + testErrorsAndWarnings('from a_index | eval log(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = log(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = log(integerField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval log(integerField, doubleField)', []); - testErrorsAndWarnings('from a_index | eval log10(stringField)', [ - 'Argument of [log10] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = log(to_integer(booleanField), to_double(booleanField))', + [] + ); - testErrorsAndWarnings('from a_index | eval log10(numberField, extraArg)', [ - 'Error: [log10] function expects exactly one argument, got 2.', - ]); + testErrorsAndWarnings('from a_index | eval var = log(integerField, integerField)', []); + testErrorsAndWarnings('from a_index | eval log(integerField, integerField)', []); - testErrorsAndWarnings('from a_index | eval var = log10(*)', [ - 'Using wildcards (*) in log10 is not allowed', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = log(to_integer(booleanField), to_integer(booleanField))', + [] + ); - testErrorsAndWarnings('from a_index | sort log10(numberField)', []); - testErrorsAndWarnings('row var = log10(to_integer(true))', []); + testErrorsAndWarnings('from a_index | eval var = log(integerField, longField)', []); + testErrorsAndWarnings('from a_index | eval log(integerField, longField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = log(to_integer(booleanField), longField)', + [] + ); + testErrorsAndWarnings('from a_index | eval var = log(integerField, unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval log(integerField, unsignedLongField)', []); - testErrorsAndWarnings('row var = log10(true)', [ - 'Argument of [log10] must be [number], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = log(to_integer(booleanField), unsignedLongField)', + [] + ); - testErrorsAndWarnings('from a_index | where log10(booleanField) > 0', [ - 'Argument of [log10] must be [number], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | eval var = log(longField)', []); + testErrorsAndWarnings('from a_index | eval log(longField)', []); + testErrorsAndWarnings('from a_index | eval var = log(longField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval log(longField, doubleField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = log(longField, to_double(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = log(longField, integerField)', []); + testErrorsAndWarnings('from a_index | eval log(longField, integerField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = log(longField, to_integer(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = log(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval log(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval var = log(longField, unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval log(longField, unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = log(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval log(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = log(unsignedLongField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval log(unsignedLongField, doubleField)', []); - testErrorsAndWarnings('from a_index | eval var = log10(to_integer(booleanField))', []); + testErrorsAndWarnings( + 'from a_index | eval var = log(unsignedLongField, to_double(booleanField))', + [] + ); - testErrorsAndWarnings('from a_index | eval log10(booleanField)', [ - 'Argument of [log10] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = log(unsignedLongField, integerField)', []); + testErrorsAndWarnings('from a_index | eval log(unsignedLongField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = log(unsignedLongField, to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = log(unsignedLongField, longField)', []); + testErrorsAndWarnings('from a_index | eval log(unsignedLongField, longField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = log(unsignedLongField, unsignedLongField)', + [] + ); + testErrorsAndWarnings('from a_index | eval log(unsignedLongField, unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval log(doubleField, doubleField, extraArg)', [ + 'Error: [log] function expects no more than 2 arguments, got 3.', ]); - testErrorsAndWarnings('from a_index | eval log10(null)', []); - testErrorsAndWarnings('row nullVar = null | eval log10(nullVar)', []); + + testErrorsAndWarnings('from a_index | sort log(doubleField)', []); + testErrorsAndWarnings('from a_index | eval log(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval log(nullVar, nullVar)', []); }); - describe('ltrim', () => { - testErrorsAndWarnings('row var = ltrim("a")', []); - testErrorsAndWarnings('row ltrim("a")', []); - testErrorsAndWarnings('row var = ltrim(to_string("a"))', []); + describe('log10', () => { + testErrorsAndWarnings('row var = log10(5.5)', []); + testErrorsAndWarnings('row log10(5.5)', []); + testErrorsAndWarnings('row var = log10(to_double(true))', []); + testErrorsAndWarnings('row var = log10(5)', []); + testErrorsAndWarnings('row log10(5)', []); + testErrorsAndWarnings('row var = log10(to_integer(true))', []); - testErrorsAndWarnings('row var = ltrim(5)', [ - 'Argument of [ltrim] must be [string], found value [5] type [number]', + testErrorsAndWarnings('row var = log10(true)', [ + 'Argument of [log10] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where length(ltrim(stringField)) > 0', []); + testErrorsAndWarnings('from a_index | where log10(doubleField) > 0', []); - testErrorsAndWarnings('from a_index | where length(ltrim(numberField)) > 0', [ - 'Argument of [ltrim] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('from a_index | where log10(booleanField) > 0', [ + 'Argument of [log10] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = ltrim(stringField)', []); - testErrorsAndWarnings('from a_index | eval ltrim(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = ltrim(to_string(stringField))', []); + testErrorsAndWarnings('from a_index | where log10(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where log10(longField) > 0', []); + testErrorsAndWarnings('from a_index | where log10(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = log10(doubleField)', []); + testErrorsAndWarnings('from a_index | eval log10(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = log10(to_double(booleanField))', []); - testErrorsAndWarnings('from a_index | eval ltrim(numberField)', [ - 'Argument of [ltrim] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('from a_index | eval log10(booleanField)', [ + 'Argument of [log10] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval ltrim(stringField, extraArg)', [ - 'Error: [ltrim] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval var = log10(*)', [ + 'Using wildcards (*) in log10 is not allowed', ]); - testErrorsAndWarnings('from a_index | eval var = ltrim(*)', [ - 'Using wildcards (*) in ltrim is not allowed', + testErrorsAndWarnings('from a_index | eval var = log10(integerField)', []); + testErrorsAndWarnings('from a_index | eval log10(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = log10(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = log10(longField)', []); + testErrorsAndWarnings('from a_index | eval log10(longField)', []); + testErrorsAndWarnings('from a_index | eval var = log10(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval log10(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval log10(doubleField, extraArg)', [ + 'Error: [log10] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | sort ltrim(stringField)', []); + testErrorsAndWarnings('from a_index | sort log10(doubleField)', []); + testErrorsAndWarnings('from a_index | eval log10(null)', []); + testErrorsAndWarnings('row nullVar = null | eval log10(nullVar)', []); + }); + + describe('ltrim', () => { + testErrorsAndWarnings('row var = ltrim("a")', []); + testErrorsAndWarnings('row ltrim("a")', []); testErrorsAndWarnings('row var = ltrim(to_string(true))', []); testErrorsAndWarnings('row var = ltrim(true)', [ - 'Argument of [ltrim] must be [string], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where length(ltrim(booleanField)) > 0', [ - 'Argument of [ltrim] must be [string], found value [booleanField] type [boolean]', + 'Argument of [ltrim] must be [keyword], found value [true] type [boolean]', ]); + testErrorsAndWarnings('from a_index | eval var = ltrim(keywordField)', []); + testErrorsAndWarnings('from a_index | eval ltrim(keywordField)', []); testErrorsAndWarnings('from a_index | eval var = ltrim(to_string(booleanField))', []); testErrorsAndWarnings('from a_index | eval ltrim(booleanField)', [ - 'Argument of [ltrim] must be [string], found value [booleanField] type [boolean]', + 'Argument of [ltrim] must be [keyword], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval ltrim(null)', []); - testErrorsAndWarnings('row nullVar = null | eval ltrim(nullVar)', []); - }); - describe('mv_avg', () => { - testErrorsAndWarnings('row var = mv_avg(5)', []); - testErrorsAndWarnings('row mv_avg(5)', []); - testErrorsAndWarnings('row var = mv_avg(to_integer("a"))', []); - - testErrorsAndWarnings('row var = mv_avg("a")', [ - 'Argument of [mv_avg] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | eval var = ltrim(*)', [ + 'Using wildcards (*) in ltrim is not allowed', ]); - testErrorsAndWarnings('from a_index | where mv_avg(numberField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = ltrim(textField)', []); + testErrorsAndWarnings('from a_index | eval ltrim(textField)', []); - testErrorsAndWarnings('from a_index | where mv_avg(stringField) > 0', [ - 'Argument of [mv_avg] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval ltrim(keywordField, extraArg)', [ + 'Error: [ltrim] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | eval var = mv_avg(numberField)', []); - testErrorsAndWarnings('from a_index | eval mv_avg(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_avg(to_integer(stringField))', []); + testErrorsAndWarnings('from a_index | sort ltrim(keywordField)', []); + testErrorsAndWarnings('from a_index | eval ltrim(null)', []); + testErrorsAndWarnings('row nullVar = null | eval ltrim(nullVar)', []); + }); - testErrorsAndWarnings('from a_index | eval mv_avg(stringField)', [ - 'Argument of [mv_avg] must be [number], found value [stringField] type [string]', + describe('mv_append', () => { + testErrorsAndWarnings('row var = mv_append(true, true)', []); + testErrorsAndWarnings('row mv_append(true, true)', []); + testErrorsAndWarnings('row var = mv_append(to_boolean(true), to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_append(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', ]); - - testErrorsAndWarnings('from a_index | eval mv_avg(numberField, extraArg)', [ - 'Error: [mv_avg] function expects exactly one argument, got 2.', + testErrorsAndWarnings('row mv_append(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', ]); - testErrorsAndWarnings('from a_index | eval var = mv_avg(*)', [ - 'Using wildcards (*) in mv_avg is not allowed', - ]); + testErrorsAndWarnings( + 'row var = mv_append(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); - testErrorsAndWarnings('from a_index | sort mv_avg(numberField)', []); - testErrorsAndWarnings('row var = mv_avg(to_integer(true))', []); + testErrorsAndWarnings( + 'row var = mv_append(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + [] + ); - testErrorsAndWarnings('row var = mv_avg(true)', [ - 'Argument of [mv_avg] must be [number], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'row mv_append(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + [] + ); - testErrorsAndWarnings('from a_index | where mv_avg(booleanField) > 0', [ - 'Argument of [mv_avg] must be [number], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings( + 'row var = mv_append(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); - testErrorsAndWarnings('from a_index | eval var = mv_avg(to_integer(booleanField))', []); + testErrorsAndWarnings( + 'row var = mv_append(to_datetime("2021-01-01T00:00:00Z"), to_datetime("2021-01-01T00:00:00Z"))', + [] + ); - testErrorsAndWarnings('from a_index | eval mv_avg(booleanField)', [ - 'Argument of [mv_avg] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval mv_avg(null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_avg(nullVar)', []); - }); + testErrorsAndWarnings( + 'row mv_append(to_datetime("2021-01-01T00:00:00Z"), to_datetime("2021-01-01T00:00:00Z"))', + [] + ); - describe('mv_concat', () => { - testErrorsAndWarnings('row var = mv_concat("a", "a")', []); - testErrorsAndWarnings('row mv_concat("a", "a")', []); - testErrorsAndWarnings('row var = mv_concat(to_string("a"), to_string("a"))', []); + testErrorsAndWarnings( + 'row var = mv_append(to_datetime(to_datetime("2021-01-01T00:00:00Z")), to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); - testErrorsAndWarnings('row var = mv_concat(5, 5)', [ - 'Argument of [mv_concat] must be [string], found value [5] type [number]', - 'Argument of [mv_concat] must be [string], found value [5] type [number]', + testErrorsAndWarnings('row var = mv_append(5.5, 5.5)', []); + + testErrorsAndWarnings('row mv_append(5.5, 5.5)', []); + testErrorsAndWarnings('row var = mv_append(to_double(true), to_double(true))', []); + testErrorsAndWarnings('row var = mv_append(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row mv_append(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', ]); + testErrorsAndWarnings( + 'row var = mv_append(to_geopoint(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); testErrorsAndWarnings( - 'from a_index | where length(mv_concat(stringField, stringField)) > 0', + 'row var = mv_append(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', [] ); testErrorsAndWarnings( - 'from a_index | where length(mv_concat(numberField, numberField)) > 0', - [ - 'Argument of [mv_concat] must be [string], found value [numberField] type [number]', - 'Argument of [mv_concat] must be [string], found value [numberField] type [number]', - ] + 'row mv_append(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + [] ); - testErrorsAndWarnings('from a_index | eval var = mv_concat(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval mv_concat(stringField, stringField)', []); + testErrorsAndWarnings( + 'row var = mv_append(to_geoshape(geoPointField), to_geoshape(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + testErrorsAndWarnings('row var = mv_append(5, 5)', []); + testErrorsAndWarnings('row mv_append(5, 5)', []); + testErrorsAndWarnings('row var = mv_append(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = mv_append(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_append(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_concat(to_string(stringField), to_string(stringField))', + 'row var = mv_append(to_ip(to_ip("127.0.0.1")), to_ip(to_ip("127.0.0.1")))', [] ); - testErrorsAndWarnings('from a_index | eval mv_concat(numberField, numberField)', [ - 'Argument of [mv_concat] must be [string], found value [numberField] type [number]', - 'Argument of [mv_concat] must be [string], found value [numberField] type [number]', - ]); + testErrorsAndWarnings('row var = mv_append("a", "a")', []); + testErrorsAndWarnings('row mv_append("a", "a")', []); + testErrorsAndWarnings('row var = mv_append(to_string(true), to_string(true))', []); + testErrorsAndWarnings('row var = mv_append(to_version("1.0.0"), to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_append(to_version("1.0.0"), to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_append(to_version("a"), to_version("a"))', []); + testErrorsAndWarnings('from a_index | where mv_append(doubleField, doubleField) > 0', []); - testErrorsAndWarnings('from a_index | eval mv_concat(stringField, stringField, extraArg)', [ - 'Error: [mv_concat] function expects exactly 2 arguments, got 3.', - ]); + testErrorsAndWarnings( + 'from a_index | where mv_append(counterDoubleField, counterDoubleField) > 0', + [ + 'Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]', + 'Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]', + ] + ); - testErrorsAndWarnings('from a_index | sort mv_concat(stringField, stringField)', []); - testErrorsAndWarnings('row var = mv_concat(to_string(true), to_string(true))', []); + testErrorsAndWarnings('from a_index | where mv_append(integerField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_append(longField, longField) > 0', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_append(booleanField, booleanField)', + [] + ); + testErrorsAndWarnings('from a_index | eval mv_append(booleanField, booleanField)', []); - testErrorsAndWarnings('row var = mv_concat(true, true)', [ - 'Argument of [mv_concat] must be [string], found value [true] type [boolean]', - 'Argument of [mv_concat] must be [string], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = mv_append(to_boolean(booleanField), to_boolean(booleanField))', + [] + ); testErrorsAndWarnings( - 'from a_index | where length(mv_concat(booleanField, booleanField)) > 0', + 'from a_index | eval mv_append(counterDoubleField, counterDoubleField)', [ - 'Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]', - 'Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]', + 'Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]', + 'Argument of [mv_append] must be [boolean], found value [counterDoubleField] type [counter_double]', ] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_concat(to_string(booleanField), to_string(booleanField))', + 'from a_index | eval var = mv_append(cartesianPointField, cartesianPointField)', [] ); - testErrorsAndWarnings('from a_index | eval mv_concat(booleanField, booleanField)', [ - 'Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]', - 'Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval mv_concat(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_concat(nullVar, nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | eval mv_append(cartesianPointField, cartesianPointField)', + [] + ); - describe('mv_count', () => { - testErrorsAndWarnings('row var = mv_count("a")', []); - testErrorsAndWarnings('row mv_count("a")', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(stringField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(stringField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_append(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); - testErrorsAndWarnings('from a_index | eval var = mv_count(*)', [ - 'Using wildcards (*) in mv_count is not allowed', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = mv_append(cartesianShapeField, cartesianShapeField)', + [] + ); - testErrorsAndWarnings('from a_index | sort mv_count(stringField)', []); - testErrorsAndWarnings('row var = mv_count(true)', []); - testErrorsAndWarnings('row mv_count(true)', []); - testErrorsAndWarnings('row var = mv_count(to_boolean(true))', []); - testErrorsAndWarnings('row var = mv_count(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_count(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings( + 'from a_index | eval mv_append(cartesianShapeField, cartesianShapeField)', + [] + ); testErrorsAndWarnings( - 'row var = mv_count(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | eval var = mv_append(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', [] ); - testErrorsAndWarnings('row var = mv_count(to_cartesianshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_count(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('from a_index | eval var = mv_append(dateField, dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_append(dateField, dateField)', []); testErrorsAndWarnings( - 'row var = mv_count(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | eval var = mv_append(to_datetime(dateField), to_datetime(dateField))', [] ); - testErrorsAndWarnings('row var = mv_count(now())', []); - testErrorsAndWarnings('row mv_count(now())', []); - testErrorsAndWarnings('row var = mv_count(to_datetime(now()))', []); - testErrorsAndWarnings('row var = mv_count(5)', []); - testErrorsAndWarnings('row mv_count(5)', []); - testErrorsAndWarnings('row var = mv_count(to_integer(true))', []); - testErrorsAndWarnings('row var = mv_count(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_count(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = mv_count(to_geopoint(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings('row var = mv_count(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_count(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = mv_count(to_geoshape(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings('row var = mv_count(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row mv_count(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row var = mv_count(to_ip(to_ip("127.0.0.1")))', []); - testErrorsAndWarnings('row var = mv_count(to_string(true))', []); - testErrorsAndWarnings('row var = mv_count(to_version("1.0.0"))', []); - testErrorsAndWarnings('row mv_count(to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = mv_count(to_version("a"))', []); - testErrorsAndWarnings('from a_index | where mv_count(booleanField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_count(cartesianPointField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_count(cartesianShapeField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_count(dateField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_count(numberField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_count(geoPointField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_count(geoShapeField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_count(ipField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_count(stringField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_count(versionField) > 0', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(to_boolean(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_append(doubleField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_append(doubleField, doubleField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_count(to_cartesianpoint(cartesianPointField))', + 'from a_index | eval var = mv_append(to_double(booleanField), to_double(booleanField))', [] ); - testErrorsAndWarnings('from a_index | eval var = mv_count(cartesianShapeField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(cartesianShapeField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_append(geoPointField, geoPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval mv_append(geoPointField, geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_count(to_cartesianshape(cartesianPointField))', + 'from a_index | eval var = mv_append(to_geopoint(geoPointField), to_geopoint(geoPointField))', [] ); - testErrorsAndWarnings('from a_index | eval var = mv_count(dateField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(numberField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(to_geopoint(geoPointField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(to_geoshape(geoPointField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(ipField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(ipField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(to_ip(ipField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(versionField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(versionField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_count(to_version(stringField))', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_append(geoShapeField, geoShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval mv_append(geoShapeField, geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(booleanField, extraArg)', [ - 'Error: [mv_count] function expects exactly one argument, got 2.', - ]); - - testErrorsAndWarnings('from a_index | sort mv_count(booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_count(null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_count(nullVar)', []); - }); - - describe('mv_dedupe', () => { - testErrorsAndWarnings('row var = mv_dedupe("a")', []); - testErrorsAndWarnings('row mv_dedupe("a")', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(stringField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(stringField)', []); - - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(*)', [ - 'Using wildcards (*) in mv_dedupe is not allowed', - ]); - - testErrorsAndWarnings('from a_index | sort mv_dedupe(stringField)', []); - testErrorsAndWarnings('row var = mv_dedupe(true)', []); - testErrorsAndWarnings('row mv_dedupe(true)', []); - testErrorsAndWarnings('row var = mv_dedupe(to_boolean(true))', []); - testErrorsAndWarnings('row var = mv_dedupe(now())', []); - testErrorsAndWarnings('row mv_dedupe(now())', []); - testErrorsAndWarnings('row var = mv_dedupe(to_datetime(now()))', []); - testErrorsAndWarnings('row var = mv_dedupe(5)', []); - testErrorsAndWarnings('row mv_dedupe(5)', []); - testErrorsAndWarnings('row var = mv_dedupe(to_integer(true))', []); - testErrorsAndWarnings('row var = mv_dedupe(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row mv_dedupe(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row var = mv_dedupe(to_ip(to_ip("127.0.0.1")))', []); - testErrorsAndWarnings('row var = mv_dedupe(to_string(true))', []); - testErrorsAndWarnings('row var = mv_dedupe(to_version("1.0.0"))', []); - testErrorsAndWarnings('row mv_dedupe(to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = mv_dedupe(to_version("a"))', []); - - testErrorsAndWarnings('from a_index | where mv_dedupe(numberField) > 0', []); - - testErrorsAndWarnings('from a_index | where length(mv_dedupe(stringField)) > 0', []); - - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_boolean(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(dateField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(numberField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(ipField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(ipField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_ip(ipField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(versionField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(versionField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_version(stringField))', []); - - testErrorsAndWarnings('from a_index | eval mv_dedupe(booleanField, extraArg)', [ - 'Error: [mv_dedupe] function expects exactly one argument, got 2.', - ]); - - testErrorsAndWarnings('from a_index | sort mv_dedupe(booleanField)', []); - testErrorsAndWarnings('row mv_dedupe(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_append(to_geoshape(geoPointField), to_geoshape(geoPointField))', + [] + ); testErrorsAndWarnings( - 'row var = mv_dedupe(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | eval var = mv_append(integerField, integerField)', [] ); - - testErrorsAndWarnings('row var = mv_dedupe(to_cartesianshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_dedupe(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('from a_index | eval mv_append(integerField, integerField)', []); testErrorsAndWarnings( - 'row var = mv_dedupe(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | eval var = mv_append(to_integer(booleanField), to_integer(booleanField))', [] ); - testErrorsAndWarnings('row var = mv_dedupe(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_dedupe(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = mv_dedupe(to_geopoint(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings('row var = mv_dedupe(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_dedupe(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = mv_dedupe(to_geoshape(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(cartesianPointField)', []); - + testErrorsAndWarnings('from a_index | eval var = mv_append(ipField, ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_append(ipField, ipField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_dedupe(to_cartesianpoint(cartesianPointField))', + 'from a_index | eval var = mv_append(to_ip(ipField), to_ip(ipField))', + [] + ); + testErrorsAndWarnings( + 'from a_index | eval var = mv_append(keywordField, keywordField)', [] ); + testErrorsAndWarnings('from a_index | eval mv_append(keywordField, keywordField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(cartesianShapeField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(cartesianShapeField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_append(to_string(booleanField), to_string(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = mv_append(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval mv_append(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_append(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval mv_append(textField, textField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_dedupe(to_cartesianshape(cartesianPointField))', + 'from a_index | eval var = mv_append(versionField, versionField)', [] ); + testErrorsAndWarnings('from a_index | eval mv_append(versionField, versionField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_dedupe(to_geopoint(geoPointField))', + 'from a_index | eval var = mv_append(to_version(keywordField), to_version(keywordField))', [] ); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(geoShapeField)', []); + testErrorsAndWarnings( - 'from a_index | eval var = mv_dedupe(to_geoshape(geoPointField))', + 'from a_index | eval mv_append(booleanField, booleanField, extraArg)', + ['Error: [mv_append] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings('from a_index | sort mv_append(booleanField, booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_append(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_append(nullVar, nullVar)', []); + testErrorsAndWarnings('from a_index | eval mv_append("2022", "2022")', []); + + testErrorsAndWarnings( + 'from a_index | eval mv_append(concat("20", "22"), concat("20", "22"))', [] ); + }); - testErrorsAndWarnings('from a_index | eval mv_dedupe(numberField, extraArg)', [ - 'Error: [mv_dedupe] function expects exactly one argument, got 2.', + describe('mv_avg', () => { + testErrorsAndWarnings('row var = mv_avg(5.5)', []); + testErrorsAndWarnings('row mv_avg(5.5)', []); + testErrorsAndWarnings('row var = mv_avg(to_double(true))', []); + testErrorsAndWarnings('row var = mv_avg(5)', []); + testErrorsAndWarnings('row mv_avg(5)', []); + testErrorsAndWarnings('row var = mv_avg(to_integer(true))', []); + + testErrorsAndWarnings('row var = mv_avg(true)', [ + 'Argument of [mv_avg] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | sort mv_dedupe(numberField)', []); - testErrorsAndWarnings('row var = mv_dedupe(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_dedupe(nullVar)', []); - }); + testErrorsAndWarnings('from a_index | where mv_avg(doubleField) > 0', []); - describe('mv_first', () => { - testErrorsAndWarnings('row var = mv_first("a")', []); - testErrorsAndWarnings('row mv_first("a")', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(stringField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(stringField)', []); + testErrorsAndWarnings('from a_index | where mv_avg(booleanField) > 0', [ + 'Argument of [mv_avg] must be [double], found value [booleanField] type [boolean]', + ]); - testErrorsAndWarnings('from a_index | eval var = mv_first(*)', [ - 'Using wildcards (*) in mv_first is not allowed', + testErrorsAndWarnings('from a_index | where mv_avg(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_avg(longField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_avg(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_avg(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_avg(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_avg(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_avg(booleanField)', [ + 'Argument of [mv_avg] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | sort mv_first(stringField)', []); - testErrorsAndWarnings('row var = mv_first(true)', []); - testErrorsAndWarnings('row mv_first(true)', []); - testErrorsAndWarnings('row var = mv_first(to_boolean(true))', []); - testErrorsAndWarnings('row var = mv_first(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_first(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings('from a_index | eval var = mv_avg(*)', [ + 'Using wildcards (*) in mv_avg is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_avg(integerField)', []); + testErrorsAndWarnings('from a_index | eval mv_avg(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_avg(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_avg(longField)', []); + testErrorsAndWarnings('from a_index | eval mv_avg(longField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_avg(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval mv_avg(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval mv_avg(doubleField, extraArg)', [ + 'Error: [mv_avg] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_avg(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_avg(null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_avg(nullVar)', []); + }); + + describe('mv_concat', () => { + testErrorsAndWarnings('row var = mv_concat("a", "a")', []); + testErrorsAndWarnings('row mv_concat("a", "a")', []); + testErrorsAndWarnings('row var = mv_concat(to_string(true), to_string(true))', []); + + testErrorsAndWarnings('row var = mv_concat(true, true)', [ + 'Argument of [mv_concat] must be [keyword], found value [true] type [boolean]', + 'Argument of [mv_concat] must be [keyword], found value [true] type [boolean]', + ]); testErrorsAndWarnings( - 'row var = mv_first(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | eval var = mv_concat(keywordField, keywordField)', [] ); - - testErrorsAndWarnings('row var = mv_first(to_cartesianshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_first(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('from a_index | eval mv_concat(keywordField, keywordField)', []); testErrorsAndWarnings( - 'row var = mv_first(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | eval var = mv_concat(to_string(booleanField), to_string(booleanField))', [] ); - testErrorsAndWarnings('row var = mv_first(now())', []); - testErrorsAndWarnings('row mv_first(now())', []); - testErrorsAndWarnings('row var = mv_first(to_datetime(now()))', []); - testErrorsAndWarnings('row var = mv_first(5)', []); - testErrorsAndWarnings('row mv_first(5)', []); - testErrorsAndWarnings('row var = mv_first(to_integer(true))', []); - testErrorsAndWarnings('row var = mv_first(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_first(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = mv_first(to_geopoint(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings('row var = mv_first(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_first(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = mv_first(to_geoshape(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings('row var = mv_first(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row mv_first(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row var = mv_first(to_ip(to_ip("127.0.0.1")))', []); - testErrorsAndWarnings('row var = mv_first(to_string(true))', []); - testErrorsAndWarnings('row var = mv_first(to_version("1.0.0"))', []); - testErrorsAndWarnings('row mv_first(to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = mv_first(to_version("a"))', []); - testErrorsAndWarnings('from a_index | where mv_first(numberField) > 0', []); - testErrorsAndWarnings('from a_index | where length(mv_first(stringField)) > 0', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(to_boolean(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_concat(booleanField, booleanField)', [ + 'Argument of [mv_concat] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [mv_concat] must be [keyword], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_concat(keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval mv_concat(keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_concat(textField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_concat(textField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_concat(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval mv_concat(textField, textField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_first(to_cartesianpoint(cartesianPointField))', - [] + 'from a_index | eval mv_concat(keywordField, keywordField, extraArg)', + ['Error: [mv_concat] function expects exactly 2 arguments, got 3.'] ); - testErrorsAndWarnings('from a_index | eval var = mv_first(cartesianShapeField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | sort mv_concat(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_concat(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_concat(nullVar, nullVar)', []); + }); + + describe('mv_count', () => { + testErrorsAndWarnings('row var = mv_count(true)', []); + testErrorsAndWarnings('row mv_count(true)', []); + testErrorsAndWarnings('row var = mv_count(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_count(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row mv_count(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_count(to_cartesianpoint(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_count(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_count(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_count(to_cartesianshape(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_count(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row mv_count(to_datetime("2021-01-01T00:00:00Z"))', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_first(to_cartesianshape(cartesianPointField))', + 'row var = mv_count(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', [] ); - testErrorsAndWarnings('from a_index | eval var = mv_first(dateField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(numberField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(to_geopoint(geoPointField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(to_geoshape(geoPointField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(ipField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(ipField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(to_ip(ipField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(versionField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(versionField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_first(to_version(stringField))', []); + testErrorsAndWarnings('row var = mv_count(5.5)', []); - testErrorsAndWarnings('from a_index | eval mv_first(booleanField, extraArg)', [ - 'Error: [mv_first] function expects exactly one argument, got 2.', + testErrorsAndWarnings('row mv_count(5.5)', []); + testErrorsAndWarnings('row var = mv_count(to_double(true))', []); + testErrorsAndWarnings('row var = mv_count(geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row mv_count(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row var = mv_count(to_geopoint(geoPointField))', [ + 'Unknown column [geoPointField]', ]); + testErrorsAndWarnings('row var = mv_count(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_count(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_count(to_geoshape(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = mv_count(5)', []); + testErrorsAndWarnings('row mv_count(5)', []); + testErrorsAndWarnings('row var = mv_count(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_count(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_count(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_count(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_count("a")', []); + testErrorsAndWarnings('row mv_count("a")', []); + testErrorsAndWarnings('row var = mv_count(to_string(true))', []); + testErrorsAndWarnings('row var = mv_count(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_count(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_count(to_version("a"))', []); + testErrorsAndWarnings('from a_index | where mv_count(booleanField) > 0', []); - testErrorsAndWarnings('from a_index | sort mv_first(booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_first(null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_first(nullVar)', []); - }); + testErrorsAndWarnings('from a_index | where mv_count(counterDoubleField) > 0', [ + 'Argument of [mv_count] must be [boolean], found value [counterDoubleField] type [counter_double]', + ]); - describe('mv_last', () => { - testErrorsAndWarnings('row var = mv_last("a")', []); - testErrorsAndWarnings('row mv_last("a")', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(stringField)', []); - testErrorsAndWarnings('from a_index | eval mv_last(stringField)', []); + testErrorsAndWarnings('from a_index | where mv_count(cartesianPointField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(cartesianShapeField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(dateField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(geoPointField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(geoShapeField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(ipField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(keywordField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(longField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(textField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(versionField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_boolean(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(*)', [ - 'Using wildcards (*) in mv_last is not allowed', + testErrorsAndWarnings('from a_index | eval mv_count(counterDoubleField)', [ + 'Argument of [mv_count] must be [boolean], found value [counterDoubleField] type [counter_double]', ]); - testErrorsAndWarnings('from a_index | sort mv_last(stringField)', []); - testErrorsAndWarnings('row var = mv_last(true)', []); - testErrorsAndWarnings('row mv_last(true)', []); - testErrorsAndWarnings('row var = mv_last(to_boolean(true))', []); - testErrorsAndWarnings('row var = mv_last(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_last(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(*)', [ + 'Using wildcards (*) in mv_count is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_count(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(cartesianPointField)', []); testErrorsAndWarnings( - 'row var = mv_last(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | eval var = mv_count(to_cartesianpoint(cartesianPointField))', [] ); - testErrorsAndWarnings('row var = mv_last(to_cartesianshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_last(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(cartesianShapeField)', []); testErrorsAndWarnings( - 'row var = mv_last(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | eval var = mv_count(to_cartesianshape(cartesianPointField))', [] ); - testErrorsAndWarnings('row var = mv_last(now())', []); - testErrorsAndWarnings('row mv_last(now())', []); - testErrorsAndWarnings('row var = mv_last(to_datetime(now()))', []); - testErrorsAndWarnings('row var = mv_last(5)', []); - testErrorsAndWarnings('row mv_last(5)', []); - testErrorsAndWarnings('row var = mv_last(to_integer(true))', []); - testErrorsAndWarnings('row var = mv_last(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_last(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = mv_last(to_geopoint(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings('row var = mv_last(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row mv_last(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = mv_last(to_geoshape(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings('row var = mv_last(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row mv_last(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row var = mv_last(to_ip(to_ip("127.0.0.1")))', []); - testErrorsAndWarnings('row var = mv_last(to_string(true))', []); - testErrorsAndWarnings('row var = mv_last(to_version("1.0.0"))', []); - testErrorsAndWarnings('row mv_last(to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = mv_last(to_version("a"))', []); - testErrorsAndWarnings('from a_index | where mv_last(numberField) > 0', []); - testErrorsAndWarnings('from a_index | where length(mv_last(stringField)) > 0', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_geopoint(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_geoshape(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(integerField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(longField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(longField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(textField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(textField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_version(keywordField))', []); + + testErrorsAndWarnings('from a_index | eval mv_count(booleanField, extraArg)', [ + 'Error: [mv_count] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_count(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_count(nullVar)', []); + testErrorsAndWarnings('from a_index | eval mv_count("2022")', []); + testErrorsAndWarnings('from a_index | eval mv_count(concat("20", "22"))', []); + }); + + describe('mv_dedupe', () => { + testErrorsAndWarnings('row var = mv_dedupe(true)', []); + testErrorsAndWarnings('row mv_dedupe(true)', []); + testErrorsAndWarnings('row var = mv_dedupe(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_dedupe(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row mv_dedupe(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_dedupe(to_cartesianpoint(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_dedupe(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_dedupe(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_cartesianshape(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_dedupe(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row mv_dedupe(to_datetime("2021-01-01T00:00:00Z"))', []); + + testErrorsAndWarnings( + 'row var = mv_dedupe(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); + + testErrorsAndWarnings('row var = mv_dedupe(5.5)', []); + + testErrorsAndWarnings('row mv_dedupe(5.5)', []); + testErrorsAndWarnings('row var = mv_dedupe(to_double(true))', []); + testErrorsAndWarnings('row var = mv_dedupe(geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row mv_dedupe(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row var = mv_dedupe(to_geopoint(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = mv_dedupe(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_dedupe(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_geoshape(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = mv_dedupe(5)', []); + testErrorsAndWarnings('row mv_dedupe(5)', []); + testErrorsAndWarnings('row var = mv_dedupe(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_dedupe(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_dedupe("a")', []); + testErrorsAndWarnings('row mv_dedupe("a")', []); + testErrorsAndWarnings('row var = mv_dedupe(to_string(true))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_dedupe(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_version("a"))', []); + testErrorsAndWarnings('from a_index | where mv_dedupe(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where mv_dedupe(counterDoubleField) > 0', [ + 'Argument of [mv_dedupe] must be [boolean], found value [counterDoubleField] type [counter_double]', + ]); + + testErrorsAndWarnings('from a_index | where mv_dedupe(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_dedupe(longField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_dedupe(counterDoubleField)', [ + 'Argument of [mv_dedupe] must be [boolean], found value [counterDoubleField] type [counter_double]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(*)', [ + 'Using wildcards (*) in mv_dedupe is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_dedupe(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_dedupe(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(geoPointField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_dedupe(to_geopoint(geoPointField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(geoShapeField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_dedupe(to_geoshape(geoPointField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(integerField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(longField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(longField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(textField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(textField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_version(keywordField))', []); + + testErrorsAndWarnings('from a_index | eval mv_dedupe(booleanField, extraArg)', [ + 'Error: [mv_dedupe] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_dedupe(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_dedupe(nullVar)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe("2022")', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(concat("20", "22"))', []); + }); + + describe('mv_first', () => { + testErrorsAndWarnings('row var = mv_first(true)', []); + testErrorsAndWarnings('row mv_first(true)', []); + testErrorsAndWarnings('row var = mv_first(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_first(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row mv_first(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_first(to_cartesianpoint(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_first(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_first(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_first(to_cartesianshape(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_first(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row mv_first(to_datetime("2021-01-01T00:00:00Z"))', []); + + testErrorsAndWarnings( + 'row var = mv_first(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); + + testErrorsAndWarnings('row var = mv_first(5.5)', []); + + testErrorsAndWarnings('row mv_first(5.5)', []); + testErrorsAndWarnings('row var = mv_first(to_double(true))', []); + testErrorsAndWarnings('row var = mv_first(geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row mv_first(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row var = mv_first(to_geopoint(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = mv_first(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_first(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_first(to_geoshape(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = mv_first(5)', []); + testErrorsAndWarnings('row mv_first(5)', []); + testErrorsAndWarnings('row var = mv_first(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_first(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_first(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_first(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_first("a")', []); + testErrorsAndWarnings('row mv_first("a")', []); + testErrorsAndWarnings('row var = mv_first(to_string(true))', []); + testErrorsAndWarnings('row var = mv_first(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_first(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_first(to_version("a"))', []); + testErrorsAndWarnings('from a_index | where mv_first(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where mv_first(counterDoubleField) > 0', [ + 'Argument of [mv_first] must be [boolean], found value [counterDoubleField] type [counter_double]', + ]); + + testErrorsAndWarnings('from a_index | where mv_first(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_first(longField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_first(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_first(counterDoubleField)', [ + 'Argument of [mv_first] must be [boolean], found value [counterDoubleField] type [counter_double]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_first(*)', [ + 'Using wildcards (*) in mv_first is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_first(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_first(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_first(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_first(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_first(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_geopoint(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_geoshape(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(integerField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(longField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(longField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(textField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(textField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_version(keywordField))', []); + + testErrorsAndWarnings('from a_index | eval mv_first(booleanField, extraArg)', [ + 'Error: [mv_first] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_first(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_first(nullVar)', []); + testErrorsAndWarnings('from a_index | eval mv_first("2022")', []); + testErrorsAndWarnings('from a_index | eval mv_first(concat("20", "22"))', []); + }); + + describe('mv_last', () => { + testErrorsAndWarnings('row var = mv_last(true)', []); + testErrorsAndWarnings('row mv_last(true)', []); + testErrorsAndWarnings('row var = mv_last(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_last(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row mv_last(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_last(to_cartesianpoint(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_last(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_last(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_last(to_cartesianshape(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = mv_last(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row mv_last(to_datetime("2021-01-01T00:00:00Z"))', []); + + testErrorsAndWarnings( + 'row var = mv_last(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); + + testErrorsAndWarnings('row var = mv_last(5.5)', []); + + testErrorsAndWarnings('row mv_last(5.5)', []); + testErrorsAndWarnings('row var = mv_last(to_double(true))', []); + testErrorsAndWarnings('row var = mv_last(geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row mv_last(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row var = mv_last(to_geopoint(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = mv_last(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_last(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_last(to_geoshape(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = mv_last(5)', []); + testErrorsAndWarnings('row mv_last(5)', []); + testErrorsAndWarnings('row var = mv_last(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_last(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_last(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_last(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_last("a")', []); + testErrorsAndWarnings('row mv_last("a")', []); + testErrorsAndWarnings('row var = mv_last(to_string(true))', []); + testErrorsAndWarnings('row var = mv_last(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_last(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_last(to_version("a"))', []); + testErrorsAndWarnings('from a_index | where mv_last(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where mv_last(counterDoubleField) > 0', [ + 'Argument of [mv_last] must be [boolean], found value [counterDoubleField] type [counter_double]', + ]); + + testErrorsAndWarnings('from a_index | where mv_last(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_last(longField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_last(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(booleanField)', []); testErrorsAndWarnings('from a_index | eval mv_last(booleanField)', []); testErrorsAndWarnings('from a_index | eval var = mv_last(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_last(counterDoubleField)', [ + 'Argument of [mv_last] must be [boolean], found value [counterDoubleField] type [counter_double]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_last(*)', [ + 'Using wildcards (*) in mv_last is not allowed', + ]); + testErrorsAndWarnings('from a_index | eval var = mv_last(cartesianPointField)', []); testErrorsAndWarnings('from a_index | eval mv_last(cartesianPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_last(to_cartesianpoint(cartesianPointField))', + 'from a_index | eval var = mv_last(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_last(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_last(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_last(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_geopoint(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_geoshape(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(integerField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(longField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(longField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(textField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(textField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_version(keywordField))', []); + + testErrorsAndWarnings('from a_index | eval mv_last(booleanField, extraArg)', [ + 'Error: [mv_last] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_last(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_last(nullVar)', []); + testErrorsAndWarnings('from a_index | eval mv_last("2022")', []); + testErrorsAndWarnings('from a_index | eval mv_last(concat("20", "22"))', []); + }); + + describe('mv_max', () => { + testErrorsAndWarnings('row var = mv_max(true)', []); + testErrorsAndWarnings('row mv_max(true)', []); + testErrorsAndWarnings('row var = mv_max(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_max(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row mv_max(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings( + 'row var = mv_max(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); + testErrorsAndWarnings('row var = mv_max(5.5)', []); + testErrorsAndWarnings('row mv_max(5.5)', []); + testErrorsAndWarnings('row var = mv_max(to_double(true))', []); + testErrorsAndWarnings('row var = mv_max(5)', []); + testErrorsAndWarnings('row mv_max(5)', []); + testErrorsAndWarnings('row var = mv_max(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_max(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_max(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_max(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_max("a")', []); + testErrorsAndWarnings('row mv_max("a")', []); + testErrorsAndWarnings('row var = mv_max(to_string(true))', []); + testErrorsAndWarnings('row var = mv_max(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_max(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_max(to_version("a"))', []); + + testErrorsAndWarnings('row var = mv_max(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [mv_max] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where mv_max(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where mv_max(cartesianPointField) > 0', [ + 'Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where mv_max(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_max(longField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_max(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_max(cartesianPointField)', [ + 'Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_max(*)', [ + 'Using wildcards (*) in mv_max is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_max(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(integerField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(longField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(longField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(textField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(textField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_version(keywordField))', []); + + testErrorsAndWarnings('from a_index | eval mv_max(booleanField, extraArg)', [ + 'Error: [mv_max] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_max(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_max(nullVar)', []); + testErrorsAndWarnings('from a_index | eval mv_max("2022")', []); + testErrorsAndWarnings('from a_index | eval mv_max(concat("20", "22"))', []); + }); + + describe('mv_median', () => { + testErrorsAndWarnings('row var = mv_median(5.5)', []); + testErrorsAndWarnings('row mv_median(5.5)', []); + testErrorsAndWarnings('row var = mv_median(to_double(true))', []); + testErrorsAndWarnings('row var = mv_median(5)', []); + testErrorsAndWarnings('row mv_median(5)', []); + testErrorsAndWarnings('row var = mv_median(to_integer(true))', []); + + testErrorsAndWarnings('row var = mv_median(true)', [ + 'Argument of [mv_median] must be [double], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where mv_median(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where mv_median(booleanField) > 0', [ + 'Argument of [mv_median] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where mv_median(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_median(longField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_median(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_median(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_median(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_median(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_median(booleanField)', [ + 'Argument of [mv_median] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_median(*)', [ + 'Using wildcards (*) in mv_median is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_median(integerField)', []); + testErrorsAndWarnings('from a_index | eval mv_median(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_median(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_median(longField)', []); + testErrorsAndWarnings('from a_index | eval mv_median(longField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_median(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval mv_median(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval mv_median(doubleField, extraArg)', [ + 'Error: [mv_median] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_median(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_median(null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_median(nullVar)', []); + }); + + describe('mv_min', () => { + testErrorsAndWarnings('row var = mv_min(true)', []); + testErrorsAndWarnings('row mv_min(true)', []); + testErrorsAndWarnings('row var = mv_min(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_min(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row mv_min(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings( + 'row var = mv_min(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); + testErrorsAndWarnings('row var = mv_min(5.5)', []); + testErrorsAndWarnings('row mv_min(5.5)', []); + testErrorsAndWarnings('row var = mv_min(to_double(true))', []); + testErrorsAndWarnings('row var = mv_min(5)', []); + testErrorsAndWarnings('row mv_min(5)', []); + testErrorsAndWarnings('row var = mv_min(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_min(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_min(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_min(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_min("a")', []); + testErrorsAndWarnings('row mv_min("a")', []); + testErrorsAndWarnings('row var = mv_min(to_string(true))', []); + testErrorsAndWarnings('row var = mv_min(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_min(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_min(to_version("a"))', []); + + testErrorsAndWarnings('row var = mv_min(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [mv_min] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where mv_min(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where mv_min(cartesianPointField) > 0', [ + 'Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where mv_min(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_min(longField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_min(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_min(cartesianPointField)', [ + 'Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_min(*)', [ + 'Using wildcards (*) in mv_min is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_min(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(integerField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(longField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(longField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(textField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(textField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_version(keywordField))', []); + + testErrorsAndWarnings('from a_index | eval mv_min(booleanField, extraArg)', [ + 'Error: [mv_min] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_min(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_min(nullVar)', []); + testErrorsAndWarnings('from a_index | eval mv_min("2022")', []); + testErrorsAndWarnings('from a_index | eval mv_min(concat("20", "22"))', []); + }); + + describe('mv_slice', () => { + testErrorsAndWarnings('row var = mv_slice(true, 5, 5)', []); + testErrorsAndWarnings('row mv_slice(true, 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_boolean(true), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(cartesianPointField, 5, 5)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row mv_slice(cartesianPointField, 5, 5)', [ + 'Unknown column [cartesianPointField]', + ]); + + testErrorsAndWarnings( + 'row var = mv_slice(to_cartesianpoint(cartesianPointField), to_integer(true), to_integer(true))', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings('row var = mv_slice(to_cartesianshape("POINT (30 10)"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_cartesianshape("POINT (30 10)"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_cartesianshape(cartesianPointField), to_integer(true), to_integer(true))', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings('row var = mv_slice(to_datetime("2021-01-01T00:00:00Z"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_datetime("2021-01-01T00:00:00Z"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_datetime(to_datetime("2021-01-01T00:00:00Z")), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(5.5, 5, 5)', []); + testErrorsAndWarnings('row mv_slice(5.5, 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_double(true), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(geoPointField, 5, 5)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row mv_slice(geoPointField, 5, 5)', [ + 'Unknown column [geoPointField]', + ]); + + testErrorsAndWarnings( + 'row var = mv_slice(to_geopoint(geoPointField), to_integer(true), to_integer(true))', + ['Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings('row var = mv_slice(to_geoshape("POINT (30 10)"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_geoshape("POINT (30 10)"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_geoshape(geoPointField), to_integer(true), to_integer(true))', + ['Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings('row var = mv_slice(5, 5, 5)', []); + testErrorsAndWarnings('row mv_slice(5, 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_integer(true), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(to_ip("127.0.0.1"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_ip("127.0.0.1"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_ip(to_ip("127.0.0.1")), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice("a", 5, 5)', []); + testErrorsAndWarnings('row mv_slice("a", 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_string(true), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(5, to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = mv_slice(to_version("1.0.0"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_version("1.0.0"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_version("a"), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(5.5, true, true)', [ + 'Argument of [mv_slice] must be [integer], found value [true] type [boolean]', + 'Argument of [mv_slice] must be [integer], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | where mv_slice(doubleField, integerField, integerField) > 0', + [] + ); + + testErrorsAndWarnings( + 'from a_index | where mv_slice(counterDoubleField, booleanField, booleanField) > 0', + [ + 'Argument of [mv_slice] must be [boolean], found value [counterDoubleField] type [counter_double]', + 'Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | where mv_slice(integerField, integerField, integerField) > 0', + [] + ); + + testErrorsAndWarnings( + 'from a_index | where mv_slice(longField, integerField, integerField) > 0', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(booleanField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(booleanField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_boolean(booleanField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(counterDoubleField, booleanField, booleanField)', + [ + 'Argument of [mv_slice] must be [boolean], found value [counterDoubleField] type [counter_double]', + 'Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [integer], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(cartesianPointField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(cartesianPointField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_cartesianpoint(cartesianPointField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(cartesianShapeField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(cartesianShapeField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_cartesianshape(cartesianPointField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(dateField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(dateField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_datetime(dateField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(doubleField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(doubleField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_double(booleanField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(geoPointField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(geoPointField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_geopoint(geoPointField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(geoShapeField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(geoShapeField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_geoshape(geoPointField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(integerField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(integerField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_integer(booleanField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(ipField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(ipField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(keywordField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(keywordField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(longField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(longField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(longField, to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(textField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(textField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(versionField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(versionField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_version(keywordField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(booleanField, integerField, integerField, extraArg)', + ['Error: [mv_slice] function expects no more than 3 arguments, got 4.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort mv_slice(booleanField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval mv_slice(null, null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_slice(nullVar, nullVar, nullVar)', []); + testErrorsAndWarnings( + 'from a_index | eval mv_slice("2022", integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(concat("20", "22"), integerField, integerField)', + [] + ); + }); + + describe('mv_sort', () => { + testErrorsAndWarnings('row var = mv_sort(true, "asc")', []); + testErrorsAndWarnings('row mv_sort(true, "asc")', []); + testErrorsAndWarnings('row var = mv_sort(to_datetime("2021-01-01T00:00:00Z"), "asc")', []); + testErrorsAndWarnings('row mv_sort(to_datetime("2021-01-01T00:00:00Z"), "asc")', []); + testErrorsAndWarnings('row var = mv_sort(5.5, "asc")', []); + testErrorsAndWarnings('row mv_sort(5.5, "asc")', []); + testErrorsAndWarnings('row var = mv_sort(5, "asc")', []); + testErrorsAndWarnings('row mv_sort(5, "asc")', []); + testErrorsAndWarnings('row var = mv_sort(to_ip("127.0.0.1"), "asc")', []); + testErrorsAndWarnings('row mv_sort(to_ip("127.0.0.1"), "asc")', []); + testErrorsAndWarnings('row var = mv_sort("a", "asc")', []); + testErrorsAndWarnings('row mv_sort("a", "asc")', []); + testErrorsAndWarnings('row var = mv_sort(to_version("1.0.0"), "asc")', []); + testErrorsAndWarnings('row mv_sort(to_version("1.0.0"), "asc")', []); + + testErrorsAndWarnings('row var = mv_sort(to_cartesianpoint("POINT (30 10)"), true)', [ + 'Argument of [mv_sort] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + 'Argument of [mv_sort] must be [keyword], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_sort(booleanField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(booleanField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(dateField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(dateField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(doubleField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(doubleField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(integerField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(integerField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(ipField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(ipField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(keywordField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(keywordField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(longField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(longField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(textField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(textField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(versionField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(versionField, "asc")', []); + + testErrorsAndWarnings('from a_index | eval mv_sort(booleanField, "asc", extraArg)', [ + 'Error: [mv_sort] function expects no more than 2 arguments, got 3.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_sort(booleanField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_sort(nullVar, nullVar)', []); + testErrorsAndWarnings('from a_index | eval mv_sort("2022", "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(concat("20", "22"), "asc")', []); + }); + + describe('mv_sum', () => { + testErrorsAndWarnings('row var = mv_sum(5.5)', []); + testErrorsAndWarnings('row mv_sum(5.5)', []); + testErrorsAndWarnings('row var = mv_sum(to_double(true))', []); + testErrorsAndWarnings('row var = mv_sum(5)', []); + testErrorsAndWarnings('row mv_sum(5)', []); + testErrorsAndWarnings('row var = mv_sum(to_integer(true))', []); + + testErrorsAndWarnings('row var = mv_sum(true)', [ + 'Argument of [mv_sum] must be [double], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where mv_sum(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where mv_sum(booleanField) > 0', [ + 'Argument of [mv_sum] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where mv_sum(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_sum(longField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_sum(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_sum(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_sum(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_sum(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_sum(booleanField)', [ + 'Argument of [mv_sum] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_sum(*)', [ + 'Using wildcards (*) in mv_sum is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_sum(integerField)', []); + testErrorsAndWarnings('from a_index | eval mv_sum(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_sum(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_sum(longField)', []); + testErrorsAndWarnings('from a_index | eval mv_sum(longField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_sum(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval mv_sum(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval mv_sum(doubleField, extraArg)', [ + 'Error: [mv_sum] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_sum(doubleField)', []); + testErrorsAndWarnings('from a_index | eval mv_sum(null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_sum(nullVar)', []); + }); + + describe('mv_zip', () => { + testErrorsAndWarnings('row var = mv_zip("a", "a")', []); + testErrorsAndWarnings('row mv_zip("a", "a")', []); + testErrorsAndWarnings('row var = mv_zip(to_string(true), to_string(true))', []); + testErrorsAndWarnings('row var = mv_zip("a", "a", "a")', []); + testErrorsAndWarnings('row mv_zip("a", "a", "a")', []); + testErrorsAndWarnings( + 'row var = mv_zip(to_string(true), to_string(true), to_string(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_zip(true, true, true)', [ + 'Argument of [mv_zip] must be [keyword], found value [true] type [boolean]', + 'Argument of [mv_zip] must be [keyword], found value [true] type [boolean]', + 'Argument of [mv_zip] must be [keyword], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_zip(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_zip(keywordField, keywordField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval mv_zip(booleanField, booleanField)', [ + 'Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(keywordField, keywordField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_zip(keywordField, keywordField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_zip(booleanField, booleanField, booleanField)', + [ + 'Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [mv_zip] must be [keyword], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(keywordField, keywordField, textField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_zip(keywordField, keywordField, textField)', + [] + ); + testErrorsAndWarnings('from a_index | eval var = mv_zip(keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval mv_zip(keywordField, textField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(keywordField, textField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_zip(keywordField, textField, keywordField)', + [] + ); + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(keywordField, textField, textField)', + [] + ); + testErrorsAndWarnings('from a_index | eval mv_zip(keywordField, textField, textField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_zip(textField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_zip(textField, keywordField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(textField, keywordField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_zip(textField, keywordField, keywordField)', + [] + ); + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(textField, keywordField, textField)', + [] + ); + testErrorsAndWarnings('from a_index | eval mv_zip(textField, keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_zip(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval mv_zip(textField, textField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(textField, textField, keywordField)', + [] + ); + testErrorsAndWarnings('from a_index | eval mv_zip(textField, textField, keywordField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(textField, textField, textField)', + [] + ); + testErrorsAndWarnings('from a_index | eval mv_zip(textField, textField, textField)', []); + + testErrorsAndWarnings( + 'from a_index | eval mv_zip(keywordField, keywordField, keywordField, extraArg)', + ['Error: [mv_zip] function expects no more than 3 arguments, got 4.'] + ); + + testErrorsAndWarnings('from a_index | sort mv_zip(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval mv_zip(null, null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval mv_zip(nullVar, nullVar, nullVar)', []); + }); + + describe('now', () => { + testErrorsAndWarnings('row var = now()', []); + testErrorsAndWarnings('row now()', []); + testErrorsAndWarnings('from a_index | eval var = now()', []); + testErrorsAndWarnings('from a_index | eval now()', []); + + testErrorsAndWarnings('from a_index | eval now(extraArg)', [ + 'Error: [now] function expects exactly 0 arguments, got 1.', + ]); + + testErrorsAndWarnings('from a_index | sort now()', []); + testErrorsAndWarnings('row nullVar = null | eval now()', []); + }); + + describe('pi', () => { + testErrorsAndWarnings('row var = pi()', []); + testErrorsAndWarnings('row pi()', []); + testErrorsAndWarnings('from a_index | where pi() > 0', []); + testErrorsAndWarnings('from a_index | eval var = pi()', []); + testErrorsAndWarnings('from a_index | eval pi()', []); + + testErrorsAndWarnings('from a_index | eval pi(extraArg)', [ + 'Error: [pi] function expects exactly 0 arguments, got 1.', + ]); + + testErrorsAndWarnings('from a_index | sort pi()', []); + testErrorsAndWarnings('row nullVar = null | eval pi()', []); + }); + + describe('pow', () => { + testErrorsAndWarnings('row var = pow(5.5, 5.5)', []); + testErrorsAndWarnings('row pow(5.5, 5.5)', []); + testErrorsAndWarnings('row var = pow(to_double(true), to_double(true))', []); + testErrorsAndWarnings('row var = pow(5.5, 5)', []); + testErrorsAndWarnings('row pow(5.5, 5)', []); + testErrorsAndWarnings('row var = pow(to_double(true), to_integer(true))', []); + testErrorsAndWarnings('row var = pow(to_double(true), 5)', []); + testErrorsAndWarnings('row var = pow(5, 5.5)', []); + testErrorsAndWarnings('row pow(5, 5.5)', []); + testErrorsAndWarnings('row var = pow(to_integer(true), to_double(true))', []); + testErrorsAndWarnings('row var = pow(5, 5)', []); + testErrorsAndWarnings('row pow(5, 5)', []); + testErrorsAndWarnings('row var = pow(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = pow(to_integer(true), 5)', []); + testErrorsAndWarnings('row var = pow(5, to_double(true))', []); + testErrorsAndWarnings('row var = pow(5, to_integer(true))', []); + + testErrorsAndWarnings('row var = pow(true, true)', [ + 'Argument of [pow] must be [double], found value [true] type [boolean]', + 'Argument of [pow] must be [double], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where pow(doubleField, doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where pow(booleanField, booleanField) > 0', [ + 'Argument of [pow] must be [double], found value [booleanField] type [boolean]', + 'Argument of [pow] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where pow(doubleField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(doubleField, longField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(doubleField, unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(integerField, doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(integerField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(integerField, longField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(integerField, unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(longField, doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(longField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(longField, longField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(longField, unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(unsignedLongField, doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(unsignedLongField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where pow(unsignedLongField, longField) > 0', []); + testErrorsAndWarnings( + 'from a_index | where pow(unsignedLongField, unsignedLongField) > 0', + [] + ); + testErrorsAndWarnings('from a_index | eval var = pow(doubleField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval pow(doubleField, doubleField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = pow(to_double(booleanField), to_double(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval pow(booleanField, booleanField)', [ + 'Argument of [pow] must be [double], found value [booleanField] type [boolean]', + 'Argument of [pow] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = pow(doubleField, integerField)', []); + testErrorsAndWarnings('from a_index | eval pow(doubleField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = pow(to_double(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = pow(doubleField, longField)', []); + testErrorsAndWarnings('from a_index | eval pow(doubleField, longField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = pow(to_double(booleanField), longField)', + [] + ); + testErrorsAndWarnings('from a_index | eval var = pow(doubleField, unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval pow(doubleField, unsignedLongField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = pow(to_double(booleanField), unsignedLongField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = pow(integerField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval pow(integerField, doubleField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = pow(to_integer(booleanField), to_double(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = pow(integerField, integerField)', []); + testErrorsAndWarnings('from a_index | eval pow(integerField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = pow(to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = pow(integerField, longField)', []); + testErrorsAndWarnings('from a_index | eval pow(integerField, longField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = pow(to_integer(booleanField), longField)', + [] + ); + testErrorsAndWarnings('from a_index | eval var = pow(integerField, unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval pow(integerField, unsignedLongField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = pow(to_integer(booleanField), unsignedLongField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = pow(longField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval pow(longField, doubleField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = pow(longField, to_double(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = pow(longField, integerField)', []); + testErrorsAndWarnings('from a_index | eval pow(longField, integerField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = pow(longField, to_integer(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = pow(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval pow(longField, longField)', []); + testErrorsAndWarnings('from a_index | eval var = pow(longField, unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval pow(longField, unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = pow(unsignedLongField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval pow(unsignedLongField, doubleField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = pow(unsignedLongField, to_double(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = pow(unsignedLongField, integerField)', []); + testErrorsAndWarnings('from a_index | eval pow(unsignedLongField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = pow(unsignedLongField, to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = pow(unsignedLongField, longField)', []); + testErrorsAndWarnings('from a_index | eval pow(unsignedLongField, longField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = pow(unsignedLongField, unsignedLongField)', + [] + ); + testErrorsAndWarnings('from a_index | eval pow(unsignedLongField, unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval pow(doubleField, doubleField, extraArg)', [ + 'Error: [pow] function expects exactly 2 arguments, got 3.', + ]); + + testErrorsAndWarnings('from a_index | sort pow(doubleField, doubleField)', []); + testErrorsAndWarnings('from a_index | eval pow(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval pow(nullVar, nullVar)', []); + }); + + describe('repeat', () => { + testErrorsAndWarnings('row var = repeat("a", 5)', []); + testErrorsAndWarnings('row repeat("a", 5)', []); + testErrorsAndWarnings('row var = repeat(to_string(true), to_integer(true))', []); + + testErrorsAndWarnings('row var = repeat(true, true)', [ + 'Argument of [repeat] must be [keyword], found value [true] type [boolean]', + 'Argument of [repeat] must be [integer], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = repeat(keywordField, integerField)', []); + testErrorsAndWarnings('from a_index | eval repeat(keywordField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = repeat(to_string(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval repeat(booleanField, booleanField)', [ + 'Argument of [repeat] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [repeat] must be [integer], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = repeat(textField, integerField)', []); + testErrorsAndWarnings('from a_index | eval repeat(textField, integerField)', []); + + testErrorsAndWarnings('from a_index | eval repeat(keywordField, integerField, extraArg)', [ + 'Error: [repeat] function expects exactly 2 arguments, got 3.', + ]); + + testErrorsAndWarnings('from a_index | sort repeat(keywordField, integerField)', []); + testErrorsAndWarnings('from a_index | eval repeat(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval repeat(nullVar, nullVar)', []); + }); + + describe('replace', () => { + testErrorsAndWarnings('row var = replace("a", "a", "a")', []); + testErrorsAndWarnings('row replace("a", "a", "a")', []); + testErrorsAndWarnings( + 'row var = replace(to_string(true), to_string(true), to_string(true))', + [] + ); + + testErrorsAndWarnings('row var = replace(true, true, true)', [ + 'Argument of [replace] must be [keyword], found value [true] type [boolean]', + 'Argument of [replace] must be [keyword], found value [true] type [boolean]', + 'Argument of [replace] must be [keyword], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = replace(keywordField, keywordField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval replace(keywordField, keywordField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = replace(to_string(booleanField), to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval replace(booleanField, booleanField, booleanField)', + [ + 'Argument of [replace] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [replace] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [replace] must be [keyword], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = replace(keywordField, keywordField, textField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval replace(keywordField, keywordField, textField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = replace(keywordField, textField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval replace(keywordField, textField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = replace(keywordField, textField, textField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval replace(keywordField, textField, textField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = replace(textField, keywordField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval replace(textField, keywordField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = replace(textField, keywordField, textField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval replace(textField, keywordField, textField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = replace(textField, textField, keywordField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval replace(textField, textField, keywordField)', + [] + ); + testErrorsAndWarnings( + 'from a_index | eval var = replace(textField, textField, textField)', + [] + ); + testErrorsAndWarnings('from a_index | eval replace(textField, textField, textField)', []); + + testErrorsAndWarnings( + 'from a_index | eval replace(keywordField, keywordField, keywordField, extraArg)', + ['Error: [replace] function expects exactly 3 arguments, got 4.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort replace(keywordField, keywordField, keywordField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval replace(null, null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval replace(nullVar, nullVar, nullVar)', []); + }); + + describe('right', () => { + testErrorsAndWarnings('row var = right("a", 5)', []); + testErrorsAndWarnings('row right("a", 5)', []); + testErrorsAndWarnings('row var = right(to_string(true), to_integer(true))', []); + + testErrorsAndWarnings('row var = right(true, true)', [ + 'Argument of [right] must be [keyword], found value [true] type [boolean]', + 'Argument of [right] must be [integer], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = right(keywordField, integerField)', []); + testErrorsAndWarnings('from a_index | eval right(keywordField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = right(to_string(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval right(booleanField, booleanField)', [ + 'Argument of [right] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [right] must be [integer], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = right(textField, integerField)', []); + testErrorsAndWarnings('from a_index | eval right(textField, integerField)', []); + + testErrorsAndWarnings('from a_index | eval right(keywordField, integerField, extraArg)', [ + 'Error: [right] function expects exactly 2 arguments, got 3.', + ]); + + testErrorsAndWarnings('from a_index | sort right(keywordField, integerField)', []); + testErrorsAndWarnings('from a_index | eval right(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval right(nullVar, nullVar)', []); + }); + + describe('round', () => { + testErrorsAndWarnings('row var = round(5.5)', []); + testErrorsAndWarnings('row round(5.5)', []); + testErrorsAndWarnings('row var = round(to_double(true))', []); + testErrorsAndWarnings('row var = round(5.5, 5)', []); + testErrorsAndWarnings('row round(5.5, 5)', []); + testErrorsAndWarnings('row var = round(to_double(true), to_integer(true))', []); + testErrorsAndWarnings('row var = round(5)', []); + testErrorsAndWarnings('row round(5)', []); + testErrorsAndWarnings('row var = round(to_integer(true))', []); + testErrorsAndWarnings('row var = round(5, 5)', []); + testErrorsAndWarnings('row round(5, 5)', []); + testErrorsAndWarnings('row var = round(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = round(5, to_integer(true))', []); + + testErrorsAndWarnings('row var = round(true, true)', [ + 'Argument of [round] must be [double], found value [true] type [boolean]', + 'Argument of [round] must be [integer], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where round(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where round(booleanField) > 0', [ + 'Argument of [round] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where round(doubleField, integerField) > 0', []); + + testErrorsAndWarnings('from a_index | where round(booleanField, booleanField) > 0', [ + 'Argument of [round] must be [double], found value [booleanField] type [boolean]', + 'Argument of [round] must be [integer], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where round(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where round(integerField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where round(longField) > 0', []); + testErrorsAndWarnings('from a_index | where round(longField, integerField) > 0', []); + testErrorsAndWarnings('from a_index | where round(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = round(doubleField)', []); + testErrorsAndWarnings('from a_index | eval round(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = round(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval round(booleanField)', [ + 'Argument of [round] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = round(*)', [ + 'Using wildcards (*) in round is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = round(doubleField, integerField)', []); + testErrorsAndWarnings('from a_index | eval round(doubleField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = round(to_double(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval round(booleanField, booleanField)', [ + 'Argument of [round] must be [double], found value [booleanField] type [boolean]', + 'Argument of [round] must be [integer], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = round(integerField)', []); + testErrorsAndWarnings('from a_index | eval round(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = round(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = round(integerField, integerField)', []); + testErrorsAndWarnings('from a_index | eval round(integerField, integerField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = round(to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = round(longField)', []); + testErrorsAndWarnings('from a_index | eval round(longField)', []); + testErrorsAndWarnings('from a_index | eval var = round(longField, integerField)', []); + testErrorsAndWarnings('from a_index | eval round(longField, integerField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = round(longField, to_integer(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = round(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval round(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval round(doubleField, integerField, extraArg)', [ + 'Error: [round] function expects no more than 2 arguments, got 3.', + ]); + + testErrorsAndWarnings('from a_index | sort round(doubleField)', []); + testErrorsAndWarnings('from a_index | eval round(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval round(nullVar, nullVar)', []); + }); + + describe('rtrim', () => { + testErrorsAndWarnings('row var = rtrim("a")', []); + testErrorsAndWarnings('row rtrim("a")', []); + testErrorsAndWarnings('row var = rtrim(to_string(true))', []); + + testErrorsAndWarnings('row var = rtrim(true)', [ + 'Argument of [rtrim] must be [keyword], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = rtrim(keywordField)', []); + testErrorsAndWarnings('from a_index | eval rtrim(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = rtrim(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval rtrim(booleanField)', [ + 'Argument of [rtrim] must be [keyword], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = rtrim(*)', [ + 'Using wildcards (*) in rtrim is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = rtrim(textField)', []); + testErrorsAndWarnings('from a_index | eval rtrim(textField)', []); + + testErrorsAndWarnings('from a_index | eval rtrim(keywordField, extraArg)', [ + 'Error: [rtrim] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort rtrim(keywordField)', []); + testErrorsAndWarnings('from a_index | eval rtrim(null)', []); + testErrorsAndWarnings('row nullVar = null | eval rtrim(nullVar)', []); + }); + + describe('signum', () => { + testErrorsAndWarnings('row var = signum(5.5)', []); + testErrorsAndWarnings('row signum(5.5)', []); + testErrorsAndWarnings('row var = signum(to_double(true))', []); + testErrorsAndWarnings('row var = signum(5)', []); + testErrorsAndWarnings('row signum(5)', []); + testErrorsAndWarnings('row var = signum(to_integer(true))', []); + + testErrorsAndWarnings('row var = signum(true)', [ + 'Argument of [signum] must be [double], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where signum(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where signum(booleanField) > 0', [ + 'Argument of [signum] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where signum(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where signum(longField) > 0', []); + testErrorsAndWarnings('from a_index | where signum(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = signum(doubleField)', []); + testErrorsAndWarnings('from a_index | eval signum(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = signum(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval signum(booleanField)', [ + 'Argument of [signum] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = signum(*)', [ + 'Using wildcards (*) in signum is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = signum(integerField)', []); + testErrorsAndWarnings('from a_index | eval signum(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = signum(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = signum(longField)', []); + testErrorsAndWarnings('from a_index | eval signum(longField)', []); + testErrorsAndWarnings('from a_index | eval var = signum(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval signum(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval signum(doubleField, extraArg)', [ + 'Error: [signum] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort signum(doubleField)', []); + testErrorsAndWarnings('from a_index | eval signum(null)', []); + testErrorsAndWarnings('row nullVar = null | eval signum(nullVar)', []); + }); + + describe('sin', () => { + testErrorsAndWarnings('row var = sin(5.5)', []); + testErrorsAndWarnings('row sin(5.5)', []); + testErrorsAndWarnings('row var = sin(to_double(true))', []); + testErrorsAndWarnings('row var = sin(5)', []); + testErrorsAndWarnings('row sin(5)', []); + testErrorsAndWarnings('row var = sin(to_integer(true))', []); + + testErrorsAndWarnings('row var = sin(true)', [ + 'Argument of [sin] must be [double], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where sin(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where sin(booleanField) > 0', [ + 'Argument of [sin] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where sin(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where sin(longField) > 0', []); + testErrorsAndWarnings('from a_index | where sin(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = sin(doubleField)', []); + testErrorsAndWarnings('from a_index | eval sin(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = sin(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval sin(booleanField)', [ + 'Argument of [sin] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = sin(*)', [ + 'Using wildcards (*) in sin is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = sin(integerField)', []); + testErrorsAndWarnings('from a_index | eval sin(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = sin(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = sin(longField)', []); + testErrorsAndWarnings('from a_index | eval sin(longField)', []); + testErrorsAndWarnings('from a_index | eval var = sin(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval sin(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval sin(doubleField, extraArg)', [ + 'Error: [sin] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort sin(doubleField)', []); + testErrorsAndWarnings('from a_index | eval sin(null)', []); + testErrorsAndWarnings('row nullVar = null | eval sin(nullVar)', []); + }); + + describe('sinh', () => { + testErrorsAndWarnings('row var = sinh(5.5)', []); + testErrorsAndWarnings('row sinh(5.5)', []); + testErrorsAndWarnings('row var = sinh(to_double(true))', []); + testErrorsAndWarnings('row var = sinh(5)', []); + testErrorsAndWarnings('row sinh(5)', []); + testErrorsAndWarnings('row var = sinh(to_integer(true))', []); + + testErrorsAndWarnings('row var = sinh(true)', [ + 'Argument of [sinh] must be [double], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where sinh(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where sinh(booleanField) > 0', [ + 'Argument of [sinh] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where sinh(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where sinh(longField) > 0', []); + testErrorsAndWarnings('from a_index | where sinh(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = sinh(doubleField)', []); + testErrorsAndWarnings('from a_index | eval sinh(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = sinh(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval sinh(booleanField)', [ + 'Argument of [sinh] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = sinh(*)', [ + 'Using wildcards (*) in sinh is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = sinh(integerField)', []); + testErrorsAndWarnings('from a_index | eval sinh(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = sinh(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = sinh(longField)', []); + testErrorsAndWarnings('from a_index | eval sinh(longField)', []); + testErrorsAndWarnings('from a_index | eval var = sinh(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval sinh(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval sinh(doubleField, extraArg)', [ + 'Error: [sinh] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort sinh(doubleField)', []); + testErrorsAndWarnings('from a_index | eval sinh(null)', []); + testErrorsAndWarnings('row nullVar = null | eval sinh(nullVar)', []); + }); + + describe('split', () => { + testErrorsAndWarnings('row var = split("a", "a")', []); + testErrorsAndWarnings('row split("a", "a")', []); + testErrorsAndWarnings('row var = split(to_string(true), to_string(true))', []); + + testErrorsAndWarnings('row var = split(true, true)', [ + 'Argument of [split] must be [keyword], found value [true] type [boolean]', + 'Argument of [split] must be [keyword], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = split(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval split(keywordField, keywordField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = split(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval split(booleanField, booleanField)', [ + 'Argument of [split] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [split] must be [keyword], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = split(keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval split(keywordField, textField)', []); + testErrorsAndWarnings('from a_index | eval var = split(textField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval split(textField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = split(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval split(textField, textField)', []); + + testErrorsAndWarnings('from a_index | eval split(keywordField, keywordField, extraArg)', [ + 'Error: [split] function expects exactly 2 arguments, got 3.', + ]); + + testErrorsAndWarnings('from a_index | sort split(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval split(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval split(nullVar, nullVar)', []); + }); + + describe('sqrt', () => { + testErrorsAndWarnings('row var = sqrt(5.5)', []); + testErrorsAndWarnings('row sqrt(5.5)', []); + testErrorsAndWarnings('row var = sqrt(to_double(true))', []); + testErrorsAndWarnings('row var = sqrt(5)', []); + testErrorsAndWarnings('row sqrt(5)', []); + testErrorsAndWarnings('row var = sqrt(to_integer(true))', []); + + testErrorsAndWarnings('row var = sqrt(true)', [ + 'Argument of [sqrt] must be [double], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where sqrt(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where sqrt(booleanField) > 0', [ + 'Argument of [sqrt] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where sqrt(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where sqrt(longField) > 0', []); + testErrorsAndWarnings('from a_index | where sqrt(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = sqrt(doubleField)', []); + testErrorsAndWarnings('from a_index | eval sqrt(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = sqrt(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval sqrt(booleanField)', [ + 'Argument of [sqrt] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = sqrt(*)', [ + 'Using wildcards (*) in sqrt is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = sqrt(integerField)', []); + testErrorsAndWarnings('from a_index | eval sqrt(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = sqrt(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = sqrt(longField)', []); + testErrorsAndWarnings('from a_index | eval sqrt(longField)', []); + testErrorsAndWarnings('from a_index | eval var = sqrt(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval sqrt(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval sqrt(doubleField, extraArg)', [ + 'Error: [sqrt] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort sqrt(doubleField)', []); + testErrorsAndWarnings('from a_index | eval sqrt(null)', []); + testErrorsAndWarnings('row nullVar = null | eval sqrt(nullVar)', []); + }); + + describe('st_contains', () => { + testErrorsAndWarnings('row var = st_contains(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row st_contains(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + + testErrorsAndWarnings( + 'row var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_contains(cartesianPointField, to_cartesianshape("POINT (30 10)"))', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row st_contains(cartesianPointField, to_cartesianshape("POINT (30 10)"))', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_contains(to_cartesianshape("POINT (30 10)"), cartesianPointField)', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row st_contains(to_cartesianshape("POINT (30 10)"), cartesianPointField)', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_contains(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row st_contains(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings('row var = st_contains(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row st_contains(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_contains(to_geopoint(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + testErrorsAndWarnings( + 'row var = st_contains(geoPointField, to_geoshape("POINT (30 10)"))', + ['Unknown column [geoPointField]'] + ); + testErrorsAndWarnings('row st_contains(geoPointField, to_geoshape("POINT (30 10)"))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_contains(to_geopoint(geoPointField), to_geoshape(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + testErrorsAndWarnings( + 'row var = st_contains(to_geoshape("POINT (30 10)"), geoPointField)', + ['Unknown column [geoPointField]'] + ); + testErrorsAndWarnings('row st_contains(to_geoshape("POINT (30 10)"), geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_contains(to_geoshape(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_contains(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row st_contains(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_contains(to_geoshape(geoPointField), to_geoshape(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings('row var = st_contains(true, true)', [ + 'Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]', + 'Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_contains(booleanField, booleanField)', [ + 'Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]', + 'Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(cartesianShapeField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianShapeField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(cartesianShapeField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianShapeField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(geoPointField, geoPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_contains(geoPointField, geoPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(geoPointField, geoShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_contains(geoPointField, geoShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(geoShapeField, geoPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_contains(geoShapeField, geoPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(geoShapeField, geoShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_contains(geoShapeField, geoShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianPointField, cartesianPointField, extraArg)', + ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort st_contains(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_contains(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval st_contains(nullVar, nullVar)', []); + }); + + describe('st_disjoint', () => { + testErrorsAndWarnings('row var = st_disjoint(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row st_disjoint(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(cartesianPointField, to_cartesianshape("POINT (30 10)"))', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row st_disjoint(cartesianPointField, to_cartesianshape("POINT (30 10)"))', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_cartesianshape("POINT (30 10)"), cartesianPointField)', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row st_disjoint(to_cartesianshape("POINT (30 10)"), cartesianPointField)', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row st_disjoint(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings('row var = st_disjoint(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row st_disjoint(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_disjoint(to_geopoint(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + testErrorsAndWarnings( + 'row var = st_disjoint(geoPointField, to_geoshape("POINT (30 10)"))', + ['Unknown column [geoPointField]'] + ); + testErrorsAndWarnings('row st_disjoint(geoPointField, to_geoshape("POINT (30 10)"))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_disjoint(to_geopoint(geoPointField), to_geoshape(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + testErrorsAndWarnings( + 'row var = st_disjoint(to_geoshape("POINT (30 10)"), geoPointField)', + ['Unknown column [geoPointField]'] + ); + testErrorsAndWarnings('row st_disjoint(to_geoshape("POINT (30 10)"), geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_disjoint(to_geoshape(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row st_disjoint(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_geoshape(geoPointField), to_geoshape(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings('row var = st_disjoint(true, true)', [ + 'Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]', + 'Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_disjoint(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_disjoint(booleanField, booleanField)', [ + 'Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]', + 'Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(cartesianShapeField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(cartesianShapeField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(geoPointField, geoPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_disjoint(geoPointField, geoPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(geoPointField, geoShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_disjoint(geoPointField, geoShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(geoShapeField, geoPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_disjoint(geoShapeField, geoPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(geoShapeField, geoShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_disjoint(geoShapeField, geoShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_disjoint(cartesianPointField, cartesianPointField, extraArg)', + ['Error: [st_disjoint] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort st_disjoint(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_disjoint(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval st_disjoint(nullVar, nullVar)', []); + }); + + describe('st_distance', () => { + testErrorsAndWarnings('row var = st_distance(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row st_distance(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + + testErrorsAndWarnings( + 'row var = st_distance(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings('row var = st_distance(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row st_distance(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_distance(to_geopoint(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings('row var = st_distance(true, true)', [ + 'Argument of [st_distance] must be [cartesian_point], found value [true] type [boolean]', + 'Argument of [st_distance] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_distance(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_distance(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_distance(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_distance(booleanField, booleanField)', [ + 'Argument of [st_distance] must be [cartesian_point], found value [booleanField] type [boolean]', + 'Argument of [st_distance] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_distance(geoPointField, geoPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_distance(geoPointField, geoPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_distance(to_geopoint(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_distance(cartesianPointField, cartesianPointField, extraArg)', + ['Error: [st_distance] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort st_distance(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_distance(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval st_distance(nullVar, nullVar)', []); + }); + + describe('st_intersects', () => { + testErrorsAndWarnings('row var = st_intersects(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row st_intersects(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + + testErrorsAndWarnings( + 'row var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(cartesianPointField, to_cartesianshape("POINT (30 10)"))', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row st_intersects(cartesianPointField, to_cartesianshape("POINT (30 10)"))', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_cartesianshape("POINT (30 10)"), cartesianPointField)', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row st_intersects(to_cartesianshape("POINT (30 10)"), cartesianPointField)', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row st_intersects(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings('row var = st_intersects(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row st_intersects(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_intersects(to_geopoint(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + testErrorsAndWarnings( + 'row var = st_intersects(geoPointField, to_geoshape("POINT (30 10)"))', + ['Unknown column [geoPointField]'] + ); + testErrorsAndWarnings('row st_intersects(geoPointField, to_geoshape("POINT (30 10)"))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_intersects(to_geopoint(geoPointField), to_geoshape(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + testErrorsAndWarnings( + 'row var = st_intersects(to_geoshape("POINT (30 10)"), geoPointField)', + ['Unknown column [geoPointField]'] + ); + testErrorsAndWarnings('row st_intersects(to_geoshape("POINT (30 10)"), geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_intersects(to_geoshape(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row st_intersects(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_geoshape(geoPointField), to_geoshape(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings('row var = st_intersects(true, true)', [ + 'Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]', + 'Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_intersects(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_intersects(booleanField, booleanField)', [ + 'Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]', + 'Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_intersects(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(cartesianShapeField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_intersects(cartesianShapeField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(cartesianShapeField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(geoPointField, geoPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_intersects(geoPointField, geoPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(geoPointField, geoShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_intersects(geoPointField, geoShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(geoShapeField, geoPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_intersects(geoShapeField, geoPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(geoShapeField, geoShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_intersects(geoShapeField, geoShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_intersects(cartesianPointField, cartesianPointField, extraArg)', + ['Error: [st_intersects] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort st_intersects(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_intersects(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval st_intersects(nullVar, nullVar)', []); + }); + + describe('st_within', () => { + testErrorsAndWarnings('row var = st_within(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row st_within(cartesianPointField, cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + 'Unknown column [cartesianPointField]', + ]); + + testErrorsAndWarnings( + 'row var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_within(cartesianPointField, to_cartesianshape("POINT (30 10)"))', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row st_within(cartesianPointField, to_cartesianshape("POINT (30 10)"))', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_within(to_cartesianshape("POINT (30 10)"), cartesianPointField)', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row st_within(to_cartesianshape("POINT (30 10)"), cartesianPointField)', + ['Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_within(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_within(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row st_within(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_within(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]', 'Unknown column [cartesianPointField]'] + ); + + testErrorsAndWarnings('row var = st_within(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row st_within(geoPointField, geoPointField)', [ + 'Unknown column [geoPointField]', + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_within(to_geopoint(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + testErrorsAndWarnings('row var = st_within(geoPointField, to_geoshape("POINT (30 10)"))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row st_within(geoPointField, to_geoshape("POINT (30 10)"))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_within(to_geopoint(geoPointField), to_geoshape(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + testErrorsAndWarnings('row var = st_within(to_geoshape("POINT (30 10)"), geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row st_within(to_geoshape("POINT (30 10)"), geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings( + 'row var = st_within(to_geoshape(geoPointField), to_geopoint(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings( + 'row var = st_within(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row st_within(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_within(to_geoshape(geoPointField), to_geoshape(geoPointField))', + ['Unknown column [geoPointField]', 'Unknown column [geoPointField]'] + ); + + testErrorsAndWarnings('row var = st_within(true, true)', [ + 'Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]', + 'Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_within(booleanField, booleanField)', [ + 'Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]', + 'Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(cartesianShapeField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(cartesianShapeField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(cartesianShapeField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(cartesianShapeField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(geoPointField, geoPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_within(geoPointField, geoPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_geopoint(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(geoPointField, geoShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_within(geoPointField, geoShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_geopoint(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(geoShapeField, geoPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_within(geoShapeField, geoPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_geoshape(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(geoShapeField, geoShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_within(geoShapeField, geoShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_geoshape(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(cartesianPointField, cartesianPointField, extraArg)', + ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort st_within(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_within(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval st_within(nullVar, nullVar)', []); + }); + + describe('st_x', () => { + testErrorsAndWarnings('row var = st_x(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row st_x(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = st_x(to_cartesianpoint(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = st_x(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row st_x(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row var = st_x(to_geopoint(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + + testErrorsAndWarnings('row var = st_x(true)', [ + 'Argument of [st_x] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = st_x(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval st_x(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_x(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_x(booleanField)', [ + 'Argument of [st_x] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = st_x(*)', [ + 'Using wildcards (*) in st_x is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = st_x(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval st_x(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = st_x(to_geopoint(geoPointField))', []); + + testErrorsAndWarnings('from a_index | eval st_x(cartesianPointField, extraArg)', [ + 'Error: [st_x] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort st_x(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval st_x(null)', []); + testErrorsAndWarnings('row nullVar = null | eval st_x(nullVar)', []); + }); + + describe('st_y', () => { + testErrorsAndWarnings('row var = st_y(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row st_y(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = st_y(to_cartesianpoint(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = st_y(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row st_y(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row var = st_y(to_geopoint(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + + testErrorsAndWarnings('row var = st_y(true)', [ + 'Argument of [st_y] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = st_y(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval st_y(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_y(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_y(booleanField)', [ + 'Argument of [st_y] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = st_y(*)', [ + 'Using wildcards (*) in st_y is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = st_y(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval st_y(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = st_y(to_geopoint(geoPointField))', []); + + testErrorsAndWarnings('from a_index | eval st_y(cartesianPointField, extraArg)', [ + 'Error: [st_y] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort st_y(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval st_y(null)', []); + testErrorsAndWarnings('row nullVar = null | eval st_y(nullVar)', []); + }); + + describe('starts_with', () => { + testErrorsAndWarnings('row var = starts_with("a", "a")', []); + testErrorsAndWarnings('row starts_with("a", "a")', []); + testErrorsAndWarnings('row var = starts_with(to_string(true), to_string(true))', []); + + testErrorsAndWarnings('row var = starts_with(true, true)', [ + 'Argument of [starts_with] must be [keyword], found value [true] type [boolean]', + 'Argument of [starts_with] must be [keyword], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = starts_with(keywordField, keywordField)', + [] + ); + testErrorsAndWarnings('from a_index | eval starts_with(keywordField, keywordField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = starts_with(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval starts_with(booleanField, booleanField)', [ + 'Argument of [starts_with] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [starts_with] must be [keyword], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = starts_with(textField, textField)', []); + testErrorsAndWarnings('from a_index | eval starts_with(textField, textField)', []); + + testErrorsAndWarnings( + 'from a_index | eval starts_with(keywordField, keywordField, extraArg)', + ['Error: [starts_with] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings('from a_index | sort starts_with(keywordField, keywordField)', []); + testErrorsAndWarnings('from a_index | eval starts_with(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval starts_with(nullVar, nullVar)', []); + }); + + describe('substring', () => { + testErrorsAndWarnings('row var = substring("a", 5, 5)', []); + testErrorsAndWarnings('row substring("a", 5, 5)', []); + + testErrorsAndWarnings( + 'row var = substring(to_string(true), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = substring(true, true, true)', [ + 'Argument of [substring] must be [keyword], found value [true] type [boolean]', + 'Argument of [substring] must be [integer], found value [true] type [boolean]', + 'Argument of [substring] must be [integer], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = substring(keywordField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval substring(keywordField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = substring(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval substring(booleanField, booleanField, booleanField)', + [ + 'Argument of [substring] must be [keyword], found value [booleanField] type [boolean]', + 'Argument of [substring] must be [integer], found value [booleanField] type [boolean]', + 'Argument of [substring] must be [integer], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = substring(textField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval substring(textField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval substring(keywordField, integerField, integerField, extraArg)', + ['Error: [substring] function expects no more than 3 arguments, got 4.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort substring(keywordField, integerField, integerField)', + [] + ); + + testErrorsAndWarnings('from a_index | eval substring(null, null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval substring(nullVar, nullVar, nullVar)', []); + }); + + describe('tan', () => { + testErrorsAndWarnings('row var = tan(5.5)', []); + testErrorsAndWarnings('row tan(5.5)', []); + testErrorsAndWarnings('row var = tan(to_double(true))', []); + testErrorsAndWarnings('row var = tan(5)', []); + testErrorsAndWarnings('row tan(5)', []); + testErrorsAndWarnings('row var = tan(to_integer(true))', []); + + testErrorsAndWarnings('row var = tan(true)', [ + 'Argument of [tan] must be [double], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where tan(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where tan(booleanField) > 0', [ + 'Argument of [tan] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where tan(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where tan(longField) > 0', []); + testErrorsAndWarnings('from a_index | where tan(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = tan(doubleField)', []); + testErrorsAndWarnings('from a_index | eval tan(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = tan(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval tan(booleanField)', [ + 'Argument of [tan] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = tan(*)', [ + 'Using wildcards (*) in tan is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = tan(integerField)', []); + testErrorsAndWarnings('from a_index | eval tan(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = tan(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = tan(longField)', []); + testErrorsAndWarnings('from a_index | eval tan(longField)', []); + testErrorsAndWarnings('from a_index | eval var = tan(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval tan(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval tan(doubleField, extraArg)', [ + 'Error: [tan] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort tan(doubleField)', []); + testErrorsAndWarnings('from a_index | eval tan(null)', []); + testErrorsAndWarnings('row nullVar = null | eval tan(nullVar)', []); + }); + + describe('tanh', () => { + testErrorsAndWarnings('row var = tanh(5.5)', []); + testErrorsAndWarnings('row tanh(5.5)', []); + testErrorsAndWarnings('row var = tanh(to_double(true))', []); + testErrorsAndWarnings('row var = tanh(5)', []); + testErrorsAndWarnings('row tanh(5)', []); + testErrorsAndWarnings('row var = tanh(to_integer(true))', []); + + testErrorsAndWarnings('row var = tanh(true)', [ + 'Argument of [tanh] must be [double], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where tanh(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where tanh(booleanField) > 0', [ + 'Argument of [tanh] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where tanh(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where tanh(longField) > 0', []); + testErrorsAndWarnings('from a_index | where tanh(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = tanh(doubleField)', []); + testErrorsAndWarnings('from a_index | eval tanh(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = tanh(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval tanh(booleanField)', [ + 'Argument of [tanh] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = tanh(*)', [ + 'Using wildcards (*) in tanh is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = tanh(integerField)', []); + testErrorsAndWarnings('from a_index | eval tanh(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = tanh(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = tanh(longField)', []); + testErrorsAndWarnings('from a_index | eval tanh(longField)', []); + testErrorsAndWarnings('from a_index | eval var = tanh(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval tanh(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval tanh(doubleField, extraArg)', [ + 'Error: [tanh] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort tanh(doubleField)', []); + testErrorsAndWarnings('from a_index | eval tanh(null)', []); + testErrorsAndWarnings('row nullVar = null | eval tanh(nullVar)', []); + }); + + describe('tau', () => { + testErrorsAndWarnings('row var = tau()', []); + testErrorsAndWarnings('row tau()', []); + testErrorsAndWarnings('from a_index | where tau() > 0', []); + testErrorsAndWarnings('from a_index | eval var = tau()', []); + testErrorsAndWarnings('from a_index | eval tau()', []); + + testErrorsAndWarnings('from a_index | eval tau(extraArg)', [ + 'Error: [tau] function expects exactly 0 arguments, got 1.', + ]); + + testErrorsAndWarnings('from a_index | sort tau()', []); + testErrorsAndWarnings('row nullVar = null | eval tau()', []); + }); + + describe('to_base64', () => { + testErrorsAndWarnings('row var = to_base64("a")', []); + testErrorsAndWarnings('row to_base64("a")', []); + testErrorsAndWarnings('row var = to_base64(to_string(true))', []); + + testErrorsAndWarnings('row var = to_base64(true)', [ + 'Argument of [to_base64] must be [keyword], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_base64(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_base64(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_base64(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_base64(booleanField)', [ + 'Argument of [to_base64] must be [keyword], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_base64(*)', [ + 'Using wildcards (*) in to_base64 is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_base64(textField)', []); + testErrorsAndWarnings('from a_index | eval to_base64(textField)', []); + + testErrorsAndWarnings('from a_index | eval to_base64(keywordField, extraArg)', [ + 'Error: [to_base64] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_base64(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_base64(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_base64(nullVar)', []); + }); + + describe('to_boolean', () => { + testErrorsAndWarnings('row var = to_boolean(true)', []); + testErrorsAndWarnings('row to_boolean(true)', []); + testErrorsAndWarnings('row var = to_bool(true)', []); + testErrorsAndWarnings('row var = to_boolean(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_boolean(5.5)', []); + testErrorsAndWarnings('row to_boolean(5.5)', []); + testErrorsAndWarnings('row var = to_bool(5.5)', []); + testErrorsAndWarnings('row var = to_boolean(to_double(true))', []); + testErrorsAndWarnings('row var = to_boolean(5)', []); + testErrorsAndWarnings('row to_boolean(5)', []); + testErrorsAndWarnings('row var = to_bool(5)', []); + testErrorsAndWarnings('row var = to_boolean(to_integer(true))', []); + testErrorsAndWarnings('row var = to_boolean("a")', []); + testErrorsAndWarnings('row to_boolean("a")', []); + testErrorsAndWarnings('row var = to_bool("a")', []); + testErrorsAndWarnings('row var = to_boolean(to_string(true))', []); + + testErrorsAndWarnings('row var = to_boolean(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [to_boolean] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_boolean(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_boolean(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_bool(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_boolean(cartesianPointField)', [ + 'Argument of [to_boolean] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_boolean(*)', [ + 'Using wildcards (*) in to_boolean is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_boolean(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_boolean(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_bool(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(integerField)', []); + testErrorsAndWarnings('from a_index | eval to_boolean(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_bool(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_boolean(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_bool(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(longField)', []); + testErrorsAndWarnings('from a_index | eval to_boolean(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_bool(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(textField)', []); + testErrorsAndWarnings('from a_index | eval to_boolean(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_bool(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval to_boolean(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_bool(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval to_boolean(booleanField, extraArg)', [ + 'Error: [to_boolean] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_boolean(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_boolean(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_boolean(nullVar)', []); + }); + + describe('to_cartesianpoint', () => { + testErrorsAndWarnings('row var = to_cartesianpoint(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row to_cartesianpoint(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings( + 'row var = to_cartesianpoint(to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]'] + ); + testErrorsAndWarnings('row var = to_cartesianpoint("a")', []); + testErrorsAndWarnings('row to_cartesianpoint("a")', []); + testErrorsAndWarnings('row var = to_cartesianpoint(to_string(true))', []); + + testErrorsAndWarnings('row var = to_cartesianpoint(true)', [ + 'Argument of [to_cartesianpoint] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianpoint(cartesianPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval to_cartesianpoint(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianpoint(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval to_cartesianpoint(booleanField)', [ + 'Argument of [to_cartesianpoint] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_cartesianpoint(*)', [ + 'Using wildcards (*) in to_cartesianpoint is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_cartesianpoint(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_cartesianpoint(keywordField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianpoint(to_string(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = to_cartesianpoint(textField)', []); + testErrorsAndWarnings('from a_index | eval to_cartesianpoint(textField)', []); + + testErrorsAndWarnings( + 'from a_index | eval to_cartesianpoint(cartesianPointField, extraArg)', + ['Error: [to_cartesianpoint] function expects exactly one argument, got 2.'] + ); + + testErrorsAndWarnings('from a_index | sort to_cartesianpoint(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval to_cartesianpoint(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_cartesianpoint(nullVar)', []); + }); + + describe('to_cartesianshape', () => { + testErrorsAndWarnings('row var = to_cartesianshape(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row to_cartesianshape(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings( + 'row var = to_cartesianshape(to_cartesianpoint(cartesianPointField))', + ['Unknown column [cartesianPointField]'] + ); + testErrorsAndWarnings( + 'row var = to_cartesianshape(to_cartesianshape("POINT (30 10)"))', + [] + ); + testErrorsAndWarnings('row to_cartesianshape(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings( + 'row var = to_cartesianshape(to_cartesianshape(cartesianPointField))', + ['Unknown column [cartesianPointField]'] + ); + testErrorsAndWarnings('row var = to_cartesianshape("a")', []); + testErrorsAndWarnings('row to_cartesianshape("a")', []); + testErrorsAndWarnings('row var = to_cartesianshape(to_string(true))', []); + + testErrorsAndWarnings('row var = to_cartesianshape(true)', [ + 'Argument of [to_cartesianshape] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianshape(cartesianPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval to_cartesianshape(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianshape(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval to_cartesianshape(booleanField)', [ + 'Argument of [to_cartesianshape] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_cartesianshape(*)', [ + 'Using wildcards (*) in to_cartesianshape is not allowed', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianshape(cartesianShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval to_cartesianshape(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianshape(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = to_cartesianshape(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_cartesianshape(keywordField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianshape(to_string(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = to_cartesianshape(textField)', []); + testErrorsAndWarnings('from a_index | eval to_cartesianshape(textField)', []); + + testErrorsAndWarnings( + 'from a_index | eval to_cartesianshape(cartesianPointField, extraArg)', + ['Error: [to_cartesianshape] function expects exactly one argument, got 2.'] + ); + + testErrorsAndWarnings('from a_index | sort to_cartesianshape(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval to_cartesianshape(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_cartesianshape(nullVar)', []); + }); + + describe('to_datetime', () => { + testErrorsAndWarnings('row var = to_datetime(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row to_datetime(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row var = to_dt(to_datetime("2021-01-01T00:00:00Z"))', []); + + testErrorsAndWarnings( + 'row var = to_datetime(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); + + testErrorsAndWarnings('row var = to_datetime(5.5)', []); + testErrorsAndWarnings('row to_datetime(5.5)', []); + testErrorsAndWarnings('row var = to_dt(5.5)', []); + testErrorsAndWarnings('row var = to_datetime(to_double(true))', []); + testErrorsAndWarnings('row var = to_datetime(5)', []); + testErrorsAndWarnings('row to_datetime(5)', []); + testErrorsAndWarnings('row var = to_dt(5)', []); + testErrorsAndWarnings('row var = to_datetime(to_integer(true))', []); + testErrorsAndWarnings('row var = to_datetime("a")', []); + testErrorsAndWarnings('row to_datetime("a")', []); + testErrorsAndWarnings('row var = to_dt("a")', []); + testErrorsAndWarnings('row var = to_datetime(to_string(true))', []); + + testErrorsAndWarnings('row var = to_datetime(true)', [ + 'Argument of [to_datetime] must be [date], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_datetime(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_datetime(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dt(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_datetime(to_datetime(dateField))', []); + + testErrorsAndWarnings('from a_index | eval to_datetime(booleanField)', [ + 'Argument of [to_datetime] must be [date], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_datetime(*)', [ + 'Using wildcards (*) in to_datetime is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_datetime(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_datetime(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dt(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_datetime(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_datetime(integerField)', []); + testErrorsAndWarnings('from a_index | eval to_datetime(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dt(integerField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_datetime(to_integer(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = to_datetime(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_datetime(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dt(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_datetime(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_datetime(longField)', []); + testErrorsAndWarnings('from a_index | eval to_datetime(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dt(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_datetime(textField)', []); + testErrorsAndWarnings('from a_index | eval to_datetime(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dt(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_datetime(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval to_datetime(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dt(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval to_datetime(dateField, extraArg)', [ + 'Error: [to_datetime] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_datetime(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_datetime(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_datetime(nullVar)', []); + testErrorsAndWarnings('from a_index | eval to_datetime("2022")', []); + testErrorsAndWarnings('from a_index | eval to_datetime(concat("20", "22"))', []); + }); + + describe('to_degrees', () => { + testErrorsAndWarnings('row var = to_degrees(5.5)', []); + testErrorsAndWarnings('row to_degrees(5.5)', []); + testErrorsAndWarnings('row var = to_degrees(to_double(true))', []); + testErrorsAndWarnings('row var = to_degrees(5)', []); + testErrorsAndWarnings('row to_degrees(5)', []); + testErrorsAndWarnings('row var = to_degrees(to_integer(true))', []); + + testErrorsAndWarnings('row var = to_degrees(true)', [ + 'Argument of [to_degrees] must be [double], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where to_degrees(doubleField) > 0', []); + + testErrorsAndWarnings('from a_index | where to_degrees(booleanField) > 0', [ + 'Argument of [to_degrees] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where to_degrees(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where to_degrees(longField) > 0', []); + testErrorsAndWarnings('from a_index | where to_degrees(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_degrees(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_degrees(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_degrees(to_double(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_degrees(booleanField)', [ + 'Argument of [to_degrees] must be [double], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_degrees(*)', [ + 'Using wildcards (*) in to_degrees is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_degrees(integerField)', []); + testErrorsAndWarnings('from a_index | eval to_degrees(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_degrees(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_degrees(longField)', []); + testErrorsAndWarnings('from a_index | eval to_degrees(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_degrees(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval to_degrees(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval to_degrees(doubleField, extraArg)', [ + 'Error: [to_degrees] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_degrees(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_degrees(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_degrees(nullVar)', []); + }); + + describe('to_double', () => { + testErrorsAndWarnings('row var = to_double(true)', []); + testErrorsAndWarnings('row to_double(true)', []); + testErrorsAndWarnings('row var = to_dbl(true)', []); + testErrorsAndWarnings('row var = to_double(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_double(5.5)', []); + testErrorsAndWarnings('row to_double(5.5)', []); + testErrorsAndWarnings('row var = to_dbl(5.5)', []); + testErrorsAndWarnings('row var = to_double(5)', []); + testErrorsAndWarnings('row to_double(5)', []); + testErrorsAndWarnings('row var = to_dbl(5)', []); + testErrorsAndWarnings('row var = to_double(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row to_double(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row var = to_dbl(to_datetime("2021-01-01T00:00:00Z"))', []); + + testErrorsAndWarnings( + 'row var = to_double(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); + + testErrorsAndWarnings('row var = to_double(to_double(true))', []); + testErrorsAndWarnings('row var = to_double(to_integer(true))', []); + testErrorsAndWarnings('row var = to_double("a")', []); + testErrorsAndWarnings('row to_double("a")', []); + testErrorsAndWarnings('row var = to_dbl("a")', []); + testErrorsAndWarnings('row var = to_double(to_string(true))', []); + + testErrorsAndWarnings('row var = to_double(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [to_double] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where to_double(booleanField) > 0', []); + + testErrorsAndWarnings('from a_index | where to_double(cartesianPointField) > 0', [ + 'Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where to_double(counterDoubleField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(counterIntegerField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(counterLongField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(dateField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(keywordField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(longField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(textField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_double(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_double(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_double(cartesianPointField)', [ + 'Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_double(*)', [ + 'Using wildcards (*) in to_double is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_double(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | eval to_double(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | eval to_double(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(counterLongField)', []); + testErrorsAndWarnings('from a_index | eval to_double(counterLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(counterLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_double(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = to_double(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_double(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_double(integerField)', []); + testErrorsAndWarnings('from a_index | eval to_double(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_double(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_double(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_double(longField)', []); + testErrorsAndWarnings('from a_index | eval to_double(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(textField)', []); + testErrorsAndWarnings('from a_index | eval to_double(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval to_double(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(unsignedLongField)', []); + + testErrorsAndWarnings('from a_index | eval to_double(booleanField, extraArg)', [ + 'Error: [to_double] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_double(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_double(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_double(nullVar)', []); + testErrorsAndWarnings('from a_index | eval to_double("2022")', []); + testErrorsAndWarnings('from a_index | eval to_double(concat("20", "22"))', []); + }); + + describe('to_geopoint', () => { + testErrorsAndWarnings('row var = to_geopoint(geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row to_geopoint(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row var = to_geopoint(to_geopoint(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = to_geopoint("a")', []); + testErrorsAndWarnings('row to_geopoint("a")', []); + testErrorsAndWarnings('row var = to_geopoint(to_string(true))', []); + + testErrorsAndWarnings('row var = to_geopoint(true)', [ + 'Argument of [to_geopoint] must be [geo_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_geopoint(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval to_geopoint(geoPointField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_geopoint(to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval to_geopoint(booleanField)', [ + 'Argument of [to_geopoint] must be [geo_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_geopoint(*)', [ + 'Using wildcards (*) in to_geopoint is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_geopoint(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_geopoint(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_geopoint(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_geopoint(textField)', []); + testErrorsAndWarnings('from a_index | eval to_geopoint(textField)', []); + + testErrorsAndWarnings('from a_index | eval to_geopoint(geoPointField, extraArg)', [ + 'Error: [to_geopoint] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_geopoint(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval to_geopoint(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_geopoint(nullVar)', []); + }); + + describe('to_geoshape', () => { + testErrorsAndWarnings('row var = to_geoshape(geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row to_geoshape(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row var = to_geoshape(to_geopoint(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = to_geoshape(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row to_geoshape(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_geoshape(to_geoshape(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = to_geoshape("a")', []); + testErrorsAndWarnings('row to_geoshape("a")', []); + testErrorsAndWarnings('row var = to_geoshape(to_string(true))', []); + + testErrorsAndWarnings('row var = to_geoshape(true)', [ + 'Argument of [to_geoshape] must be [geo_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_geoshape(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval to_geoshape(geoPointField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_geoshape(to_geopoint(geoPointField))', [] ); - testErrorsAndWarnings('from a_index | eval var = mv_last(cartesianShapeField)', []); - testErrorsAndWarnings('from a_index | eval mv_last(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval to_geoshape(booleanField)', [ + 'Argument of [to_geoshape] must be [geo_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_geoshape(*)', [ + 'Using wildcards (*) in to_geoshape is not allowed', + ]); + testErrorsAndWarnings('from a_index | eval var = to_geoshape(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval to_geoshape(geoShapeField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_last(to_cartesianshape(cartesianPointField))', + 'from a_index | eval var = to_geoshape(to_geoshape(geoPointField))', [] ); + testErrorsAndWarnings('from a_index | eval var = to_geoshape(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_geoshape(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_geoshape(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_geoshape(textField)', []); + testErrorsAndWarnings('from a_index | eval to_geoshape(textField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(dateField)', []); - testErrorsAndWarnings('from a_index | eval mv_last(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(numberField)', []); - testErrorsAndWarnings('from a_index | eval mv_last(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval mv_last(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(to_geopoint(geoPointField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval mv_last(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(to_geoshape(geoPointField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(ipField)', []); - testErrorsAndWarnings('from a_index | eval mv_last(ipField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(to_ip(ipField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(versionField)', []); - testErrorsAndWarnings('from a_index | eval mv_last(versionField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_last(to_version(stringField))', []); - - testErrorsAndWarnings('from a_index | eval mv_last(booleanField, extraArg)', [ - 'Error: [mv_last] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval to_geoshape(geoPointField, extraArg)', [ + 'Error: [to_geoshape] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | sort mv_last(booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_last(null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_last(nullVar)', []); + testErrorsAndWarnings('from a_index | sort to_geoshape(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval to_geoshape(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_geoshape(nullVar)', []); }); - describe('mv_max', () => { - testErrorsAndWarnings('row var = mv_max("a")', []); - testErrorsAndWarnings('row mv_max("a")', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(stringField)', []); - testErrorsAndWarnings('from a_index | eval mv_max(stringField)', []); + describe('to_integer', () => { + testErrorsAndWarnings('row var = to_integer(true)', []); + testErrorsAndWarnings('row to_integer(true)', []); + testErrorsAndWarnings('row var = to_int(true)', []); + testErrorsAndWarnings('row var = to_integer(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_integer(5)', []); + testErrorsAndWarnings('row to_integer(5)', []); + testErrorsAndWarnings('row var = to_int(5)', []); + testErrorsAndWarnings('row var = to_integer(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row to_integer(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row var = to_int(to_datetime("2021-01-01T00:00:00Z"))', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(*)', [ - 'Using wildcards (*) in mv_max is not allowed', - ]); + testErrorsAndWarnings( + 'row var = to_integer(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); - testErrorsAndWarnings('from a_index | sort mv_max(stringField)', []); - testErrorsAndWarnings('row var = mv_max(true)', []); - testErrorsAndWarnings('row mv_max(true)', []); - testErrorsAndWarnings('row var = mv_max(to_boolean(true))', []); - testErrorsAndWarnings('row var = mv_max(now())', []); - testErrorsAndWarnings('row mv_max(now())', []); - testErrorsAndWarnings('row var = mv_max(to_datetime(now()))', []); - testErrorsAndWarnings('row var = mv_max(5)', []); - testErrorsAndWarnings('row mv_max(5)', []); - testErrorsAndWarnings('row var = mv_max(to_integer(true))', []); - testErrorsAndWarnings('row var = mv_max(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row mv_max(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row var = mv_max(to_ip(to_ip("127.0.0.1")))', []); - testErrorsAndWarnings('row var = mv_max(to_string(true))', []); - testErrorsAndWarnings('row var = mv_max(to_version("1.0.0"))', []); - testErrorsAndWarnings('row mv_max(to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = mv_max(to_version("a"))', []); + testErrorsAndWarnings('row var = to_integer(5.5)', []); + testErrorsAndWarnings('row to_integer(5.5)', []); + testErrorsAndWarnings('row var = to_int(5.5)', []); + testErrorsAndWarnings('row var = to_integer(to_double(true))', []); + testErrorsAndWarnings('row var = to_integer(to_integer(true))', []); + testErrorsAndWarnings('row var = to_integer("a")', []); + testErrorsAndWarnings('row to_integer("a")', []); + testErrorsAndWarnings('row var = to_int("a")', []); + testErrorsAndWarnings('row var = to_integer(to_string(true))', []); - testErrorsAndWarnings('row var = mv_max(to_cartesianpoint("POINT (30 10)"))', [ - 'Argument of [mv_max] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + testErrorsAndWarnings('row var = to_integer(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [to_integer] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', ]); - testErrorsAndWarnings('from a_index | where mv_max(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(booleanField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_max(cartesianPointField) > 0', [ - 'Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | where to_integer(cartesianPointField) > 0', [ + 'Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]', ]); - testErrorsAndWarnings('from a_index | where length(mv_max(stringField)) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(counterIntegerField) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(dateField) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(keywordField) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(longField) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(textField) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(to_boolean(booleanField))', []); - testErrorsAndWarnings('from a_index | where length(mv_max(cartesianPointField)) > 0', [ - 'Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval to_integer(cartesianPointField)', [ + 'Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]', ]); - testErrorsAndWarnings('from a_index | eval var = mv_max(booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_max(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(to_boolean(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval mv_max(cartesianPointField)', [ - 'Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval var = to_integer(*)', [ + 'Using wildcards (*) in to_integer is not allowed', ]); - testErrorsAndWarnings('from a_index | eval var = mv_max(dateField)', []); - testErrorsAndWarnings('from a_index | eval mv_max(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(numberField)', []); - testErrorsAndWarnings('from a_index | eval mv_max(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(ipField)', []); - testErrorsAndWarnings('from a_index | eval mv_max(ipField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(to_ip(ipField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(versionField)', []); - testErrorsAndWarnings('from a_index | eval mv_max(versionField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_max(to_version(stringField))', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(integerField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(longField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(textField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(unsignedLongField)', []); - testErrorsAndWarnings('from a_index | eval mv_max(booleanField, extraArg)', [ - 'Error: [mv_max] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval to_integer(booleanField, extraArg)', [ + 'Error: [to_integer] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | sort mv_max(booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_max(null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_max(nullVar)', []); + testErrorsAndWarnings('from a_index | sort to_integer(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_integer(nullVar)', []); + testErrorsAndWarnings('from a_index | eval to_integer("2022")', []); + testErrorsAndWarnings('from a_index | eval to_integer(concat("20", "22"))', []); }); - describe('mv_median', () => { - testErrorsAndWarnings('row var = mv_median(5)', []); - testErrorsAndWarnings('row mv_median(5)', []); - testErrorsAndWarnings('row var = mv_median(to_integer("a"))', []); + describe('to_ip', () => { + testErrorsAndWarnings('row var = to_ip(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row to_ip(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = to_ip(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = to_ip("a")', []); + testErrorsAndWarnings('row to_ip("a")', []); + testErrorsAndWarnings('row var = to_ip(to_string(true))', []); - testErrorsAndWarnings('row var = mv_median("a")', [ - 'Argument of [mv_median] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('row var = to_ip(true)', [ + 'Argument of [to_ip] must be [ip], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where mv_median(numberField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_ip(ipField)', []); + testErrorsAndWarnings('from a_index | eval to_ip(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ip(to_ip(ipField))', []); + + testErrorsAndWarnings('from a_index | eval to_ip(booleanField)', [ + 'Argument of [to_ip] must be [ip], found value [booleanField] type [boolean]', + ]); - testErrorsAndWarnings('from a_index | where mv_median(stringField) > 0', [ - 'Argument of [mv_median] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval var = to_ip(*)', [ + 'Using wildcards (*) in to_ip is not allowed', ]); - testErrorsAndWarnings('from a_index | eval var = mv_median(numberField)', []); - testErrorsAndWarnings('from a_index | eval mv_median(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_median(to_integer(stringField))', []); + testErrorsAndWarnings('from a_index | eval var = to_ip(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_ip(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ip(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_ip(textField)', []); + testErrorsAndWarnings('from a_index | eval to_ip(textField)', []); - testErrorsAndWarnings('from a_index | eval mv_median(stringField)', [ - 'Argument of [mv_median] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval to_ip(ipField, extraArg)', [ + 'Error: [to_ip] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | eval mv_median(numberField, extraArg)', [ - 'Error: [mv_median] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | sort to_ip(ipField)', []); + testErrorsAndWarnings('from a_index | eval to_ip(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_ip(nullVar)', []); + }); + + describe('to_long', () => { + testErrorsAndWarnings('row var = to_long(true)', []); + testErrorsAndWarnings('row to_long(true)', []); + testErrorsAndWarnings('row var = to_long(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_long(5)', []); + testErrorsAndWarnings('row to_long(5)', []); + testErrorsAndWarnings('row var = to_long(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row to_long(to_datetime("2021-01-01T00:00:00Z"))', []); + + testErrorsAndWarnings( + 'row var = to_long(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); + + testErrorsAndWarnings('row var = to_long(5.5)', []); + testErrorsAndWarnings('row to_long(5.5)', []); + testErrorsAndWarnings('row var = to_long(to_double(true))', []); + testErrorsAndWarnings('row var = to_long(to_integer(true))', []); + testErrorsAndWarnings('row var = to_long("a")', []); + testErrorsAndWarnings('row to_long("a")', []); + testErrorsAndWarnings('row var = to_long(to_string(true))', []); + + testErrorsAndWarnings('row var = to_long(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [to_long] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', ]); - testErrorsAndWarnings('from a_index | eval var = mv_median(*)', [ - 'Using wildcards (*) in mv_median is not allowed', + testErrorsAndWarnings('from a_index | where to_long(booleanField) > 0', []); + + testErrorsAndWarnings('from a_index | where to_long(cartesianPointField) > 0', [ + 'Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', ]); - testErrorsAndWarnings('from a_index | sort mv_median(numberField)', []); - testErrorsAndWarnings('row var = mv_median(to_integer(true))', []); + testErrorsAndWarnings('from a_index | where to_long(counterIntegerField) > 0', []); + testErrorsAndWarnings('from a_index | where to_long(counterLongField) > 0', []); + testErrorsAndWarnings('from a_index | where to_long(dateField) > 0', []); + testErrorsAndWarnings('from a_index | where to_long(doubleField) > 0', []); + testErrorsAndWarnings('from a_index | where to_long(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where to_long(keywordField) > 0', []); + testErrorsAndWarnings('from a_index | where to_long(longField) > 0', []); + testErrorsAndWarnings('from a_index | where to_long(textField) > 0', []); + testErrorsAndWarnings('from a_index | where to_long(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_long(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_long(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(to_boolean(booleanField))', []); - testErrorsAndWarnings('row var = mv_median(true)', [ - 'Argument of [mv_median] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval to_long(cartesianPointField)', [ + 'Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', ]); - testErrorsAndWarnings('from a_index | where mv_median(booleanField) > 0', [ - 'Argument of [mv_median] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = to_long(*)', [ + 'Using wildcards (*) in to_long is not allowed', ]); - testErrorsAndWarnings('from a_index | eval var = mv_median(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_long(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | eval to_long(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(counterLongField)', []); + testErrorsAndWarnings('from a_index | eval to_long(counterLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_long(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = to_long(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_long(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_long(integerField)', []); + testErrorsAndWarnings('from a_index | eval to_long(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_long(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_long(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_long(longField)', []); + testErrorsAndWarnings('from a_index | eval to_long(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(textField)', []); + testErrorsAndWarnings('from a_index | eval to_long(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval to_long(unsignedLongField)', []); - testErrorsAndWarnings('from a_index | eval mv_median(booleanField)', [ - 'Argument of [mv_median] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval to_long(booleanField, extraArg)', [ + 'Error: [to_long] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | eval mv_median(null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_median(nullVar)', []); + + testErrorsAndWarnings('from a_index | sort to_long(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_long(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_long(nullVar)', []); + testErrorsAndWarnings('from a_index | eval to_long("2022")', []); + testErrorsAndWarnings('from a_index | eval to_long(concat("20", "22"))', []); }); - describe('mv_min', () => { - testErrorsAndWarnings('row var = mv_min("a")', []); - testErrorsAndWarnings('row mv_min("a")', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(stringField)', []); - testErrorsAndWarnings('from a_index | eval mv_min(stringField)', []); + describe('to_lower', () => { + testErrorsAndWarnings('row var = to_lower("a")', []); + testErrorsAndWarnings('row to_lower("a")', []); + testErrorsAndWarnings('row var = to_lower(to_string(true))', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(*)', [ - 'Using wildcards (*) in mv_min is not allowed', + testErrorsAndWarnings('row var = to_lower(true)', [ + 'Argument of [to_lower] must be [keyword], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | sort mv_min(stringField)', []); - testErrorsAndWarnings('row var = mv_min(true)', []); - testErrorsAndWarnings('row mv_min(true)', []); - testErrorsAndWarnings('row var = mv_min(to_boolean(true))', []); - testErrorsAndWarnings('row var = mv_min(now())', []); - testErrorsAndWarnings('row mv_min(now())', []); - testErrorsAndWarnings('row var = mv_min(to_datetime(now()))', []); - testErrorsAndWarnings('row var = mv_min(5)', []); - testErrorsAndWarnings('row mv_min(5)', []); - testErrorsAndWarnings('row var = mv_min(to_integer(true))', []); - testErrorsAndWarnings('row var = mv_min(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row mv_min(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row var = mv_min(to_ip(to_ip("127.0.0.1")))', []); - testErrorsAndWarnings('row var = mv_min(to_string(true))', []); - testErrorsAndWarnings('row var = mv_min(to_version("1.0.0"))', []); - testErrorsAndWarnings('row mv_min(to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = mv_min(to_version("a"))', []); + testErrorsAndWarnings('from a_index | eval var = to_lower(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_lower(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_lower(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_lower(booleanField)', [ + 'Argument of [to_lower] must be [keyword], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_lower(*)', [ + 'Using wildcards (*) in to_lower is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_lower(textField)', []); + testErrorsAndWarnings('from a_index | eval to_lower(textField)', []); + + testErrorsAndWarnings('from a_index | eval to_lower(keywordField, extraArg)', [ + 'Error: [to_lower] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_lower(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_lower(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_lower(nullVar)', []); + }); + + describe('to_radians', () => { + testErrorsAndWarnings('row var = to_radians(5.5)', []); + testErrorsAndWarnings('row to_radians(5.5)', []); + testErrorsAndWarnings('row var = to_radians(to_double(true))', []); + testErrorsAndWarnings('row var = to_radians(5)', []); + testErrorsAndWarnings('row to_radians(5)', []); + testErrorsAndWarnings('row var = to_radians(to_integer(true))', []); - testErrorsAndWarnings('row var = mv_min(to_cartesianpoint("POINT (30 10)"))', [ - 'Argument of [mv_min] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + testErrorsAndWarnings('row var = to_radians(true)', [ + 'Argument of [to_radians] must be [double], found value [true] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where mv_min(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where to_radians(doubleField) > 0', []); - testErrorsAndWarnings('from a_index | where mv_min(cartesianPointField) > 0', [ - 'Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | where to_radians(booleanField) > 0', [ + 'Argument of [to_radians] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | where length(mv_min(stringField)) > 0', []); + testErrorsAndWarnings('from a_index | where to_radians(integerField) > 0', []); + testErrorsAndWarnings('from a_index | where to_radians(longField) > 0', []); + testErrorsAndWarnings('from a_index | where to_radians(unsignedLongField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_radians(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_radians(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_radians(to_double(booleanField))', []); - testErrorsAndWarnings('from a_index | where length(mv_min(cartesianPointField)) > 0', [ - 'Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval to_radians(booleanField)', [ + 'Argument of [to_radians] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = mv_min(booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_min(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(to_boolean(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval mv_min(cartesianPointField)', [ - 'Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval var = to_radians(*)', [ + 'Using wildcards (*) in to_radians is not allowed', ]); - testErrorsAndWarnings('from a_index | eval var = mv_min(dateField)', []); - testErrorsAndWarnings('from a_index | eval mv_min(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(numberField)', []); - testErrorsAndWarnings('from a_index | eval mv_min(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(ipField)', []); - testErrorsAndWarnings('from a_index | eval mv_min(ipField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(to_ip(ipField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(versionField)', []); - testErrorsAndWarnings('from a_index | eval mv_min(versionField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_min(to_version(stringField))', []); + testErrorsAndWarnings('from a_index | eval var = to_radians(integerField)', []); + testErrorsAndWarnings('from a_index | eval to_radians(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_radians(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_radians(longField)', []); + testErrorsAndWarnings('from a_index | eval to_radians(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_radians(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval to_radians(unsignedLongField)', []); - testErrorsAndWarnings('from a_index | eval mv_min(booleanField, extraArg)', [ - 'Error: [mv_min] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval to_radians(doubleField, extraArg)', [ + 'Error: [to_radians] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | sort mv_min(booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_min(null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_min(nullVar)', []); + testErrorsAndWarnings('from a_index | sort to_radians(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_radians(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_radians(nullVar)', []); }); - describe('mv_slice', () => { - testErrorsAndWarnings('row var = mv_slice("a", 5, 5)', []); - testErrorsAndWarnings('row mv_slice("a", 5, 5)', []); - + describe('to_unsigned_long', () => { + testErrorsAndWarnings('row var = to_unsigned_long(true)', []); + testErrorsAndWarnings('row to_unsigned_long(true)', []); + testErrorsAndWarnings('row var = to_ul(true)', []); + testErrorsAndWarnings('row var = to_ulong(true)', []); + testErrorsAndWarnings('row var = to_unsigned_long(to_boolean(true))', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(stringField, numberField, numberField)', + 'row var = to_unsigned_long(to_datetime("2021-01-01T00:00:00Z"))', [] ); + testErrorsAndWarnings('row to_unsigned_long(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row var = to_ul(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row var = to_ulong(to_datetime("2021-01-01T00:00:00Z"))', []); testErrorsAndWarnings( - 'from a_index | eval mv_slice(stringField, numberField, numberField)', - [] - ); - testErrorsAndWarnings( - 'from a_index | sort mv_slice(stringField, numberField, numberField)', + 'row var = to_unsigned_long(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', [] ); - testErrorsAndWarnings('row var = mv_slice(true, 5, 5)', []); - testErrorsAndWarnings('row mv_slice(true, 5, 5)', []); - testErrorsAndWarnings( - 'row var = mv_slice(to_boolean(true), to_integer(true), to_integer(true))', - [] - ); + testErrorsAndWarnings('row var = to_unsigned_long(5.5)', []); + testErrorsAndWarnings('row to_unsigned_long(5.5)', []); + testErrorsAndWarnings('row var = to_ul(5.5)', []); + testErrorsAndWarnings('row var = to_ulong(5.5)', []); + testErrorsAndWarnings('row var = to_unsigned_long(to_double(true))', []); + testErrorsAndWarnings('row var = to_unsigned_long(5)', []); + testErrorsAndWarnings('row to_unsigned_long(5)', []); + testErrorsAndWarnings('row var = to_ul(5)', []); + testErrorsAndWarnings('row var = to_ulong(5)', []); + testErrorsAndWarnings('row var = to_unsigned_long(to_integer(true))', []); + testErrorsAndWarnings('row var = to_unsigned_long("a")', []); + testErrorsAndWarnings('row to_unsigned_long("a")', []); + testErrorsAndWarnings('row var = to_ul("a")', []); + testErrorsAndWarnings('row var = to_ulong("a")', []); + testErrorsAndWarnings('row var = to_unsigned_long(to_string(true))', []); - testErrorsAndWarnings('row var = mv_slice(to_cartesianpoint("POINT (30 10)"), 5, 5)', []); - testErrorsAndWarnings('row mv_slice(to_cartesianpoint("POINT (30 10)"), 5, 5)', []); + testErrorsAndWarnings('row var = to_unsigned_long(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [to_unsigned_long] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); - testErrorsAndWarnings( - 'row var = mv_slice(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_integer(true), to_integer(true))', - [] - ); + testErrorsAndWarnings('from a_index | where to_unsigned_long(booleanField) > 0', [ + 'Argument of [>] must be [double], found value [to_unsigned_long(booleanField)] type [unsigned_long]', + ]); - testErrorsAndWarnings('row var = mv_slice(to_cartesianshape("POINT (30 10)"), 5, 5)', []); - testErrorsAndWarnings('row mv_slice(to_cartesianshape("POINT (30 10)"), 5, 5)', []); + testErrorsAndWarnings('from a_index | where to_unsigned_long(cartesianPointField) > 0', [ + 'Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + 'Argument of [>] must be [double], found value [to_unsigned_long(cartesianPointField)] type [unsigned_long]', + ]); + testErrorsAndWarnings('from a_index | where to_unsigned_long(dateField) > 0', [ + 'Argument of [>] must be [double], found value [to_unsigned_long(dateField)] type [unsigned_long]', + ]); + testErrorsAndWarnings('from a_index | where to_unsigned_long(doubleField) > 0', [ + 'Argument of [>] must be [double], found value [to_unsigned_long(doubleField)] type [unsigned_long]', + ]); + testErrorsAndWarnings('from a_index | where to_unsigned_long(integerField) > 0', [ + 'Argument of [>] must be [double], found value [to_unsigned_long(integerField)] type [unsigned_long]', + ]); + testErrorsAndWarnings('from a_index | where to_unsigned_long(keywordField) > 0', [ + 'Argument of [>] must be [double], found value [to_unsigned_long(keywordField)] type [unsigned_long]', + ]); + testErrorsAndWarnings('from a_index | where to_unsigned_long(longField) > 0', [ + 'Argument of [>] must be [double], found value [to_unsigned_long(longField)] type [unsigned_long]', + ]); + testErrorsAndWarnings('from a_index | where to_unsigned_long(textField) > 0', [ + 'Argument of [>] must be [double], found value [to_unsigned_long(textField)] type [unsigned_long]', + ]); + testErrorsAndWarnings('from a_index | where to_unsigned_long(unsignedLongField) > 0', [ + 'Argument of [>] must be [double], found value [to_unsigned_long(unsignedLongField)] type [unsigned_long]', + ]); + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(booleanField)', []); testErrorsAndWarnings( - 'row var = mv_slice(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_integer(true), to_integer(true))', + 'from a_index | eval var = to_unsigned_long(to_boolean(booleanField))', [] ); - testErrorsAndWarnings('row var = mv_slice(now(), 5, 5)', []); - testErrorsAndWarnings('row mv_slice(now(), 5, 5)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(cartesianPointField)', [ + 'Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); - testErrorsAndWarnings( - 'row var = mv_slice(to_datetime(now()), to_integer(true), to_integer(true))', - [] - ); + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(*)', [ + 'Using wildcards (*) in to_unsigned_long is not allowed', + ]); - testErrorsAndWarnings('row var = mv_slice(5, 5, 5)', []); - testErrorsAndWarnings('row mv_slice(5, 5, 5)', []); + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(dateField)', []); testErrorsAndWarnings( - 'row var = mv_slice(to_integer(true), to_integer(true), to_integer(true))', + 'from a_index | eval var = to_unsigned_long(to_datetime(dateField))', [] ); - testErrorsAndWarnings('row var = mv_slice(to_geopoint("POINT (30 10)"), 5, 5)', []); - testErrorsAndWarnings('row mv_slice(to_geopoint("POINT (30 10)"), 5, 5)', []); - + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(doubleField)', []); testErrorsAndWarnings( - 'row var = mv_slice(to_geopoint(to_geopoint("POINT (30 10)")), to_integer(true), to_integer(true))', + 'from a_index | eval var = to_unsigned_long(to_double(booleanField))', [] ); - - testErrorsAndWarnings('row var = mv_slice(to_geoshape("POINT (30 10)"), 5, 5)', []); - testErrorsAndWarnings('row mv_slice(to_geoshape("POINT (30 10)"), 5, 5)', []); - + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(integerField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(integerField)', []); testErrorsAndWarnings( - 'row var = mv_slice(to_geoshape(to_geopoint("POINT (30 10)")), to_integer(true), to_integer(true))', + 'from a_index | eval var = to_unsigned_long(to_integer(booleanField))', [] ); - - testErrorsAndWarnings('row var = mv_slice(to_ip("127.0.0.1"), 5, 5)', []); - testErrorsAndWarnings('row mv_slice(to_ip("127.0.0.1"), 5, 5)', []); - + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(keywordField)', []); testErrorsAndWarnings( - 'row var = mv_slice(to_ip(to_ip("127.0.0.1")), to_integer(true), to_integer(true))', + 'from a_index | eval var = to_unsigned_long(to_string(booleanField))', [] ); + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(longField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(textField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(unsignedLongField)', []); - testErrorsAndWarnings( - 'row var = mv_slice(to_string(true), to_integer(true), to_integer(true))', - [] - ); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(booleanField, extraArg)', [ + 'Error: [to_unsigned_long] function expects exactly one argument, got 2.', + ]); - testErrorsAndWarnings('row var = mv_slice(to_version("1.0.0"), 5, 5)', []); - testErrorsAndWarnings('row mv_slice(to_version("1.0.0"), 5, 5)', []); + testErrorsAndWarnings('from a_index | sort to_unsigned_long(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_unsigned_long(nullVar)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long("2022")', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(concat("20", "22"))', []); + }); - testErrorsAndWarnings( - 'row var = mv_slice(to_version("a"), to_integer(true), to_integer(true))', - [] - ); + describe('to_upper', () => { + testErrorsAndWarnings('row var = to_upper("a")', []); + testErrorsAndWarnings('row to_upper("a")', []); + testErrorsAndWarnings('row var = to_upper(to_string(true))', []); - testErrorsAndWarnings('row var = mv_slice(to_version("1.0.0"), true, true)', [ - 'Argument of [mv_slice] must be [number], found value [true] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('row var = to_upper(true)', [ + 'Argument of [to_upper] must be [keyword], found value [true] type [boolean]', ]); - testErrorsAndWarnings( - 'from a_index | where mv_slice(numberField, numberField, numberField) > 0', - [] - ); + testErrorsAndWarnings('from a_index | eval var = to_upper(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_upper(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_upper(to_string(booleanField))', []); - testErrorsAndWarnings( - 'from a_index | where mv_slice(numberField, booleanField, booleanField) > 0', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] - ); + testErrorsAndWarnings('from a_index | eval to_upper(booleanField)', [ + 'Argument of [to_upper] must be [keyword], found value [booleanField] type [boolean]', + ]); - testErrorsAndWarnings( - 'from a_index | where length(mv_slice(stringField, numberField, numberField)) > 0', - [] - ); + testErrorsAndWarnings('from a_index | eval var = to_upper(*)', [ + 'Using wildcards (*) in to_upper is not allowed', + ]); - testErrorsAndWarnings( - 'from a_index | where length(mv_slice(stringField, booleanField, booleanField)) > 0', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] - ); + testErrorsAndWarnings('from a_index | eval var = to_upper(textField)', []); + testErrorsAndWarnings('from a_index | eval to_upper(textField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(booleanField, numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval to_upper(keywordField, extraArg)', [ + 'Error: [to_upper] function expects exactly one argument, got 2.', + ]); - testErrorsAndWarnings( - 'from a_index | eval mv_slice(booleanField, numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | sort to_upper(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_upper(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_upper(nullVar)', []); + }); - testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(to_boolean(booleanField), to_integer(booleanField), to_integer(booleanField))', - [] - ); + describe('to_version', () => { + testErrorsAndWarnings('row var = to_version("a")', []); + testErrorsAndWarnings('row to_version("a")', []); + testErrorsAndWarnings('row var = to_ver("a")', []); + testErrorsAndWarnings('row var = to_version(to_version("1.0.0"))', []); + testErrorsAndWarnings('row to_version(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = to_ver(to_version("1.0.0"))', []); - testErrorsAndWarnings( - 'from a_index | eval mv_slice(booleanField, booleanField, booleanField)', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] - ); + testErrorsAndWarnings('row var = to_version(true)', [ + 'Argument of [to_version] must be [keyword], found value [true] type [boolean]', + ]); - testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(cartesianPointField, numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval var = to_version(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_version(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ver(keywordField)', []); - testErrorsAndWarnings( - 'from a_index | eval mv_slice(cartesianPointField, numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval var = to_version(*)', [ + 'Using wildcards (*) in to_version is not allowed', + ]); - testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(to_cartesianpoint(cartesianPointField), to_integer(booleanField), to_integer(booleanField))', - [] - ); + testErrorsAndWarnings('from a_index | eval var = to_version(textField)', []); + testErrorsAndWarnings('from a_index | eval to_version(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ver(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_version(versionField)', []); + testErrorsAndWarnings('from a_index | eval to_version(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ver(versionField)', []); - testErrorsAndWarnings( - 'from a_index | eval mv_slice(cartesianPointField, booleanField, booleanField)', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] - ); + testErrorsAndWarnings('from a_index | eval to_version(keywordField, extraArg)', [ + 'Error: [to_version] function expects exactly one argument, got 2.', + ]); - testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(cartesianShapeField, numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | sort to_version(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_version(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_version(nullVar)', []); + }); - testErrorsAndWarnings( - 'from a_index | eval mv_slice(cartesianShapeField, numberField, numberField)', - [] - ); + describe('trim', () => { + testErrorsAndWarnings('row var = trim("a")', []); + testErrorsAndWarnings('row trim("a")', []); + testErrorsAndWarnings('row var = trim(to_string(true))', []); - testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(to_cartesianshape(cartesianPointField), to_integer(booleanField), to_integer(booleanField))', - [] - ); + testErrorsAndWarnings('row var = trim(true)', [ + 'Argument of [trim] must be [keyword], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = trim(keywordField)', []); + testErrorsAndWarnings('from a_index | eval trim(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = trim(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval trim(booleanField)', [ + 'Argument of [trim] must be [keyword], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = trim(*)', [ + 'Using wildcards (*) in trim is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval var = trim(textField)', []); + testErrorsAndWarnings('from a_index | eval trim(textField)', []); + + testErrorsAndWarnings('from a_index | eval trim(keywordField, extraArg)', [ + 'Error: [trim] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort trim(keywordField)', []); + testErrorsAndWarnings('from a_index | eval trim(null)', []); + testErrorsAndWarnings('row nullVar = null | eval trim(nullVar)', []); + }); + + describe('case', () => { + testErrorsAndWarnings('row var = case(true, "a")', []); + testErrorsAndWarnings('row case(true, "a")', []); + + testErrorsAndWarnings('row var = case(to_cartesianpoint("POINT (30 10)"), true)', [ + 'Argument of [case] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = case(booleanField, textField)', []); + testErrorsAndWarnings('from a_index | eval case(booleanField, textField)', []); + testErrorsAndWarnings('from a_index | sort case(booleanField, textField)', []); + testErrorsAndWarnings('from a_index | eval case(null, null)', []); + testErrorsAndWarnings('row nullVar = null | eval case(nullVar, nullVar)', []); + }); - testErrorsAndWarnings( - 'from a_index | eval mv_slice(cartesianShapeField, booleanField, booleanField)', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] - ); + describe('avg', () => { + testErrorsAndWarnings('from a_index | stats var = avg(integerField)', []); + testErrorsAndWarnings('from a_index | stats avg(integerField)', []); + testErrorsAndWarnings('from a_index | stats var = round(avg(integerField))', []); + testErrorsAndWarnings('from a_index | stats round(avg(integerField))', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(dateField, numberField, numberField)', + 'from a_index | stats var = round(avg(integerField)) + avg(integerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval mv_slice(dateField, numberField, numberField)', + 'from a_index | stats round(avg(integerField)) + avg(integerField)', [] ); - + testErrorsAndWarnings('from a_index | stats avg(doubleField / 2)', []); + testErrorsAndWarnings('from a_index | stats var0 = avg(doubleField / 2)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), avg(doubleField / 2)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(to_datetime(dateField), to_integer(booleanField), to_integer(booleanField))', + 'from a_index | stats avg(doubleField), var0 = avg(doubleField / 2)', [] ); - - testErrorsAndWarnings( - 'from a_index | eval mv_slice(dateField, booleanField, booleanField)', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] - ); - + testErrorsAndWarnings('from a_index | stats var0 = avg(integerField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), avg(integerField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(numberField, numberField, numberField)', + 'from a_index | stats avg(doubleField), var0 = avg(integerField)', [] ); - testErrorsAndWarnings( - 'from a_index | eval mv_slice(numberField, numberField, numberField)', + 'from a_index | stats avg(integerField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(to_integer(booleanField), to_integer(booleanField), to_integer(booleanField))', + 'from a_index | stats var0 = avg(integerField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval mv_slice(numberField, booleanField, booleanField)', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(doubleField), avg(integerField) by round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(geoPointField, numberField, numberField)', + 'from a_index | stats avg(doubleField), var0 = avg(integerField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval mv_slice(geoPointField, numberField, numberField)', + 'from a_index | stats avg(doubleField), avg(integerField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(to_geopoint(geoPointField), to_integer(booleanField), to_integer(booleanField))', + 'from a_index | stats avg(doubleField), var0 = avg(integerField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings( - 'from a_index | eval mv_slice(geoPointField, booleanField, booleanField)', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] - ); + testErrorsAndWarnings('from a_index | stats var = avg(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ]); - testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(geoShapeField, numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | stats avg(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ]); - testErrorsAndWarnings( - 'from a_index | eval mv_slice(geoShapeField, numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | stats avg(booleanField)', [ + 'Argument of [avg] must be [integer], found value [booleanField] type [boolean]', + ]); - testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(to_geoshape(geoPointField), to_integer(booleanField), to_integer(booleanField))', - [] - ); + testErrorsAndWarnings('from a_index | stats var = avg(*)', [ + 'Using wildcards (*) in avg is not allowed', + ]); - testErrorsAndWarnings( - 'from a_index | eval mv_slice(geoShapeField, booleanField, booleanField)', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] - ); + testErrorsAndWarnings('from a_index | stats var = avg(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | stats avg(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | stats var = round(avg(counterIntegerField))', []); + testErrorsAndWarnings('from a_index | stats round(avg(counterIntegerField))', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(ipField, numberField, numberField)', + 'from a_index | stats var = round(avg(counterIntegerField)) + avg(counterIntegerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval mv_slice(ipField, numberField, numberField)', + 'from a_index | stats round(avg(counterIntegerField)) + avg(counterIntegerField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = avg(counterIntegerField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))', + 'from a_index | stats avg(doubleField), avg(counterIntegerField)', [] ); - testErrorsAndWarnings('from a_index | eval mv_slice(ipField, booleanField, booleanField)', [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))', + 'from a_index | stats avg(doubleField), var0 = avg(counterIntegerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval mv_slice(stringField, booleanField, booleanField)', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] - ); - - testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(versionField, numberField, numberField)', + 'from a_index | stats avg(counterIntegerField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval mv_slice(versionField, numberField, numberField)', + 'from a_index | stats var0 = avg(counterIntegerField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(to_version(stringField), to_integer(booleanField), to_integer(booleanField))', + 'from a_index | stats avg(doubleField), avg(counterIntegerField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval mv_slice(versionField, booleanField, booleanField)', - [ - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(doubleField), var0 = avg(counterIntegerField) by var1 = round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval mv_slice(booleanField, numberField, numberField, extraArg)', - ['Error: [mv_slice] function expects no more than 3 arguments, got 4.'] + 'from a_index | stats avg(doubleField), avg(counterIntegerField) by round(doubleField / 2), doubleField / 2', + [] ); testErrorsAndWarnings( - 'from a_index | sort mv_slice(booleanField, numberField, numberField)', + 'from a_index | stats avg(doubleField), var0 = avg(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval mv_slice(null, null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_slice(nullVar, nullVar, nullVar)', []); - }); - - describe('mv_sort', () => { - testErrorsAndWarnings('row var = mv_sort("a", "asc")', []); - testErrorsAndWarnings('row mv_sort("a", "asc")', []); - testErrorsAndWarnings('from a_index | eval var = mv_sort(stringField, "asc")', []); - testErrorsAndWarnings('from a_index | eval mv_sort(stringField, "asc")', []); - testErrorsAndWarnings('from a_index | sort mv_sort(stringField, "asc")', []); - testErrorsAndWarnings('row var = mv_sort(true, "asc")', []); - testErrorsAndWarnings('row mv_sort(true, "asc")', []); - testErrorsAndWarnings('row var = mv_sort(now(), "asc")', []); - testErrorsAndWarnings('row mv_sort(now(), "asc")', []); - testErrorsAndWarnings('row var = mv_sort(5, "asc")', []); - testErrorsAndWarnings('row mv_sort(5, "asc")', []); - testErrorsAndWarnings('row var = mv_sort(to_ip("127.0.0.1"), "asc")', []); - testErrorsAndWarnings('row mv_sort(to_ip("127.0.0.1"), "asc")', []); - testErrorsAndWarnings('row var = mv_sort(to_version("1.0.0"), "asc")', []); - testErrorsAndWarnings('row mv_sort(to_version("1.0.0"), "asc")', []); - - testErrorsAndWarnings('row var = mv_sort(to_cartesianpoint("POINT (30 10)"), true)', [ - 'Argument of [mv_sort] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', - 'Argument of [mv_sort] must be [string], found value [true] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | where mv_sort(numberField, "asc") > 0', []); + testErrorsAndWarnings('from a_index | stats var = avg(doubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField)', []); + testErrorsAndWarnings('from a_index | stats var = round(avg(doubleField))', []); + testErrorsAndWarnings('from a_index | stats round(avg(doubleField))', []); testErrorsAndWarnings( - 'from a_index | where mv_sort(cartesianPointField, booleanField) > 0', - [ - 'Argument of [mv_sort] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - 'Argument of [mv_sort] must be [string], found value [booleanField] type [boolean]', - ] + 'from a_index | stats var = round(avg(doubleField)) + avg(doubleField)', + [] ); - testErrorsAndWarnings('from a_index | where length(mv_sort(stringField, "asc")) > 0', []); - testErrorsAndWarnings( - 'from a_index | where length(mv_sort(cartesianPointField, booleanField)) > 0', - [ - 'Argument of [mv_sort] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - 'Argument of [mv_sort] must be [string], found value [booleanField] type [boolean]', - ] + 'from a_index | stats round(avg(doubleField)) + avg(doubleField)', + [] ); - - testErrorsAndWarnings('from a_index | eval var = mv_sort(booleanField, "asc")', []); - testErrorsAndWarnings('from a_index | eval mv_sort(booleanField, "asc")', []); - testErrorsAndWarnings('from a_index | eval var = mv_sort(dateField, "asc")', []); - testErrorsAndWarnings('from a_index | eval mv_sort(dateField, "asc")', []); - testErrorsAndWarnings('from a_index | eval var = mv_sort(numberField, "asc")', []); - testErrorsAndWarnings('from a_index | eval mv_sort(numberField, "asc")', []); - testErrorsAndWarnings('from a_index | eval var = mv_sort(ipField, "asc")', []); - testErrorsAndWarnings('from a_index | eval mv_sort(ipField, "asc")', []); - testErrorsAndWarnings('from a_index | eval var = mv_sort(versionField, "asc")', []); - testErrorsAndWarnings('from a_index | eval mv_sort(versionField, "asc")', []); - - testErrorsAndWarnings('from a_index | eval mv_sort(booleanField, "asc", extraArg)', [ - 'Error: [mv_sort] function expects no more than 2 arguments, got 3.', - ]); - - testErrorsAndWarnings('from a_index | sort mv_sort(booleanField, "asc")', []); - testErrorsAndWarnings('from a_index | eval mv_sort(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_sort(nullVar, nullVar)', []); - }); - - describe('mv_sum', () => { - testErrorsAndWarnings('row var = mv_sum(5)', []); - testErrorsAndWarnings('row mv_sum(5)', []); - testErrorsAndWarnings('row var = mv_sum(to_integer("a"))', []); - - testErrorsAndWarnings('row var = mv_sum("a")', [ - 'Argument of [mv_sum] must be [number], found value ["a"] type [string]', - ]); - - testErrorsAndWarnings('from a_index | where mv_sum(numberField) > 0', []); - - testErrorsAndWarnings('from a_index | where mv_sum(stringField) > 0', [ - 'Argument of [mv_sum] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval var = mv_sum(numberField)', []); - testErrorsAndWarnings('from a_index | eval mv_sum(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = mv_sum(to_integer(stringField))', []); - - testErrorsAndWarnings('from a_index | eval mv_sum(stringField)', [ - 'Argument of [mv_sum] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval mv_sum(numberField, extraArg)', [ - 'Error: [mv_sum] function expects exactly one argument, got 2.', - ]); - - testErrorsAndWarnings('from a_index | eval var = mv_sum(*)', [ - 'Using wildcards (*) in mv_sum is not allowed', - ]); - - testErrorsAndWarnings('from a_index | sort mv_sum(numberField)', []); - testErrorsAndWarnings('row var = mv_sum(to_integer(true))', []); - - testErrorsAndWarnings('row var = mv_sum(true)', [ - 'Argument of [mv_sum] must be [number], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where mv_sum(booleanField) > 0', [ - 'Argument of [mv_sum] must be [number], found value [booleanField] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | eval var = mv_sum(to_integer(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval mv_sum(booleanField)', [ - 'Argument of [mv_sum] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval mv_sum(null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_sum(nullVar)', []); - }); - - describe('mv_zip', () => { - testErrorsAndWarnings('row var = mv_zip("a", "a", "a")', []); - testErrorsAndWarnings('row var = mv_zip("a", "a")', []); - testErrorsAndWarnings('row mv_zip("a", "a", "a")', []); - testErrorsAndWarnings('row mv_zip("a", "a")', []); - + testErrorsAndWarnings('from a_index | stats var0 = avg(doubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), avg(doubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), var0 = avg(doubleField)', []); testErrorsAndWarnings( - 'row var = mv_zip(to_string("a"), to_string("a"), to_string("a"))', + 'from a_index | stats avg(doubleField) by round(doubleField / 2)', [] ); - testErrorsAndWarnings('row var = mv_zip(5, 5, 5)', [ - 'Argument of [mv_zip] must be [string], found value [5] type [number]', - 'Argument of [mv_zip] must be [string], found value [5] type [number]', - 'Argument of [mv_zip] must be [string], found value [5] type [number]', - ]); - testErrorsAndWarnings( - 'from a_index | where length(mv_zip(stringField, stringField, stringField)) > 0', + 'from a_index | stats var0 = avg(doubleField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | where length(mv_zip(numberField, numberField, numberField)) > 0', - [ - 'Argument of [mv_zip] must be [string], found value [numberField] type [number]', - 'Argument of [mv_zip] must be [string], found value [numberField] type [number]', - 'Argument of [mv_zip] must be [string], found value [numberField] type [number]', - ] + 'from a_index | stats avg(doubleField), avg(doubleField) by round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_zip(stringField, stringField, stringField)', + 'from a_index | stats avg(doubleField), var0 = avg(doubleField) by var1 = round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('from a_index | eval mv_zip(stringField, stringField)', []); - testErrorsAndWarnings( - 'from a_index | eval mv_zip(stringField, stringField, stringField)', + 'from a_index | stats avg(doubleField), avg(doubleField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_zip(to_string(stringField), to_string(stringField), to_string(stringField))', + 'from a_index | stats avg(doubleField), var0 = avg(doubleField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval mv_zip(numberField, numberField, numberField)', [ - 'Argument of [mv_zip] must be [string], found value [numberField] type [number]', - 'Argument of [mv_zip] must be [string], found value [numberField] type [number]', - 'Argument of [mv_zip] must be [string], found value [numberField] type [number]', - ]); + testErrorsAndWarnings('from a_index | stats var = avg(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | stats avg(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | stats var = round(avg(unsignedLongField))', []); + testErrorsAndWarnings('from a_index | stats round(avg(unsignedLongField))', []); testErrorsAndWarnings( - 'from a_index | eval mv_zip(stringField, stringField, stringField, extraArg)', - ['Error: [mv_zip] function expects no more than 3 arguments, got 4.'] + 'from a_index | stats var = round(avg(unsignedLongField)) + avg(unsignedLongField)', + [] ); testErrorsAndWarnings( - 'from a_index | sort mv_zip(stringField, stringField, stringField)', + 'from a_index | stats round(avg(unsignedLongField)) + avg(unsignedLongField)', [] ); + + testErrorsAndWarnings('from a_index | stats var0 = avg(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), avg(unsignedLongField)', []); testErrorsAndWarnings( - 'row var = mv_zip(to_string(true), to_string(true), to_string(true))', + 'from a_index | stats avg(doubleField), var0 = avg(unsignedLongField)', [] ); - testErrorsAndWarnings('row var = mv_zip(true, true, true)', [ - 'Argument of [mv_zip] must be [string], found value [true] type [boolean]', - 'Argument of [mv_zip] must be [string], found value [true] type [boolean]', - 'Argument of [mv_zip] must be [string], found value [true] type [boolean]', - ]); - testErrorsAndWarnings( - 'from a_index | where length(mv_zip(booleanField, booleanField, booleanField)) > 0', - [ - 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', - 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', - 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(unsignedLongField) by round(doubleField / 2)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField), to_string(booleanField))', + 'from a_index | stats var0 = avg(unsignedLongField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval mv_zip(booleanField, booleanField, booleanField)', - [ - 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', - 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', - 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(doubleField), avg(unsignedLongField) by round(doubleField / 2), ipField', + [] ); - testErrorsAndWarnings('from a_index | eval mv_zip(null, null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_zip(nullVar, nullVar, nullVar)', []); - testErrorsAndWarnings('row var = mv_zip(to_string(true), to_string(true))', []); + testErrorsAndWarnings( - 'from a_index | where length(mv_zip(stringField, stringField)) > 0', + 'from a_index | stats avg(doubleField), var0 = avg(unsignedLongField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | where length(mv_zip(booleanField, booleanField)) > 0', - [ - 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', - 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(doubleField), avg(unsignedLongField) by round(doubleField / 2), doubleField / 2', + [] ); - testErrorsAndWarnings('from a_index | eval var = mv_zip(stringField, stringField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField))', + 'from a_index | stats avg(doubleField), var0 = avg(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval mv_zip(booleanField, booleanField)', [ - 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', - 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | sort mv_zip(stringField, stringField)', []); - }); - - describe('now', () => { - testErrorsAndWarnings('row var = now()', []); - testErrorsAndWarnings('row now()', []); - testErrorsAndWarnings('from a_index | eval var = now()', []); - testErrorsAndWarnings('from a_index | eval now()', []); - - testErrorsAndWarnings('from a_index | eval now(extraArg)', [ - 'Error: [now] function expects exactly 0 arguments, got 1.', - ]); - - testErrorsAndWarnings('from a_index | sort now()', []); - testErrorsAndWarnings('row nullVar = null | eval now()', []); - }); - - describe('pi', () => { - testErrorsAndWarnings('row var = pi()', []); - testErrorsAndWarnings('row pi()', []); - testErrorsAndWarnings('from a_index | where pi() > 0', []); - testErrorsAndWarnings('from a_index | eval var = pi()', []); - testErrorsAndWarnings('from a_index | eval pi()', []); - - testErrorsAndWarnings('from a_index | eval pi(extraArg)', [ - 'Error: [pi] function expects exactly 0 arguments, got 1.', - ]); - - testErrorsAndWarnings('from a_index | sort pi()', []); - testErrorsAndWarnings('row nullVar = null | eval pi()', []); - }); - - describe('pow', () => { - testErrorsAndWarnings('row var = pow(5, 5)', []); - testErrorsAndWarnings('row pow(5, 5)', []); - testErrorsAndWarnings('row var = pow(to_integer("a"), to_integer("a"))', []); - - testErrorsAndWarnings('row var = pow("a", "a")', [ - 'Argument of [pow] must be [number], found value ["a"] type [string]', - 'Argument of [pow] must be [number], found value ["a"] type [string]', - ]); - - testErrorsAndWarnings('from a_index | where pow(numberField, numberField) > 0', []); - - testErrorsAndWarnings('from a_index | where pow(stringField, stringField) > 0', [ - 'Argument of [pow] must be [number], found value [stringField] type [string]', - 'Argument of [pow] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval var = pow(numberField, numberField)', []); - testErrorsAndWarnings('from a_index | eval pow(numberField, numberField)', []); - + testErrorsAndWarnings('from a_index | stats var = avg(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(longField)', []); + testErrorsAndWarnings('from a_index | stats var = round(avg(longField))', []); + testErrorsAndWarnings('from a_index | stats round(avg(longField))', []); testErrorsAndWarnings( - 'from a_index | eval var = pow(to_integer(stringField), to_integer(stringField))', + 'from a_index | stats var = round(avg(longField)) + avg(longField)', [] ); - - testErrorsAndWarnings('from a_index | eval pow(stringField, stringField)', [ - 'Argument of [pow] must be [number], found value [stringField] type [string]', - 'Argument of [pow] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval pow(numberField, numberField, extraArg)', [ - 'Error: [pow] function expects exactly 2 arguments, got 3.', - ]); - - testErrorsAndWarnings('from a_index | sort pow(numberField, numberField)', []); - testErrorsAndWarnings('row var = pow(to_integer(true), to_integer(true))', []); - - testErrorsAndWarnings('row var = pow(true, true)', [ - 'Argument of [pow] must be [number], found value [true] type [boolean]', - 'Argument of [pow] must be [number], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where pow(booleanField, booleanField) > 0', [ - 'Argument of [pow] must be [number], found value [booleanField] type [boolean]', - 'Argument of [pow] must be [number], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | stats round(avg(longField)) + avg(longField)', []); + testErrorsAndWarnings('from a_index | stats var0 = avg(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), avg(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), var0 = avg(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(longField) by round(doubleField / 2)', []); testErrorsAndWarnings( - 'from a_index | eval var = pow(to_integer(booleanField), to_integer(booleanField))', + 'from a_index | stats var0 = avg(longField) by var1 = round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | eval pow(booleanField, booleanField)', [ - 'Argument of [pow] must be [number], found value [booleanField] type [boolean]', - 'Argument of [pow] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval pow(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval pow(nullVar, nullVar)', []); - }); - - describe('replace', () => { - testErrorsAndWarnings('row var = replace("a", "a", "a")', []); - testErrorsAndWarnings('row replace("a", "a", "a")', []); - testErrorsAndWarnings( - 'row var = replace(to_string("a"), to_string("a"), to_string("a"))', + 'from a_index | stats avg(doubleField), avg(longField) by round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('row var = replace(5, 5, 5)', [ - 'Argument of [replace] must be [string], found value [5] type [number]', - 'Argument of [replace] must be [string], found value [5] type [number]', - 'Argument of [replace] must be [string], found value [5] type [number]', - ]); - testErrorsAndWarnings( - 'from a_index | where length(replace(stringField, stringField, stringField)) > 0', + 'from a_index | stats avg(doubleField), var0 = avg(longField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | where length(replace(numberField, numberField, numberField)) > 0', - [ - 'Argument of [replace] must be [string], found value [numberField] type [number]', - 'Argument of [replace] must be [string], found value [numberField] type [number]', - 'Argument of [replace] must be [string], found value [numberField] type [number]', - ] + 'from a_index | stats avg(doubleField), avg(longField) by round(doubleField / 2), doubleField / 2', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = replace(stringField, stringField, stringField)', + 'from a_index | stats avg(doubleField), var0 = avg(longField) by var1 = round(doubleField / 2), doubleField / 2', [] ); + testErrorsAndWarnings('from a_index | stats var = avg(counterLongField)', []); + testErrorsAndWarnings('from a_index | stats avg(counterLongField)', []); + testErrorsAndWarnings('from a_index | stats var = round(avg(counterLongField))', []); + testErrorsAndWarnings('from a_index | stats round(avg(counterLongField))', []); + testErrorsAndWarnings( - 'from a_index | eval replace(stringField, stringField, stringField)', + 'from a_index | stats var = round(avg(counterLongField)) + avg(counterLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = replace(to_string(stringField), to_string(stringField), to_string(stringField))', + 'from a_index | stats round(avg(counterLongField)) + avg(counterLongField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = avg(counterLongField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), avg(counterLongField)', []); testErrorsAndWarnings( - 'from a_index | eval replace(numberField, numberField, numberField)', - [ - 'Argument of [replace] must be [string], found value [numberField] type [number]', - 'Argument of [replace] must be [string], found value [numberField] type [number]', - 'Argument of [replace] must be [string], found value [numberField] type [number]', - ] + 'from a_index | stats avg(doubleField), var0 = avg(counterLongField)', + [] ); - testErrorsAndWarnings( - 'from a_index | eval replace(stringField, stringField, stringField, extraArg)', - ['Error: [replace] function expects exactly 3 arguments, got 4.'] + 'from a_index | stats avg(counterLongField) by round(doubleField / 2)', + [] ); testErrorsAndWarnings( - 'from a_index | sort replace(stringField, stringField, stringField)', + 'from a_index | stats var0 = avg(counterLongField) by var1 = round(doubleField / 2)', [] ); + testErrorsAndWarnings( - 'row var = replace(to_string(true), to_string(true), to_string(true))', + 'from a_index | stats avg(doubleField), avg(counterLongField) by round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('row var = replace(true, true, true)', [ - 'Argument of [replace] must be [string], found value [true] type [boolean]', - 'Argument of [replace] must be [string], found value [true] type [boolean]', - 'Argument of [replace] must be [string], found value [true] type [boolean]', - ]); - testErrorsAndWarnings( - 'from a_index | where length(replace(booleanField, booleanField, booleanField)) > 0', - [ - 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', - 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', - 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(doubleField), var0 = avg(counterLongField) by var1 = round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = replace(to_string(booleanField), to_string(booleanField), to_string(booleanField))', + 'from a_index | stats avg(doubleField), avg(counterLongField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval replace(booleanField, booleanField, booleanField)', - [ - 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', - 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', - 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(doubleField), var0 = avg(counterLongField) by var1 = round(doubleField / 2), doubleField / 2', + [] ); - testErrorsAndWarnings('from a_index | eval replace(null, null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval replace(nullVar, nullVar, nullVar)', []); - }); - describe('right', () => { - testErrorsAndWarnings('row var = right("a", 5)', []); - testErrorsAndWarnings('row right("a", 5)', []); - testErrorsAndWarnings('row var = right(to_string("a"), to_integer("a"))', []); - - testErrorsAndWarnings('row var = right(5, "a")', [ - 'Argument of [right] must be [string], found value [5] type [number]', - 'Argument of [right] must be [number], found value ["a"] type [string]', - ]); + testErrorsAndWarnings('from a_index | stats var = avg(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | stats var = round(avg(counterDoubleField))', []); + testErrorsAndWarnings('from a_index | stats round(avg(counterDoubleField))', []); testErrorsAndWarnings( - 'from a_index | where length(right(stringField, numberField)) > 0', + 'from a_index | stats var = round(avg(counterDoubleField)) + avg(counterDoubleField)', [] ); - testErrorsAndWarnings('from a_index | where length(right(numberField, stringField)) > 0', [ - 'Argument of [right] must be [string], found value [numberField] type [number]', - 'Argument of [right] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval var = right(stringField, numberField)', []); - testErrorsAndWarnings('from a_index | eval right(stringField, numberField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = right(to_string(stringField), to_integer(stringField))', + 'from a_index | stats round(avg(counterDoubleField)) + avg(counterDoubleField)', [] ); - testErrorsAndWarnings('from a_index | eval right(numberField, stringField)', [ - 'Argument of [right] must be [string], found value [numberField] type [number]', - 'Argument of [right] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval right(stringField, numberField, extraArg)', [ - 'Error: [right] function expects exactly 2 arguments, got 3.', - ]); - - testErrorsAndWarnings('from a_index | sort right(stringField, numberField)', []); - testErrorsAndWarnings('row var = right(to_string(true), to_integer(true))', []); - - testErrorsAndWarnings('row var = right(true, true)', [ - 'Argument of [right] must be [string], found value [true] type [boolean]', - 'Argument of [right] must be [number], found value [true] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | stats var0 = avg(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), avg(counterDoubleField)', []); testErrorsAndWarnings( - 'from a_index | where length(right(booleanField, booleanField)) > 0', - [ - 'Argument of [right] must be [string], found value [booleanField] type [boolean]', - 'Argument of [right] must be [number], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(doubleField), var0 = avg(counterDoubleField)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = right(to_string(booleanField), to_integer(booleanField))', + 'from a_index | stats avg(counterDoubleField) by round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | eval right(booleanField, booleanField)', [ - 'Argument of [right] must be [string], found value [booleanField] type [boolean]', - 'Argument of [right] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval right(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval right(nullVar, nullVar)', []); - }); - - describe('round', () => { - testErrorsAndWarnings('row var = round(5, 5)', []); - testErrorsAndWarnings('row round(5, 5)', []); - testErrorsAndWarnings('row var = round(to_integer("a"), to_integer("a"))', []); - - testErrorsAndWarnings('row var = round("a", "a")', [ - 'Argument of [round] must be [number], found value ["a"] type [string]', - 'Argument of [round] must be [number], found value ["a"] type [string]', - ]); - - testErrorsAndWarnings('from a_index | where round(numberField, numberField) > 0', []); - - testErrorsAndWarnings('from a_index | where round(stringField, stringField) > 0', [ - 'Argument of [round] must be [number], found value [stringField] type [string]', - 'Argument of [round] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval var = round(numberField, numberField)', []); - testErrorsAndWarnings('from a_index | eval round(numberField, numberField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = round(to_integer(stringField), to_integer(stringField))', + 'from a_index | stats var0 = avg(counterDoubleField) by var1 = round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | eval round(stringField, stringField)', [ - 'Argument of [round] must be [number], found value [stringField] type [string]', - 'Argument of [round] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval round(numberField, numberField, extraArg)', [ - 'Error: [round] function expects no more than 2 arguments, got 3.', - ]); - - testErrorsAndWarnings('from a_index | sort round(numberField, numberField)', []); - testErrorsAndWarnings('row var = round(5)', []); - testErrorsAndWarnings('row round(5)', []); - testErrorsAndWarnings('row var = round(to_integer(true))', []); - testErrorsAndWarnings('row var = round(to_integer(true), to_integer(true))', []); - - testErrorsAndWarnings('row var = round(true, true)', [ - 'Argument of [round] must be [number], found value [true] type [boolean]', - 'Argument of [round] must be [number], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where round(numberField) > 0', []); - - testErrorsAndWarnings('from a_index | where round(booleanField) > 0', [ - 'Argument of [round] must be [number], found value [booleanField] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where round(booleanField, booleanField) > 0', [ - 'Argument of [round] must be [number], found value [booleanField] type [boolean]', - 'Argument of [round] must be [number], found value [booleanField] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | eval var = round(numberField)', []); - testErrorsAndWarnings('from a_index | eval round(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = round(to_integer(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval round(booleanField)', [ - 'Argument of [round] must be [number], found value [booleanField] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | eval var = round(*)', [ - 'Using wildcards (*) in round is not allowed', - ]); - testErrorsAndWarnings( - 'from a_index | eval var = round(to_integer(booleanField), to_integer(booleanField))', + 'from a_index | stats avg(doubleField), avg(counterDoubleField) by round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('from a_index | eval round(booleanField, booleanField)', [ - 'Argument of [round] must be [number], found value [booleanField] type [boolean]', - 'Argument of [round] must be [number], found value [booleanField] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | sort round(numberField)', []); - testErrorsAndWarnings('from a_index | eval round(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval round(nullVar, nullVar)', []); - }); - - describe('rtrim', () => { - testErrorsAndWarnings('row var = rtrim("a")', []); - testErrorsAndWarnings('row rtrim("a")', []); - testErrorsAndWarnings('row var = rtrim(to_string("a"))', []); - - testErrorsAndWarnings('row var = rtrim(5)', [ - 'Argument of [rtrim] must be [string], found value [5] type [number]', - ]); - - testErrorsAndWarnings('from a_index | where length(rtrim(stringField)) > 0', []); - - testErrorsAndWarnings('from a_index | where length(rtrim(numberField)) > 0', [ - 'Argument of [rtrim] must be [string], found value [numberField] type [number]', - ]); - - testErrorsAndWarnings('from a_index | eval var = rtrim(stringField)', []); - testErrorsAndWarnings('from a_index | eval rtrim(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = rtrim(to_string(stringField))', []); - - testErrorsAndWarnings('from a_index | eval rtrim(numberField)', [ - 'Argument of [rtrim] must be [string], found value [numberField] type [number]', - ]); - - testErrorsAndWarnings('from a_index | eval rtrim(stringField, extraArg)', [ - 'Error: [rtrim] function expects exactly one argument, got 2.', - ]); - - testErrorsAndWarnings('from a_index | eval var = rtrim(*)', [ - 'Using wildcards (*) in rtrim is not allowed', - ]); - - testErrorsAndWarnings('from a_index | sort rtrim(stringField)', []); - testErrorsAndWarnings('row var = rtrim(to_string(true))', []); - - testErrorsAndWarnings('row var = rtrim(true)', [ - 'Argument of [rtrim] must be [string], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where length(rtrim(booleanField)) > 0', [ - 'Argument of [rtrim] must be [string], found value [booleanField] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | eval var = rtrim(to_string(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval rtrim(booleanField)', [ - 'Argument of [rtrim] must be [string], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval rtrim(null)', []); - testErrorsAndWarnings('row nullVar = null | eval rtrim(nullVar)', []); - }); - - describe('signum', () => { - testErrorsAndWarnings('row var = signum(5)', []); - testErrorsAndWarnings('row signum(5)', []); - testErrorsAndWarnings('row var = signum(to_integer("a"))', []); - - testErrorsAndWarnings('row var = signum("a")', [ - 'Argument of [signum] must be [number], found value ["a"] type [string]', - ]); - - testErrorsAndWarnings('from a_index | where signum(numberField) > 0', []); - - testErrorsAndWarnings('from a_index | where signum(stringField) > 0', [ - 'Argument of [signum] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | eval var = signum(numberField)', []); - testErrorsAndWarnings('from a_index | eval signum(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = signum(to_integer(stringField))', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = avg(counterDoubleField) by var1 = round(doubleField / 2), ipField', + [] + ); - testErrorsAndWarnings('from a_index | eval signum(stringField)', [ - 'Argument of [signum] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), avg(counterDoubleField) by round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('from a_index | eval signum(numberField, extraArg)', [ - 'Error: [signum] function expects exactly one argument, got 2.', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = avg(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('from a_index | eval var = signum(*)', [ - 'Using wildcards (*) in signum is not allowed', + testErrorsAndWarnings('from a_index | sort avg(integerField)', [ + 'SORT does not support function avg', ]); - testErrorsAndWarnings('from a_index | sort signum(numberField)', []); - testErrorsAndWarnings('row var = signum(to_integer(true))', []); - - testErrorsAndWarnings('row var = signum(true)', [ - 'Argument of [signum] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | where avg(integerField)', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | where signum(booleanField) > 0', [ - 'Argument of [signum] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | where avg(integerField) > 0', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = signum(to_integer(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval signum(booleanField)', [ - 'Argument of [signum] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | where avg(counterIntegerField)', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval signum(null)', []); - testErrorsAndWarnings('row nullVar = null | eval signum(nullVar)', []); - }); - - describe('sin', () => { - testErrorsAndWarnings('row var = sin(5)', []); - testErrorsAndWarnings('row sin(5)', []); - testErrorsAndWarnings('row var = sin(to_integer("a"))', []); - testErrorsAndWarnings('row var = sin("a")', [ - 'Argument of [sin] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | where avg(counterIntegerField) > 0', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | where sin(numberField) > 0', []); - - testErrorsAndWarnings('from a_index | where sin(stringField) > 0', [ - 'Argument of [sin] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where avg(doubleField)', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = sin(numberField)', []); - testErrorsAndWarnings('from a_index | eval sin(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = sin(to_integer(stringField))', []); - - testErrorsAndWarnings('from a_index | eval sin(stringField)', [ - 'Argument of [sin] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where avg(doubleField) > 0', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval sin(numberField, extraArg)', [ - 'Error: [sin] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | where avg(unsignedLongField)', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = sin(*)', [ - 'Using wildcards (*) in sin is not allowed', + testErrorsAndWarnings('from a_index | where avg(unsignedLongField) > 0', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | sort sin(numberField)', []); - testErrorsAndWarnings('row var = sin(to_integer(true))', []); - - testErrorsAndWarnings('row var = sin(true)', [ - 'Argument of [sin] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | where avg(longField)', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | where sin(booleanField) > 0', [ - 'Argument of [sin] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | where avg(longField) > 0', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = sin(to_integer(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval sin(booleanField)', [ - 'Argument of [sin] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | where avg(counterLongField)', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval sin(null)', []); - testErrorsAndWarnings('row nullVar = null | eval sin(nullVar)', []); - }); - - describe('sinh', () => { - testErrorsAndWarnings('row var = sinh(5)', []); - testErrorsAndWarnings('row sinh(5)', []); - testErrorsAndWarnings('row var = sinh(to_integer("a"))', []); - testErrorsAndWarnings('row var = sinh("a")', [ - 'Argument of [sinh] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | where avg(counterLongField) > 0', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | where sinh(numberField) > 0', []); - - testErrorsAndWarnings('from a_index | where sinh(stringField) > 0', [ - 'Argument of [sinh] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where avg(counterDoubleField)', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = sinh(numberField)', []); - testErrorsAndWarnings('from a_index | eval sinh(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = sinh(to_integer(stringField))', []); - - testErrorsAndWarnings('from a_index | eval sinh(stringField)', [ - 'Argument of [sinh] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where avg(counterDoubleField) > 0', [ + 'WHERE does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval sinh(numberField, extraArg)', [ - 'Error: [sinh] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval var = avg(integerField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = sinh(*)', [ - 'Using wildcards (*) in sinh is not allowed', + testErrorsAndWarnings('from a_index | eval var = avg(integerField) > 0', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | sort sinh(numberField)', []); - testErrorsAndWarnings('row var = sinh(to_integer(true))', []); - - testErrorsAndWarnings('row var = sinh(true)', [ - 'Argument of [sinh] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval avg(integerField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | where sinh(booleanField) > 0', [ - 'Argument of [sinh] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval avg(integerField) > 0', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = sinh(to_integer(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval sinh(booleanField)', [ - 'Argument of [sinh] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = avg(counterIntegerField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval sinh(null)', []); - testErrorsAndWarnings('row nullVar = null | eval sinh(nullVar)', []); - }); - - describe('split', () => { - testErrorsAndWarnings('row var = split("a", "a")', []); - testErrorsAndWarnings('row split("a", "a")', []); - testErrorsAndWarnings('row var = split(to_string("a"), to_string("a"))', []); - testErrorsAndWarnings('row var = split(5, 5)', [ - 'Argument of [split] must be [string], found value [5] type [number]', - 'Argument of [split] must be [string], found value [5] type [number]', + testErrorsAndWarnings('from a_index | eval var = avg(counterIntegerField) > 0', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings( - 'from a_index | where length(split(stringField, stringField)) > 0', - [] - ); - - testErrorsAndWarnings('from a_index | where length(split(numberField, numberField)) > 0', [ - 'Argument of [split] must be [string], found value [numberField] type [number]', - 'Argument of [split] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('from a_index | eval avg(counterIntegerField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = split(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval split(stringField, stringField)', []); - - testErrorsAndWarnings( - 'from a_index | eval var = split(to_string(stringField), to_string(stringField))', - [] - ); - - testErrorsAndWarnings('from a_index | eval split(numberField, numberField)', [ - 'Argument of [split] must be [string], found value [numberField] type [number]', - 'Argument of [split] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('from a_index | eval avg(counterIntegerField) > 0', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval split(stringField, stringField, extraArg)', [ - 'Error: [split] function expects exactly 2 arguments, got 3.', + testErrorsAndWarnings('from a_index | eval var = avg(doubleField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | sort split(stringField, stringField)', []); - testErrorsAndWarnings('row var = split(to_string(true), to_string(true))', []); - - testErrorsAndWarnings('row var = split(true, true)', [ - 'Argument of [split] must be [string], found value [true] type [boolean]', - 'Argument of [split] must be [string], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = avg(doubleField) > 0', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings( - 'from a_index | where length(split(booleanField, booleanField)) > 0', - [ - 'Argument of [split] must be [string], found value [booleanField] type [boolean]', - 'Argument of [split] must be [string], found value [booleanField] type [boolean]', - ] - ); - - testErrorsAndWarnings( - 'from a_index | eval var = split(to_string(booleanField), to_string(booleanField))', - [] - ); - - testErrorsAndWarnings('from a_index | eval split(booleanField, booleanField)', [ - 'Argument of [split] must be [string], found value [booleanField] type [boolean]', - 'Argument of [split] must be [string], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval avg(doubleField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval split(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval split(nullVar, nullVar)', []); - }); - describe('sqrt', () => { - testErrorsAndWarnings('row var = sqrt(5)', []); - testErrorsAndWarnings('row sqrt(5)', []); - testErrorsAndWarnings('row var = sqrt(to_integer("a"))', []); + testErrorsAndWarnings('from a_index | eval avg(doubleField) > 0', [ + 'EVAL does not support function avg', + ]); - testErrorsAndWarnings('row var = sqrt("a")', [ - 'Argument of [sqrt] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | eval var = avg(unsignedLongField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | where sqrt(numberField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = avg(unsignedLongField) > 0', [ + 'EVAL does not support function avg', + ]); - testErrorsAndWarnings('from a_index | where sqrt(stringField) > 0', [ - 'Argument of [sqrt] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval avg(unsignedLongField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = sqrt(numberField)', []); - testErrorsAndWarnings('from a_index | eval sqrt(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = sqrt(to_integer(stringField))', []); + testErrorsAndWarnings('from a_index | eval avg(unsignedLongField) > 0', [ + 'EVAL does not support function avg', + ]); - testErrorsAndWarnings('from a_index | eval sqrt(stringField)', [ - 'Argument of [sqrt] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval var = avg(longField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval sqrt(numberField, extraArg)', [ - 'Error: [sqrt] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval var = avg(longField) > 0', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = sqrt(*)', [ - 'Using wildcards (*) in sqrt is not allowed', + testErrorsAndWarnings('from a_index | eval avg(longField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | sort sqrt(numberField)', []); - testErrorsAndWarnings('row var = sqrt(to_integer(true))', []); + testErrorsAndWarnings('from a_index | eval avg(longField) > 0', [ + 'EVAL does not support function avg', + ]); - testErrorsAndWarnings('row var = sqrt(true)', [ - 'Argument of [sqrt] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = avg(counterLongField)', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | where sqrt(booleanField) > 0', [ - 'Argument of [sqrt] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = avg(counterLongField) > 0', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval var = sqrt(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval avg(counterLongField)', [ + 'EVAL does not support function avg', + ]); - testErrorsAndWarnings('from a_index | eval sqrt(booleanField)', [ - 'Argument of [sqrt] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval avg(counterLongField) > 0', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings('from a_index | eval sqrt(null)', []); - testErrorsAndWarnings('row nullVar = null | eval sqrt(nullVar)', []); - }); - describe('st_contains', () => { - testErrorsAndWarnings( - 'row var = st_contains(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', - [] - ); + testErrorsAndWarnings('from a_index | eval var = avg(counterDoubleField)', [ + 'EVAL does not support function avg', + ]); - testErrorsAndWarnings( - 'row st_contains(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', - [] - ); + testErrorsAndWarnings('from a_index | eval var = avg(counterDoubleField) > 0', [ + 'EVAL does not support function avg', + ]); - testErrorsAndWarnings('row var = st_contains(to_geopoint("a"), to_geopoint("a"))', []); + testErrorsAndWarnings('from a_index | eval avg(counterDoubleField)', [ + 'EVAL does not support function avg', + ]); - testErrorsAndWarnings('row var = st_contains("a", "a")', [ - 'Argument of [st_contains] must be [cartesian_point], found value ["a"] type [string]', - 'Argument of [st_contains] must be [cartesian_point], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | eval avg(counterDoubleField) > 0', [ + 'EVAL does not support function avg', ]); - testErrorsAndWarnings( - 'row var = st_contains(to_geopoint("POINT (30 10)"), to_geoshape("POINT (30 10)"))', - [] - ); + testErrorsAndWarnings('from a_index | stats avg(null)', []); + testErrorsAndWarnings('row nullVar = null | stats avg(nullVar)', []); + }); + + describe('sum', () => { + testErrorsAndWarnings('from a_index | stats var = sum(integerField)', []); + testErrorsAndWarnings('from a_index | stats sum(integerField)', []); + testErrorsAndWarnings('from a_index | stats var = round(sum(integerField))', []); + testErrorsAndWarnings('from a_index | stats round(sum(integerField))', []); testErrorsAndWarnings( - 'row st_contains(to_geopoint("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats var = round(sum(integerField)) + sum(integerField)', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_geopoint("a"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats round(sum(integerField)) + sum(integerField)', [] ); - + testErrorsAndWarnings('from a_index | stats sum(doubleField / 2)', []); + testErrorsAndWarnings('from a_index | stats var0 = sum(doubleField / 2)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), sum(doubleField / 2)', []); testErrorsAndWarnings( - 'row var = st_contains(to_geoshape("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = sum(doubleField / 2)', [] ); - + testErrorsAndWarnings('from a_index | stats var0 = sum(integerField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), sum(integerField)', []); testErrorsAndWarnings( - 'row st_contains(to_geoshape("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = sum(integerField)', [] ); - testErrorsAndWarnings( - 'row var = st_contains(to_geoshape("POINT (30 10)"), to_geopoint("a"))', + 'from a_index | stats sum(integerField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats var0 = sum(integerField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row st_contains(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), sum(integerField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = sum(integerField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row st_contains(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), sum(integerField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_cartesianpoint("a"), to_cartesianpoint("a"))', + 'from a_index | stats avg(doubleField), var0 = sum(integerField) by var1 = round(doubleField / 2), doubleField / 2', [] ); + testErrorsAndWarnings('from a_index | stats var = sum(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ]); + + testErrorsAndWarnings('from a_index | stats sum(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ]); + + testErrorsAndWarnings('from a_index | stats sum(booleanField)', [ + 'Argument of [sum] must be [integer], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | stats var = sum(*)', [ + 'Using wildcards (*) in sum is not allowed', + ]); + + testErrorsAndWarnings('from a_index | stats var = sum(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | stats sum(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | stats var = round(sum(counterIntegerField))', []); + testErrorsAndWarnings('from a_index | stats round(sum(counterIntegerField))', []); + testErrorsAndWarnings( - 'row var = st_contains(to_cartesianpoint("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats var = round(sum(counterIntegerField)) + sum(counterIntegerField)', [] ); testErrorsAndWarnings( - 'row st_contains(to_cartesianpoint("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats round(sum(counterIntegerField)) + sum(counterIntegerField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = sum(counterIntegerField)', []); testErrorsAndWarnings( - 'row var = st_contains(to_cartesianpoint("a"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), sum(counterIntegerField)', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = sum(counterIntegerField)', [] ); testErrorsAndWarnings( - 'row st_contains(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats sum(counterIntegerField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("a"))', + 'from a_index | stats var0 = sum(counterIntegerField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), sum(counterIntegerField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row st_contains(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = sum(counterIntegerField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(geoPointField, geoPointField)', + 'from a_index | stats avg(doubleField), sum(counterIntegerField) by round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval st_contains(geoPointField, geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_geopoint(stringField), to_geopoint(stringField))', + 'from a_index | stats avg(doubleField), var0 = sum(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval st_contains(stringField, stringField)', [ - 'Argument of [st_contains] must be [cartesian_point], found value [stringField] type [string]', - 'Argument of [st_contains] must be [cartesian_point], found value [stringField] type [string]', - ]); + testErrorsAndWarnings('from a_index | stats var = sum(doubleField)', []); + testErrorsAndWarnings('from a_index | stats sum(doubleField)', []); + testErrorsAndWarnings('from a_index | stats var = round(sum(doubleField))', []); + testErrorsAndWarnings('from a_index | stats round(sum(doubleField))', []); testErrorsAndWarnings( - 'from a_index | eval st_contains(geoPointField, geoPointField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats var = round(sum(doubleField)) + sum(doubleField)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(geoPointField, geoShapeField)', + 'from a_index | stats round(sum(doubleField)) + sum(doubleField)', [] ); - testErrorsAndWarnings('from a_index | eval st_contains(geoPointField, geoShapeField)', []); - + testErrorsAndWarnings('from a_index | stats var0 = sum(doubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), sum(doubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), var0 = sum(doubleField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_geopoint(stringField), geoShapeField)', + 'from a_index | stats sum(doubleField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(geoPointField, geoShapeField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats var0 = sum(doubleField) by var1 = round(doubleField / 2)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(geoShapeField, geoPointField)', + 'from a_index | stats avg(doubleField), sum(doubleField) by round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('from a_index | eval st_contains(geoShapeField, geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(geoShapeField, to_geopoint(stringField))', + 'from a_index | stats avg(doubleField), var0 = sum(doubleField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(geoShapeField, geoPointField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), sum(doubleField) by round(doubleField / 2), doubleField / 2', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(geoShapeField, geoShapeField)', + 'from a_index | stats avg(doubleField), var0 = sum(doubleField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval st_contains(geoShapeField, geoShapeField)', []); - testErrorsAndWarnings( - 'from a_index | eval st_contains(geoShapeField, geoShapeField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] - ); + testErrorsAndWarnings('from a_index | stats var = sum(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | stats sum(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | stats var = round(sum(unsignedLongField))', []); + testErrorsAndWarnings('from a_index | stats round(sum(unsignedLongField))', []); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(cartesianPointField, cartesianPointField)', + 'from a_index | stats var = round(sum(unsignedLongField)) + sum(unsignedLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianPointField, cartesianPointField)', + 'from a_index | stats round(sum(unsignedLongField)) + sum(unsignedLongField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = sum(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), sum(unsignedLongField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_cartesianpoint(stringField), to_cartesianpoint(stringField))', + 'from a_index | stats avg(doubleField), var0 = sum(unsignedLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianPointField, cartesianPointField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats sum(unsignedLongField) by round(doubleField / 2)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(cartesianPointField, cartesianShapeField)', + 'from a_index | stats var0 = sum(unsignedLongField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianPointField, cartesianShapeField)', + 'from a_index | stats avg(doubleField), sum(unsignedLongField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_cartesianpoint(stringField), cartesianShapeField)', + 'from a_index | stats avg(doubleField), var0 = sum(unsignedLongField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianPointField, cartesianShapeField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), sum(unsignedLongField) by round(doubleField / 2), doubleField / 2', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(cartesianShapeField, cartesianPointField)', + 'from a_index | stats avg(doubleField), var0 = sum(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2', [] ); + testErrorsAndWarnings('from a_index | stats var = sum(longField)', []); + testErrorsAndWarnings('from a_index | stats sum(longField)', []); + testErrorsAndWarnings('from a_index | stats var = round(sum(longField))', []); + testErrorsAndWarnings('from a_index | stats round(sum(longField))', []); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianShapeField, cartesianPointField)', + 'from a_index | stats var = round(sum(longField)) + sum(longField)', [] ); + testErrorsAndWarnings('from a_index | stats round(sum(longField)) + sum(longField)', []); + testErrorsAndWarnings('from a_index | stats var0 = sum(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), sum(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), var0 = sum(longField)', []); + testErrorsAndWarnings('from a_index | stats sum(longField) by round(doubleField / 2)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(cartesianShapeField, to_cartesianpoint(stringField))', + 'from a_index | stats var0 = sum(longField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianShapeField, cartesianPointField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), sum(longField) by round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(cartesianShapeField, cartesianShapeField)', + 'from a_index | stats avg(doubleField), var0 = sum(longField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianShapeField, cartesianShapeField)', + 'from a_index | stats avg(doubleField), sum(longField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianShapeField, cartesianShapeField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), var0 = sum(longField) by var1 = round(doubleField / 2), doubleField / 2', + [] ); - testErrorsAndWarnings('from a_index | sort st_contains(geoPointField, geoPointField)', []); + testErrorsAndWarnings('from a_index | stats var = sum(counterLongField)', []); + testErrorsAndWarnings('from a_index | stats sum(counterLongField)', []); + testErrorsAndWarnings('from a_index | stats var = round(sum(counterLongField))', []); + testErrorsAndWarnings('from a_index | stats round(sum(counterLongField))', []); testErrorsAndWarnings( - 'row var = st_contains(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats var = round(sum(counterLongField)) + sum(counterLongField)', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats round(sum(counterLongField)) + sum(counterLongField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = sum(counterLongField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), sum(counterLongField)', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = sum(counterLongField)', + [] + ); testErrorsAndWarnings( - 'row var = st_contains(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats sum(counterLongField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats var0 = sum(counterLongField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), sum(counterLongField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_geopoint(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), var0 = sum(counterLongField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_geoshape(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), sum(counterLongField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'row var = st_contains(to_geoshape(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), var0 = sum(counterLongField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('row var = st_contains(true, true)', [ - 'Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]', - 'Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | stats var = sum(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | stats sum(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | stats var = round(sum(counterDoubleField))', []); + testErrorsAndWarnings('from a_index | stats round(sum(counterDoubleField))', []); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + 'from a_index | stats var = round(sum(counterDoubleField)) + sum(counterDoubleField)', [] ); - testErrorsAndWarnings('from a_index | eval st_contains(booleanField, booleanField)', [ - 'Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]', - 'Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + 'from a_index | stats round(sum(counterDoubleField)) + sum(counterDoubleField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = sum(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), sum(counterDoubleField)', []); + testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + 'from a_index | stats avg(doubleField), var0 = sum(counterDoubleField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + 'from a_index | stats sum(counterDoubleField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geopoint(geoPointField))', + 'from a_index | stats var0 = sum(counterDoubleField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geoshape(geoPointField))', + 'from a_index | stats avg(doubleField), sum(counterDoubleField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geopoint(geoPointField))', + 'from a_index | stats avg(doubleField), var0 = sum(counterDoubleField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geoshape(geoPointField))', + 'from a_index | stats avg(doubleField), sum(counterDoubleField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | sort st_contains(cartesianPointField, cartesianPointField)', + 'from a_index | stats avg(doubleField), var0 = sum(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval st_contains(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval st_contains(nullVar, nullVar)', []); + + testErrorsAndWarnings('from a_index | sort sum(integerField)', [ + 'SORT does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(integerField)', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(integerField) > 0', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(counterIntegerField)', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(counterIntegerField) > 0', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(doubleField)', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(doubleField) > 0', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(unsignedLongField)', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(unsignedLongField) > 0', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(longField)', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(longField) > 0', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(counterLongField)', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(counterLongField) > 0', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(counterDoubleField)', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | where sum(counterDoubleField) > 0', [ + 'WHERE does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(integerField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(integerField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(integerField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(integerField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(counterIntegerField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(counterIntegerField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(counterIntegerField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(counterIntegerField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(doubleField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(doubleField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(doubleField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(doubleField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(unsignedLongField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(unsignedLongField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(unsignedLongField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(unsignedLongField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(longField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(longField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(longField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(longField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(counterLongField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(counterLongField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(counterLongField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(counterLongField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(counterDoubleField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval var = sum(counterDoubleField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(counterDoubleField)', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | eval sum(counterDoubleField) > 0', [ + 'EVAL does not support function sum', + ]); + + testErrorsAndWarnings('from a_index | stats sum(null)', []); + testErrorsAndWarnings('row nullVar = null | stats sum(nullVar)', []); }); - describe('st_disjoint', () => { + describe('median', () => { + testErrorsAndWarnings('from a_index | stats var = median(integerField)', []); + testErrorsAndWarnings('from a_index | stats median(integerField)', []); + testErrorsAndWarnings('from a_index | stats var = round(median(integerField))', []); + testErrorsAndWarnings('from a_index | stats round(median(integerField))', []); + testErrorsAndWarnings( - 'row var = st_disjoint(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats var = round(median(integerField)) + median(integerField)', [] ); testErrorsAndWarnings( - 'row st_disjoint(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats round(median(integerField)) + median(integerField)', [] ); - testErrorsAndWarnings('row var = st_disjoint(to_geopoint("a"), to_geopoint("a"))', []); - - testErrorsAndWarnings('row var = st_disjoint("a", "a")', [ - 'Argument of [st_disjoint] must be [cartesian_point], found value ["a"] type [string]', - 'Argument of [st_disjoint] must be [cartesian_point], found value ["a"] type [string]', - ]); + testErrorsAndWarnings('from a_index | stats median(doubleField / 2)', []); + testErrorsAndWarnings('from a_index | stats var0 = median(doubleField / 2)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), median(doubleField / 2)', []); testErrorsAndWarnings( - 'row var = st_disjoint(to_geopoint("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median(doubleField / 2)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = median(integerField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), median(integerField)', []); testErrorsAndWarnings( - 'row st_disjoint(to_geopoint("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median(integerField)', [] ); - testErrorsAndWarnings( - 'row var = st_disjoint(to_geopoint("a"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats median(integerField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_geoshape("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats var0 = median(integerField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row st_disjoint(to_geoshape("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median(integerField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_geoshape("POINT (30 10)"), to_geopoint("a"))', + 'from a_index | stats avg(doubleField), var0 = median(integerField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median(integerField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'row st_disjoint(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median(integerField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', - [] - ); + testErrorsAndWarnings('from a_index | stats var = median(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ]); - testErrorsAndWarnings( - 'row st_disjoint(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', - [] - ); + testErrorsAndWarnings('from a_index | stats median(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ]); - testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianpoint("a"), to_cartesianpoint("a"))', - [] - ); + testErrorsAndWarnings('from a_index | stats median(booleanField)', [ + 'Argument of [median] must be [integer], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | stats var = median(*)', [ + 'Using wildcards (*) in median is not allowed', + ]); + + testErrorsAndWarnings('from a_index | stats var = median(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | stats median(counterIntegerField)', []); + testErrorsAndWarnings('from a_index | stats var = round(median(counterIntegerField))', []); + testErrorsAndWarnings('from a_index | stats round(median(counterIntegerField))', []); testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianpoint("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats var = round(median(counterIntegerField)) + median(counterIntegerField)', [] ); testErrorsAndWarnings( - 'row st_disjoint(to_cartesianpoint("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats round(median(counterIntegerField)) + median(counterIntegerField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = median(counterIntegerField)', []); testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianpoint("a"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median(counterIntegerField)', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median(counterIntegerField)', [] ); testErrorsAndWarnings( - 'row st_disjoint(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats median(counterIntegerField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("a"))', + 'from a_index | stats var0 = median(counterIntegerField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median(counterIntegerField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row st_disjoint(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median(counterIntegerField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(geoPointField, geoPointField)', + 'from a_index | stats avg(doubleField), median(counterIntegerField) by round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval st_disjoint(geoPointField, geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_geopoint(stringField), to_geopoint(stringField))', + 'from a_index | stats avg(doubleField), var0 = median(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval st_disjoint(stringField, stringField)', [ - 'Argument of [st_disjoint] must be [cartesian_point], found value [stringField] type [string]', - 'Argument of [st_disjoint] must be [cartesian_point], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings( - 'from a_index | eval st_disjoint(geoPointField, geoPointField, extraArg)', - ['Error: [st_disjoint] function expects exactly 2 arguments, got 3.'] - ); + testErrorsAndWarnings('from a_index | stats var = median(doubleField)', []); + testErrorsAndWarnings('from a_index | stats median(doubleField)', []); + testErrorsAndWarnings('from a_index | stats var = round(median(doubleField))', []); + testErrorsAndWarnings('from a_index | stats round(median(doubleField))', []); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(geoPointField, geoShapeField)', + 'from a_index | stats var = round(median(doubleField)) + median(doubleField)', [] ); - testErrorsAndWarnings('from a_index | eval st_disjoint(geoPointField, geoShapeField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_geopoint(stringField), geoShapeField)', + 'from a_index | stats round(median(doubleField)) + median(doubleField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = median(doubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), median(doubleField)', []); testErrorsAndWarnings( - 'from a_index | eval st_disjoint(geoPointField, geoShapeField, extraArg)', - ['Error: [st_disjoint] function expects exactly 2 arguments, got 3.'] - ); - - testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(geoShapeField, geoPointField)', + 'from a_index | stats avg(doubleField), var0 = median(doubleField)', [] ); - testErrorsAndWarnings('from a_index | eval st_disjoint(geoShapeField, geoPointField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(geoShapeField, to_geopoint(stringField))', + 'from a_index | stats median(doubleField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_disjoint(geoShapeField, geoPointField, extraArg)', - ['Error: [st_disjoint] function expects exactly 2 arguments, got 3.'] - ); - - testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(geoShapeField, geoShapeField)', + 'from a_index | stats var0 = median(doubleField) by var1 = round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | eval st_disjoint(geoShapeField, geoShapeField)', []); testErrorsAndWarnings( - 'from a_index | eval st_disjoint(geoShapeField, geoShapeField, extraArg)', - ['Error: [st_disjoint] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), median(doubleField) by round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(cartesianPointField, cartesianPointField)', + 'from a_index | stats avg(doubleField), var0 = median(doubleField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval st_disjoint(cartesianPointField, cartesianPointField)', + 'from a_index | stats avg(doubleField), median(doubleField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_cartesianpoint(stringField), to_cartesianpoint(stringField))', + 'from a_index | stats avg(doubleField), var0 = median(doubleField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings( - 'from a_index | eval st_disjoint(cartesianPointField, cartesianPointField, extraArg)', - ['Error: [st_disjoint] function expects exactly 2 arguments, got 3.'] - ); + testErrorsAndWarnings('from a_index | stats var = median(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | stats median(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | stats var = round(median(unsignedLongField))', []); + testErrorsAndWarnings('from a_index | stats round(median(unsignedLongField))', []); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(cartesianPointField, cartesianShapeField)', + 'from a_index | stats var = round(median(unsignedLongField)) + median(unsignedLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField)', + 'from a_index | stats round(median(unsignedLongField)) + median(unsignedLongField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = median(unsignedLongField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_cartesianpoint(stringField), cartesianShapeField)', + 'from a_index | stats avg(doubleField), median(unsignedLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField, extraArg)', - ['Error: [st_disjoint] function expects exactly 2 arguments, got 3.'] - ); - - testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(cartesianShapeField, cartesianPointField)', + 'from a_index | stats avg(doubleField), var0 = median(unsignedLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField)', + 'from a_index | stats median(unsignedLongField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(cartesianShapeField, to_cartesianpoint(stringField))', + 'from a_index | stats var0 = median(unsignedLongField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField, extraArg)', - ['Error: [st_disjoint] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), median(unsignedLongField) by round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(cartesianShapeField, cartesianShapeField)', + 'from a_index | stats avg(doubleField), var0 = median(unsignedLongField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField)', + 'from a_index | stats avg(doubleField), median(unsignedLongField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField, extraArg)', - ['Error: [st_disjoint] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), var0 = median(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2', + [] ); - testErrorsAndWarnings('from a_index | sort st_disjoint(geoPointField, geoPointField)', []); + testErrorsAndWarnings('from a_index | stats var = median(longField)', []); + testErrorsAndWarnings('from a_index | stats median(longField)', []); + testErrorsAndWarnings('from a_index | stats var = round(median(longField))', []); + testErrorsAndWarnings('from a_index | stats round(median(longField))', []); testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats var = round(median(longField)) + median(longField)', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats round(median(longField)) + median(longField)', [] ); - + testErrorsAndWarnings('from a_index | stats var0 = median(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), median(longField)', []); testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), var0 = median(longField)', [] ); - testErrorsAndWarnings( - 'row var = st_disjoint(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats median(longField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + 'from a_index | stats var0 = median(longField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_geopoint(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), median(longField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_geoshape(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), var0 = median(longField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_disjoint(to_geoshape(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), median(longField) by round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('row var = st_disjoint(true, true)', [ - 'Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]', - 'Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]', - ]); - testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + 'from a_index | stats avg(doubleField), var0 = median(longField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval st_disjoint(booleanField, booleanField)', [ - 'Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]', - 'Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings('from a_index | stats var = median(counterLongField)', []); + testErrorsAndWarnings('from a_index | stats median(counterLongField)', []); + testErrorsAndWarnings('from a_index | stats var = round(median(counterLongField))', []); + testErrorsAndWarnings('from a_index | stats round(median(counterLongField))', []); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + 'from a_index | stats var = round(median(counterLongField)) + median(counterLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + 'from a_index | stats round(median(counterLongField)) + median(counterLongField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = median(counterLongField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + 'from a_index | stats avg(doubleField), median(counterLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geopoint(geoPointField))', + 'from a_index | stats avg(doubleField), var0 = median(counterLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geoshape(geoPointField))', + 'from a_index | stats median(counterLongField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geopoint(geoPointField))', + 'from a_index | stats var0 = median(counterLongField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geoshape(geoPointField))', + 'from a_index | stats avg(doubleField), median(counterLongField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | sort st_disjoint(cartesianPointField, cartesianPointField)', + 'from a_index | stats avg(doubleField), var0 = median(counterLongField) by var1 = round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('from a_index | eval st_disjoint(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval st_disjoint(nullVar, nullVar)', []); - }); - describe('st_intersects', () => { testErrorsAndWarnings( - 'row var = st_intersects(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median(counterLongField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'row st_intersects(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median(counterLongField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('row var = st_intersects(to_geopoint("a"), to_geopoint("a"))', []); - - testErrorsAndWarnings('row var = st_intersects("a", "a")', [ - 'Argument of [st_intersects] must be [cartesian_point], found value ["a"] type [string]', - 'Argument of [st_intersects] must be [cartesian_point], found value ["a"] type [string]', - ]); + testErrorsAndWarnings('from a_index | stats var = median(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | stats median(counterDoubleField)', []); + testErrorsAndWarnings('from a_index | stats var = round(median(counterDoubleField))', []); + testErrorsAndWarnings('from a_index | stats round(median(counterDoubleField))', []); testErrorsAndWarnings( - 'row var = st_intersects(to_geopoint("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats var = round(median(counterDoubleField)) + median(counterDoubleField)', [] ); testErrorsAndWarnings( - 'row st_intersects(to_geopoint("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats round(median(counterDoubleField)) + median(counterDoubleField)', [] ); + testErrorsAndWarnings('from a_index | stats var0 = median(counterDoubleField)', []); testErrorsAndWarnings( - 'row var = st_intersects(to_geopoint("a"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median(counterDoubleField)', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_geoshape("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median(counterDoubleField)', [] ); testErrorsAndWarnings( - 'row st_intersects(to_geoshape("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats median(counterDoubleField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_geoshape("POINT (30 10)"), to_geopoint("a"))', + 'from a_index | stats var0 = median(counterDoubleField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median(counterDoubleField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row st_intersects(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median(counterDoubleField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median(counterDoubleField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'row st_intersects(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianpoint("a"), to_cartesianpoint("a"))', - [] - ); + testErrorsAndWarnings('from a_index | sort median(integerField)', [ + 'SORT does not support function median', + ]); - testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianpoint("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', - [] - ); + testErrorsAndWarnings('from a_index | where median(integerField)', [ + 'WHERE does not support function median', + ]); - testErrorsAndWarnings( - 'row st_intersects(to_cartesianpoint("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', - [] - ); + testErrorsAndWarnings('from a_index | where median(integerField) > 0', [ + 'WHERE does not support function median', + ]); - testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianpoint("a"), to_cartesianshape("POINT (30 10)"))', - [] - ); + testErrorsAndWarnings('from a_index | where median(counterIntegerField)', [ + 'WHERE does not support function median', + ]); - testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', - [] - ); + testErrorsAndWarnings('from a_index | where median(counterIntegerField) > 0', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | where median(doubleField)', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | where median(doubleField) > 0', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | where median(unsignedLongField)', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | where median(unsignedLongField) > 0', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | where median(longField)', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | where median(longField) > 0', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | where median(counterLongField)', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | where median(counterLongField) > 0', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | where median(counterDoubleField)', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | where median(counterDoubleField) > 0', [ + 'WHERE does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(integerField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(integerField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(integerField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(integerField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(counterIntegerField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(counterIntegerField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(counterIntegerField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(counterIntegerField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(doubleField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(doubleField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(doubleField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(doubleField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(unsignedLongField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(unsignedLongField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(unsignedLongField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(unsignedLongField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(longField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(longField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(longField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(longField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(counterLongField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(counterLongField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(counterLongField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(counterLongField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(counterDoubleField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval var = median(counterDoubleField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(counterDoubleField)', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | eval median(counterDoubleField) > 0', [ + 'EVAL does not support function median', + ]); + + testErrorsAndWarnings('from a_index | stats median(null)', []); + testErrorsAndWarnings('row nullVar = null | stats median(nullVar)', []); + }); + describe('median_absolute_deviation', () => { testErrorsAndWarnings( - 'row st_intersects(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats var = median_absolute_deviation(integerField)', [] ); + testErrorsAndWarnings('from a_index | stats median_absolute_deviation(integerField)', []); testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("a"))', + 'from a_index | stats var = round(median_absolute_deviation(integerField))', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats round(median_absolute_deviation(integerField))', [] ); testErrorsAndWarnings( - 'row st_intersects(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats var = round(median_absolute_deviation(integerField)) + median_absolute_deviation(integerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(geoPointField, geoPointField)', + 'from a_index | stats round(median_absolute_deviation(integerField)) + median_absolute_deviation(integerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(geoPointField, geoPointField)', + 'from a_index | stats median_absolute_deviation(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_geopoint(stringField), to_geopoint(stringField))', + 'from a_index | stats var0 = median_absolute_deviation(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | eval st_intersects(stringField, stringField)', [ - 'Argument of [st_intersects] must be [cartesian_point], found value [stringField] type [string]', - 'Argument of [st_intersects] must be [cartesian_point], found value [stringField] type [string]', - ]); - testErrorsAndWarnings( - 'from a_index | eval st_intersects(geoPointField, geoPointField, extraArg)', - ['Error: [st_intersects] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), median_absolute_deviation(doubleField / 2)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(geoPointField, geoShapeField)', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(geoPointField, geoShapeField)', + 'from a_index | stats var0 = median_absolute_deviation(integerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_geopoint(stringField), geoShapeField)', + 'from a_index | stats avg(doubleField), median_absolute_deviation(integerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(geoPointField, geoShapeField, extraArg)', - ['Error: [st_intersects] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(integerField)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(geoShapeField, geoPointField)', + 'from a_index | stats median_absolute_deviation(integerField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(geoShapeField, geoPointField)', + 'from a_index | stats var0 = median_absolute_deviation(integerField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(geoShapeField, to_geopoint(stringField))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(integerField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(geoShapeField, geoPointField, extraArg)', - ['Error: [st_intersects] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(integerField) by var1 = round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(geoShapeField, geoShapeField)', + 'from a_index | stats avg(doubleField), median_absolute_deviation(integerField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(geoShapeField, geoShapeField)', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(integerField) by var1 = round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(geoShapeField, geoShapeField, extraArg)', - ['Error: [st_intersects] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats var = median_absolute_deviation(avg(integerField))', + [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ] ); + testErrorsAndWarnings('from a_index | stats median_absolute_deviation(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ]); + + testErrorsAndWarnings('from a_index | stats median_absolute_deviation(booleanField)', [ + 'Argument of [median_absolute_deviation] must be [integer], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | stats var = median_absolute_deviation(*)', [ + 'Using wildcards (*) in median_absolute_deviation is not allowed', + ]); + testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(cartesianPointField, cartesianPointField)', + 'from a_index | stats var = median_absolute_deviation(counterIntegerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(cartesianPointField, cartesianPointField)', + 'from a_index | stats median_absolute_deviation(counterIntegerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_cartesianpoint(stringField), to_cartesianpoint(stringField))', + 'from a_index | stats var = round(median_absolute_deviation(counterIntegerField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(cartesianPointField, cartesianPointField, extraArg)', - ['Error: [st_intersects] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats round(median_absolute_deviation(counterIntegerField))', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(cartesianPointField, cartesianShapeField)', + 'from a_index | stats var = round(median_absolute_deviation(counterIntegerField)) + median_absolute_deviation(counterIntegerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(cartesianPointField, cartesianShapeField)', + 'from a_index | stats round(median_absolute_deviation(counterIntegerField)) + median_absolute_deviation(counterIntegerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_cartesianpoint(stringField), cartesianShapeField)', + 'from a_index | stats var0 = median_absolute_deviation(counterIntegerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(cartesianPointField, cartesianShapeField, extraArg)', - ['Error: [st_intersects] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), median_absolute_deviation(counterIntegerField)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(cartesianShapeField, cartesianPointField)', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterIntegerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(cartesianShapeField, cartesianPointField)', + 'from a_index | stats median_absolute_deviation(counterIntegerField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(cartesianShapeField, to_cartesianpoint(stringField))', + 'from a_index | stats var0 = median_absolute_deviation(counterIntegerField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(cartesianShapeField, cartesianPointField, extraArg)', - ['Error: [st_intersects] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), median_absolute_deviation(counterIntegerField) by round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(cartesianShapeField, cartesianShapeField)', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterIntegerField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField)', + 'from a_index | stats avg(doubleField), median_absolute_deviation(counterIntegerField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField, extraArg)', - ['Error: [st_intersects] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterIntegerField) by var1 = round(doubleField / 2), doubleField / 2', + [] ); testErrorsAndWarnings( - 'from a_index | sort st_intersects(geoPointField, geoPointField)', + 'from a_index | stats var = median_absolute_deviation(doubleField)', [] ); + testErrorsAndWarnings('from a_index | stats median_absolute_deviation(doubleField)', []); testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats var = round(median_absolute_deviation(doubleField))', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats round(median_absolute_deviation(doubleField))', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats var = round(median_absolute_deviation(doubleField)) + median_absolute_deviation(doubleField)', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats round(median_absolute_deviation(doubleField)) + median_absolute_deviation(doubleField)', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + 'from a_index | stats var0 = median_absolute_deviation(doubleField)', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_geopoint(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(doubleField)', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_geoshape(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField)', [] ); testErrorsAndWarnings( - 'row var = st_intersects(to_geoshape(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + 'from a_index | stats median_absolute_deviation(doubleField) by round(doubleField / 2)', [] ); - testErrorsAndWarnings('row var = st_intersects(true, true)', [ - 'Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]', - 'Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]', - ]); - testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + 'from a_index | stats var0 = median_absolute_deviation(doubleField) by var1 = round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | eval st_intersects(booleanField, booleanField)', [ - 'Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]', - 'Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(doubleField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(doubleField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geopoint(geoPointField))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(doubleField) by var1 = round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geoshape(geoPointField))', + 'from a_index | stats var = median_absolute_deviation(unsignedLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geopoint(geoPointField))', + 'from a_index | stats median_absolute_deviation(unsignedLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geoshape(geoPointField))', + 'from a_index | stats var = round(median_absolute_deviation(unsignedLongField))', [] ); testErrorsAndWarnings( - 'from a_index | sort st_intersects(cartesianPointField, cartesianPointField)', + 'from a_index | stats round(median_absolute_deviation(unsignedLongField))', [] ); - testErrorsAndWarnings('from a_index | eval st_intersects(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval st_intersects(nullVar, nullVar)', []); - }); - describe('st_within', () => { testErrorsAndWarnings( - 'row var = st_within(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats var = round(median_absolute_deviation(unsignedLongField)) + median_absolute_deviation(unsignedLongField)', [] ); testErrorsAndWarnings( - 'row st_within(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats round(median_absolute_deviation(unsignedLongField)) + median_absolute_deviation(unsignedLongField)', [] ); - testErrorsAndWarnings('row var = st_within(to_geopoint("a"), to_geopoint("a"))', []); - - testErrorsAndWarnings('row var = st_within("a", "a")', [ - 'Argument of [st_within] must be [cartesian_point], found value ["a"] type [string]', - 'Argument of [st_within] must be [cartesian_point], found value ["a"] type [string]', - ]); - testErrorsAndWarnings( - 'row var = st_within(to_geopoint("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats var0 = median_absolute_deviation(unsignedLongField)', [] ); testErrorsAndWarnings( - 'row st_within(to_geopoint("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(unsignedLongField)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_geopoint("a"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(unsignedLongField)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_geoshape("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats median_absolute_deviation(unsignedLongField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row st_within(to_geoshape("POINT (30 10)"), to_geopoint("POINT (30 10)"))', + 'from a_index | stats var0 = median_absolute_deviation(unsignedLongField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_geoshape("POINT (30 10)"), to_geopoint("a"))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(unsignedLongField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_within(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(unsignedLongField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row st_within(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(unsignedLongField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'row var = st_within(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(unsignedLongField) by var1 = round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'row st_within(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats var = median_absolute_deviation(longField)', [] ); + testErrorsAndWarnings('from a_index | stats median_absolute_deviation(longField)', []); testErrorsAndWarnings( - 'row var = st_within(to_cartesianpoint("a"), to_cartesianpoint("a"))', + 'from a_index | stats var = round(median_absolute_deviation(longField))', [] ); testErrorsAndWarnings( - 'row var = st_within(to_cartesianpoint("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats round(median_absolute_deviation(longField))', [] ); testErrorsAndWarnings( - 'row st_within(to_cartesianpoint("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats var = round(median_absolute_deviation(longField)) + median_absolute_deviation(longField)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_cartesianpoint("a"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats round(median_absolute_deviation(longField)) + median_absolute_deviation(longField)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats var0 = median_absolute_deviation(longField)', [] ); testErrorsAndWarnings( - 'row st_within(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(longField)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_cartesianshape("POINT (30 10)"), to_cartesianpoint("a"))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(longField)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats median_absolute_deviation(longField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row st_within(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats var0 = median_absolute_deviation(longField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(geoPointField, geoPointField)', + 'from a_index | stats avg(doubleField), median_absolute_deviation(longField) by round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('from a_index | eval st_within(geoPointField, geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_geopoint(stringField), to_geopoint(stringField))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(longField) by var1 = round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('from a_index | eval st_within(stringField, stringField)', [ - 'Argument of [st_within] must be [cartesian_point], found value [stringField] type [string]', - 'Argument of [st_within] must be [cartesian_point], found value [stringField] type [string]', - ]); - testErrorsAndWarnings( - 'from a_index | eval st_within(geoPointField, geoPointField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), median_absolute_deviation(longField) by round(doubleField / 2), doubleField / 2', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(geoPointField, geoShapeField)', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(longField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval st_within(geoPointField, geoShapeField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_geopoint(stringField), geoShapeField)', + 'from a_index | stats var = median_absolute_deviation(counterLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(geoPointField, geoShapeField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats median_absolute_deviation(counterLongField)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(geoShapeField, geoPointField)', + 'from a_index | stats var = round(median_absolute_deviation(counterLongField))', [] ); - testErrorsAndWarnings('from a_index | eval st_within(geoShapeField, geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_within(geoShapeField, to_geopoint(stringField))', + 'from a_index | stats round(median_absolute_deviation(counterLongField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(geoShapeField, geoPointField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats var = round(median_absolute_deviation(counterLongField)) + median_absolute_deviation(counterLongField)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(geoShapeField, geoShapeField)', + 'from a_index | stats round(median_absolute_deviation(counterLongField)) + median_absolute_deviation(counterLongField)', [] ); - testErrorsAndWarnings('from a_index | eval st_within(geoShapeField, geoShapeField)', []); testErrorsAndWarnings( - 'from a_index | eval st_within(geoShapeField, geoShapeField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats var0 = median_absolute_deviation(counterLongField)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(cartesianPointField, cartesianPointField)', + 'from a_index | stats avg(doubleField), median_absolute_deviation(counterLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianPointField, cartesianPointField)', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterLongField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_cartesianpoint(stringField), to_cartesianpoint(stringField))', + 'from a_index | stats median_absolute_deviation(counterLongField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianPointField, cartesianPointField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats var0 = median_absolute_deviation(counterLongField) by var1 = round(doubleField / 2)', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(cartesianPointField, cartesianShapeField)', + 'from a_index | stats avg(doubleField), median_absolute_deviation(counterLongField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianPointField, cartesianShapeField)', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterLongField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_cartesianpoint(stringField), cartesianShapeField)', + 'from a_index | stats avg(doubleField), median_absolute_deviation(counterLongField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianPointField, cartesianShapeField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterLongField) by var1 = round(doubleField / 2), doubleField / 2', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(cartesianShapeField, cartesianPointField)', + 'from a_index | stats var = median_absolute_deviation(counterDoubleField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianShapeField, cartesianPointField)', + 'from a_index | stats median_absolute_deviation(counterDoubleField)', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(cartesianShapeField, to_cartesianpoint(stringField))', + 'from a_index | stats var = round(median_absolute_deviation(counterDoubleField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianShapeField, cartesianPointField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats round(median_absolute_deviation(counterDoubleField))', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(cartesianShapeField, cartesianShapeField)', + 'from a_index | stats var = round(median_absolute_deviation(counterDoubleField)) + median_absolute_deviation(counterDoubleField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianShapeField, cartesianShapeField)', + 'from a_index | stats round(median_absolute_deviation(counterDoubleField)) + median_absolute_deviation(counterDoubleField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianShapeField, cartesianShapeField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats var0 = median_absolute_deviation(counterDoubleField)', + [] ); - testErrorsAndWarnings('from a_index | sort st_within(geoPointField, geoPointField)', []); - testErrorsAndWarnings( - 'row var = st_within(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(counterDoubleField)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterDoubleField)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats median_absolute_deviation(counterDoubleField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats var0 = median_absolute_deviation(counterDoubleField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = st_within(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(counterDoubleField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_within(to_geopoint(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterDoubleField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'row var = st_within(to_geoshape(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), median_absolute_deviation(counterDoubleField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'row var = st_within(to_geoshape(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), var0 = median_absolute_deviation(counterDoubleField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('row var = st_within(true, true)', [ - 'Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]', - 'Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | sort median_absolute_deviation(integerField)', [ + 'SORT does not support function median_absolute_deviation', + ]); + + testErrorsAndWarnings('from a_index | where median_absolute_deviation(integerField)', [ + 'WHERE does not support function median_absolute_deviation', + ]); + + testErrorsAndWarnings('from a_index | where median_absolute_deviation(integerField) > 0', [ + 'WHERE does not support function median_absolute_deviation', ]); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', - [] + 'from a_index | where median_absolute_deviation(counterIntegerField)', + ['WHERE does not support function median_absolute_deviation'] ); - testErrorsAndWarnings('from a_index | eval st_within(booleanField, booleanField)', [ - 'Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]', - 'Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]', + testErrorsAndWarnings( + 'from a_index | where median_absolute_deviation(counterIntegerField) > 0', + ['WHERE does not support function median_absolute_deviation'] + ); + + testErrorsAndWarnings('from a_index | where median_absolute_deviation(doubleField)', [ + 'WHERE does not support function median_absolute_deviation', + ]); + + testErrorsAndWarnings('from a_index | where median_absolute_deviation(doubleField) > 0', [ + 'WHERE does not support function median_absolute_deviation', + ]); + + testErrorsAndWarnings('from a_index | where median_absolute_deviation(unsignedLongField)', [ + 'WHERE does not support function median_absolute_deviation', ]); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', - [] + 'from a_index | where median_absolute_deviation(unsignedLongField) > 0', + ['WHERE does not support function median_absolute_deviation'] ); + testErrorsAndWarnings('from a_index | where median_absolute_deviation(longField)', [ + 'WHERE does not support function median_absolute_deviation', + ]); + + testErrorsAndWarnings('from a_index | where median_absolute_deviation(longField) > 0', [ + 'WHERE does not support function median_absolute_deviation', + ]); + + testErrorsAndWarnings('from a_index | where median_absolute_deviation(counterLongField)', [ + 'WHERE does not support function median_absolute_deviation', + ]); + testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', - [] + 'from a_index | where median_absolute_deviation(counterLongField) > 0', + ['WHERE does not support function median_absolute_deviation'] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', - [] + 'from a_index | where median_absolute_deviation(counterDoubleField)', + ['WHERE does not support function median_absolute_deviation'] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_geopoint(geoPointField), to_geopoint(geoPointField))', - [] + 'from a_index | where median_absolute_deviation(counterDoubleField) > 0', + ['WHERE does not support function median_absolute_deviation'] ); + testErrorsAndWarnings('from a_index | eval var = median_absolute_deviation(integerField)', [ + 'EVAL does not support function median_absolute_deviation', + ]); + testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_geopoint(geoPointField), to_geoshape(geoPointField))', - [] + 'from a_index | eval var = median_absolute_deviation(integerField) > 0', + ['EVAL does not support function median_absolute_deviation'] ); + testErrorsAndWarnings('from a_index | eval median_absolute_deviation(integerField)', [ + 'EVAL does not support function median_absolute_deviation', + ]); + + testErrorsAndWarnings('from a_index | eval median_absolute_deviation(integerField) > 0', [ + 'EVAL does not support function median_absolute_deviation', + ]); + testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_geoshape(geoPointField), to_geopoint(geoPointField))', - [] + 'from a_index | eval var = median_absolute_deviation(counterIntegerField)', + ['EVAL does not support function median_absolute_deviation'] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_geoshape(geoPointField), to_geoshape(geoPointField))', - [] + 'from a_index | eval var = median_absolute_deviation(counterIntegerField) > 0', + ['EVAL does not support function median_absolute_deviation'] ); testErrorsAndWarnings( - 'from a_index | sort st_within(cartesianPointField, cartesianPointField)', - [] + 'from a_index | eval median_absolute_deviation(counterIntegerField)', + ['EVAL does not support function median_absolute_deviation'] ); - testErrorsAndWarnings('from a_index | eval st_within(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval st_within(nullVar, nullVar)', []); - }); - describe('st_x', () => { - testErrorsAndWarnings('row var = st_x(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row st_x(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = st_x(to_geopoint("a"))', []); + testErrorsAndWarnings( + 'from a_index | eval median_absolute_deviation(counterIntegerField) > 0', + ['EVAL does not support function median_absolute_deviation'] + ); - testErrorsAndWarnings('row var = st_x("a")', [ - 'Argument of [st_x] must be [cartesian_point], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | eval var = median_absolute_deviation(doubleField)', [ + 'EVAL does not support function median_absolute_deviation', ]); - testErrorsAndWarnings('row var = st_x(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row st_x(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = st_x(to_cartesianpoint("a"))', []); - testErrorsAndWarnings('from a_index | eval var = st_x(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval st_x(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval var = st_x(to_geopoint(stringField))', []); + testErrorsAndWarnings( + 'from a_index | eval var = median_absolute_deviation(doubleField) > 0', + ['EVAL does not support function median_absolute_deviation'] + ); - testErrorsAndWarnings('from a_index | eval st_x(stringField)', [ - 'Argument of [st_x] must be [cartesian_point], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval median_absolute_deviation(doubleField)', [ + 'EVAL does not support function median_absolute_deviation', ]); - testErrorsAndWarnings('from a_index | eval st_x(geoPointField, extraArg)', [ - 'Error: [st_x] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval median_absolute_deviation(doubleField) > 0', [ + 'EVAL does not support function median_absolute_deviation', ]); - testErrorsAndWarnings('from a_index | eval var = st_x(*)', [ - 'Using wildcards (*) in st_x is not allowed', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = median_absolute_deviation(unsignedLongField)', + ['EVAL does not support function median_absolute_deviation'] + ); - testErrorsAndWarnings('from a_index | eval var = st_x(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval st_x(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval var = st_x(to_cartesianpoint(stringField))', []); + testErrorsAndWarnings( + 'from a_index | eval var = median_absolute_deviation(unsignedLongField) > 0', + ['EVAL does not support function median_absolute_deviation'] + ); - testErrorsAndWarnings('from a_index | eval st_x(cartesianPointField, extraArg)', [ - 'Error: [st_x] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval median_absolute_deviation(unsignedLongField)', [ + 'EVAL does not support function median_absolute_deviation', ]); - testErrorsAndWarnings('from a_index | sort st_x(geoPointField)', []); - testErrorsAndWarnings( - 'row var = st_x(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', - [] + 'from a_index | eval median_absolute_deviation(unsignedLongField) > 0', + ['EVAL does not support function median_absolute_deviation'] ); - testErrorsAndWarnings('row var = st_x(to_geopoint(to_geopoint("POINT (30 10)")))', []); - - testErrorsAndWarnings('row var = st_x(true)', [ - 'Argument of [st_x] must be [cartesian_point], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = median_absolute_deviation(longField)', [ + 'EVAL does not support function median_absolute_deviation', ]); testErrorsAndWarnings( - 'from a_index | eval var = st_x(to_cartesianpoint(cartesianPointField))', - [] + 'from a_index | eval var = median_absolute_deviation(longField) > 0', + ['EVAL does not support function median_absolute_deviation'] ); - testErrorsAndWarnings('from a_index | eval st_x(booleanField)', [ - 'Argument of [st_x] must be [cartesian_point], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval median_absolute_deviation(longField)', [ + 'EVAL does not support function median_absolute_deviation', ]); - testErrorsAndWarnings('from a_index | eval var = st_x(to_geopoint(geoPointField))', []); - testErrorsAndWarnings('from a_index | sort st_x(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval st_x(null)', []); - testErrorsAndWarnings('row nullVar = null | eval st_x(nullVar)', []); - }); - - describe('st_y', () => { - testErrorsAndWarnings('row var = st_y(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row st_y(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = st_y(to_geopoint("a"))', []); - - testErrorsAndWarnings('row var = st_y("a")', [ - 'Argument of [st_y] must be [cartesian_point], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | eval median_absolute_deviation(longField) > 0', [ + 'EVAL does not support function median_absolute_deviation', ]); - testErrorsAndWarnings('row var = st_y(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row st_y(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = st_y(to_cartesianpoint("a"))', []); - testErrorsAndWarnings('from a_index | eval var = st_y(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval st_y(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval var = st_y(to_geopoint(stringField))', []); + testErrorsAndWarnings( + 'from a_index | eval var = median_absolute_deviation(counterLongField)', + ['EVAL does not support function median_absolute_deviation'] + ); - testErrorsAndWarnings('from a_index | eval st_y(stringField)', [ - 'Argument of [st_y] must be [cartesian_point], found value [stringField] type [string]', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = median_absolute_deviation(counterLongField) > 0', + ['EVAL does not support function median_absolute_deviation'] + ); - testErrorsAndWarnings('from a_index | eval st_y(geoPointField, extraArg)', [ - 'Error: [st_y] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval median_absolute_deviation(counterLongField)', [ + 'EVAL does not support function median_absolute_deviation', ]); - testErrorsAndWarnings('from a_index | eval var = st_y(*)', [ - 'Using wildcards (*) in st_y is not allowed', - ]); + testErrorsAndWarnings( + 'from a_index | eval median_absolute_deviation(counterLongField) > 0', + ['EVAL does not support function median_absolute_deviation'] + ); - testErrorsAndWarnings('from a_index | eval var = st_y(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval st_y(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval var = st_y(to_cartesianpoint(stringField))', []); + testErrorsAndWarnings( + 'from a_index | eval var = median_absolute_deviation(counterDoubleField)', + ['EVAL does not support function median_absolute_deviation'] + ); - testErrorsAndWarnings('from a_index | eval st_y(cartesianPointField, extraArg)', [ - 'Error: [st_y] function expects exactly one argument, got 2.', + testErrorsAndWarnings( + 'from a_index | eval var = median_absolute_deviation(counterDoubleField) > 0', + ['EVAL does not support function median_absolute_deviation'] + ); + + testErrorsAndWarnings('from a_index | eval median_absolute_deviation(counterDoubleField)', [ + 'EVAL does not support function median_absolute_deviation', ]); - testErrorsAndWarnings('from a_index | sort st_y(geoPointField)', []); + testErrorsAndWarnings( + 'from a_index | eval median_absolute_deviation(counterDoubleField) > 0', + ['EVAL does not support function median_absolute_deviation'] + ); + + testErrorsAndWarnings('from a_index | stats median_absolute_deviation(null)', []); + testErrorsAndWarnings('row nullVar = null | stats median_absolute_deviation(nullVar)', []); + }); + describe('max', () => { + testErrorsAndWarnings('from a_index | stats var = max(doubleField)', []); + testErrorsAndWarnings('from a_index | stats max(doubleField)', []); + testErrorsAndWarnings('from a_index | stats var = round(max(doubleField))', []); + testErrorsAndWarnings('from a_index | stats round(max(doubleField))', []); testErrorsAndWarnings( - 'row var = st_y(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats var = round(max(doubleField)) + max(doubleField)', [] ); - testErrorsAndWarnings('row var = st_y(to_geopoint(to_geopoint("POINT (30 10)")))', []); - - testErrorsAndWarnings('row var = st_y(true)', [ - 'Argument of [st_y] must be [cartesian_point], found value [true] type [boolean]', - ]); - testErrorsAndWarnings( - 'from a_index | eval var = st_y(to_cartesianpoint(cartesianPointField))', + 'from a_index | stats round(max(doubleField)) + max(doubleField)', + [] + ); + testErrorsAndWarnings('from a_index | stats max(doubleField / 2)', []); + testErrorsAndWarnings('from a_index | stats var0 = max(doubleField / 2)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), max(doubleField / 2)', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = max(doubleField / 2)', + [] + ); + testErrorsAndWarnings('from a_index | stats var0 = max(doubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), max(doubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), var0 = max(doubleField)', []); + testErrorsAndWarnings( + 'from a_index | stats max(doubleField) by round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | eval st_y(booleanField)', [ - 'Argument of [st_y] must be [cartesian_point], found value [booleanField] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | eval var = st_y(to_geopoint(geoPointField))', []); - testErrorsAndWarnings('from a_index | sort st_y(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval st_y(null)', []); - testErrorsAndWarnings('row nullVar = null | eval st_y(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats var0 = max(doubleField) by var1 = round(doubleField / 2)', + [] + ); - describe('starts_with', () => { - testErrorsAndWarnings('row var = starts_with("a", "a")', []); - testErrorsAndWarnings('row starts_with("a", "a")', []); - testErrorsAndWarnings('row var = starts_with(to_string("a"), to_string("a"))', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), max(doubleField) by round(doubleField / 2), ipField', + [] + ); - testErrorsAndWarnings('row var = starts_with(5, 5)', [ - 'Argument of [starts_with] must be [string], found value [5] type [number]', - 'Argument of [starts_with] must be [string], found value [5] type [number]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = max(doubleField) by var1 = round(doubleField / 2), ipField', + [] + ); testErrorsAndWarnings( - 'from a_index | eval var = starts_with(stringField, stringField)', + 'from a_index | stats avg(doubleField), max(doubleField) by round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval starts_with(stringField, stringField)', []); testErrorsAndWarnings( - 'from a_index | eval var = starts_with(to_string(stringField), to_string(stringField))', + 'from a_index | stats avg(doubleField), var0 = max(doubleField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | eval starts_with(numberField, numberField)', [ - 'Argument of [starts_with] must be [string], found value [numberField] type [number]', - 'Argument of [starts_with] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('from a_index | stats var = max(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", ]); - testErrorsAndWarnings( - 'from a_index | eval starts_with(stringField, stringField, extraArg)', - ['Error: [starts_with] function expects exactly 2 arguments, got 3.'] - ); + testErrorsAndWarnings('from a_index | stats max(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ]); - testErrorsAndWarnings('from a_index | sort starts_with(stringField, stringField)', []); - testErrorsAndWarnings('row var = starts_with(to_string(true), to_string(true))', []); + testErrorsAndWarnings('from a_index | stats max(cartesianPointField)', [ + 'Argument of [max] must be [double], found value [cartesianPointField] type [cartesian_point]', + ]); - testErrorsAndWarnings('row var = starts_with(true, true)', [ - 'Argument of [starts_with] must be [string], found value [true] type [boolean]', - 'Argument of [starts_with] must be [string], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | stats var = max(*)', [ + 'Using wildcards (*) in max is not allowed', ]); + testErrorsAndWarnings('from a_index | stats var = max(longField)', []); + testErrorsAndWarnings('from a_index | stats max(longField)', []); + testErrorsAndWarnings('from a_index | stats var = round(max(longField))', []); + testErrorsAndWarnings('from a_index | stats round(max(longField))', []); testErrorsAndWarnings( - 'from a_index | eval var = starts_with(to_string(booleanField), to_string(booleanField))', + 'from a_index | stats var = round(max(longField)) + max(longField)', [] ); - - testErrorsAndWarnings('from a_index | eval starts_with(booleanField, booleanField)', [ - 'Argument of [starts_with] must be [string], found value [booleanField] type [boolean]', - 'Argument of [starts_with] must be [string], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval starts_with(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval starts_with(nullVar, nullVar)', []); - }); - - describe('substring', () => { - testErrorsAndWarnings('row var = substring("a", 5, 5)', []); - testErrorsAndWarnings('row var = substring("a", 5)', []); - testErrorsAndWarnings('row substring("a", 5, 5)', []); - testErrorsAndWarnings('row substring("a", 5)', []); + testErrorsAndWarnings('from a_index | stats round(max(longField)) + max(longField)', []); + testErrorsAndWarnings('from a_index | stats var0 = max(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), max(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), var0 = max(longField)', []); + testErrorsAndWarnings('from a_index | stats max(longField) by round(doubleField / 2)', []); testErrorsAndWarnings( - 'row var = substring(to_string("a"), to_integer("a"), to_integer("a"))', + 'from a_index | stats var0 = max(longField) by var1 = round(doubleField / 2)', [] ); - testErrorsAndWarnings('row var = substring(5, "a", "a")', [ - 'Argument of [substring] must be [string], found value [5] type [number]', - 'Argument of [substring] must be [number], found value ["a"] type [string]', - 'Argument of [substring] must be [number], found value ["a"] type [string]', - ]); - testErrorsAndWarnings( - 'from a_index | where length(substring(stringField, numberField, numberField)) > 0', + 'from a_index | stats avg(doubleField), max(longField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | where length(substring(numberField, stringField, stringField)) > 0', - [ - 'Argument of [substring] must be [string], found value [numberField] type [number]', - 'Argument of [substring] must be [number], found value [stringField] type [string]', - 'Argument of [substring] must be [number], found value [stringField] type [string]', - ] + 'from a_index | stats avg(doubleField), var0 = max(longField) by var1 = round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = substring(stringField, numberField, numberField)', + 'from a_index | stats avg(doubleField), max(longField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval substring(stringField, numberField, numberField)', + 'from a_index | stats avg(doubleField), var0 = max(longField) by var1 = round(doubleField / 2), doubleField / 2', [] ); + testErrorsAndWarnings('from a_index | stats var = max(integerField)', []); + testErrorsAndWarnings('from a_index | stats max(integerField)', []); + testErrorsAndWarnings('from a_index | stats var = round(max(integerField))', []); + testErrorsAndWarnings('from a_index | stats round(max(integerField))', []); + testErrorsAndWarnings( - 'from a_index | eval var = substring(to_string(stringField), to_integer(stringField), to_integer(stringField))', + 'from a_index | stats var = round(max(integerField)) + max(integerField)', [] ); testErrorsAndWarnings( - 'from a_index | eval substring(numberField, stringField, stringField)', - [ - 'Argument of [substring] must be [string], found value [numberField] type [number]', - 'Argument of [substring] must be [number], found value [stringField] type [string]', - 'Argument of [substring] must be [number], found value [stringField] type [string]', - ] + 'from a_index | stats round(max(integerField)) + max(integerField)', + [] ); - + testErrorsAndWarnings('from a_index | stats var0 = max(integerField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), max(integerField)', []); testErrorsAndWarnings( - 'from a_index | eval substring(stringField, numberField, numberField, extraArg)', - ['Error: [substring] function expects no more than 3 arguments, got 4.'] + 'from a_index | stats avg(doubleField), var0 = max(integerField)', + [] ); - testErrorsAndWarnings( - 'from a_index | sort substring(stringField, numberField, numberField)', + 'from a_index | stats max(integerField) by round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | sort substring(stringField, numberField)', []); testErrorsAndWarnings( - 'row var = substring(to_string(true), to_integer(true), to_integer(true))', + 'from a_index | stats var0 = max(integerField) by var1 = round(doubleField / 2)', [] ); - testErrorsAndWarnings('row var = substring(true, true, true)', [ - 'Argument of [substring] must be [string], found value [true] type [boolean]', - 'Argument of [substring] must be [number], found value [true] type [boolean]', - 'Argument of [substring] must be [number], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), max(integerField) by round(doubleField / 2), ipField', + [] + ); testErrorsAndWarnings( - 'from a_index | where length(substring(booleanField, booleanField, booleanField)) > 0', - [ - 'Argument of [substring] must be [string], found value [booleanField] type [boolean]', - 'Argument of [substring] must be [number], found value [booleanField] type [boolean]', - 'Argument of [substring] must be [number], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(doubleField), var0 = max(integerField) by var1 = round(doubleField / 2), ipField', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = substring(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))', + 'from a_index | stats avg(doubleField), max(integerField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval substring(booleanField, booleanField, booleanField)', - [ - 'Argument of [substring] must be [string], found value [booleanField] type [boolean]', - 'Argument of [substring] must be [number], found value [booleanField] type [boolean]', - 'Argument of [substring] must be [number], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(doubleField), var0 = max(integerField) by var1 = round(doubleField / 2), doubleField / 2', + [] ); - testErrorsAndWarnings('from a_index | eval substring(null, null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval substring(nullVar, nullVar, nullVar)', []); - }); - describe('tan', () => { - testErrorsAndWarnings('row var = tan(5)', []); - testErrorsAndWarnings('row tan(5)', []); - testErrorsAndWarnings('row var = tan(to_integer("a"))', []); + testErrorsAndWarnings('from a_index | stats var = max(dateField)', []); + testErrorsAndWarnings('from a_index | stats max(dateField)', []); + testErrorsAndWarnings('from a_index | stats var = max(datePeriodField)', []); + testErrorsAndWarnings('from a_index | stats max(datePeriodField)', []); + testErrorsAndWarnings('from a_index | stats var = max(booleanField)', []); + testErrorsAndWarnings('from a_index | stats max(booleanField)', []); + testErrorsAndWarnings('from a_index | stats var = max(ipField)', []); + testErrorsAndWarnings('from a_index | stats max(ipField)', []); - testErrorsAndWarnings('row var = tan("a")', [ - 'Argument of [tan] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | sort max(doubleField)', [ + 'SORT does not support function max', ]); - testErrorsAndWarnings('from a_index | where tan(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where max(doubleField)', [ + 'WHERE does not support function max', + ]); - testErrorsAndWarnings('from a_index | where tan(stringField) > 0', [ - 'Argument of [tan] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where max(doubleField) > 0', [ + 'WHERE does not support function max', ]); - testErrorsAndWarnings('from a_index | eval var = tan(numberField)', []); - testErrorsAndWarnings('from a_index | eval tan(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = tan(to_integer(stringField))', []); + testErrorsAndWarnings('from a_index | where max(longField)', [ + 'WHERE does not support function max', + ]); - testErrorsAndWarnings('from a_index | eval tan(stringField)', [ - 'Argument of [tan] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where max(longField) > 0', [ + 'WHERE does not support function max', ]); - testErrorsAndWarnings('from a_index | eval tan(numberField, extraArg)', [ - 'Error: [tan] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | where max(integerField)', [ + 'WHERE does not support function max', ]); - testErrorsAndWarnings('from a_index | eval var = tan(*)', [ - 'Using wildcards (*) in tan is not allowed', + testErrorsAndWarnings('from a_index | where max(integerField) > 0', [ + 'WHERE does not support function max', ]); - testErrorsAndWarnings('from a_index | sort tan(numberField)', []); - testErrorsAndWarnings('row var = tan(to_integer(true))', []); + testErrorsAndWarnings('from a_index | where max(dateField)', [ + 'WHERE does not support function max', + ]); - testErrorsAndWarnings('row var = tan(true)', [ - 'Argument of [tan] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | where max(dateField) > 0', [ + 'WHERE does not support function max', ]); - testErrorsAndWarnings('from a_index | where tan(booleanField) > 0', [ - 'Argument of [tan] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | where max(datePeriodField)', [ + 'WHERE does not support function max', ]); - testErrorsAndWarnings('from a_index | eval var = tan(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | where max(datePeriodField) > 0', [ + 'WHERE does not support function max', + ]); - testErrorsAndWarnings('from a_index | eval tan(booleanField)', [ - 'Argument of [tan] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | where max(booleanField)', [ + 'WHERE does not support function max', ]); - testErrorsAndWarnings('from a_index | eval tan(null)', []); - testErrorsAndWarnings('row nullVar = null | eval tan(nullVar)', []); - }); - describe('tanh', () => { - testErrorsAndWarnings('row var = tanh(5)', []); - testErrorsAndWarnings('row tanh(5)', []); - testErrorsAndWarnings('row var = tanh(to_integer("a"))', []); + testErrorsAndWarnings('from a_index | where max(booleanField) > 0', [ + 'WHERE does not support function max', + ]); - testErrorsAndWarnings('row var = tanh("a")', [ - 'Argument of [tanh] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | where max(ipField)', [ + 'WHERE does not support function max', ]); - testErrorsAndWarnings('from a_index | where tanh(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where max(ipField) > 0', [ + 'WHERE does not support function max', + ]); - testErrorsAndWarnings('from a_index | where tanh(stringField) > 0', [ - 'Argument of [tanh] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval var = max(doubleField)', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | eval var = tanh(numberField)', []); - testErrorsAndWarnings('from a_index | eval tanh(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = tanh(to_integer(stringField))', []); + testErrorsAndWarnings('from a_index | eval var = max(doubleField) > 0', [ + 'EVAL does not support function max', + ]); - testErrorsAndWarnings('from a_index | eval tanh(stringField)', [ - 'Argument of [tanh] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval max(doubleField)', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | eval tanh(numberField, extraArg)', [ - 'Error: [tanh] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval max(doubleField) > 0', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | eval var = tanh(*)', [ - 'Using wildcards (*) in tanh is not allowed', + testErrorsAndWarnings('from a_index | eval var = max(longField)', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | sort tanh(numberField)', []); - testErrorsAndWarnings('row var = tanh(to_integer(true))', []); + testErrorsAndWarnings('from a_index | eval var = max(longField) > 0', [ + 'EVAL does not support function max', + ]); - testErrorsAndWarnings('row var = tanh(true)', [ - 'Argument of [tanh] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval max(longField)', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | where tanh(booleanField) > 0', [ - 'Argument of [tanh] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval max(longField) > 0', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | eval var = tanh(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = max(integerField)', [ + 'EVAL does not support function max', + ]); - testErrorsAndWarnings('from a_index | eval tanh(booleanField)', [ - 'Argument of [tanh] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = max(integerField) > 0', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | eval tanh(null)', []); - testErrorsAndWarnings('row nullVar = null | eval tanh(nullVar)', []); - }); - describe('tau', () => { - testErrorsAndWarnings('row var = tau()', []); - testErrorsAndWarnings('row tau()', []); - testErrorsAndWarnings('from a_index | where tau() > 0', []); - testErrorsAndWarnings('from a_index | eval var = tau()', []); - testErrorsAndWarnings('from a_index | eval tau()', []); + testErrorsAndWarnings('from a_index | eval max(integerField)', [ + 'EVAL does not support function max', + ]); - testErrorsAndWarnings('from a_index | eval tau(extraArg)', [ - 'Error: [tau] function expects exactly 0 arguments, got 1.', + testErrorsAndWarnings('from a_index | eval max(integerField) > 0', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | sort tau()', []); - testErrorsAndWarnings('row nullVar = null | eval tau()', []); - }); + testErrorsAndWarnings('from a_index | eval var = max(dateField)', [ + 'EVAL does not support function max', + ]); - describe('to_boolean', () => { - testErrorsAndWarnings('row var = to_boolean("a")', []); - testErrorsAndWarnings('row to_boolean("a")', []); - testErrorsAndWarnings('row var = to_bool("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_boolean(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_boolean(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_bool(stringField)', []); + testErrorsAndWarnings('from a_index | eval var = max(dateField) > 0', [ + 'EVAL does not support function max', + ]); - testErrorsAndWarnings('from a_index | eval var = to_boolean(*)', [ - 'Using wildcards (*) in to_boolean is not allowed', + testErrorsAndWarnings('from a_index | eval max(dateField)', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | sort to_boolean(stringField)', []); - testErrorsAndWarnings('row var = to_boolean(true)', []); - testErrorsAndWarnings('row to_boolean(true)', []); - testErrorsAndWarnings('row var = to_bool(true)', []); - testErrorsAndWarnings('row var = to_boolean(to_boolean(true))', []); - testErrorsAndWarnings('row var = to_boolean(5)', []); - testErrorsAndWarnings('row to_boolean(5)', []); - testErrorsAndWarnings('row var = to_bool(5)', []); - testErrorsAndWarnings('row var = to_boolean(to_integer(true))', []); - testErrorsAndWarnings('row var = to_boolean(to_string(true))', []); + testErrorsAndWarnings('from a_index | eval max(dateField) > 0', [ + 'EVAL does not support function max', + ]); - testErrorsAndWarnings('row var = to_boolean(to_cartesianpoint("POINT (30 10)"))', [ - 'Argument of [to_boolean] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval var = max(datePeriodField)', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | eval var = to_boolean(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_boolean(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_bool(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_boolean(to_boolean(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = max(datePeriodField) > 0', [ + 'EVAL does not support function max', + ]); - testErrorsAndWarnings('from a_index | eval to_boolean(cartesianPointField)', [ - 'Argument of [to_boolean] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval max(datePeriodField)', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | eval var = to_boolean(numberField)', []); - testErrorsAndWarnings('from a_index | eval to_boolean(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_bool(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_boolean(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = to_boolean(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval max(datePeriodField) > 0', [ + 'EVAL does not support function max', + ]); - testErrorsAndWarnings('from a_index | eval to_boolean(booleanField, extraArg)', [ - 'Error: [to_boolean] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval var = max(booleanField)', [ + 'EVAL does not support function max', ]); - testErrorsAndWarnings('from a_index | sort to_boolean(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_boolean(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_boolean(nullVar)', []); - }); + testErrorsAndWarnings('from a_index | eval var = max(booleanField) > 0', [ + 'EVAL does not support function max', + ]); - describe('to_cartesianpoint', () => { - testErrorsAndWarnings('row var = to_cartesianpoint("a")', []); - testErrorsAndWarnings('row to_cartesianpoint("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_cartesianpoint(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_cartesianpoint(stringField)', []); + testErrorsAndWarnings('from a_index | eval max(booleanField)', [ + 'EVAL does not support function max', + ]); - testErrorsAndWarnings('from a_index | eval var = to_cartesianpoint(*)', [ - 'Using wildcards (*) in to_cartesianpoint is not allowed', + testErrorsAndWarnings('from a_index | eval max(booleanField) > 0', [ + 'EVAL does not support function max', + ]); + + testErrorsAndWarnings('from a_index | eval var = max(ipField)', [ + 'EVAL does not support function max', + ]); + + testErrorsAndWarnings('from a_index | eval var = max(ipField) > 0', [ + 'EVAL does not support function max', + ]); + + testErrorsAndWarnings('from a_index | eval max(ipField)', [ + 'EVAL does not support function max', + ]); + + testErrorsAndWarnings('from a_index | eval max(ipField) > 0', [ + 'EVAL does not support function max', + ]); + + testErrorsAndWarnings('from a_index | stats max(null)', []); + testErrorsAndWarnings('row nullVar = null | stats max(nullVar)', []); + testErrorsAndWarnings('from a_index | stats max("2022")', []); + testErrorsAndWarnings('from a_index | stats max(concat("20", "22"))', [ + 'Argument of [max] must be [double], found value [concat("20","22")] type [keyword]', ]); + }); + + describe('min', () => { + testErrorsAndWarnings('from a_index | stats var = min(doubleField)', []); + testErrorsAndWarnings('from a_index | stats min(doubleField)', []); + testErrorsAndWarnings('from a_index | stats var = round(min(doubleField))', []); + testErrorsAndWarnings('from a_index | stats round(min(doubleField))', []); - testErrorsAndWarnings('from a_index | sort to_cartesianpoint(stringField)', []); testErrorsAndWarnings( - 'row var = to_cartesianpoint(to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats var = round(min(doubleField)) + min(doubleField)', [] ); - testErrorsAndWarnings('row to_cartesianpoint(to_cartesianpoint("POINT (30 10)"))', []); testErrorsAndWarnings( - 'row var = to_cartesianpoint(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats round(min(doubleField)) + min(doubleField)', + [] + ); + testErrorsAndWarnings('from a_index | stats min(doubleField / 2)', []); + testErrorsAndWarnings('from a_index | stats var0 = min(doubleField / 2)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), min(doubleField / 2)', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = min(doubleField / 2)', + [] + ); + testErrorsAndWarnings('from a_index | stats var0 = min(doubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), min(doubleField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), var0 = min(doubleField)', []); + testErrorsAndWarnings( + 'from a_index | stats min(doubleField) by round(doubleField / 2)', [] ); - - testErrorsAndWarnings('row var = to_cartesianpoint(to_string(true))', []); - - testErrorsAndWarnings('row var = to_cartesianpoint(true)', [ - 'Argument of [to_cartesianpoint] must be [cartesian_point], found value [true] type [boolean]', - ]); testErrorsAndWarnings( - 'from a_index | eval var = to_cartesianpoint(cartesianPointField)', + 'from a_index | stats var0 = min(doubleField) by var1 = round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | eval to_cartesianpoint(cartesianPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = to_cartesianpoint(to_cartesianpoint(cartesianPointField))', + 'from a_index | stats avg(doubleField), min(doubleField) by round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('from a_index | eval to_cartesianpoint(booleanField)', [ - 'Argument of [to_cartesianpoint] must be [cartesian_point], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = min(doubleField) by var1 = round(doubleField / 2), ipField', + [] + ); testErrorsAndWarnings( - 'from a_index | eval var = to_cartesianpoint(to_string(booleanField))', + 'from a_index | stats avg(doubleField), min(doubleField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval to_cartesianpoint(cartesianPointField, extraArg)', - ['Error: [to_cartesianpoint] function expects exactly one argument, got 2.'] + 'from a_index | stats avg(doubleField), var0 = min(doubleField) by var1 = round(doubleField / 2), doubleField / 2', + [] ); - testErrorsAndWarnings('from a_index | sort to_cartesianpoint(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval to_cartesianpoint(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_cartesianpoint(nullVar)', []); - }); + testErrorsAndWarnings('from a_index | stats var = min(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ]); - describe('to_cartesianshape', () => { - testErrorsAndWarnings('row var = to_cartesianshape("a")', []); - testErrorsAndWarnings('row to_cartesianshape("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_cartesianshape(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_cartesianshape(stringField)', []); + testErrorsAndWarnings('from a_index | stats min(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ]); - testErrorsAndWarnings('from a_index | eval var = to_cartesianshape(*)', [ - 'Using wildcards (*) in to_cartesianshape is not allowed', + testErrorsAndWarnings('from a_index | stats min(cartesianPointField)', [ + 'Argument of [min] must be [double], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | stats var = min(*)', [ + 'Using wildcards (*) in min is not allowed', ]); - testErrorsAndWarnings('from a_index | sort to_cartesianshape(stringField)', []); + testErrorsAndWarnings('from a_index | stats var = min(longField)', []); + testErrorsAndWarnings('from a_index | stats min(longField)', []); + testErrorsAndWarnings('from a_index | stats var = round(min(longField))', []); + testErrorsAndWarnings('from a_index | stats round(min(longField))', []); testErrorsAndWarnings( - 'row var = to_cartesianshape(to_cartesianpoint("POINT (30 10)"))', + 'from a_index | stats var = round(min(longField)) + min(longField)', [] ); - testErrorsAndWarnings('row to_cartesianshape(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings('from a_index | stats round(min(longField)) + min(longField)', []); + testErrorsAndWarnings('from a_index | stats var0 = min(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), min(longField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), var0 = min(longField)', []); + testErrorsAndWarnings('from a_index | stats min(longField) by round(doubleField / 2)', []); testErrorsAndWarnings( - 'row var = to_cartesianshape(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats var0 = min(longField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'row var = to_cartesianshape(to_cartesianshape("POINT (30 10)"))', + 'from a_index | stats avg(doubleField), min(longField) by round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('row to_cartesianshape(to_cartesianshape("POINT (30 10)"))', []); testErrorsAndWarnings( - 'row var = to_cartesianshape(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats avg(doubleField), var0 = min(longField) by var1 = round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('row var = to_cartesianshape(to_string(true))', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), min(longField) by round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('row var = to_cartesianshape(true)', [ - 'Argument of [to_cartesianshape] must be [cartesian_point], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = min(longField) by var1 = round(doubleField / 2), doubleField / 2', + [] + ); + + testErrorsAndWarnings('from a_index | stats var = min(integerField)', []); + testErrorsAndWarnings('from a_index | stats min(integerField)', []); + testErrorsAndWarnings('from a_index | stats var = round(min(integerField))', []); + testErrorsAndWarnings('from a_index | stats round(min(integerField))', []); testErrorsAndWarnings( - 'from a_index | eval var = to_cartesianshape(cartesianPointField)', + 'from a_index | stats var = round(min(integerField)) + min(integerField)', [] ); - testErrorsAndWarnings('from a_index | eval to_cartesianshape(cartesianPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = to_cartesianshape(to_cartesianpoint(cartesianPointField))', + 'from a_index | stats round(min(integerField)) + min(integerField)', + [] + ); + testErrorsAndWarnings('from a_index | stats var0 = min(integerField)', []); + testErrorsAndWarnings('from a_index | stats avg(doubleField), min(integerField)', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = min(integerField)', + [] + ); + testErrorsAndWarnings( + 'from a_index | stats min(integerField) by round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | eval to_cartesianshape(booleanField)', [ - 'Argument of [to_cartesianshape] must be [cartesian_point], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats var0 = min(integerField) by var1 = round(doubleField / 2)', + [] + ); testErrorsAndWarnings( - 'from a_index | eval var = to_cartesianshape(cartesianShapeField)', + 'from a_index | stats avg(doubleField), min(integerField) by round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('from a_index | eval to_cartesianshape(cartesianShapeField)', []); testErrorsAndWarnings( - 'from a_index | eval var = to_cartesianshape(to_cartesianshape(cartesianPointField))', + 'from a_index | stats avg(doubleField), var0 = min(integerField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | eval var = to_cartesianshape(to_string(booleanField))', + 'from a_index | stats avg(doubleField), min(integerField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | eval to_cartesianshape(cartesianPointField, extraArg)', - ['Error: [to_cartesianshape] function expects exactly one argument, got 2.'] + 'from a_index | stats avg(doubleField), var0 = min(integerField) by var1 = round(doubleField / 2), doubleField / 2', + [] ); - testErrorsAndWarnings('from a_index | sort to_cartesianshape(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval to_cartesianshape(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_cartesianshape(nullVar)', []); - }); + testErrorsAndWarnings('from a_index | stats var = min(dateField)', []); + testErrorsAndWarnings('from a_index | stats min(dateField)', []); + testErrorsAndWarnings('from a_index | stats var = min(datePeriodField)', []); + testErrorsAndWarnings('from a_index | stats min(datePeriodField)', []); + testErrorsAndWarnings('from a_index | stats var = min(booleanField)', []); + testErrorsAndWarnings('from a_index | stats min(booleanField)', []); + testErrorsAndWarnings('from a_index | stats var = min(ipField)', []); + testErrorsAndWarnings('from a_index | stats min(ipField)', []); - describe('to_datetime', () => { - testErrorsAndWarnings('row var = to_datetime("a")', []); - testErrorsAndWarnings('row to_datetime("a")', []); - testErrorsAndWarnings('row var = to_dt("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_datetime(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_datetime(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_dt(stringField)', []); + testErrorsAndWarnings('from a_index | sort min(doubleField)', [ + 'SORT does not support function min', + ]); - testErrorsAndWarnings('from a_index | eval var = to_datetime(*)', [ - 'Using wildcards (*) in to_datetime is not allowed', + testErrorsAndWarnings('from a_index | where min(doubleField)', [ + 'WHERE does not support function min', ]); - testErrorsAndWarnings('from a_index | sort to_datetime(stringField)', []); - testErrorsAndWarnings('row var = to_datetime(now())', []); - testErrorsAndWarnings('row to_datetime(now())', []); - testErrorsAndWarnings('row var = to_dt(now())', []); - testErrorsAndWarnings('row var = to_datetime(to_datetime(now()))', []); - testErrorsAndWarnings('row var = to_datetime(5)', []); - testErrorsAndWarnings('row to_datetime(5)', []); - testErrorsAndWarnings('row var = to_dt(5)', []); - testErrorsAndWarnings('row var = to_datetime(to_integer(true))', []); - testErrorsAndWarnings('row var = to_datetime(to_string(true))', []); + testErrorsAndWarnings('from a_index | where min(doubleField) > 0', [ + 'WHERE does not support function min', + ]); - testErrorsAndWarnings('row var = to_datetime(true)', [ - 'Argument of [to_datetime] must be [date], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | where min(longField)', [ + 'WHERE does not support function min', ]); - testErrorsAndWarnings('from a_index | eval var = to_datetime(dateField)', []); - testErrorsAndWarnings('from a_index | eval to_datetime(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_dt(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_datetime(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | where min(longField) > 0', [ + 'WHERE does not support function min', + ]); - testErrorsAndWarnings('from a_index | eval to_datetime(booleanField)', [ - 'Argument of [to_datetime] must be [date], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | where min(integerField)', [ + 'WHERE does not support function min', ]); - testErrorsAndWarnings('from a_index | eval var = to_datetime(numberField)', []); - testErrorsAndWarnings('from a_index | eval to_datetime(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_dt(numberField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = to_datetime(to_integer(booleanField))', - [] - ); - testErrorsAndWarnings('from a_index | eval var = to_datetime(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | where min(integerField) > 0', [ + 'WHERE does not support function min', + ]); - testErrorsAndWarnings('from a_index | eval to_datetime(dateField, extraArg)', [ - 'Error: [to_datetime] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | where min(dateField)', [ + 'WHERE does not support function min', ]); - testErrorsAndWarnings('from a_index | sort to_datetime(dateField)', []); - testErrorsAndWarnings('from a_index | eval to_datetime(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_datetime(nullVar)', []); - }); + testErrorsAndWarnings('from a_index | where min(dateField) > 0', [ + 'WHERE does not support function min', + ]); - describe('to_degrees', () => { - testErrorsAndWarnings('row var = to_degrees(5)', []); - testErrorsAndWarnings('row to_degrees(5)', []); - testErrorsAndWarnings('row var = to_degrees(to_integer("a"))', []); + testErrorsAndWarnings('from a_index | where min(datePeriodField)', [ + 'WHERE does not support function min', + ]); - testErrorsAndWarnings('row var = to_degrees("a")', [ - 'Argument of [to_degrees] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | where min(datePeriodField) > 0', [ + 'WHERE does not support function min', ]); - testErrorsAndWarnings('from a_index | where to_degrees(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where min(booleanField)', [ + 'WHERE does not support function min', + ]); - testErrorsAndWarnings('from a_index | where to_degrees(stringField) > 0', [ - 'Argument of [to_degrees] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where min(booleanField) > 0', [ + 'WHERE does not support function min', ]); - testErrorsAndWarnings('from a_index | eval var = to_degrees(numberField)', []); - testErrorsAndWarnings('from a_index | eval to_degrees(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_degrees(to_integer(stringField))', []); + testErrorsAndWarnings('from a_index | where min(ipField)', [ + 'WHERE does not support function min', + ]); - testErrorsAndWarnings('from a_index | eval to_degrees(stringField)', [ - 'Argument of [to_degrees] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | where min(ipField) > 0', [ + 'WHERE does not support function min', ]); - testErrorsAndWarnings('from a_index | eval to_degrees(numberField, extraArg)', [ - 'Error: [to_degrees] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval var = min(doubleField)', [ + 'EVAL does not support function min', ]); - testErrorsAndWarnings('from a_index | eval var = to_degrees(*)', [ - 'Using wildcards (*) in to_degrees is not allowed', + testErrorsAndWarnings('from a_index | eval var = min(doubleField) > 0', [ + 'EVAL does not support function min', ]); - testErrorsAndWarnings('from a_index | sort to_degrees(numberField)', []); - testErrorsAndWarnings('row var = to_degrees(to_integer(true))', []); + testErrorsAndWarnings('from a_index | eval min(doubleField)', [ + 'EVAL does not support function min', + ]); - testErrorsAndWarnings('row var = to_degrees(true)', [ - 'Argument of [to_degrees] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval min(doubleField) > 0', [ + 'EVAL does not support function min', ]); - testErrorsAndWarnings('from a_index | where to_degrees(booleanField) > 0', [ - 'Argument of [to_degrees] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = min(longField)', [ + 'EVAL does not support function min', ]); - testErrorsAndWarnings('from a_index | eval var = to_degrees(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = min(longField) > 0', [ + 'EVAL does not support function min', + ]); - testErrorsAndWarnings('from a_index | eval to_degrees(booleanField)', [ - 'Argument of [to_degrees] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval min(longField)', [ + 'EVAL does not support function min', ]); - testErrorsAndWarnings('from a_index | eval to_degrees(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_degrees(nullVar)', []); - }); - describe('to_double', () => { - testErrorsAndWarnings('row var = to_double("a")', []); - testErrorsAndWarnings('row to_double("a")', []); - testErrorsAndWarnings('row var = to_dbl("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_double(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_double(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_dbl(stringField)', []); + testErrorsAndWarnings('from a_index | eval min(longField) > 0', [ + 'EVAL does not support function min', + ]); - testErrorsAndWarnings('from a_index | eval var = to_double(*)', [ - 'Using wildcards (*) in to_double is not allowed', + testErrorsAndWarnings('from a_index | eval var = min(integerField)', [ + 'EVAL does not support function min', ]); - testErrorsAndWarnings('from a_index | sort to_double(stringField)', []); - testErrorsAndWarnings('row var = to_double(true)', []); - testErrorsAndWarnings('row to_double(true)', []); - testErrorsAndWarnings('row var = to_dbl(true)', []); - testErrorsAndWarnings('row var = to_double(to_boolean(true))', []); - testErrorsAndWarnings('row var = to_double(5)', []); - testErrorsAndWarnings('row to_double(5)', []); - testErrorsAndWarnings('row var = to_dbl(5)', []); - testErrorsAndWarnings('row var = to_double(to_integer(true))', []); - testErrorsAndWarnings('row var = to_double(now())', []); - testErrorsAndWarnings('row to_double(now())', []); - testErrorsAndWarnings('row var = to_dbl(now())', []); - testErrorsAndWarnings('row var = to_double(to_datetime(now()))', []); - testErrorsAndWarnings('row var = to_double(to_string(true))', []); + testErrorsAndWarnings('from a_index | eval var = min(integerField) > 0', [ + 'EVAL does not support function min', + ]); - testErrorsAndWarnings('row var = to_double(to_cartesianpoint("POINT (30 10)"))', [ - 'Argument of [to_double] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval min(integerField)', [ + 'EVAL does not support function min', ]); - testErrorsAndWarnings('from a_index | where to_double(booleanField) > 0', []); + testErrorsAndWarnings('from a_index | eval min(integerField) > 0', [ + 'EVAL does not support function min', + ]); - testErrorsAndWarnings('from a_index | where to_double(cartesianPointField) > 0', [ - 'Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval var = min(dateField)', [ + 'EVAL does not support function min', ]); - testErrorsAndWarnings('from a_index | where to_double(numberField) > 0', []); - testErrorsAndWarnings('from a_index | where to_double(dateField) > 0', []); - testErrorsAndWarnings('from a_index | where to_double(stringField) > 0', []); - testErrorsAndWarnings('from a_index | eval var = to_double(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_double(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_dbl(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_double(to_boolean(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = min(dateField) > 0', [ + 'EVAL does not support function min', + ]); - testErrorsAndWarnings('from a_index | eval to_double(cartesianPointField)', [ - 'Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval min(dateField)', [ + 'EVAL does not support function min', ]); - testErrorsAndWarnings('from a_index | eval var = to_double(numberField)', []); - testErrorsAndWarnings('from a_index | eval to_double(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_dbl(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_double(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = to_double(dateField)', []); - testErrorsAndWarnings('from a_index | eval to_double(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_dbl(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_double(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = to_double(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval min(dateField) > 0', [ + 'EVAL does not support function min', + ]); + + testErrorsAndWarnings('from a_index | eval var = min(datePeriodField)', [ + 'EVAL does not support function min', + ]); + + testErrorsAndWarnings('from a_index | eval var = min(datePeriodField) > 0', [ + 'EVAL does not support function min', + ]); + + testErrorsAndWarnings('from a_index | eval min(datePeriodField)', [ + 'EVAL does not support function min', + ]); + + testErrorsAndWarnings('from a_index | eval min(datePeriodField) > 0', [ + 'EVAL does not support function min', + ]); + + testErrorsAndWarnings('from a_index | eval var = min(booleanField)', [ + 'EVAL does not support function min', + ]); + + testErrorsAndWarnings('from a_index | eval var = min(booleanField) > 0', [ + 'EVAL does not support function min', + ]); + + testErrorsAndWarnings('from a_index | eval min(booleanField)', [ + 'EVAL does not support function min', + ]); + + testErrorsAndWarnings('from a_index | eval min(booleanField) > 0', [ + 'EVAL does not support function min', + ]); + + testErrorsAndWarnings('from a_index | eval var = min(ipField)', [ + 'EVAL does not support function min', + ]); - testErrorsAndWarnings('from a_index | eval to_double(booleanField, extraArg)', [ - 'Error: [to_double] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval var = min(ipField) > 0', [ + 'EVAL does not support function min', ]); - testErrorsAndWarnings('from a_index | sort to_double(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_double(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_double(nullVar)', []); - }); + testErrorsAndWarnings('from a_index | eval min(ipField)', [ + 'EVAL does not support function min', + ]); - describe('to_geopoint', () => { - testErrorsAndWarnings('row var = to_geopoint("a")', []); - testErrorsAndWarnings('row to_geopoint("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_geopoint(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_geopoint(stringField)', []); + testErrorsAndWarnings('from a_index | eval min(ipField) > 0', [ + 'EVAL does not support function min', + ]); - testErrorsAndWarnings('from a_index | eval var = to_geopoint(*)', [ - 'Using wildcards (*) in to_geopoint is not allowed', + testErrorsAndWarnings('from a_index | stats min(null)', []); + testErrorsAndWarnings('row nullVar = null | stats min(nullVar)', []); + testErrorsAndWarnings('from a_index | stats min("2022")', []); + testErrorsAndWarnings('from a_index | stats min(concat("20", "22"))', [ + 'Argument of [min] must be [double], found value [concat("20","22")] type [keyword]', ]); + }); + + describe('count', () => { + testErrorsAndWarnings('from a_index | stats var = count(textField)', []); + testErrorsAndWarnings('from a_index | stats count(textField)', []); + testErrorsAndWarnings('from a_index | stats var = round(count(textField))', []); + testErrorsAndWarnings('from a_index | stats round(count(textField))', []); - testErrorsAndWarnings('from a_index | sort to_geopoint(stringField)', []); - testErrorsAndWarnings('row var = to_geopoint(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row to_geopoint(to_geopoint("POINT (30 10)"))', []); testErrorsAndWarnings( - 'row var = to_geopoint(to_geopoint(to_geopoint("POINT (30 10)")))', + 'from a_index | stats var = round(count(textField)) + count(textField)', [] ); - testErrorsAndWarnings('row var = to_geopoint(to_string(true))', []); - - testErrorsAndWarnings('row var = to_geopoint(true)', [ - 'Argument of [to_geopoint] must be [geo_point], found value [true] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval var = to_geopoint(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval to_geopoint(geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = to_geopoint(to_geopoint(geoPointField))', + 'from a_index | stats round(count(textField)) + count(textField)', [] ); - testErrorsAndWarnings('from a_index | eval to_geopoint(booleanField)', [ - 'Argument of [to_geopoint] must be [geo_point], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | sort count(textField)', [ + 'SORT does not support function count', ]); - testErrorsAndWarnings('from a_index | eval var = to_geopoint(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | where count(textField)', [ + 'WHERE does not support function count', + ]); - testErrorsAndWarnings('from a_index | eval to_geopoint(geoPointField, extraArg)', [ - 'Error: [to_geopoint] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | where count(textField) > 0', [ + 'WHERE does not support function count', ]); - testErrorsAndWarnings('from a_index | sort to_geopoint(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval to_geopoint(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_geopoint(nullVar)', []); - }); + testErrorsAndWarnings('from a_index | eval var = count(textField)', [ + 'EVAL does not support function count', + ]); - describe('to_geoshape', () => { - testErrorsAndWarnings('row var = to_geoshape("a")', []); - testErrorsAndWarnings('row to_geoshape("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_geoshape(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_geoshape(stringField)', []); + testErrorsAndWarnings('from a_index | eval var = count(textField) > 0', [ + 'EVAL does not support function count', + ]); - testErrorsAndWarnings('from a_index | eval var = to_geoshape(*)', [ - 'Using wildcards (*) in to_geoshape is not allowed', + testErrorsAndWarnings('from a_index | eval count(textField)', [ + 'EVAL does not support function count', ]); - testErrorsAndWarnings('from a_index | sort to_geoshape(stringField)', []); - testErrorsAndWarnings('row var = to_geoshape(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row to_geoshape(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings( - 'row var = to_geoshape(to_geopoint(to_geopoint("POINT (30 10)")))', - [] - ); - testErrorsAndWarnings('row var = to_geoshape(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row to_geoshape(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('from a_index | eval count(textField) > 0', [ + 'EVAL does not support function count', + ]); + + testErrorsAndWarnings('from a_index | stats count(null)', []); + testErrorsAndWarnings('row nullVar = null | stats count(nullVar)', []); + }); + + describe('count_distinct', () => { testErrorsAndWarnings( - 'row var = to_geoshape(to_geoshape(to_geopoint("POINT (30 10)")))', + 'from a_index | stats count_distinct(null, null, null, null, null, null, null, null)', [] ); - testErrorsAndWarnings('row var = to_geoshape(to_string(true))', []); - - testErrorsAndWarnings('row var = to_geoshape(true)', [ - 'Argument of [to_geoshape] must be [geo_point], found value [true] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval var = to_geoshape(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval to_geoshape(geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = to_geoshape(to_geopoint(geoPointField))', + 'row nullVar = null | stats count_distinct(nullVar, nullVar, nullVar, nullVar, nullVar, nullVar, nullVar, nullVar)', [] ); + }); - testErrorsAndWarnings('from a_index | eval to_geoshape(booleanField)', [ - 'Argument of [to_geoshape] must be [geo_point], found value [booleanField] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | eval var = to_geoshape(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval to_geoshape(geoShapeField)', []); + describe('st_centroid_agg', () => { testErrorsAndWarnings( - 'from a_index | eval var = to_geoshape(to_geoshape(geoPointField))', + 'from a_index | stats var = st_centroid_agg(cartesianPointField)', [] ); - testErrorsAndWarnings('from a_index | eval var = to_geoshape(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | stats st_centroid_agg(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval to_geoshape(geoPointField, extraArg)', [ - 'Error: [to_geoshape] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | stats var = st_centroid_agg(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", ]); - testErrorsAndWarnings('from a_index | sort to_geoshape(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval to_geoshape(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_geoshape(nullVar)', []); - }); - - describe('to_integer', () => { - testErrorsAndWarnings('row var = to_integer("a")', []); - testErrorsAndWarnings('row to_integer("a")', []); - testErrorsAndWarnings('row var = to_int("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_integer(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_integer(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_int(stringField)', []); - - testErrorsAndWarnings('from a_index | eval var = to_integer(*)', [ - 'Using wildcards (*) in to_integer is not allowed', + testErrorsAndWarnings('from a_index | stats st_centroid_agg(avg(integerField))', [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", ]); - testErrorsAndWarnings('from a_index | sort to_integer(stringField)', []); - testErrorsAndWarnings('row var = to_integer(true)', []); - testErrorsAndWarnings('row to_integer(true)', []); - testErrorsAndWarnings('row var = to_int(true)', []); - testErrorsAndWarnings('row var = to_integer(to_boolean(true))', []); - testErrorsAndWarnings('row var = to_integer(5)', []); - testErrorsAndWarnings('row to_integer(5)', []); - testErrorsAndWarnings('row var = to_int(5)', []); - testErrorsAndWarnings('row var = to_integer(to_integer(true))', []); - testErrorsAndWarnings('row var = to_integer(now())', []); - testErrorsAndWarnings('row to_integer(now())', []); - testErrorsAndWarnings('row var = to_int(now())', []); - testErrorsAndWarnings('row var = to_integer(to_datetime(now()))', []); - testErrorsAndWarnings('row var = to_integer(to_string(true))', []); + testErrorsAndWarnings('from a_index | stats st_centroid_agg(booleanField)', [ + 'Argument of [st_centroid_agg] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); - testErrorsAndWarnings('row var = to_integer(to_cartesianpoint("POINT (30 10)"))', [ - 'Argument of [to_integer] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + testErrorsAndWarnings('from a_index | stats var = st_centroid_agg(*)', [ + 'Using wildcards (*) in st_centroid_agg is not allowed', ]); - testErrorsAndWarnings('from a_index | where to_integer(booleanField) > 0', []); + testErrorsAndWarnings('from a_index | stats var = st_centroid_agg(geoPointField)', []); + testErrorsAndWarnings('from a_index | stats st_centroid_agg(geoPointField)', []); - testErrorsAndWarnings('from a_index | where to_integer(cartesianPointField) > 0', [ - 'Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | sort st_centroid_agg(cartesianPointField)', [ + 'SORT does not support function st_centroid_agg', ]); - testErrorsAndWarnings('from a_index | where to_integer(numberField) > 0', []); - testErrorsAndWarnings('from a_index | where to_integer(dateField) > 0', []); - testErrorsAndWarnings('from a_index | where to_integer(stringField) > 0', []); - testErrorsAndWarnings('from a_index | eval var = to_integer(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_integer(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_int(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_integer(to_boolean(booleanField))', []); + testErrorsAndWarnings('from a_index | where st_centroid_agg(cartesianPointField)', [ + 'WHERE does not support function st_centroid_agg', + ]); - testErrorsAndWarnings('from a_index | eval to_integer(cartesianPointField)', [ - 'Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | where st_centroid_agg(cartesianPointField) > 0', [ + 'WHERE does not support function st_centroid_agg', ]); - testErrorsAndWarnings('from a_index | eval var = to_integer(numberField)', []); - testErrorsAndWarnings('from a_index | eval to_integer(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_int(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_integer(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = to_integer(dateField)', []); - testErrorsAndWarnings('from a_index | eval to_integer(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_int(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_integer(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = to_integer(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | where st_centroid_agg(geoPointField)', [ + 'WHERE does not support function st_centroid_agg', + ]); - testErrorsAndWarnings('from a_index | eval to_integer(booleanField, extraArg)', [ - 'Error: [to_integer] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | where st_centroid_agg(geoPointField) > 0', [ + 'WHERE does not support function st_centroid_agg', ]); - testErrorsAndWarnings('from a_index | sort to_integer(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_integer(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_integer(nullVar)', []); - }); + testErrorsAndWarnings('from a_index | eval var = st_centroid_agg(cartesianPointField)', [ + 'EVAL does not support function st_centroid_agg', + ]); - describe('to_ip', () => { - testErrorsAndWarnings('row var = to_ip("a")', []); - testErrorsAndWarnings('row to_ip("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_ip(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_ip(stringField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = st_centroid_agg(cartesianPointField) > 0', + ['EVAL does not support function st_centroid_agg'] + ); - testErrorsAndWarnings('from a_index | eval var = to_ip(*)', [ - 'Using wildcards (*) in to_ip is not allowed', + testErrorsAndWarnings('from a_index | eval st_centroid_agg(cartesianPointField)', [ + 'EVAL does not support function st_centroid_agg', ]); - testErrorsAndWarnings('from a_index | sort to_ip(stringField)', []); - testErrorsAndWarnings('row var = to_ip(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row to_ip(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row var = to_ip(to_ip(to_ip("127.0.0.1")))', []); - testErrorsAndWarnings('row var = to_ip(to_string(true))', []); - - testErrorsAndWarnings('row var = to_ip(true)', [ - 'Argument of [to_ip] must be [ip], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval st_centroid_agg(cartesianPointField) > 0', [ + 'EVAL does not support function st_centroid_agg', ]); - testErrorsAndWarnings('from a_index | eval var = to_ip(ipField)', []); - testErrorsAndWarnings('from a_index | eval to_ip(ipField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ip(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = st_centroid_agg(geoPointField)', [ + 'EVAL does not support function st_centroid_agg', + ]); - testErrorsAndWarnings('from a_index | eval to_ip(booleanField)', [ - 'Argument of [to_ip] must be [ip], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = st_centroid_agg(geoPointField) > 0', [ + 'EVAL does not support function st_centroid_agg', ]); - testErrorsAndWarnings('from a_index | eval var = to_ip(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval st_centroid_agg(geoPointField)', [ + 'EVAL does not support function st_centroid_agg', + ]); - testErrorsAndWarnings('from a_index | eval to_ip(ipField, extraArg)', [ - 'Error: [to_ip] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval st_centroid_agg(geoPointField) > 0', [ + 'EVAL does not support function st_centroid_agg', ]); - testErrorsAndWarnings('from a_index | sort to_ip(ipField)', []); - testErrorsAndWarnings('from a_index | eval to_ip(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_ip(nullVar)', []); + testErrorsAndWarnings('from a_index | stats st_centroid_agg(null)', []); + testErrorsAndWarnings('row nullVar = null | stats st_centroid_agg(nullVar)', []); }); - describe('to_long', () => { - testErrorsAndWarnings('row var = to_long("a")', []); - testErrorsAndWarnings('row to_long("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_long(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_long(stringField)', []); + describe('values', () => { + testErrorsAndWarnings('from a_index | stats var = values(textField)', []); + testErrorsAndWarnings('from a_index | stats values(textField)', []); - testErrorsAndWarnings('from a_index | eval var = to_long(*)', [ - 'Using wildcards (*) in to_long is not allowed', + testErrorsAndWarnings('from a_index | sort values(textField)', [ + 'SORT does not support function values', ]); - testErrorsAndWarnings('from a_index | sort to_long(stringField)', []); - testErrorsAndWarnings('row var = to_long(true)', []); - testErrorsAndWarnings('row to_long(true)', []); - testErrorsAndWarnings('row var = to_long(to_boolean(true))', []); - testErrorsAndWarnings('row var = to_long(5)', []); - testErrorsAndWarnings('row to_long(5)', []); - testErrorsAndWarnings('row var = to_long(to_integer(true))', []); - testErrorsAndWarnings('row var = to_long(now())', []); - testErrorsAndWarnings('row to_long(now())', []); - testErrorsAndWarnings('row var = to_long(to_datetime(now()))', []); - testErrorsAndWarnings('row var = to_long(to_string(true))', []); - - testErrorsAndWarnings('row var = to_long(to_cartesianpoint("POINT (30 10)"))', [ - 'Argument of [to_long] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + testErrorsAndWarnings('from a_index | where values(textField)', [ + 'WHERE does not support function values', ]); - testErrorsAndWarnings('from a_index | where to_long(booleanField) > 0', []); - - testErrorsAndWarnings('from a_index | where to_long(cartesianPointField) > 0', [ - 'Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | where values(textField) > 0', [ + 'WHERE does not support function values', ]); - testErrorsAndWarnings('from a_index | where to_long(numberField) > 0', []); - testErrorsAndWarnings('from a_index | where to_long(dateField) > 0', []); - testErrorsAndWarnings('from a_index | where to_long(stringField) > 0', []); - testErrorsAndWarnings('from a_index | eval var = to_long(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_long(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_long(to_boolean(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = values(textField)', [ + 'EVAL does not support function values', + ]); - testErrorsAndWarnings('from a_index | eval to_long(cartesianPointField)', [ - 'Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval var = values(textField) > 0', [ + 'EVAL does not support function values', ]); - testErrorsAndWarnings('from a_index | eval var = to_long(numberField)', []); - testErrorsAndWarnings('from a_index | eval to_long(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_long(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = to_long(dateField)', []); - testErrorsAndWarnings('from a_index | eval to_long(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_long(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = to_long(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval values(textField)', [ + 'EVAL does not support function values', + ]); - testErrorsAndWarnings('from a_index | eval to_long(booleanField, extraArg)', [ - 'Error: [to_long] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval values(textField) > 0', [ + 'EVAL does not support function values', ]); - testErrorsAndWarnings('from a_index | sort to_long(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_long(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_long(nullVar)', []); + testErrorsAndWarnings('from a_index | stats values(null)', []); + testErrorsAndWarnings('row nullVar = null | stats values(nullVar)', []); }); - describe('to_lower', () => { - testErrorsAndWarnings('row var = to_lower("a")', []); - testErrorsAndWarnings('row to_lower("a")', []); - testErrorsAndWarnings('row var = to_lower(to_string("a"))', []); + describe('top', () => { + testErrorsAndWarnings( + 'from a_index | stats var = top(textField, integerField, textField)', + ['Argument of [=] must be a constant, received [top(textField,integerField,textField)]'] + ); - testErrorsAndWarnings('row var = to_lower(5)', [ - 'Argument of [to_lower] must be [string], found value [5] type [number]', + testErrorsAndWarnings('from a_index | stats top(textField, integerField, textField)', [ + 'Argument of [top] must be a constant, received [integerField]', + 'Argument of [top] must be a constant, received [textField]', ]); - testErrorsAndWarnings('from a_index | where length(to_lower(stringField)) > 0', []); - - testErrorsAndWarnings('from a_index | where length(to_lower(numberField)) > 0', [ - 'Argument of [to_lower] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('from a_index | sort top(textField, integerField, textField)', [ + 'SORT does not support function top', ]); - testErrorsAndWarnings('from a_index | eval var = to_lower(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_lower(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_lower(to_string(stringField))', []); - - testErrorsAndWarnings('from a_index | eval to_lower(numberField)', [ - 'Argument of [to_lower] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('from a_index | where top(textField, integerField, textField)', [ + 'WHERE does not support function top', ]); - testErrorsAndWarnings('from a_index | eval to_lower(stringField, extraArg)', [ - 'Error: [to_lower] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | where top(textField, integerField, textField) > 0', [ + 'WHERE does not support function top', ]); - testErrorsAndWarnings('from a_index | eval var = to_lower(*)', [ - 'Using wildcards (*) in to_lower is not allowed', + testErrorsAndWarnings('from a_index | eval var = top(textField, integerField, textField)', [ + 'EVAL does not support function top', ]); - testErrorsAndWarnings('from a_index | sort to_lower(stringField)', []); - testErrorsAndWarnings('row var = to_lower(to_string(true))', []); + testErrorsAndWarnings( + 'from a_index | eval var = top(textField, integerField, textField) > 0', + ['EVAL does not support function top'] + ); - testErrorsAndWarnings('row var = to_lower(true)', [ - 'Argument of [to_lower] must be [string], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval top(textField, integerField, textField)', [ + 'EVAL does not support function top', ]); - testErrorsAndWarnings('from a_index | where length(to_lower(booleanField)) > 0', [ - 'Argument of [to_lower] must be [string], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval top(textField, integerField, textField) > 0', [ + 'EVAL does not support function top', ]); - testErrorsAndWarnings('from a_index | eval var = to_lower(to_string(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval to_lower(booleanField)', [ - 'Argument of [to_lower] must be [string], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | stats top(null, null, null)', []); + testErrorsAndWarnings('row nullVar = null | stats top(nullVar, nullVar, nullVar)', [ + 'Argument of [top] must be a constant, received [nullVar]', + 'Argument of [top] must be a constant, received [nullVar]', ]); - testErrorsAndWarnings('from a_index | eval to_lower(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_lower(nullVar)', []); - }); - - describe('to_radians', () => { - testErrorsAndWarnings('row var = to_radians(5)', []); - testErrorsAndWarnings('row to_radians(5)', []); - testErrorsAndWarnings('row var = to_radians(to_integer("a"))', []); - - testErrorsAndWarnings('row var = to_radians("a")', [ - 'Argument of [to_radians] must be [number], found value ["a"] type [string]', + testErrorsAndWarnings('from a_index | stats var = top(textField, integerField, "asc")', [ + 'Argument of [=] must be a constant, received [top(textField,integerField,"asc")]', ]); - testErrorsAndWarnings('from a_index | where to_radians(numberField) > 0', []); - - testErrorsAndWarnings('from a_index | where to_radians(stringField) > 0', [ - 'Argument of [to_radians] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | stats top(textField, integerField, "asc")', [ + 'Argument of [top] must be a constant, received [integerField]', ]); - testErrorsAndWarnings('from a_index | eval var = to_radians(numberField)', []); - testErrorsAndWarnings('from a_index | eval to_radians(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_radians(to_integer(stringField))', []); - - testErrorsAndWarnings('from a_index | eval to_radians(stringField)', [ - 'Argument of [to_radians] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | sort top(textField, integerField, "asc")', [ + 'SORT does not support function top', ]); - testErrorsAndWarnings('from a_index | eval to_radians(numberField, extraArg)', [ - 'Error: [to_radians] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | where top(textField, integerField, "asc")', [ + 'WHERE does not support function top', ]); - testErrorsAndWarnings('from a_index | eval var = to_radians(*)', [ - 'Using wildcards (*) in to_radians is not allowed', + testErrorsAndWarnings('from a_index | where top(textField, integerField, "asc") > 0', [ + 'WHERE does not support function top', ]); - testErrorsAndWarnings('from a_index | sort to_radians(numberField)', []); - testErrorsAndWarnings('row var = to_radians(to_integer(true))', []); - - testErrorsAndWarnings('row var = to_radians(true)', [ - 'Argument of [to_radians] must be [number], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = top(textField, integerField, "asc")', [ + 'EVAL does not support function top', ]); - testErrorsAndWarnings('from a_index | where to_radians(booleanField) > 0', [ - 'Argument of [to_radians] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval var = top(textField, integerField, "asc") > 0', [ + 'EVAL does not support function top', ]); - testErrorsAndWarnings('from a_index | eval var = to_radians(to_integer(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval to_radians(booleanField)', [ - 'Argument of [to_radians] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval top(textField, integerField, "asc")', [ + 'EVAL does not support function top', ]); - testErrorsAndWarnings('from a_index | eval to_radians(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_radians(nullVar)', []); - }); - - describe('to_string', () => { - testErrorsAndWarnings('row var = to_string("a")', []); - testErrorsAndWarnings('row to_string("a")', []); - testErrorsAndWarnings('row var = to_str("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_string(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_string(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_str(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_string(*)', [ - 'Using wildcards (*) in to_string is not allowed', + testErrorsAndWarnings('from a_index | eval top(textField, integerField, "asc") > 0', [ + 'EVAL does not support function top', ]); + }); - testErrorsAndWarnings('from a_index | sort to_string(stringField)', []); - testErrorsAndWarnings('row var = to_string(true)', []); - testErrorsAndWarnings('row to_string(true)', []); - testErrorsAndWarnings('row var = to_str(true)', []); - testErrorsAndWarnings('row var = to_string(to_boolean(true))', []); - testErrorsAndWarnings('row var = to_string(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row to_string(to_cartesianpoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = to_str(to_cartesianpoint("POINT (30 10)"))', []); - + describe('weighted_avg', () => { testErrorsAndWarnings( - 'row var = to_string(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats var = weighted_avg(doubleField, doubleField)', [] ); - - testErrorsAndWarnings('row var = to_string(to_cartesianshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row to_string(to_cartesianshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = to_str(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('from a_index | stats weighted_avg(doubleField, doubleField)', []); testErrorsAndWarnings( - 'row var = to_string(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + 'from a_index | stats var = round(weighted_avg(doubleField, doubleField))', [] ); - testErrorsAndWarnings('row var = to_string(now())', []); - testErrorsAndWarnings('row to_string(now())', []); - testErrorsAndWarnings('row var = to_str(now())', []); - testErrorsAndWarnings('row var = to_string(to_datetime(now()))', []); - testErrorsAndWarnings('row var = to_string(5)', []); - testErrorsAndWarnings('row to_string(5)', []); - testErrorsAndWarnings('row var = to_str(5)', []); - testErrorsAndWarnings('row var = to_string(to_integer(true))', []); - testErrorsAndWarnings('row var = to_string(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row to_string(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = to_str(to_geopoint("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = to_string(to_geopoint(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings('row var = to_string(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row to_string(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = to_str(to_geoshape("POINT (30 10)"))', []); - testErrorsAndWarnings('row var = to_string(to_geoshape(to_geopoint("POINT (30 10)")))', []); - testErrorsAndWarnings('row var = to_string(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row to_string(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row var = to_str(to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row var = to_string(to_ip(to_ip("127.0.0.1")))', []); - testErrorsAndWarnings('row var = to_string(to_string(true))', []); - testErrorsAndWarnings('row var = to_string(to_version("1.0.0"))', []); - testErrorsAndWarnings('row to_string(to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = to_str(to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = to_string(to_version("a"))', []); - testErrorsAndWarnings('from a_index | where length(to_string(booleanField)) > 0', []); testErrorsAndWarnings( - 'from a_index | where length(to_string(cartesianPointField)) > 0', + 'from a_index | stats round(weighted_avg(doubleField, doubleField))', [] ); + testErrorsAndWarnings( - 'from a_index | where length(to_string(cartesianShapeField)) > 0', + 'from a_index | stats var = round(weighted_avg(doubleField, doubleField)) + weighted_avg(doubleField, doubleField)', [] ); - testErrorsAndWarnings('from a_index | where length(to_string(dateField)) > 0', []); - testErrorsAndWarnings('from a_index | where length(to_string(numberField)) > 0', []); - testErrorsAndWarnings('from a_index | where length(to_string(geoPointField)) > 0', []); - testErrorsAndWarnings('from a_index | where length(to_string(geoShapeField)) > 0', []); - testErrorsAndWarnings('from a_index | where length(to_string(ipField)) > 0', []); - testErrorsAndWarnings('from a_index | where length(to_string(stringField)) > 0', []); - testErrorsAndWarnings('from a_index | where length(to_string(versionField)) > 0', []); - testErrorsAndWarnings('from a_index | eval var = to_string(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_string(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_str(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_string(to_boolean(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = to_string(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval to_string(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | eval var = to_str(cartesianPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = to_string(to_cartesianpoint(cartesianPointField))', + 'from a_index | stats round(weighted_avg(doubleField, doubleField)) + weighted_avg(doubleField, doubleField)', [] ); - testErrorsAndWarnings('from a_index | eval var = to_string(cartesianShapeField)', []); - testErrorsAndWarnings('from a_index | eval to_string(cartesianShapeField)', []); - testErrorsAndWarnings('from a_index | eval var = to_str(cartesianShapeField)', []); - testErrorsAndWarnings( - 'from a_index | eval var = to_string(to_cartesianshape(cartesianPointField))', + 'from a_index | stats weighted_avg(doubleField / 2, doubleField)', [] ); - testErrorsAndWarnings('from a_index | eval var = to_string(dateField)', []); - testErrorsAndWarnings('from a_index | eval to_string(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_str(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_string(to_datetime(dateField))', []); - testErrorsAndWarnings('from a_index | eval var = to_string(numberField)', []); - testErrorsAndWarnings('from a_index | eval to_string(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_str(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_string(to_integer(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = to_string(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval to_string(geoPointField)', []); - testErrorsAndWarnings('from a_index | eval var = to_str(geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = to_string(to_geopoint(geoPointField))', + 'from a_index | stats var0 = weighted_avg(doubleField / 2, doubleField)', [] ); - testErrorsAndWarnings('from a_index | eval var = to_string(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval to_string(geoShapeField)', []); - testErrorsAndWarnings('from a_index | eval var = to_str(geoShapeField)', []); + testErrorsAndWarnings( - 'from a_index | eval var = to_string(to_geoshape(geoPointField))', + 'from a_index | stats avg(doubleField), weighted_avg(doubleField / 2, doubleField)', [] ); - testErrorsAndWarnings('from a_index | eval var = to_string(ipField)', []); - testErrorsAndWarnings('from a_index | eval to_string(ipField)', []); - testErrorsAndWarnings('from a_index | eval var = to_str(ipField)', []); - testErrorsAndWarnings('from a_index | eval var = to_string(to_ip(ipField))', []); - testErrorsAndWarnings('from a_index | eval var = to_string(to_string(booleanField))', []); - testErrorsAndWarnings('from a_index | eval var = to_string(versionField)', []); - testErrorsAndWarnings('from a_index | eval to_string(versionField)', []); - testErrorsAndWarnings('from a_index | eval var = to_str(versionField)', []); - testErrorsAndWarnings('from a_index | eval var = to_string(to_version(stringField))', []); - - testErrorsAndWarnings('from a_index | eval to_string(booleanField, extraArg)', [ - 'Error: [to_string] function expects exactly one argument, got 2.', - ]); - testErrorsAndWarnings('from a_index | sort to_string(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_string(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_string(nullVar)', []); - }); - - describe('to_unsigned_long', () => { - testErrorsAndWarnings('row var = to_unsigned_long("a")', []); - testErrorsAndWarnings('row to_unsigned_long("a")', []); - testErrorsAndWarnings('row var = to_ul("a")', []); - testErrorsAndWarnings('row var = to_ulong("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_unsigned_long(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ul(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ulong(stringField)', []); - - testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(*)', [ - 'Using wildcards (*) in to_unsigned_long is not allowed', - ]); - - testErrorsAndWarnings('from a_index | sort to_unsigned_long(stringField)', []); - testErrorsAndWarnings('row var = to_unsigned_long(true)', []); - testErrorsAndWarnings('row to_unsigned_long(true)', []); - testErrorsAndWarnings('row var = to_ul(true)', []); - testErrorsAndWarnings('row var = to_ulong(true)', []); - testErrorsAndWarnings('row var = to_unsigned_long(to_boolean(true))', []); - testErrorsAndWarnings('row var = to_unsigned_long(now())', []); - testErrorsAndWarnings('row to_unsigned_long(now())', []); - testErrorsAndWarnings('row var = to_ul(now())', []); - testErrorsAndWarnings('row var = to_ulong(now())', []); - testErrorsAndWarnings('row var = to_unsigned_long(to_datetime(now()))', []); - testErrorsAndWarnings('row var = to_unsigned_long(5)', []); - testErrorsAndWarnings('row to_unsigned_long(5)', []); - testErrorsAndWarnings('row var = to_ul(5)', []); - testErrorsAndWarnings('row var = to_ulong(5)', []); - testErrorsAndWarnings('row var = to_unsigned_long(to_integer(true))', []); - testErrorsAndWarnings('row var = to_unsigned_long(to_string(true))', []); - - testErrorsAndWarnings('row var = to_unsigned_long(to_cartesianpoint("POINT (30 10)"))', [ - 'Argument of [to_unsigned_long] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', - ]); - - testErrorsAndWarnings('from a_index | where to_unsigned_long(booleanField) > 0', []); - - testErrorsAndWarnings('from a_index | where to_unsigned_long(cartesianPointField) > 0', [ - 'Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - ]); - - testErrorsAndWarnings('from a_index | where to_unsigned_long(dateField) > 0', []); - testErrorsAndWarnings('from a_index | where to_unsigned_long(numberField) > 0', []); - testErrorsAndWarnings('from a_index | where to_unsigned_long(stringField) > 0', []); - testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_unsigned_long(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ul(booleanField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ulong(booleanField)', []); testErrorsAndWarnings( - 'from a_index | eval var = to_unsigned_long(to_boolean(booleanField))', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField / 2, doubleField)', [] ); - testErrorsAndWarnings('from a_index | eval to_unsigned_long(cartesianPointField)', [ - 'Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', - ]); - - testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(dateField)', []); - testErrorsAndWarnings('from a_index | eval to_unsigned_long(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ul(dateField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ulong(dateField)', []); testErrorsAndWarnings( - 'from a_index | eval var = to_unsigned_long(to_datetime(dateField))', + 'from a_index | stats var0 = weighted_avg(doubleField, doubleField)', [] ); - testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(numberField)', []); - testErrorsAndWarnings('from a_index | eval to_unsigned_long(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ul(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ulong(numberField)', []); + testErrorsAndWarnings( - 'from a_index | eval var = to_unsigned_long(to_integer(booleanField))', + 'from a_index | stats avg(doubleField), weighted_avg(doubleField, doubleField)', [] ); + testErrorsAndWarnings( - 'from a_index | eval var = to_unsigned_long(to_string(booleanField))', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, doubleField)', [] ); - testErrorsAndWarnings('from a_index | eval to_unsigned_long(booleanField, extraArg)', [ - 'Error: [to_unsigned_long] function expects exactly one argument, got 2.', - ]); - - testErrorsAndWarnings('from a_index | sort to_unsigned_long(booleanField)', []); - testErrorsAndWarnings('from a_index | eval to_unsigned_long(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_unsigned_long(nullVar)', []); - }); - - describe('to_upper', () => { - testErrorsAndWarnings('row var = to_upper("a")', []); - testErrorsAndWarnings('row to_upper("a")', []); - testErrorsAndWarnings('row var = to_upper(to_string("a"))', []); - - testErrorsAndWarnings('row var = to_upper(5)', [ - 'Argument of [to_upper] must be [string], found value [5] type [number]', - ]); - - testErrorsAndWarnings('from a_index | where length(to_upper(stringField)) > 0', []); - - testErrorsAndWarnings('from a_index | where length(to_upper(numberField)) > 0', [ - 'Argument of [to_upper] must be [string], found value [numberField] type [number]', - ]); - - testErrorsAndWarnings('from a_index | eval var = to_upper(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_upper(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_upper(to_string(stringField))', []); - - testErrorsAndWarnings('from a_index | eval to_upper(numberField)', [ - 'Argument of [to_upper] must be [string], found value [numberField] type [number]', - ]); - - testErrorsAndWarnings('from a_index | eval to_upper(stringField, extraArg)', [ - 'Error: [to_upper] function expects exactly one argument, got 2.', - ]); - - testErrorsAndWarnings('from a_index | eval var = to_upper(*)', [ - 'Using wildcards (*) in to_upper is not allowed', - ]); - - testErrorsAndWarnings('from a_index | sort to_upper(stringField)', []); - testErrorsAndWarnings('row var = to_upper(to_string(true))', []); - - testErrorsAndWarnings('row var = to_upper(true)', [ - 'Argument of [to_upper] must be [string], found value [true] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | where length(to_upper(booleanField)) > 0', [ - 'Argument of [to_upper] must be [string], found value [booleanField] type [boolean]', - ]); - - testErrorsAndWarnings('from a_index | eval var = to_upper(to_string(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval to_upper(booleanField)', [ - 'Argument of [to_upper] must be [string], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval to_upper(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_upper(nullVar)', []); - }); - - describe('to_version', () => { - testErrorsAndWarnings('row var = to_version("a")', []); - testErrorsAndWarnings('row to_version("a")', []); - testErrorsAndWarnings('row var = to_ver("a")', []); - testErrorsAndWarnings('from a_index | eval var = to_version(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_version(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ver(stringField)', []); - - testErrorsAndWarnings('from a_index | eval var = to_version(*)', [ - 'Using wildcards (*) in to_version is not allowed', - ]); - - testErrorsAndWarnings('from a_index | sort to_version(stringField)', []); - testErrorsAndWarnings('row var = to_version(to_version("1.0.0"))', []); - testErrorsAndWarnings('row to_version(to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = to_ver(to_version("1.0.0"))', []); + testErrorsAndWarnings( + 'from a_index | stats weighted_avg(doubleField, doubleField) by round(doubleField / 2)', + [] + ); - testErrorsAndWarnings('row var = to_version(true)', [ - 'Argument of [to_version] must be [string], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats var0 = weighted_avg(doubleField, doubleField) by var1 = round(doubleField / 2)', + [] + ); - testErrorsAndWarnings('from a_index | eval var = to_version(versionField)', []); - testErrorsAndWarnings('from a_index | eval to_version(versionField)', []); - testErrorsAndWarnings('from a_index | eval var = to_ver(versionField)', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(doubleField, doubleField) by round(doubleField / 2), ipField', + [] + ); - testErrorsAndWarnings('from a_index | eval to_version(stringField, extraArg)', [ - 'Error: [to_version] function expects exactly one argument, got 2.', - ]); - testErrorsAndWarnings('from a_index | eval to_version(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_version(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, doubleField) by var1 = round(doubleField / 2), ipField', + [] + ); - describe('trim', () => { - testErrorsAndWarnings('row var = trim("a")', []); - testErrorsAndWarnings('row trim("a")', []); - testErrorsAndWarnings('row var = trim(to_string("a"))', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(doubleField, doubleField) by round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('row var = trim(5)', [ - 'Argument of [trim] must be [string], found value [5] type [number]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, doubleField) by var1 = round(doubleField / 2), doubleField / 2', + [] + ); + + testErrorsAndWarnings( + 'from a_index | stats var = weighted_avg(avg(integerField), avg(integerField))', + [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ] + ); - testErrorsAndWarnings('from a_index | where length(trim(stringField)) > 0', []); + testErrorsAndWarnings( + 'from a_index | stats weighted_avg(avg(integerField), avg(integerField))', + [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", + ] + ); - testErrorsAndWarnings('from a_index | where length(trim(numberField)) > 0', [ - 'Argument of [trim] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('from a_index | stats weighted_avg(booleanField, booleanField)', [ + 'Argument of [weighted_avg] must be [double], found value [booleanField] type [boolean]', + 'Argument of [weighted_avg] must be [double], found value [booleanField] type [boolean]', ]); - testErrorsAndWarnings('from a_index | eval var = trim(stringField)', []); - testErrorsAndWarnings('from a_index | eval trim(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = trim(to_string(stringField))', []); + testErrorsAndWarnings('from a_index | sort weighted_avg(doubleField, doubleField)', [ + 'SORT does not support function weighted_avg', + ]); - testErrorsAndWarnings('from a_index | eval trim(numberField)', [ - 'Argument of [trim] must be [string], found value [numberField] type [number]', + testErrorsAndWarnings('from a_index | where weighted_avg(doubleField, doubleField)', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval trim(stringField, extraArg)', [ - 'Error: [trim] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | where weighted_avg(doubleField, doubleField) > 0', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = trim(*)', [ - 'Using wildcards (*) in trim is not allowed', + testErrorsAndWarnings('from a_index | eval var = weighted_avg(doubleField, doubleField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | sort trim(stringField)', []); - testErrorsAndWarnings('row var = trim(to_string(true))', []); + testErrorsAndWarnings( + 'from a_index | eval var = weighted_avg(doubleField, doubleField) > 0', + ['EVAL does not support function weighted_avg'] + ); - testErrorsAndWarnings('row var = trim(true)', [ - 'Argument of [trim] must be [string], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | eval weighted_avg(doubleField, doubleField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | where length(trim(booleanField)) > 0', [ - 'Argument of [trim] must be [string], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval weighted_avg(doubleField, doubleField) > 0', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = trim(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | stats weighted_avg(null, null)', []); + testErrorsAndWarnings('row nullVar = null | stats weighted_avg(nullVar, nullVar)', []); + testErrorsAndWarnings( + 'from a_index | stats var = weighted_avg(doubleField, longField)', + [] + ); + testErrorsAndWarnings('from a_index | stats weighted_avg(doubleField, longField)', []); - testErrorsAndWarnings('from a_index | eval trim(booleanField)', [ - 'Argument of [trim] must be [string], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | eval trim(null)', []); - testErrorsAndWarnings('row nullVar = null | eval trim(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats var = round(weighted_avg(doubleField, longField))', + [] + ); - describe('avg', () => { - testErrorsAndWarnings('from a_index | stats var = avg(numberField)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField)', []); - testErrorsAndWarnings('from a_index | stats var = round(avg(numberField))', []); - testErrorsAndWarnings('from a_index | stats round(avg(numberField))', []); + testErrorsAndWarnings( + 'from a_index | stats round(weighted_avg(doubleField, longField))', + [] + ); testErrorsAndWarnings( - 'from a_index | stats var = round(avg(numberField)) + avg(numberField)', + 'from a_index | stats var = round(weighted_avg(doubleField, longField)) + weighted_avg(doubleField, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats round(avg(numberField)) + avg(numberField)', + 'from a_index | stats round(weighted_avg(doubleField, longField)) + weighted_avg(doubleField, longField)', [] ); - testErrorsAndWarnings('from a_index | stats avg(numberField / 2)', []); - testErrorsAndWarnings('from a_index | stats var0 = avg(numberField / 2)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), avg(numberField / 2)', []); + + testErrorsAndWarnings('from a_index | stats weighted_avg(doubleField / 2, longField)', []); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = avg(numberField / 2)', + 'from a_index | stats var0 = weighted_avg(doubleField / 2, longField)', [] ); - testErrorsAndWarnings('from a_index | stats var0 = avg(numberField)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), avg(numberField)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), var0 = avg(numberField)', []); + testErrorsAndWarnings( - 'from a_index | stats avg(numberField) by round(numberField / 2)', + 'from a_index | stats avg(doubleField), weighted_avg(doubleField / 2, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats var0 = avg(numberField) by var1 = round(numberField / 2)', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField / 2, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), ipField', + 'from a_index | stats var0 = weighted_avg(doubleField, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), ipField', + 'from a_index | stats avg(doubleField), weighted_avg(doubleField, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), numberField / 2', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), numberField / 2', + 'from a_index | stats weighted_avg(doubleField, longField) by round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | stats var = avg(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); + testErrorsAndWarnings( + 'from a_index | stats var0 = weighted_avg(doubleField, longField) by var1 = round(doubleField / 2)', + [] + ); - testErrorsAndWarnings('from a_index | stats avg(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(doubleField, longField) by round(doubleField / 2), ipField', + [] + ); - testErrorsAndWarnings('from a_index | stats avg(stringField)', [ - 'Argument of [avg] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, longField) by var1 = round(doubleField / 2), ipField', + [] + ); - testErrorsAndWarnings('from a_index | stats var = avg(*)', [ - 'Using wildcards (*) in avg is not allowed', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(doubleField, longField) by round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('from a_index | sort avg(numberField)', [ - 'SORT does not support function avg', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, longField) by var1 = round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('from a_index | where avg(numberField)', [ - 'WHERE does not support function avg', - ]); + testErrorsAndWarnings( + 'from a_index | stats var = weighted_avg(doubleField, integerField)', + [] + ); + testErrorsAndWarnings('from a_index | stats weighted_avg(doubleField, integerField)', []); - testErrorsAndWarnings('from a_index | where avg(numberField) > 0', [ - 'WHERE does not support function avg', - ]); + testErrorsAndWarnings( + 'from a_index | stats var = round(weighted_avg(doubleField, integerField))', + [] + ); - testErrorsAndWarnings('from a_index | eval var = avg(numberField)', [ - 'EVAL does not support function avg', - ]); + testErrorsAndWarnings( + 'from a_index | stats round(weighted_avg(doubleField, integerField))', + [] + ); - testErrorsAndWarnings('from a_index | eval var = avg(numberField) > 0', [ - 'EVAL does not support function avg', - ]); + testErrorsAndWarnings( + 'from a_index | stats var = round(weighted_avg(doubleField, integerField)) + weighted_avg(doubleField, integerField)', + [] + ); - testErrorsAndWarnings('from a_index | eval avg(numberField)', [ - 'EVAL does not support function avg', - ]); + testErrorsAndWarnings( + 'from a_index | stats round(weighted_avg(doubleField, integerField)) + weighted_avg(doubleField, integerField)', + [] + ); - testErrorsAndWarnings('from a_index | eval avg(numberField) > 0', [ - 'EVAL does not support function avg', - ]); + testErrorsAndWarnings( + 'from a_index | stats weighted_avg(doubleField / 2, integerField)', + [] + ); - testErrorsAndWarnings('from a_index | stats avg(booleanField)', [ - 'Argument of [avg] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | stats avg(null)', []); - testErrorsAndWarnings('row nullVar = null | stats avg(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats var0 = weighted_avg(doubleField / 2, integerField)', + [] + ); - describe('sum', () => { - testErrorsAndWarnings('from a_index | stats var = sum(numberField)', []); - testErrorsAndWarnings('from a_index | stats sum(numberField)', []); - testErrorsAndWarnings('from a_index | stats var = round(sum(numberField))', []); - testErrorsAndWarnings('from a_index | stats round(sum(numberField))', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(doubleField / 2, integerField)', + [] + ); testErrorsAndWarnings( - 'from a_index | stats var = round(sum(numberField)) + sum(numberField)', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField / 2, integerField)', [] ); testErrorsAndWarnings( - 'from a_index | stats round(sum(numberField)) + sum(numberField)', + 'from a_index | stats var0 = weighted_avg(doubleField, integerField)', [] ); - testErrorsAndWarnings('from a_index | stats sum(numberField / 2)', []); - testErrorsAndWarnings('from a_index | stats var0 = sum(numberField / 2)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), sum(numberField / 2)', []); + testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = sum(numberField / 2)', + 'from a_index | stats avg(doubleField), weighted_avg(doubleField, integerField)', [] ); - testErrorsAndWarnings('from a_index | stats var0 = sum(numberField)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), sum(numberField)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), var0 = sum(numberField)', []); + testErrorsAndWarnings( - 'from a_index | stats sum(numberField) by round(numberField / 2)', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, integerField)', [] ); testErrorsAndWarnings( - 'from a_index | stats var0 = sum(numberField) by var1 = round(numberField / 2)', + 'from a_index | stats weighted_avg(doubleField, integerField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), ipField', + 'from a_index | stats var0 = weighted_avg(doubleField, integerField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), ipField', + 'from a_index | stats avg(doubleField), weighted_avg(doubleField, integerField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), numberField / 2', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, integerField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), numberField / 2', + 'from a_index | stats avg(doubleField), weighted_avg(doubleField, integerField) by round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | stats var = sum(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(doubleField, integerField) by var1 = round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('from a_index | stats sum(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); + testErrorsAndWarnings( + 'from a_index | stats var = weighted_avg(longField, doubleField)', + [] + ); + testErrorsAndWarnings('from a_index | stats weighted_avg(longField, doubleField)', []); - testErrorsAndWarnings('from a_index | stats sum(stringField)', [ - 'Argument of [sum] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings( + 'from a_index | stats var = round(weighted_avg(longField, doubleField))', + [] + ); - testErrorsAndWarnings('from a_index | stats var = sum(*)', [ - 'Using wildcards (*) in sum is not allowed', - ]); + testErrorsAndWarnings( + 'from a_index | stats round(weighted_avg(longField, doubleField))', + [] + ); - testErrorsAndWarnings('from a_index | sort sum(numberField)', [ - 'SORT does not support function sum', - ]); + testErrorsAndWarnings( + 'from a_index | stats var = round(weighted_avg(longField, doubleField)) + weighted_avg(longField, doubleField)', + [] + ); - testErrorsAndWarnings('from a_index | where sum(numberField)', [ - 'WHERE does not support function sum', - ]); + testErrorsAndWarnings( + 'from a_index | stats round(weighted_avg(longField, doubleField)) + weighted_avg(longField, doubleField)', + [] + ); - testErrorsAndWarnings('from a_index | where sum(numberField) > 0', [ - 'WHERE does not support function sum', - ]); + testErrorsAndWarnings( + 'from a_index | stats var0 = weighted_avg(longField, doubleField)', + [] + ); - testErrorsAndWarnings('from a_index | eval var = sum(numberField)', [ - 'EVAL does not support function sum', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(longField, doubleField)', + [] + ); - testErrorsAndWarnings('from a_index | eval var = sum(numberField) > 0', [ - 'EVAL does not support function sum', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(longField, doubleField)', + [] + ); - testErrorsAndWarnings('from a_index | eval sum(numberField)', [ - 'EVAL does not support function sum', - ]); + testErrorsAndWarnings( + 'from a_index | stats weighted_avg(longField, doubleField) by round(doubleField / 2)', + [] + ); - testErrorsAndWarnings('from a_index | eval sum(numberField) > 0', [ - 'EVAL does not support function sum', - ]); + testErrorsAndWarnings( + 'from a_index | stats var0 = weighted_avg(longField, doubleField) by var1 = round(doubleField / 2)', + [] + ); - testErrorsAndWarnings('from a_index | stats sum(booleanField)', [ - 'Argument of [sum] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | stats sum(null)', []); - testErrorsAndWarnings('row nullVar = null | stats sum(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(longField, doubleField) by round(doubleField / 2), ipField', + [] + ); - describe('median', () => { - testErrorsAndWarnings('from a_index | stats var = median(numberField)', []); - testErrorsAndWarnings('from a_index | stats median(numberField)', []); - testErrorsAndWarnings('from a_index | stats var = round(median(numberField))', []); - testErrorsAndWarnings('from a_index | stats round(median(numberField))', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(longField, doubleField) by var1 = round(doubleField / 2), ipField', + [] + ); testErrorsAndWarnings( - 'from a_index | stats var = round(median(numberField)) + median(numberField)', + 'from a_index | stats avg(doubleField), weighted_avg(longField, doubleField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | stats round(median(numberField)) + median(numberField)', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(longField, doubleField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | stats median(numberField / 2)', []); - testErrorsAndWarnings('from a_index | stats var0 = median(numberField / 2)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), median(numberField / 2)', []); + testErrorsAndWarnings('from a_index | stats var = weighted_avg(longField, longField)', []); + testErrorsAndWarnings('from a_index | stats weighted_avg(longField, longField)', []); + testErrorsAndWarnings( + 'from a_index | stats var = round(weighted_avg(longField, longField))', + [] + ); + testErrorsAndWarnings('from a_index | stats round(weighted_avg(longField, longField))', []); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = median(numberField / 2)', + 'from a_index | stats var = round(weighted_avg(longField, longField)) + weighted_avg(longField, longField)', [] ); - testErrorsAndWarnings('from a_index | stats var0 = median(numberField)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), median(numberField)', []); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = median(numberField)', + 'from a_index | stats round(weighted_avg(longField, longField)) + weighted_avg(longField, longField)', [] ); + + testErrorsAndWarnings('from a_index | stats var0 = weighted_avg(longField, longField)', []); + testErrorsAndWarnings( - 'from a_index | stats median(numberField) by round(numberField / 2)', + 'from a_index | stats avg(doubleField), weighted_avg(longField, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats var0 = median(numberField) by var1 = round(numberField / 2)', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(longField, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), ipField', + 'from a_index | stats weighted_avg(longField, longField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), ipField', + 'from a_index | stats var0 = weighted_avg(longField, longField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), numberField / 2', + 'from a_index | stats avg(doubleField), weighted_avg(longField, longField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), numberField / 2', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(longField, longField) by var1 = round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('from a_index | stats var = median(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(longField, longField) by round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('from a_index | stats median(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(longField, longField) by var1 = round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('from a_index | stats median(stringField)', [ - 'Argument of [median] must be [number], found value [stringField] type [string]', - ]); + testErrorsAndWarnings( + 'from a_index | stats var = weighted_avg(longField, integerField)', + [] + ); + testErrorsAndWarnings('from a_index | stats weighted_avg(longField, integerField)', []); - testErrorsAndWarnings('from a_index | stats var = median(*)', [ - 'Using wildcards (*) in median is not allowed', - ]); + testErrorsAndWarnings( + 'from a_index | stats var = round(weighted_avg(longField, integerField))', + [] + ); - testErrorsAndWarnings('from a_index | sort median(numberField)', [ - 'SORT does not support function median', - ]); + testErrorsAndWarnings( + 'from a_index | stats round(weighted_avg(longField, integerField))', + [] + ); - testErrorsAndWarnings('from a_index | where median(numberField)', [ - 'WHERE does not support function median', - ]); + testErrorsAndWarnings( + 'from a_index | stats var = round(weighted_avg(longField, integerField)) + weighted_avg(longField, integerField)', + [] + ); - testErrorsAndWarnings('from a_index | where median(numberField) > 0', [ - 'WHERE does not support function median', - ]); + testErrorsAndWarnings( + 'from a_index | stats round(weighted_avg(longField, integerField)) + weighted_avg(longField, integerField)', + [] + ); - testErrorsAndWarnings('from a_index | eval var = median(numberField)', [ - 'EVAL does not support function median', - ]); + testErrorsAndWarnings( + 'from a_index | stats var0 = weighted_avg(longField, integerField)', + [] + ); - testErrorsAndWarnings('from a_index | eval var = median(numberField) > 0', [ - 'EVAL does not support function median', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(longField, integerField)', + [] + ); - testErrorsAndWarnings('from a_index | eval median(numberField)', [ - 'EVAL does not support function median', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(longField, integerField)', + [] + ); - testErrorsAndWarnings('from a_index | eval median(numberField) > 0', [ - 'EVAL does not support function median', - ]); + testErrorsAndWarnings( + 'from a_index | stats weighted_avg(longField, integerField) by round(doubleField / 2)', + [] + ); - testErrorsAndWarnings('from a_index | stats median(booleanField)', [ - 'Argument of [median] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | stats median(null)', []); - testErrorsAndWarnings('row nullVar = null | stats median(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats var0 = weighted_avg(longField, integerField) by var1 = round(doubleField / 2)', + [] + ); - describe('median_absolute_deviation', () => { testErrorsAndWarnings( - 'from a_index | stats var = median_absolute_deviation(numberField)', + 'from a_index | stats avg(doubleField), weighted_avg(longField, integerField) by round(doubleField / 2), ipField', [] ); - testErrorsAndWarnings('from a_index | stats median_absolute_deviation(numberField)', []); testErrorsAndWarnings( - 'from a_index | stats var = round(median_absolute_deviation(numberField))', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(longField, integerField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | stats round(median_absolute_deviation(numberField))', + 'from a_index | stats avg(doubleField), weighted_avg(longField, integerField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | stats var = round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(longField, integerField) by var1 = round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | stats round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)', + 'from a_index | stats var = weighted_avg(integerField, doubleField)', [] ); + testErrorsAndWarnings('from a_index | stats weighted_avg(integerField, doubleField)', []); testErrorsAndWarnings( - 'from a_index | stats median_absolute_deviation(numberField / 2)', + 'from a_index | stats var = round(weighted_avg(integerField, doubleField))', [] ); testErrorsAndWarnings( - 'from a_index | stats var0 = median_absolute_deviation(numberField / 2)', + 'from a_index | stats round(weighted_avg(integerField, doubleField))', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), median_absolute_deviation(numberField / 2)', + 'from a_index | stats var = round(weighted_avg(integerField, doubleField)) + weighted_avg(integerField, doubleField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField / 2)', + 'from a_index | stats round(weighted_avg(integerField, doubleField)) + weighted_avg(integerField, doubleField)', [] ); testErrorsAndWarnings( - 'from a_index | stats var0 = median_absolute_deviation(numberField)', + 'from a_index | stats var0 = weighted_avg(integerField, doubleField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), median_absolute_deviation(numberField)', + 'from a_index | stats avg(doubleField), weighted_avg(integerField, doubleField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField)', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, doubleField)', [] ); testErrorsAndWarnings( - 'from a_index | stats median_absolute_deviation(numberField) by round(numberField / 2)', + 'from a_index | stats weighted_avg(integerField, doubleField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | stats var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2)', + 'from a_index | stats var0 = weighted_avg(integerField, doubleField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), ipField', + 'from a_index | stats avg(doubleField), weighted_avg(integerField, doubleField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), ipField', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, doubleField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), numberField / 2', + 'from a_index | stats avg(doubleField), weighted_avg(integerField, doubleField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), numberField / 2', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, doubleField) by var1 = round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | stats var = median_absolute_deviation(avg(numberField))', - [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ] + 'from a_index | stats var = weighted_avg(integerField, longField)', + [] ); - - testErrorsAndWarnings('from a_index | stats median_absolute_deviation(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); - - testErrorsAndWarnings('from a_index | stats median_absolute_deviation(stringField)', [ - 'Argument of [median_absolute_deviation] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | stats var = median_absolute_deviation(*)', [ - 'Using wildcards (*) in median_absolute_deviation is not allowed', - ]); - - testErrorsAndWarnings('from a_index | sort median_absolute_deviation(numberField)', [ - 'SORT does not support function median_absolute_deviation', - ]); - - testErrorsAndWarnings('from a_index | where median_absolute_deviation(numberField)', [ - 'WHERE does not support function median_absolute_deviation', - ]); - - testErrorsAndWarnings('from a_index | where median_absolute_deviation(numberField) > 0', [ - 'WHERE does not support function median_absolute_deviation', - ]); - - testErrorsAndWarnings('from a_index | eval var = median_absolute_deviation(numberField)', [ - 'EVAL does not support function median_absolute_deviation', - ]); + testErrorsAndWarnings('from a_index | stats weighted_avg(integerField, longField)', []); testErrorsAndWarnings( - 'from a_index | eval var = median_absolute_deviation(numberField) > 0', - ['EVAL does not support function median_absolute_deviation'] + 'from a_index | stats var = round(weighted_avg(integerField, longField))', + [] ); - testErrorsAndWarnings('from a_index | eval median_absolute_deviation(numberField)', [ - 'EVAL does not support function median_absolute_deviation', - ]); - - testErrorsAndWarnings('from a_index | eval median_absolute_deviation(numberField) > 0', [ - 'EVAL does not support function median_absolute_deviation', - ]); - - testErrorsAndWarnings('from a_index | stats median_absolute_deviation(booleanField)', [ - 'Argument of [median_absolute_deviation] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | stats median_absolute_deviation(null)', []); - testErrorsAndWarnings('row nullVar = null | stats median_absolute_deviation(nullVar)', []); - }); - - describe('percentile', () => { - testErrorsAndWarnings('from a_index | stats var = percentile(numberField, 5)', []); - testErrorsAndWarnings('from a_index | stats percentile(numberField, 5)', []); - testErrorsAndWarnings('from a_index | stats var = round(percentile(numberField, 5))', []); - testErrorsAndWarnings('from a_index | stats round(percentile(numberField, 5))', []); - testErrorsAndWarnings( - 'from a_index | stats var = round(percentile(numberField, 5)) + percentile(numberField, 5)', + 'from a_index | stats round(weighted_avg(integerField, longField))', [] ); testErrorsAndWarnings( - 'from a_index | stats round(percentile(numberField, 5)) + percentile(numberField, 5)', + 'from a_index | stats var = round(weighted_avg(integerField, longField)) + weighted_avg(integerField, longField)', [] ); - testErrorsAndWarnings('from a_index | stats percentile(numberField, numberField)', [ - 'Argument of [percentile] must be a constant, received [numberField]', - ]); - - testErrorsAndWarnings('from a_index | stats percentile(numberField / 2, 5)', []); - testErrorsAndWarnings('from a_index | stats var0 = percentile(numberField / 2, 5)', []); - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), percentile(numberField / 2, 5)', + 'from a_index | stats round(weighted_avg(integerField, longField)) + weighted_avg(integerField, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = percentile(numberField / 2, 5)', + 'from a_index | stats var0 = weighted_avg(integerField, longField)', [] ); - testErrorsAndWarnings('from a_index | stats var0 = percentile(numberField, 5)', []); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), percentile(numberField, 5)', + 'from a_index | stats avg(doubleField), weighted_avg(integerField, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = percentile(numberField, 5)', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, longField)', [] ); testErrorsAndWarnings( - 'from a_index | stats percentile(numberField, 5) by round(numberField / 2)', + 'from a_index | stats weighted_avg(integerField, longField) by round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | stats var0 = percentile(numberField, 5) by var1 = round(numberField / 2)', + 'from a_index | stats var0 = weighted_avg(integerField, longField) by var1 = round(doubleField / 2)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), ipField', + 'from a_index | stats avg(doubleField), weighted_avg(integerField, longField) by round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), ipField', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, longField) by var1 = round(doubleField / 2), ipField', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), numberField / 2', + 'from a_index | stats avg(doubleField), weighted_avg(integerField, longField) by round(doubleField / 2), doubleField / 2', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), numberField / 2', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, longField) by var1 = round(doubleField / 2), doubleField / 2', [] ); - testErrorsAndWarnings('from a_index | stats var = percentile(avg(numberField), 5)', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); - - testErrorsAndWarnings('from a_index | stats percentile(avg(numberField), 5)', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); - - testErrorsAndWarnings('from a_index | stats percentile(stringField, 5)', [ - 'Argument of [percentile] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | sort percentile(numberField, 5)', [ - 'SORT does not support function percentile', - ]); - - testErrorsAndWarnings('from a_index | where percentile(numberField, 5)', [ - 'WHERE does not support function percentile', - ]); - - testErrorsAndWarnings('from a_index | where percentile(numberField, 5) > 0', [ - 'WHERE does not support function percentile', - ]); - - testErrorsAndWarnings('from a_index | eval var = percentile(numberField, 5)', [ - 'EVAL does not support function percentile', - ]); - - testErrorsAndWarnings('from a_index | eval var = percentile(numberField, 5) > 0', [ - 'EVAL does not support function percentile', - ]); - - testErrorsAndWarnings('from a_index | eval percentile(numberField, 5)', [ - 'EVAL does not support function percentile', - ]); - - testErrorsAndWarnings('from a_index | eval percentile(numberField, 5) > 0', [ - 'EVAL does not support function percentile', - ]); - - testErrorsAndWarnings('from a_index | stats percentile(booleanField, 5)', [ - 'Argument of [percentile] must be [number], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | stats percentile(null, null)', []); - testErrorsAndWarnings('row nullVar = null | stats percentile(nullVar, nullVar)', [ - 'Argument of [percentile] must be a constant, received [nullVar]', - ]); - }); - - describe('max', () => { - testErrorsAndWarnings('from a_index | stats var = max(numberField)', []); - testErrorsAndWarnings('from a_index | stats max(numberField)', []); - testErrorsAndWarnings('from a_index | stats var = round(max(numberField))', []); - testErrorsAndWarnings('from a_index | stats round(max(numberField))', []); - testErrorsAndWarnings( - 'from a_index | stats var = round(max(numberField)) + max(numberField)', + 'from a_index | stats var = weighted_avg(integerField, integerField)', [] ); + testErrorsAndWarnings('from a_index | stats weighted_avg(integerField, integerField)', []); testErrorsAndWarnings( - 'from a_index | stats round(max(numberField)) + max(numberField)', + 'from a_index | stats var = round(weighted_avg(integerField, integerField))', [] ); - testErrorsAndWarnings('from a_index | stats max(numberField / 2)', []); - testErrorsAndWarnings('from a_index | stats var0 = max(numberField / 2)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), max(numberField / 2)', []); + testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = max(numberField / 2)', + 'from a_index | stats round(weighted_avg(integerField, integerField))', [] ); - testErrorsAndWarnings('from a_index | stats var0 = max(numberField)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), max(numberField)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), var0 = max(numberField)', []); + testErrorsAndWarnings( - 'from a_index | stats max(numberField) by round(numberField / 2)', + 'from a_index | stats var = round(weighted_avg(integerField, integerField)) + weighted_avg(integerField, integerField)', [] ); testErrorsAndWarnings( - 'from a_index | stats var0 = max(numberField) by var1 = round(numberField / 2)', + 'from a_index | stats round(weighted_avg(integerField, integerField)) + weighted_avg(integerField, integerField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), ipField', + 'from a_index | stats var0 = weighted_avg(integerField, integerField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), ipField', + 'from a_index | stats avg(doubleField), weighted_avg(integerField, integerField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), numberField / 2', + 'from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, integerField)', [] ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), numberField / 2', + 'from a_index | stats weighted_avg(integerField, integerField) by round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | stats var = max(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); - - testErrorsAndWarnings('from a_index | stats max(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); - - testErrorsAndWarnings('from a_index | stats max(stringField)', [ - 'Argument of [max] must be [number], found value [stringField] type [string]', - ]); - - testErrorsAndWarnings('from a_index | stats var = max(*)', [ - 'Using wildcards (*) in max is not allowed', - ]); - - testErrorsAndWarnings('from a_index | stats var = max(dateField)', []); - testErrorsAndWarnings('from a_index | stats max(dateField)', []); - testErrorsAndWarnings('from a_index | stats var = round(max(dateField))', []); - testErrorsAndWarnings('from a_index | stats round(max(dateField))', []); testErrorsAndWarnings( - 'from a_index | stats var = round(max(dateField)) + max(dateField)', + 'from a_index | stats var0 = weighted_avg(integerField, integerField) by var1 = round(doubleField / 2)', [] ); - testErrorsAndWarnings('from a_index | stats round(max(dateField)) + max(dateField)', []); - - testErrorsAndWarnings('from a_index | sort max(numberField)', [ - 'SORT does not support function max', - ]); - testErrorsAndWarnings('from a_index | where max(numberField)', [ - 'WHERE does not support function max', - ]); - - testErrorsAndWarnings('from a_index | where max(numberField) > 0', [ - 'WHERE does not support function max', - ]); - - testErrorsAndWarnings('from a_index | where max(dateField)', [ - 'WHERE does not support function max', - ]); - - testErrorsAndWarnings('from a_index | where max(dateField) > 0', [ - 'WHERE does not support function max', - ]); - - testErrorsAndWarnings('from a_index | eval var = max(numberField)', [ - 'EVAL does not support function max', - ]); - - testErrorsAndWarnings('from a_index | eval var = max(numberField) > 0', [ - 'EVAL does not support function max', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(integerField, integerField) by round(doubleField / 2), ipField', + [] + ); - testErrorsAndWarnings('from a_index | eval max(numberField)', [ - 'EVAL does not support function max', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, integerField) by var1 = round(doubleField / 2), ipField', + [] + ); - testErrorsAndWarnings('from a_index | eval max(numberField) > 0', [ - 'EVAL does not support function max', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), weighted_avg(integerField, integerField) by round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('from a_index | eval var = max(dateField)', [ - 'EVAL does not support function max', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = weighted_avg(integerField, integerField) by var1 = round(doubleField / 2), doubleField / 2', + [] + ); - testErrorsAndWarnings('from a_index | eval var = max(dateField) > 0', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(doubleField, longField)', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval max(dateField)', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(doubleField, longField) > 0', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval max(dateField) > 0', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(doubleField, integerField)', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | stats max(booleanField)', []); - testErrorsAndWarnings('from a_index | stats max(null)', []); - testErrorsAndWarnings('row nullVar = null | stats max(nullVar)', []); - testErrorsAndWarnings('from a_index | stats max("2022")', []); - testErrorsAndWarnings('from a_index | stats max(concat("20", "22"))', [ - 'Argument of [max] must be [number], found value [concat("20","22")] type [string]', + testErrorsAndWarnings('from a_index | where weighted_avg(doubleField, integerField) > 0', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | stats max(cartesianPointField)', [ - 'Argument of [max] must be [number], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | where weighted_avg(longField, doubleField)', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | stats var = max(booleanField)', []); - - testErrorsAndWarnings('from a_index | where max(booleanField)', [ - 'WHERE does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(longField, doubleField) > 0', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | where max(booleanField) > 0', [ - 'WHERE does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(longField, longField)', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = max(booleanField)', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(longField, longField) > 0', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = max(booleanField) > 0', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(longField, integerField)', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval max(booleanField)', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(longField, integerField) > 0', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval max(booleanField) > 0', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(integerField, doubleField)', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | stats var = max(ipField)', []); - testErrorsAndWarnings('from a_index | stats max(ipField)', []); - testErrorsAndWarnings('from a_index | where max(ipField)', [ - 'WHERE does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(integerField, doubleField) > 0', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | where max(ipField) > 0', [ - 'WHERE does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(integerField, longField)', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = max(ipField)', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(integerField, longField) > 0', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = max(ipField) > 0', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(integerField, integerField)', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval max(ipField)', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | where weighted_avg(integerField, integerField) > 0', [ + 'WHERE does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval max(ipField) > 0', [ - 'EVAL does not support function max', + testErrorsAndWarnings('from a_index | eval var = weighted_avg(doubleField, longField)', [ + 'EVAL does not support function weighted_avg', ]); - }); - - describe('min', () => { - testErrorsAndWarnings('from a_index | stats var = min(numberField)', []); - testErrorsAndWarnings('from a_index | stats min(numberField)', []); - testErrorsAndWarnings('from a_index | stats var = round(min(numberField))', []); - testErrorsAndWarnings('from a_index | stats round(min(numberField))', []); - - testErrorsAndWarnings( - 'from a_index | stats var = round(min(numberField)) + min(numberField)', - [] - ); - - testErrorsAndWarnings( - 'from a_index | stats round(min(numberField)) + min(numberField)', - [] - ); - testErrorsAndWarnings('from a_index | stats min(numberField / 2)', []); - testErrorsAndWarnings('from a_index | stats var0 = min(numberField / 2)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), min(numberField / 2)', []); - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = min(numberField / 2)', - [] - ); - testErrorsAndWarnings('from a_index | stats var0 = min(numberField)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), min(numberField)', []); - testErrorsAndWarnings('from a_index | stats avg(numberField), var0 = min(numberField)', []); - testErrorsAndWarnings( - 'from a_index | stats min(numberField) by round(numberField / 2)', - [] - ); - - testErrorsAndWarnings( - 'from a_index | stats var0 = min(numberField) by var1 = round(numberField / 2)', - [] - ); - - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), ipField', - [] - ); - - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), ipField', - [] - ); - - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), numberField / 2', - [] - ); testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), numberField / 2', - [] + 'from a_index | eval var = weighted_avg(doubleField, longField) > 0', + ['EVAL does not support function weighted_avg'] ); - testErrorsAndWarnings('from a_index | stats var = min(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); - - testErrorsAndWarnings('from a_index | stats min(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", + testErrorsAndWarnings('from a_index | eval weighted_avg(doubleField, longField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | stats min(stringField)', [ - 'Argument of [min] must be [number], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | eval weighted_avg(doubleField, longField) > 0', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | stats var = min(*)', [ - 'Using wildcards (*) in min is not allowed', + testErrorsAndWarnings('from a_index | eval var = weighted_avg(doubleField, integerField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | stats var = min(dateField)', []); - testErrorsAndWarnings('from a_index | stats min(dateField)', []); - testErrorsAndWarnings('from a_index | stats var = round(min(dateField))', []); - testErrorsAndWarnings('from a_index | stats round(min(dateField))', []); testErrorsAndWarnings( - 'from a_index | stats var = round(min(dateField)) + min(dateField)', - [] + 'from a_index | eval var = weighted_avg(doubleField, integerField) > 0', + ['EVAL does not support function weighted_avg'] ); - testErrorsAndWarnings('from a_index | stats round(min(dateField)) + min(dateField)', []); - - testErrorsAndWarnings('from a_index | sort min(numberField)', [ - 'SORT does not support function min', - ]); - testErrorsAndWarnings('from a_index | where min(numberField)', [ - 'WHERE does not support function min', - ]); - - testErrorsAndWarnings('from a_index | where min(numberField) > 0', [ - 'WHERE does not support function min', - ]); - - testErrorsAndWarnings('from a_index | where min(dateField)', [ - 'WHERE does not support function min', - ]); - - testErrorsAndWarnings('from a_index | where min(dateField) > 0', [ - 'WHERE does not support function min', - ]); - - testErrorsAndWarnings('from a_index | eval var = min(numberField)', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval weighted_avg(doubleField, integerField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = min(numberField) > 0', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval weighted_avg(doubleField, integerField) > 0', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval min(numberField)', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval var = weighted_avg(longField, doubleField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval min(numberField) > 0', [ - 'EVAL does not support function min', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = weighted_avg(longField, doubleField) > 0', + ['EVAL does not support function weighted_avg'] + ); - testErrorsAndWarnings('from a_index | eval var = min(dateField)', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval weighted_avg(longField, doubleField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = min(dateField) > 0', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval weighted_avg(longField, doubleField) > 0', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval min(dateField)', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval var = weighted_avg(longField, longField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval min(dateField) > 0', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval var = weighted_avg(longField, longField) > 0', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | stats min(booleanField)', []); - testErrorsAndWarnings('from a_index | stats min(null)', []); - testErrorsAndWarnings('row nullVar = null | stats min(nullVar)', []); - testErrorsAndWarnings('from a_index | stats min("2022")', []); - testErrorsAndWarnings('from a_index | stats min(concat("20", "22"))', [ - 'Argument of [min] must be [number], found value [concat("20","22")] type [string]', + testErrorsAndWarnings('from a_index | eval weighted_avg(longField, longField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | stats min(cartesianPointField)', [ - 'Argument of [min] must be [number], found value [cartesianPointField] type [cartesian_point]', + testErrorsAndWarnings('from a_index | eval weighted_avg(longField, longField) > 0', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | stats var = min(booleanField)', []); - - testErrorsAndWarnings('from a_index | where min(booleanField)', [ - 'WHERE does not support function min', + testErrorsAndWarnings('from a_index | eval var = weighted_avg(longField, integerField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | where min(booleanField) > 0', [ - 'WHERE does not support function min', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = weighted_avg(longField, integerField) > 0', + ['EVAL does not support function weighted_avg'] + ); - testErrorsAndWarnings('from a_index | eval var = min(booleanField)', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval weighted_avg(longField, integerField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = min(booleanField) > 0', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval weighted_avg(longField, integerField) > 0', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval min(booleanField)', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval var = weighted_avg(integerField, doubleField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval min(booleanField) > 0', [ - 'EVAL does not support function min', - ]); - testErrorsAndWarnings('from a_index | stats var = min(ipField)', []); - testErrorsAndWarnings('from a_index | stats min(ipField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = weighted_avg(integerField, doubleField) > 0', + ['EVAL does not support function weighted_avg'] + ); - testErrorsAndWarnings('from a_index | where min(ipField)', [ - 'WHERE does not support function min', + testErrorsAndWarnings('from a_index | eval weighted_avg(integerField, doubleField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | where min(ipField) > 0', [ - 'WHERE does not support function min', + testErrorsAndWarnings('from a_index | eval weighted_avg(integerField, doubleField) > 0', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = min(ipField)', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval var = weighted_avg(integerField, longField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = min(ipField) > 0', [ - 'EVAL does not support function min', - ]); + testErrorsAndWarnings( + 'from a_index | eval var = weighted_avg(integerField, longField) > 0', + ['EVAL does not support function weighted_avg'] + ); - testErrorsAndWarnings('from a_index | eval min(ipField)', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval weighted_avg(integerField, longField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval min(ipField) > 0', [ - 'EVAL does not support function min', + testErrorsAndWarnings('from a_index | eval weighted_avg(integerField, longField) > 0', [ + 'EVAL does not support function weighted_avg', ]); - }); - - describe('count', () => { - testErrorsAndWarnings('from a_index | stats var = count(stringField)', []); - testErrorsAndWarnings('from a_index | stats count(stringField)', []); - testErrorsAndWarnings('from a_index | stats var = round(count(stringField))', []); - testErrorsAndWarnings('from a_index | stats round(count(stringField))', []); testErrorsAndWarnings( - 'from a_index | stats var = round(count(stringField)) + count(stringField)', - [] + 'from a_index | eval var = weighted_avg(integerField, integerField)', + ['EVAL does not support function weighted_avg'] ); testErrorsAndWarnings( - 'from a_index | stats round(count(stringField)) + count(stringField)', - [] + 'from a_index | eval var = weighted_avg(integerField, integerField) > 0', + ['EVAL does not support function weighted_avg'] ); - testErrorsAndWarnings('from a_index | sort count(stringField)', [ - 'SORT does not support function count', - ]); - - testErrorsAndWarnings('from a_index | where count(stringField)', [ - 'WHERE does not support function count', - ]); - - testErrorsAndWarnings('from a_index | where count(stringField) > 0', [ - 'WHERE does not support function count', + testErrorsAndWarnings('from a_index | eval weighted_avg(integerField, integerField)', [ + 'EVAL does not support function weighted_avg', ]); - testErrorsAndWarnings('from a_index | eval var = count(stringField)', [ - 'EVAL does not support function count', + testErrorsAndWarnings('from a_index | eval weighted_avg(integerField, integerField) > 0', [ + 'EVAL does not support function weighted_avg', ]); + }); - testErrorsAndWarnings('from a_index | eval var = count(stringField) > 0', [ - 'EVAL does not support function count', - ]); + describe('bucket', () => { + testErrorsAndWarnings('from a_index | stats by bucket(dateField, 1 year)', []); + testErrorsAndWarnings('from a_index | stats by bin(dateField, 1 year)', []); - testErrorsAndWarnings('from a_index | eval count(stringField)', [ - 'EVAL does not support function count', + testErrorsAndWarnings('from a_index | stats by bucket(integerField, integerField)', [ + 'Argument of [bucket] must be a constant, received [integerField]', ]); - testErrorsAndWarnings('from a_index | eval count(stringField) > 0', [ - 'EVAL does not support function count', + testErrorsAndWarnings('from a_index | stats by bin(integerField, integerField)', [ + 'Argument of [bin] must be a constant, received [integerField]', ]); - testErrorsAndWarnings('from a_index | stats count(null)', []); - testErrorsAndWarnings('row nullVar = null | stats count(nullVar)', []); - }); - describe('count_distinct', () => { testErrorsAndWarnings( - 'from a_index | stats var = count_distinct(stringField, numberField)', - [] + 'from a_index | stats by bucket(dateField, integerField, textField, textField)', + [ + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [textField]', + 'Argument of [bucket] must be a constant, received [textField]', + ] ); - testErrorsAndWarnings('from a_index | stats count_distinct(stringField, numberField)', []); testErrorsAndWarnings( - 'from a_index | stats var = round(count_distinct(stringField, numberField))', - [] + 'from a_index | stats by bin(dateField, integerField, textField, textField)', + [ + 'Argument of [bin] must be a constant, received [integerField]', + 'Argument of [bin] must be a constant, received [textField]', + 'Argument of [bin] must be a constant, received [textField]', + ] ); testErrorsAndWarnings( - 'from a_index | stats round(count_distinct(stringField, numberField))', - [] + 'from a_index | stats by bucket(dateField, integerField, dateField, dateField)', + [ + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [dateField]', + 'Argument of [bucket] must be a constant, received [dateField]', + ] ); testErrorsAndWarnings( - 'from a_index | stats var = round(count_distinct(stringField, numberField)) + count_distinct(stringField, numberField)', - [] + 'from a_index | stats by bin(dateField, integerField, dateField, dateField)', + [ + 'Argument of [bin] must be a constant, received [integerField]', + 'Argument of [bin] must be a constant, received [dateField]', + 'Argument of [bin] must be a constant, received [dateField]', + ] ); testErrorsAndWarnings( - 'from a_index | stats round(count_distinct(stringField, numberField)) + count_distinct(stringField, numberField)', - [] + 'from a_index | stats by bucket(dateField, integerField, textField, dateField)', + [ + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [textField]', + 'Argument of [bucket] must be a constant, received [dateField]', + ] ); - testErrorsAndWarnings('from a_index | sort count_distinct(stringField, numberField)', [ - 'SORT does not support function count_distinct', - ]); - - testErrorsAndWarnings('from a_index | where count_distinct(stringField, numberField)', [ - 'WHERE does not support function count_distinct', - ]); - - testErrorsAndWarnings('from a_index | where count_distinct(stringField, numberField) > 0', [ - 'WHERE does not support function count_distinct', - ]); - testErrorsAndWarnings( - 'from a_index | eval var = count_distinct(stringField, numberField)', - ['EVAL does not support function count_distinct'] + 'from a_index | stats by bin(dateField, integerField, textField, dateField)', + [ + 'Argument of [bin] must be a constant, received [integerField]', + 'Argument of [bin] must be a constant, received [textField]', + 'Argument of [bin] must be a constant, received [dateField]', + ] ); testErrorsAndWarnings( - 'from a_index | eval var = count_distinct(stringField, numberField) > 0', - ['EVAL does not support function count_distinct'] + 'from a_index | stats by bucket(dateField, integerField, dateField, textField)', + [ + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [dateField]', + 'Argument of [bucket] must be a constant, received [textField]', + ] ); - testErrorsAndWarnings('from a_index | eval count_distinct(stringField, numberField)', [ - 'EVAL does not support function count_distinct', - ]); - - testErrorsAndWarnings('from a_index | eval count_distinct(stringField, numberField) > 0', [ - 'EVAL does not support function count_distinct', - ]); - testErrorsAndWarnings('from a_index | stats count_distinct(null, null)', []); - testErrorsAndWarnings('row nullVar = null | stats count_distinct(nullVar, nullVar)', []); - }); - - describe('st_centroid_agg', () => { testErrorsAndWarnings( - 'from a_index | stats var = st_centroid_agg(cartesianPointField)', - [] + 'from a_index | stats by bin(dateField, integerField, dateField, textField)', + [ + 'Argument of [bin] must be a constant, received [integerField]', + 'Argument of [bin] must be a constant, received [dateField]', + 'Argument of [bin] must be a constant, received [textField]', + ] ); - testErrorsAndWarnings('from a_index | stats st_centroid_agg(cartesianPointField)', []); - testErrorsAndWarnings('from a_index | stats var = st_centroid_agg(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); + testErrorsAndWarnings( + 'from a_index | stats by bucket(integerField, integerField, integerField, integerField)', + [ + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [integerField]', + ] + ); - testErrorsAndWarnings('from a_index | stats st_centroid_agg(avg(numberField))', [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ]); + testErrorsAndWarnings( + 'from a_index | stats by bin(integerField, integerField, integerField, integerField)', + [ + 'Argument of [bin] must be a constant, received [integerField]', + 'Argument of [bin] must be a constant, received [integerField]', + 'Argument of [bin] must be a constant, received [integerField]', + ] + ); - testErrorsAndWarnings('from a_index | stats st_centroid_agg(stringField)', [ - 'Argument of [st_centroid_agg] must be [cartesian_point], found value [stringField] type [string]', + testErrorsAndWarnings('from a_index | sort bucket(dateField, 1 year)', [ + 'SORT does not support function bucket', ]); - testErrorsAndWarnings('from a_index | stats var = st_centroid_agg(*)', [ - 'Using wildcards (*) in st_centroid_agg is not allowed', - ]); + testErrorsAndWarnings('from a_index | stats bucket(null, null, null, null)', []); - testErrorsAndWarnings('from a_index | stats var = st_centroid_agg(geoPointField)', []); - testErrorsAndWarnings('from a_index | stats st_centroid_agg(geoPointField)', []); + testErrorsAndWarnings( + 'row nullVar = null | stats bucket(nullVar, nullVar, nullVar, nullVar)', + [ + 'Argument of [bucket] must be a constant, received [nullVar]', + 'Argument of [bucket] must be a constant, received [nullVar]', + 'Argument of [bucket] must be a constant, received [nullVar]', + ] + ); - testErrorsAndWarnings('from a_index | sort st_centroid_agg(cartesianPointField)', [ - 'SORT does not support function st_centroid_agg', + testErrorsAndWarnings('from a_index | stats bucket("2022", 1 year)', []); + testErrorsAndWarnings('from a_index | stats bucket(concat("20", "22"), 1 year)', [ + 'Argument of [bucket] must be [date], found value [concat("20","22")] type [keyword]', ]); - testErrorsAndWarnings('from a_index | where st_centroid_agg(cartesianPointField)', [ - 'WHERE does not support function st_centroid_agg', - ]); + testErrorsAndWarnings( + 'from a_index | stats bucket("2022", integerField, textField, textField)', + [ + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [textField]', + 'Argument of [bucket] must be a constant, received [textField]', + ] + ); - testErrorsAndWarnings('from a_index | where st_centroid_agg(cartesianPointField) > 0', [ - 'WHERE does not support function st_centroid_agg', - ]); + testErrorsAndWarnings( + 'from a_index | stats bucket(concat("20", "22"), integerField, textField, textField)', + [ + 'Argument of [bucket] must be [date], found value [concat("20","22")] type [keyword]', + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [textField]', + 'Argument of [bucket] must be a constant, received [textField]', + ] + ); - testErrorsAndWarnings('from a_index | where st_centroid_agg(geoPointField)', [ - 'WHERE does not support function st_centroid_agg', + testErrorsAndWarnings('from a_index | stats bucket("2022", integerField, "2022", "2022")', [ + 'Argument of [bucket] must be a constant, received [integerField]', ]); - testErrorsAndWarnings('from a_index | where st_centroid_agg(geoPointField) > 0', [ - 'WHERE does not support function st_centroid_agg', - ]); + testErrorsAndWarnings( + 'from a_index | stats bucket(concat("20", "22"), integerField, concat("20", "22"), concat("20", "22"))', + [ + 'Argument of [bucket] must be [date], found value [concat("20","22")] type [keyword]', + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be [date], found value [concat("20","22")] type [keyword]', + 'Argument of [bucket] must be [date], found value [concat("20","22")] type [keyword]', + ] + ); - testErrorsAndWarnings('from a_index | eval var = st_centroid_agg(cartesianPointField)', [ - 'EVAL does not support function st_centroid_agg', - ]); + testErrorsAndWarnings( + 'from a_index | stats bucket("2022", integerField, textField, "2022")', + [ + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [textField]', + ] + ); testErrorsAndWarnings( - 'from a_index | eval var = st_centroid_agg(cartesianPointField) > 0', - ['EVAL does not support function st_centroid_agg'] + 'from a_index | stats bucket(concat("20", "22"), integerField, textField, concat("20", "22"))', + [ + 'Argument of [bucket] must be [date], found value [concat("20","22")] type [keyword]', + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [textField]', + 'Argument of [bucket] must be [date], found value [concat("20","22")] type [keyword]', + ] ); - testErrorsAndWarnings('from a_index | eval st_centroid_agg(cartesianPointField)', [ - 'EVAL does not support function st_centroid_agg', - ]); + testErrorsAndWarnings( + 'from a_index | stats bucket("2022", integerField, "2022", textField)', + [ + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be a constant, received [textField]', + ] + ); - testErrorsAndWarnings('from a_index | eval st_centroid_agg(cartesianPointField) > 0', [ - 'EVAL does not support function st_centroid_agg', - ]); + testErrorsAndWarnings( + 'from a_index | stats bucket(concat("20", "22"), integerField, concat("20", "22"), textField)', + [ + 'Argument of [bucket] must be [date], found value [concat("20","22")] type [keyword]', + 'Argument of [bucket] must be a constant, received [integerField]', + 'Argument of [bucket] must be [date], found value [concat("20","22")] type [keyword]', + 'Argument of [bucket] must be a constant, received [textField]', + ] + ); + }); - testErrorsAndWarnings('from a_index | eval var = st_centroid_agg(geoPointField)', [ - 'EVAL does not support function st_centroid_agg', + describe('percentile', () => { + testErrorsAndWarnings('from a_index | stats var = percentile(doubleField, doubleField)', [ + 'Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]', ]); - - testErrorsAndWarnings('from a_index | eval var = st_centroid_agg(geoPointField) > 0', [ - 'EVAL does not support function st_centroid_agg', + testErrorsAndWarnings('from a_index | stats percentile(doubleField, doubleField)', [ + 'Argument of [percentile] must be a constant, received [doubleField]', ]); - testErrorsAndWarnings('from a_index | eval st_centroid_agg(geoPointField)', [ - 'EVAL does not support function st_centroid_agg', - ]); + testErrorsAndWarnings( + 'from a_index | stats var = round(percentile(doubleField, doubleField))', + [ + 'Argument of [=] must be a constant, received [round(percentile(doubleField,doubleField))]', + ] + ); - testErrorsAndWarnings('from a_index | eval st_centroid_agg(geoPointField) > 0', [ - 'EVAL does not support function st_centroid_agg', + testErrorsAndWarnings('from a_index | stats round(percentile(doubleField, doubleField))', [ + 'Argument of [round] must be a constant, received [percentile(doubleField,doubleField)]', ]); - testErrorsAndWarnings('from a_index | stats st_centroid_agg(booleanField)', [ - 'Argument of [st_centroid_agg] must be [cartesian_point], found value [booleanField] type [boolean]', - ]); - testErrorsAndWarnings('from a_index | stats st_centroid_agg(null)', []); - testErrorsAndWarnings('row nullVar = null | stats st_centroid_agg(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats var = round(percentile(doubleField, doubleField)) + percentile(doubleField, doubleField)', + [ + 'Argument of [=] must be a constant, received [round(percentile(doubleField,doubleField))+percentile(doubleField,doubleField)]', + ] + ); - describe('values', () => { - testErrorsAndWarnings('from a_index | stats var = values(stringField)', []); - testErrorsAndWarnings('from a_index | stats values(stringField)', []); + testErrorsAndWarnings( + 'from a_index | stats round(percentile(doubleField, doubleField)) + percentile(doubleField, doubleField)', + [ + 'Argument of [+] must be a constant, received [round(percentile(doubleField,doubleField))]', + 'Argument of [+] must be a constant, received [percentile(doubleField,doubleField)]', + ] + ); - testErrorsAndWarnings('from a_index | sort values(stringField)', [ - 'SORT does not support function values', + testErrorsAndWarnings('from a_index | stats percentile(doubleField / 2, doubleField)', [ + 'Argument of [percentile] must be a constant, received [doubleField]', ]); + testErrorsAndWarnings( + 'from a_index | stats var0 = percentile(doubleField / 2, doubleField)', + ['Argument of [=] must be a constant, received [percentile(doubleField/2,doubleField)]'] + ); - testErrorsAndWarnings('from a_index | where values(stringField)', [ - 'WHERE does not support function values', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(doubleField / 2, doubleField)', + ['Argument of [percentile] must be a constant, received [doubleField]'] + ); - testErrorsAndWarnings('from a_index | where values(stringField) > 0', [ - 'WHERE does not support function values', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField / 2, doubleField)', + ['Argument of [=] must be a constant, received [percentile(doubleField/2,doubleField)]'] + ); - testErrorsAndWarnings('from a_index | eval var = values(stringField)', [ - 'EVAL does not support function values', + testErrorsAndWarnings('from a_index | stats var0 = percentile(doubleField, doubleField)', [ + 'Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]', ]); - testErrorsAndWarnings('from a_index | eval var = values(stringField) > 0', [ - 'EVAL does not support function values', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(doubleField, doubleField)', + ['Argument of [percentile] must be a constant, received [doubleField]'] + ); - testErrorsAndWarnings('from a_index | eval values(stringField)', [ - 'EVAL does not support function values', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField, doubleField)', + ['Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]'] + ); - testErrorsAndWarnings('from a_index | eval values(stringField) > 0', [ - 'EVAL does not support function values', - ]); - testErrorsAndWarnings('from a_index | stats values(null)', []); - testErrorsAndWarnings('row nullVar = null | stats values(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats percentile(doubleField, doubleField) by round(doubleField / 2)', + ['Argument of [percentile] must be a constant, received [doubleField]'] + ); - describe('bucket', () => { - testErrorsAndWarnings('from a_index | stats by bucket(dateField, 1 year)', []); - testErrorsAndWarnings('from a_index | stats by bin(dateField, 1 year)', []); - testErrorsAndWarnings('from a_index | stats by bucket(numberField, 5)', []); + testErrorsAndWarnings( + 'from a_index | stats var0 = percentile(doubleField, doubleField) by var1 = round(doubleField / 2)', + ['Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]'] + ); - testErrorsAndWarnings('from a_index | stats by bucket(numberField, numberField)', [ - 'Argument of [bucket] must be a constant, received [numberField]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(doubleField, doubleField) by round(doubleField / 2), ipField', + ['Argument of [percentile] must be a constant, received [doubleField]'] + ); - testErrorsAndWarnings('from a_index | stats by bin(numberField, 5)', []); - testErrorsAndWarnings('from a_index | stats by bucket(dateField, 5, "a", "a")', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField, doubleField) by var1 = round(doubleField / 2), ipField', + ['Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]'] + ); testErrorsAndWarnings( - 'from a_index | stats by bucket(dateField, numberField, stringField, stringField)', - [ - 'Argument of [bucket] must be a constant, received [numberField]', - 'Argument of [bucket] must be a constant, received [stringField]', - 'Argument of [bucket] must be a constant, received [stringField]', - ] + 'from a_index | stats avg(doubleField), percentile(doubleField, doubleField) by round(doubleField / 2), doubleField / 2', + ['Argument of [percentile] must be a constant, received [doubleField]'] ); - testErrorsAndWarnings('from a_index | stats by bin(dateField, 5, "a", "a")', []); - testErrorsAndWarnings('from a_index | stats by bucket(dateField, 5, now(), now())', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField, doubleField) by var1 = round(doubleField / 2), doubleField / 2', + ['Argument of [=] must be a constant, received [percentile(doubleField,doubleField)]'] + ); testErrorsAndWarnings( - 'from a_index | stats by bucket(dateField, numberField, dateField, dateField)', + 'from a_index | stats var = percentile(avg(integerField), avg(integerField))', [ - 'Argument of [bucket] must be a constant, received [numberField]', - 'Argument of [bucket] must be a constant, received [dateField]', - 'Argument of [bucket] must be a constant, received [dateField]', + 'Argument of [=] must be a constant, received [percentile(avg(integerField),avg(integerField))]', + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", ] ); - testErrorsAndWarnings('from a_index | stats by bin(dateField, 5, now(), now())', []); - testErrorsAndWarnings('from a_index | stats by bucket(dateField, 5, "a", now())', []); - testErrorsAndWarnings( - 'from a_index | stats by bucket(dateField, numberField, stringField, dateField)', + 'from a_index | stats percentile(avg(integerField), avg(integerField))', [ - 'Argument of [bucket] must be a constant, received [numberField]', - 'Argument of [bucket] must be a constant, received [stringField]', - 'Argument of [bucket] must be a constant, received [dateField]', + 'Argument of [percentile] must be a constant, received [avg(integerField)]', + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(integerField)] of type [double]", ] ); - testErrorsAndWarnings('from a_index | stats by bin(dateField, 5, "a", now())', []); - testErrorsAndWarnings('from a_index | stats by bucket(dateField, 5, now(), "a")', []); + testErrorsAndWarnings('from a_index | stats percentile(booleanField, )', [ + "SyntaxError: no viable alternative at input 'percentile(booleanField, )'", + "SyntaxError: mismatched input ')' expecting {QUOTED_STRING, INTEGER_LITERAL, DECIMAL_LITERAL, 'false', '(', 'not', 'null', '?', 'true', '+', '-', NAMED_OR_POSITIONAL_PARAM, OPENING_BRACKET, UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER}", + 'At least one aggregation or grouping expression required in [STATS]', + ]); + testErrorsAndWarnings('from a_index | stats var = percentile(doubleField, longField)', [ + 'Argument of [=] must be a constant, received [percentile(doubleField,longField)]', + ]); + testErrorsAndWarnings('from a_index | stats percentile(doubleField, longField)', [ + 'Argument of [percentile] must be a constant, received [longField]', + ]); testErrorsAndWarnings( - 'from a_index | stats by bucket(dateField, numberField, dateField, stringField)', + 'from a_index | stats var = round(percentile(doubleField, longField))', [ - 'Argument of [bucket] must be a constant, received [numberField]', - 'Argument of [bucket] must be a constant, received [dateField]', - 'Argument of [bucket] must be a constant, received [stringField]', + 'Argument of [=] must be a constant, received [round(percentile(doubleField,longField))]', ] ); - - testErrorsAndWarnings('from a_index | stats by bin(dateField, 5, now(), "a")', []); - testErrorsAndWarnings('from a_index | stats by bucket(numberField, 5, 5, 5)', []); + testErrorsAndWarnings('from a_index | stats round(percentile(doubleField, longField))', [ + 'Argument of [round] must be a constant, received [percentile(doubleField,longField)]', + ]); testErrorsAndWarnings( - 'from a_index | stats by bucket(numberField, numberField, numberField, numberField)', + 'from a_index | stats var = round(percentile(doubleField, longField)) + percentile(doubleField, longField)', [ - 'Argument of [bucket] must be a constant, received [numberField]', - 'Argument of [bucket] must be a constant, received [numberField]', - 'Argument of [bucket] must be a constant, received [numberField]', + 'Argument of [=] must be a constant, received [round(percentile(doubleField,longField))+percentile(doubleField,longField)]', ] ); - testErrorsAndWarnings('from a_index | stats by bin(numberField, 5, 5, 5)', []); - - testErrorsAndWarnings('from a_index | sort bucket(dateField, 1 year)', [ - 'SORT does not support function bucket', - ]); - testErrorsAndWarnings('from a_index | stats bucket(null, null, null, null)', []); - testErrorsAndWarnings( - 'row nullVar = null | stats bucket(nullVar, nullVar, nullVar, nullVar)', + 'from a_index | stats round(percentile(doubleField, longField)) + percentile(doubleField, longField)', [ - 'Argument of [bucket] must be a constant, received [nullVar]', - 'Argument of [bucket] must be a constant, received [nullVar]', - 'Argument of [bucket] must be a constant, received [nullVar]', + 'Argument of [+] must be a constant, received [round(percentile(doubleField,longField))]', + 'Argument of [+] must be a constant, received [percentile(doubleField,longField)]', ] ); - testErrorsAndWarnings('from a_index | stats bucket("2022", 1 year)', []); - testErrorsAndWarnings('from a_index | stats bucket(concat("20", "22"), 1 year)', [ - 'Argument of [bucket] must be [date], found value [concat("20","22")] type [string]', - ]); - testErrorsAndWarnings('from a_index | stats by bucket(concat("20", "22"), 1 year)', [ - 'Argument of [bucket] must be [date], found value [concat("20","22")] type [string]', - ]); - testErrorsAndWarnings('from a_index | stats bucket("2022", 5, "a", "a")', []); - testErrorsAndWarnings('from a_index | stats bucket(concat("20", "22"), 5, "a", "a")', [ - 'Argument of [bucket] must be [date], found value [concat("20","22")] type [string]', + + testErrorsAndWarnings('from a_index | stats percentile(doubleField / 2, longField)', [ + 'Argument of [percentile] must be a constant, received [longField]', ]); - testErrorsAndWarnings('from a_index | stats bucket("2022", 5, "2022", "2022")', []); + testErrorsAndWarnings( + 'from a_index | stats var0 = percentile(doubleField / 2, longField)', + ['Argument of [=] must be a constant, received [percentile(doubleField/2,longField)]'] + ); testErrorsAndWarnings( - 'from a_index | stats bucket(concat("20", "22"), 5, concat("20", "22"), concat("20", "22"))', - ['Argument of [bucket] must be [date], found value [concat("20","22")] type [string]'] + 'from a_index | stats avg(doubleField), percentile(doubleField / 2, longField)', + ['Argument of [percentile] must be a constant, received [longField]'] ); - testErrorsAndWarnings('from a_index | stats bucket("2022", 5, "a", "2022")', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField / 2, longField)', + ['Argument of [=] must be a constant, received [percentile(doubleField/2,longField)]'] + ); + + testErrorsAndWarnings('from a_index | stats var0 = percentile(doubleField, longField)', [ + 'Argument of [=] must be a constant, received [percentile(doubleField,longField)]', + ]); testErrorsAndWarnings( - 'from a_index | stats bucket(concat("20", "22"), 5, "a", concat("20", "22"))', - ['Argument of [bucket] must be [date], found value [concat("20","22")] type [string]'] + 'from a_index | stats avg(doubleField), percentile(doubleField, longField)', + ['Argument of [percentile] must be a constant, received [longField]'] ); - testErrorsAndWarnings('from a_index | stats bucket("2022", 5, "2022", "a")', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField, longField)', + ['Argument of [=] must be a constant, received [percentile(doubleField,longField)]'] + ); testErrorsAndWarnings( - 'from a_index | stats bucket(concat("20", "22"), 5, concat("20", "22"), "a")', - ['Argument of [bucket] must be [date], found value [concat("20","22")] type [string]'] + 'from a_index | stats percentile(doubleField, longField) by round(doubleField / 2)', + ['Argument of [percentile] must be a constant, received [longField]'] ); - }); - describe('cbrt', () => { - testErrorsAndWarnings('row var = cbrt(5)', []); - testErrorsAndWarnings('row cbrt(5)', []); - testErrorsAndWarnings('row var = cbrt(to_integer(true))', []); + testErrorsAndWarnings( + 'from a_index | stats var0 = percentile(doubleField, longField) by var1 = round(doubleField / 2)', + ['Argument of [=] must be a constant, received [percentile(doubleField,longField)]'] + ); - testErrorsAndWarnings('row var = cbrt(true)', [ - 'Argument of [cbrt] must be [number], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(doubleField, longField) by round(doubleField / 2), ipField', + ['Argument of [percentile] must be a constant, received [longField]'] + ); - testErrorsAndWarnings('from a_index | where cbrt(numberField) > 0', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField, longField) by var1 = round(doubleField / 2), ipField', + ['Argument of [=] must be a constant, received [percentile(doubleField,longField)]'] + ); - testErrorsAndWarnings('from a_index | where cbrt(booleanField) > 0', [ - 'Argument of [cbrt] must be [number], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(doubleField, longField) by round(doubleField / 2), doubleField / 2', + ['Argument of [percentile] must be a constant, received [longField]'] + ); - testErrorsAndWarnings('from a_index | eval var = cbrt(numberField)', []); - testErrorsAndWarnings('from a_index | eval cbrt(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = cbrt(to_integer(booleanField))', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField, longField) by var1 = round(doubleField / 2), doubleField / 2', + ['Argument of [=] must be a constant, received [percentile(doubleField,longField)]'] + ); - testErrorsAndWarnings('from a_index | eval cbrt(booleanField)', [ - 'Argument of [cbrt] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | stats var = percentile(doubleField, integerField)', [ + 'Argument of [=] must be a constant, received [percentile(doubleField,integerField)]', ]); - - testErrorsAndWarnings('from a_index | eval var = cbrt(*)', [ - 'Using wildcards (*) in cbrt is not allowed', + testErrorsAndWarnings('from a_index | stats percentile(doubleField, integerField)', [ + 'Argument of [percentile] must be a constant, received [integerField]', ]); - testErrorsAndWarnings('from a_index | eval cbrt(numberField, extraArg)', [ - 'Error: [cbrt] function expects exactly one argument, got 2.', + testErrorsAndWarnings( + 'from a_index | stats var = round(percentile(doubleField, integerField))', + [ + 'Argument of [=] must be a constant, received [round(percentile(doubleField,integerField))]', + ] + ); + + testErrorsAndWarnings('from a_index | stats round(percentile(doubleField, integerField))', [ + 'Argument of [round] must be a constant, received [percentile(doubleField,integerField)]', ]); - testErrorsAndWarnings('from a_index | sort cbrt(numberField)', []); - testErrorsAndWarnings('from a_index | eval cbrt(null)', []); - testErrorsAndWarnings('row nullVar = null | eval cbrt(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats var = round(percentile(doubleField, integerField)) + percentile(doubleField, integerField)', + [ + 'Argument of [=] must be a constant, received [round(percentile(doubleField,integerField))+percentile(doubleField,integerField)]', + ] + ); - describe('from_base64', () => { - testErrorsAndWarnings('row var = from_base64("a")', []); - testErrorsAndWarnings('row from_base64("a")', []); - testErrorsAndWarnings('row var = from_base64(to_string(true))', []); + testErrorsAndWarnings( + 'from a_index | stats round(percentile(doubleField, integerField)) + percentile(doubleField, integerField)', + [ + 'Argument of [+] must be a constant, received [round(percentile(doubleField,integerField))]', + 'Argument of [+] must be a constant, received [percentile(doubleField,integerField)]', + ] + ); - testErrorsAndWarnings('row var = from_base64(true)', [ - 'Argument of [from_base64] must be [string], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | stats percentile(doubleField / 2, integerField)', [ + 'Argument of [percentile] must be a constant, received [integerField]', ]); - testErrorsAndWarnings('from a_index | where length(from_base64(stringField)) > 0', []); + testErrorsAndWarnings( + 'from a_index | stats var0 = percentile(doubleField / 2, integerField)', + ['Argument of [=] must be a constant, received [percentile(doubleField/2,integerField)]'] + ); - testErrorsAndWarnings('from a_index | where length(from_base64(booleanField)) > 0', [ - 'Argument of [from_base64] must be [string], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(doubleField / 2, integerField)', + ['Argument of [percentile] must be a constant, received [integerField]'] + ); - testErrorsAndWarnings('from a_index | eval var = from_base64(stringField)', []); - testErrorsAndWarnings('from a_index | eval from_base64(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = from_base64(to_string(booleanField))', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField / 2, integerField)', + ['Argument of [=] must be a constant, received [percentile(doubleField/2,integerField)]'] + ); - testErrorsAndWarnings('from a_index | eval from_base64(booleanField)', [ - 'Argument of [from_base64] must be [string], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | stats var0 = percentile(doubleField, integerField)', [ + 'Argument of [=] must be a constant, received [percentile(doubleField,integerField)]', ]); - testErrorsAndWarnings('from a_index | eval var = from_base64(*)', [ - 'Using wildcards (*) in from_base64 is not allowed', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(doubleField, integerField)', + ['Argument of [percentile] must be a constant, received [integerField]'] + ); - testErrorsAndWarnings('from a_index | eval from_base64(stringField, extraArg)', [ - 'Error: [from_base64] function expects exactly one argument, got 2.', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField, integerField)', + ['Argument of [=] must be a constant, received [percentile(doubleField,integerField)]'] + ); - testErrorsAndWarnings('from a_index | sort from_base64(stringField)', []); - testErrorsAndWarnings('from a_index | eval from_base64(null)', []); - testErrorsAndWarnings('row nullVar = null | eval from_base64(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats percentile(doubleField, integerField) by round(doubleField / 2)', + ['Argument of [percentile] must be a constant, received [integerField]'] + ); - describe('locate', () => { - testErrorsAndWarnings('row var = locate("a", "a")', []); - testErrorsAndWarnings('row locate("a", "a")', []); - testErrorsAndWarnings('row var = locate(to_string(true), to_string(true))', []); - testErrorsAndWarnings('row var = locate("a", "a", 5)', []); - testErrorsAndWarnings('row locate("a", "a", 5)', []); testErrorsAndWarnings( - 'row var = locate(to_string(true), to_string(true), to_integer(true))', - [] + 'from a_index | stats var0 = percentile(doubleField, integerField) by var1 = round(doubleField / 2)', + ['Argument of [=] must be a constant, received [percentile(doubleField,integerField)]'] ); - testErrorsAndWarnings('row var = locate(true, true, true)', [ - 'Argument of [locate] must be [string], found value [true] type [boolean]', - 'Argument of [locate] must be [string], found value [true] type [boolean]', - 'Argument of [locate] must be [number], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(doubleField, integerField) by round(doubleField / 2), ipField', + ['Argument of [percentile] must be a constant, received [integerField]'] + ); - testErrorsAndWarnings('from a_index | where locate(stringField, stringField) > 0', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField, integerField) by var1 = round(doubleField / 2), ipField', + ['Argument of [=] must be a constant, received [percentile(doubleField,integerField)]'] + ); - testErrorsAndWarnings('from a_index | where locate(booleanField, booleanField) > 0', [ - 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', - 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(doubleField, integerField) by round(doubleField / 2), doubleField / 2', + ['Argument of [percentile] must be a constant, received [integerField]'] + ); testErrorsAndWarnings( - 'from a_index | where locate(stringField, stringField, numberField) > 0', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(doubleField, integerField) by var1 = round(doubleField / 2), doubleField / 2', + ['Argument of [=] must be a constant, received [percentile(doubleField,integerField)]'] ); + testErrorsAndWarnings('from a_index | stats var = percentile(longField, doubleField)', [ + 'Argument of [=] must be a constant, received [percentile(longField,doubleField)]', + ]); + testErrorsAndWarnings('from a_index | stats percentile(longField, doubleField)', [ + 'Argument of [percentile] must be a constant, received [doubleField]', + ]); testErrorsAndWarnings( - 'from a_index | where locate(booleanField, booleanField, booleanField) > 0', + 'from a_index | stats var = round(percentile(longField, doubleField))', [ - 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', - 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', - 'Argument of [locate] must be [number], found value [booleanField] type [boolean]', + 'Argument of [=] must be a constant, received [round(percentile(longField,doubleField))]', ] ); + testErrorsAndWarnings('from a_index | stats round(percentile(longField, doubleField))', [ + 'Argument of [round] must be a constant, received [percentile(longField,doubleField)]', + ]); - testErrorsAndWarnings('from a_index | eval var = locate(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval locate(stringField, stringField)', []); + testErrorsAndWarnings( + 'from a_index | stats var = round(percentile(longField, doubleField)) + percentile(longField, doubleField)', + [ + 'Argument of [=] must be a constant, received [round(percentile(longField,doubleField))+percentile(longField,doubleField)]', + ] + ); testErrorsAndWarnings( - 'from a_index | eval var = locate(to_string(booleanField), to_string(booleanField))', - [] + 'from a_index | stats round(percentile(longField, doubleField)) + percentile(longField, doubleField)', + [ + 'Argument of [+] must be a constant, received [round(percentile(longField,doubleField))]', + 'Argument of [+] must be a constant, received [percentile(longField,doubleField)]', + ] ); - testErrorsAndWarnings('from a_index | eval locate(booleanField, booleanField)', [ - 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', - 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | stats var0 = percentile(longField, doubleField)', [ + 'Argument of [=] must be a constant, received [percentile(longField,doubleField)]', ]); testErrorsAndWarnings( - 'from a_index | eval var = locate(stringField, stringField, numberField)', - [] + 'from a_index | stats avg(doubleField), percentile(longField, doubleField)', + ['Argument of [percentile] must be a constant, received [doubleField]'] ); testErrorsAndWarnings( - 'from a_index | eval locate(stringField, stringField, numberField)', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(longField, doubleField)', + ['Argument of [=] must be a constant, received [percentile(longField,doubleField)]'] ); testErrorsAndWarnings( - 'from a_index | eval var = locate(to_string(booleanField), to_string(booleanField), to_integer(booleanField))', - [] + 'from a_index | stats percentile(longField, doubleField) by round(doubleField / 2)', + ['Argument of [percentile] must be a constant, received [doubleField]'] ); testErrorsAndWarnings( - 'from a_index | eval locate(booleanField, booleanField, booleanField)', - [ - 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', - 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', - 'Argument of [locate] must be [number], found value [booleanField] type [boolean]', - ] + 'from a_index | stats var0 = percentile(longField, doubleField) by var1 = round(doubleField / 2)', + ['Argument of [=] must be a constant, received [percentile(longField,doubleField)]'] ); testErrorsAndWarnings( - 'from a_index | eval locate(stringField, stringField, numberField, extraArg)', - ['Error: [locate] function expects no more than 3 arguments, got 4.'] + 'from a_index | stats avg(doubleField), percentile(longField, doubleField) by round(doubleField / 2), ipField', + ['Argument of [percentile] must be a constant, received [doubleField]'] ); - testErrorsAndWarnings('from a_index | sort locate(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval locate(null, null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval locate(nullVar, nullVar, nullVar)', []); - }); - - describe('to_base64', () => { - testErrorsAndWarnings('row var = to_base64("a")', []); - testErrorsAndWarnings('row to_base64("a")', []); - testErrorsAndWarnings('row var = to_base64(to_string(true))', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(longField, doubleField) by var1 = round(doubleField / 2), ipField', + ['Argument of [=] must be a constant, received [percentile(longField,doubleField)]'] + ); - testErrorsAndWarnings('row var = to_base64(true)', [ - 'Argument of [to_base64] must be [string], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(longField, doubleField) by round(doubleField / 2), doubleField / 2', + ['Argument of [percentile] must be a constant, received [doubleField]'] + ); - testErrorsAndWarnings('from a_index | where length(to_base64(stringField)) > 0', []); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(longField, doubleField) by var1 = round(doubleField / 2), doubleField / 2', + ['Argument of [=] must be a constant, received [percentile(longField,doubleField)]'] + ); - testErrorsAndWarnings('from a_index | where length(to_base64(booleanField)) > 0', [ - 'Argument of [to_base64] must be [string], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | stats var = percentile(longField, longField)', [ + 'Argument of [=] must be a constant, received [percentile(longField,longField)]', ]); - - testErrorsAndWarnings('from a_index | eval var = to_base64(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_base64(stringField)', []); - testErrorsAndWarnings('from a_index | eval var = to_base64(to_string(booleanField))', []); - - testErrorsAndWarnings('from a_index | eval to_base64(booleanField)', [ - 'Argument of [to_base64] must be [string], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | stats percentile(longField, longField)', [ + 'Argument of [percentile] must be a constant, received [longField]', ]); - - testErrorsAndWarnings('from a_index | eval var = to_base64(*)', [ - 'Using wildcards (*) in to_base64 is not allowed', + testErrorsAndWarnings( + 'from a_index | stats var = round(percentile(longField, longField))', + ['Argument of [=] must be a constant, received [round(percentile(longField,longField))]'] + ); + testErrorsAndWarnings('from a_index | stats round(percentile(longField, longField))', [ + 'Argument of [round] must be a constant, received [percentile(longField,longField)]', ]); - testErrorsAndWarnings('from a_index | eval to_base64(stringField, extraArg)', [ - 'Error: [to_base64] function expects exactly one argument, got 2.', - ]); + testErrorsAndWarnings( + 'from a_index | stats var = round(percentile(longField, longField)) + percentile(longField, longField)', + [ + 'Argument of [=] must be a constant, received [round(percentile(longField,longField))+percentile(longField,longField)]', + ] + ); - testErrorsAndWarnings('from a_index | sort to_base64(stringField)', []); - testErrorsAndWarnings('from a_index | eval to_base64(null)', []); - testErrorsAndWarnings('row nullVar = null | eval to_base64(nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats round(percentile(longField, longField)) + percentile(longField, longField)', + [ + 'Argument of [+] must be a constant, received [round(percentile(longField,longField))]', + 'Argument of [+] must be a constant, received [percentile(longField,longField)]', + ] + ); - describe('ip_prefix', () => { - testErrorsAndWarnings('row var = ip_prefix(to_ip("127.0.0.1"), 5, 5)', []); - testErrorsAndWarnings('row ip_prefix(to_ip("127.0.0.1"), 5, 5)', []); + testErrorsAndWarnings('from a_index | stats var0 = percentile(longField, longField)', [ + 'Argument of [=] must be a constant, received [percentile(longField,longField)]', + ]); testErrorsAndWarnings( - 'row var = ip_prefix(to_ip(to_ip("127.0.0.1")), to_integer(true), to_integer(true))', - [] + 'from a_index | stats avg(doubleField), percentile(longField, longField)', + ['Argument of [percentile] must be a constant, received [longField]'] ); - testErrorsAndWarnings('row var = ip_prefix(true, true, true)', [ - 'Argument of [ip_prefix] must be [ip], found value [true] type [boolean]', - 'Argument of [ip_prefix] must be [number], found value [true] type [boolean]', - 'Argument of [ip_prefix] must be [number], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(longField, longField)', + ['Argument of [=] must be a constant, received [percentile(longField,longField)]'] + ); testErrorsAndWarnings( - 'from a_index | eval var = ip_prefix(ipField, numberField, numberField)', - [] + 'from a_index | stats percentile(longField, longField) by round(doubleField / 2)', + ['Argument of [percentile] must be a constant, received [longField]'] ); testErrorsAndWarnings( - 'from a_index | eval ip_prefix(ipField, numberField, numberField)', - [] + 'from a_index | stats var0 = percentile(longField, longField) by var1 = round(doubleField / 2)', + ['Argument of [=] must be a constant, received [percentile(longField,longField)]'] ); testErrorsAndWarnings( - 'from a_index | eval var = ip_prefix(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))', - [] + 'from a_index | stats avg(doubleField), percentile(longField, longField) by round(doubleField / 2), ipField', + ['Argument of [percentile] must be a constant, received [longField]'] ); testErrorsAndWarnings( - 'from a_index | eval ip_prefix(booleanField, booleanField, booleanField)', - [ - 'Argument of [ip_prefix] must be [ip], found value [booleanField] type [boolean]', - 'Argument of [ip_prefix] must be [number], found value [booleanField] type [boolean]', - 'Argument of [ip_prefix] must be [number], found value [booleanField] type [boolean]', - ] + 'from a_index | stats avg(doubleField), var0 = percentile(longField, longField) by var1 = round(doubleField / 2), ipField', + ['Argument of [=] must be a constant, received [percentile(longField,longField)]'] ); testErrorsAndWarnings( - 'from a_index | eval ip_prefix(ipField, numberField, numberField, extraArg)', - ['Error: [ip_prefix] function expects exactly 3 arguments, got 4.'] + 'from a_index | stats avg(doubleField), percentile(longField, longField) by round(doubleField / 2), doubleField / 2', + ['Argument of [percentile] must be a constant, received [longField]'] ); testErrorsAndWarnings( - 'from a_index | sort ip_prefix(ipField, numberField, numberField)', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(longField, longField) by var1 = round(doubleField / 2), doubleField / 2', + ['Argument of [=] must be a constant, received [percentile(longField,longField)]'] ); - testErrorsAndWarnings('from a_index | eval ip_prefix(null, null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval ip_prefix(nullVar, nullVar, nullVar)', []); - }); - describe('mv_append', () => { - testErrorsAndWarnings('row var = mv_append(true, true)', []); - testErrorsAndWarnings('row mv_append(true, true)', []); - testErrorsAndWarnings('row var = mv_append(to_boolean(true), to_boolean(true))', []); + testErrorsAndWarnings('from a_index | stats var = percentile(longField, integerField)', [ + 'Argument of [=] must be a constant, received [percentile(longField,integerField)]', + ]); + testErrorsAndWarnings('from a_index | stats percentile(longField, integerField)', [ + 'Argument of [percentile] must be a constant, received [integerField]', + ]); testErrorsAndWarnings( - 'row var = mv_append(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', - [] + 'from a_index | stats var = round(percentile(longField, integerField))', + [ + 'Argument of [=] must be a constant, received [round(percentile(longField,integerField))]', + ] ); + testErrorsAndWarnings('from a_index | stats round(percentile(longField, integerField))', [ + 'Argument of [round] must be a constant, received [percentile(longField,integerField)]', + ]); + testErrorsAndWarnings( - 'row mv_append(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', - [] + 'from a_index | stats var = round(percentile(longField, integerField)) + percentile(longField, integerField)', + [ + 'Argument of [=] must be a constant, received [round(percentile(longField,integerField))+percentile(longField,integerField)]', + ] ); testErrorsAndWarnings( - 'row var = mv_append(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', - [] + 'from a_index | stats round(percentile(longField, integerField)) + percentile(longField, integerField)', + [ + 'Argument of [+] must be a constant, received [round(percentile(longField,integerField))]', + 'Argument of [+] must be a constant, received [percentile(longField,integerField)]', + ] ); + testErrorsAndWarnings('from a_index | stats var0 = percentile(longField, integerField)', [ + 'Argument of [=] must be a constant, received [percentile(longField,integerField)]', + ]); + testErrorsAndWarnings( - 'row var = mv_append(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', - [] + 'from a_index | stats avg(doubleField), percentile(longField, integerField)', + ['Argument of [percentile] must be a constant, received [integerField]'] ); testErrorsAndWarnings( - 'row mv_append(to_cartesianshape("POINT (30 10)"), to_cartesianshape("POINT (30 10)"))', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(longField, integerField)', + ['Argument of [=] must be a constant, received [percentile(longField,integerField)]'] ); testErrorsAndWarnings( - 'row var = mv_append(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', - [] + 'from a_index | stats percentile(longField, integerField) by round(doubleField / 2)', + ['Argument of [percentile] must be a constant, received [integerField]'] ); - testErrorsAndWarnings('row var = mv_append(now(), now())', []); - testErrorsAndWarnings('row mv_append(now(), now())', []); - testErrorsAndWarnings('row var = mv_append(to_datetime(now()), to_datetime(now()))', []); - testErrorsAndWarnings('row var = mv_append(5, 5)', []); - testErrorsAndWarnings('row mv_append(5, 5)', []); - testErrorsAndWarnings('row var = mv_append(to_integer(true), to_integer(true))', []); - testErrorsAndWarnings( - 'row var = mv_append(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', - [] + 'from a_index | stats var0 = percentile(longField, integerField) by var1 = round(doubleField / 2)', + ['Argument of [=] must be a constant, received [percentile(longField,integerField)]'] ); testErrorsAndWarnings( - 'row mv_append(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', - [] + 'from a_index | stats avg(doubleField), percentile(longField, integerField) by round(doubleField / 2), ipField', + ['Argument of [percentile] must be a constant, received [integerField]'] ); testErrorsAndWarnings( - 'row var = mv_append(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(longField, integerField) by var1 = round(doubleField / 2), ipField', + ['Argument of [=] must be a constant, received [percentile(longField,integerField)]'] ); testErrorsAndWarnings( - 'row var = mv_append(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', - [] + 'from a_index | stats avg(doubleField), percentile(longField, integerField) by round(doubleField / 2), doubleField / 2', + ['Argument of [percentile] must be a constant, received [integerField]'] ); testErrorsAndWarnings( - 'row mv_append(to_geoshape("POINT (30 10)"), to_geoshape("POINT (30 10)"))', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(longField, integerField) by var1 = round(doubleField / 2), doubleField / 2', + ['Argument of [=] must be a constant, received [percentile(longField,integerField)]'] ); + testErrorsAndWarnings('from a_index | stats var = percentile(integerField, doubleField)', [ + 'Argument of [=] must be a constant, received [percentile(integerField,doubleField)]', + ]); + testErrorsAndWarnings('from a_index | stats percentile(integerField, doubleField)', [ + 'Argument of [percentile] must be a constant, received [doubleField]', + ]); + testErrorsAndWarnings( - 'row var = mv_append(to_geoshape(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', - [] + 'from a_index | stats var = round(percentile(integerField, doubleField))', + [ + 'Argument of [=] must be a constant, received [round(percentile(integerField,doubleField))]', + ] ); - testErrorsAndWarnings('row var = mv_append(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); - testErrorsAndWarnings('row mv_append(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('from a_index | stats round(percentile(integerField, doubleField))', [ + 'Argument of [round] must be a constant, received [percentile(integerField,doubleField)]', + ]); testErrorsAndWarnings( - 'row var = mv_append(to_ip(to_ip("127.0.0.1")), to_ip(to_ip("127.0.0.1")))', - [] + 'from a_index | stats var = round(percentile(integerField, doubleField)) + percentile(integerField, doubleField)', + [ + 'Argument of [=] must be a constant, received [round(percentile(integerField,doubleField))+percentile(integerField,doubleField)]', + ] ); - testErrorsAndWarnings('row var = mv_append("a", "a")', []); - testErrorsAndWarnings('row mv_append("a", "a")', []); - testErrorsAndWarnings('row var = mv_append(to_string(true), to_string(true))', []); - testErrorsAndWarnings('row var = mv_append(to_version("1.0.0"), to_version("1.0.0"))', []); - testErrorsAndWarnings('row mv_append(to_version("1.0.0"), to_version("1.0.0"))', []); - testErrorsAndWarnings('row var = mv_append(to_version("a"), to_version("a"))', []); - testErrorsAndWarnings('from a_index | where mv_append(numberField, numberField) > 0', []); testErrorsAndWarnings( - 'from a_index | where length(mv_append(stringField, stringField)) > 0', - [] + 'from a_index | stats round(percentile(integerField, doubleField)) + percentile(integerField, doubleField)', + [ + 'Argument of [+] must be a constant, received [round(percentile(integerField,doubleField))]', + 'Argument of [+] must be a constant, received [percentile(integerField,doubleField)]', + ] ); + + testErrorsAndWarnings('from a_index | stats var0 = percentile(integerField, doubleField)', [ + 'Argument of [=] must be a constant, received [percentile(integerField,doubleField)]', + ]); + testErrorsAndWarnings( - 'from a_index | eval var = mv_append(booleanField, booleanField)', - [] + 'from a_index | stats avg(doubleField), percentile(integerField, doubleField)', + ['Argument of [percentile] must be a constant, received [doubleField]'] ); - testErrorsAndWarnings('from a_index | eval mv_append(booleanField, booleanField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(to_boolean(booleanField), to_boolean(booleanField))', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(integerField, doubleField)', + ['Argument of [=] must be a constant, received [percentile(integerField,doubleField)]'] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(cartesianPointField, cartesianPointField)', - [] + 'from a_index | stats percentile(integerField, doubleField) by round(doubleField / 2)', + ['Argument of [percentile] must be a constant, received [doubleField]'] ); testErrorsAndWarnings( - 'from a_index | eval mv_append(cartesianPointField, cartesianPointField)', - [] + 'from a_index | stats var0 = percentile(integerField, doubleField) by var1 = round(doubleField / 2)', + ['Argument of [=] must be a constant, received [percentile(integerField,doubleField)]'] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', - [] + 'from a_index | stats avg(doubleField), percentile(integerField, doubleField) by round(doubleField / 2), ipField', + ['Argument of [percentile] must be a constant, received [doubleField]'] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(cartesianShapeField, cartesianShapeField)', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(integerField, doubleField) by var1 = round(doubleField / 2), ipField', + ['Argument of [=] must be a constant, received [percentile(integerField,doubleField)]'] ); testErrorsAndWarnings( - 'from a_index | eval mv_append(cartesianShapeField, cartesianShapeField)', - [] + 'from a_index | stats avg(doubleField), percentile(integerField, doubleField) by round(doubleField / 2), doubleField / 2', + ['Argument of [percentile] must be a constant, received [doubleField]'] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(integerField, doubleField) by var1 = round(doubleField / 2), doubleField / 2', + ['Argument of [=] must be a constant, received [percentile(integerField,doubleField)]'] ); - testErrorsAndWarnings('from a_index | eval var = mv_append(dateField, dateField)', []); - testErrorsAndWarnings('from a_index | eval mv_append(dateField, dateField)', []); + testErrorsAndWarnings('from a_index | stats var = percentile(integerField, longField)', [ + 'Argument of [=] must be a constant, received [percentile(integerField,longField)]', + ]); + testErrorsAndWarnings('from a_index | stats percentile(integerField, longField)', [ + 'Argument of [percentile] must be a constant, received [longField]', + ]); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(to_datetime(dateField), to_datetime(dateField))', - [] + 'from a_index | stats var = round(percentile(integerField, longField))', + [ + 'Argument of [=] must be a constant, received [round(percentile(integerField,longField))]', + ] ); - testErrorsAndWarnings('from a_index | eval var = mv_append(numberField, numberField)', []); - testErrorsAndWarnings('from a_index | eval mv_append(numberField, numberField)', []); + testErrorsAndWarnings('from a_index | stats round(percentile(integerField, longField))', [ + 'Argument of [round] must be a constant, received [percentile(integerField,longField)]', + ]); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(to_integer(booleanField), to_integer(booleanField))', - [] + 'from a_index | stats var = round(percentile(integerField, longField)) + percentile(integerField, longField)', + [ + 'Argument of [=] must be a constant, received [round(percentile(integerField,longField))+percentile(integerField,longField)]', + ] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(geoPointField, geoPointField)', - [] + 'from a_index | stats round(percentile(integerField, longField)) + percentile(integerField, longField)', + [ + 'Argument of [+] must be a constant, received [round(percentile(integerField,longField))]', + 'Argument of [+] must be a constant, received [percentile(integerField,longField)]', + ] ); - testErrorsAndWarnings('from a_index | eval mv_append(geoPointField, geoPointField)', []); + + testErrorsAndWarnings('from a_index | stats var0 = percentile(integerField, longField)', [ + 'Argument of [=] must be a constant, received [percentile(integerField,longField)]', + ]); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(to_geopoint(geoPointField), to_geopoint(geoPointField))', - [] + 'from a_index | stats avg(doubleField), percentile(integerField, longField)', + ['Argument of [percentile] must be a constant, received [longField]'] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(geoShapeField, geoShapeField)', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(integerField, longField)', + ['Argument of [=] must be a constant, received [percentile(integerField,longField)]'] ); - testErrorsAndWarnings('from a_index | eval mv_append(geoShapeField, geoShapeField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(to_geoshape(geoPointField), to_geoshape(geoPointField))', - [] + 'from a_index | stats percentile(integerField, longField) by round(doubleField / 2)', + ['Argument of [percentile] must be a constant, received [longField]'] ); - testErrorsAndWarnings('from a_index | eval var = mv_append(ipField, ipField)', []); - testErrorsAndWarnings('from a_index | eval mv_append(ipField, ipField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(to_ip(ipField), to_ip(ipField))', - [] + 'from a_index | stats var0 = percentile(integerField, longField) by var1 = round(doubleField / 2)', + ['Argument of [=] must be a constant, received [percentile(integerField,longField)]'] ); - testErrorsAndWarnings('from a_index | eval var = mv_append(stringField, stringField)', []); - testErrorsAndWarnings('from a_index | eval mv_append(stringField, stringField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(to_string(booleanField), to_string(booleanField))', - [] + 'from a_index | stats avg(doubleField), percentile(integerField, longField) by round(doubleField / 2), ipField', + ['Argument of [percentile] must be a constant, received [longField]'] ); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(versionField, versionField)', - [] + 'from a_index | stats avg(doubleField), var0 = percentile(integerField, longField) by var1 = round(doubleField / 2), ipField', + ['Argument of [=] must be a constant, received [percentile(integerField,longField)]'] ); - testErrorsAndWarnings('from a_index | eval mv_append(versionField, versionField)', []); testErrorsAndWarnings( - 'from a_index | eval var = mv_append(to_version(stringField), to_version(stringField))', - [] + 'from a_index | stats avg(doubleField), percentile(integerField, longField) by round(doubleField / 2), doubleField / 2', + ['Argument of [percentile] must be a constant, received [longField]'] ); testErrorsAndWarnings( - 'from a_index | eval mv_append(booleanField, booleanField, extraArg)', - ['Error: [mv_append] function expects exactly 2 arguments, got 3.'] + 'from a_index | stats avg(doubleField), var0 = percentile(integerField, longField) by var1 = round(doubleField / 2), doubleField / 2', + ['Argument of [=] must be a constant, received [percentile(integerField,longField)]'] ); - testErrorsAndWarnings('from a_index | sort mv_append(booleanField, booleanField)', []); - testErrorsAndWarnings('from a_index | eval mv_append(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval mv_append(nullVar, nullVar)', []); - }); + testErrorsAndWarnings('from a_index | stats var = percentile(integerField, integerField)', [ + 'Argument of [=] must be a constant, received [percentile(integerField,integerField)]', + ]); + testErrorsAndWarnings('from a_index | stats percentile(integerField, integerField)', [ + 'Argument of [percentile] must be a constant, received [integerField]', + ]); - describe('repeat', () => { - testErrorsAndWarnings('row var = repeat("a", 5)', []); - testErrorsAndWarnings('row repeat("a", 5)', []); - testErrorsAndWarnings('row var = repeat(to_string(true), to_integer(true))', []); + testErrorsAndWarnings( + 'from a_index | stats var = round(percentile(integerField, integerField))', + [ + 'Argument of [=] must be a constant, received [round(percentile(integerField,integerField))]', + ] + ); - testErrorsAndWarnings('row var = repeat(true, true)', [ - 'Argument of [repeat] must be [string], found value [true] type [boolean]', - 'Argument of [repeat] must be [number], found value [true] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats round(percentile(integerField, integerField))', + [ + 'Argument of [round] must be a constant, received [percentile(integerField,integerField)]', + ] + ); testErrorsAndWarnings( - 'from a_index | where length(repeat(stringField, numberField)) > 0', - [] + 'from a_index | stats var = round(percentile(integerField, integerField)) + percentile(integerField, integerField)', + [ + 'Argument of [=] must be a constant, received [round(percentile(integerField,integerField))+percentile(integerField,integerField)]', + ] ); testErrorsAndWarnings( - 'from a_index | where length(repeat(booleanField, booleanField)) > 0', + 'from a_index | stats round(percentile(integerField, integerField)) + percentile(integerField, integerField)', [ - 'Argument of [repeat] must be [string], found value [booleanField] type [boolean]', - 'Argument of [repeat] must be [number], found value [booleanField] type [boolean]', + 'Argument of [+] must be a constant, received [round(percentile(integerField,integerField))]', + 'Argument of [+] must be a constant, received [percentile(integerField,integerField)]', ] ); - testErrorsAndWarnings('from a_index | eval var = repeat(stringField, numberField)', []); - testErrorsAndWarnings('from a_index | eval repeat(stringField, numberField)', []); + testErrorsAndWarnings( + 'from a_index | stats var0 = percentile(integerField, integerField)', + ['Argument of [=] must be a constant, received [percentile(integerField,integerField)]'] + ); testErrorsAndWarnings( - 'from a_index | eval var = repeat(to_string(booleanField), to_integer(booleanField))', - [] + 'from a_index | stats avg(doubleField), percentile(integerField, integerField)', + ['Argument of [percentile] must be a constant, received [integerField]'] ); - testErrorsAndWarnings('from a_index | eval repeat(booleanField, booleanField)', [ - 'Argument of [repeat] must be [string], found value [booleanField] type [boolean]', - 'Argument of [repeat] must be [number], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(integerField, integerField)', + ['Argument of [=] must be a constant, received [percentile(integerField,integerField)]'] + ); - testErrorsAndWarnings('from a_index | eval repeat(stringField, numberField, extraArg)', [ - 'Error: [repeat] function expects exactly 2 arguments, got 3.', - ]); + testErrorsAndWarnings( + 'from a_index | stats percentile(integerField, integerField) by round(doubleField / 2)', + ['Argument of [percentile] must be a constant, received [integerField]'] + ); - testErrorsAndWarnings('from a_index | sort repeat(stringField, numberField)', []); - testErrorsAndWarnings('from a_index | eval repeat(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval repeat(nullVar, nullVar)', []); - }); + testErrorsAndWarnings( + 'from a_index | stats var0 = percentile(integerField, integerField) by var1 = round(doubleField / 2)', + ['Argument of [=] must be a constant, received [percentile(integerField,integerField)]'] + ); - describe('top', () => { - describe('no errors on correct usage', () => { - testErrorsAndWarnings('from a_index | stats var = top(stringField, 3, "asc")', []); - testErrorsAndWarnings('from a_index | stats top(stringField, 1, "desc")', []); - testErrorsAndWarnings('from a_index | stats var = top(stringField, 5, "asc")', []); - testErrorsAndWarnings('from a_index | stats top(stringField, 5, "asc")', []); - }); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(integerField, integerField) by round(doubleField / 2), ipField', + ['Argument of [percentile] must be a constant, received [integerField]'] + ); - describe('errors on invalid argument count', () => { - testErrorsAndWarnings('from a_index | stats var = top(stringField, 3)', [ - 'Error: [top] function expects exactly 3 arguments, got 2.', - ]); - testErrorsAndWarnings('from a_index | stats var = top(stringField)', [ - 'Error: [top] function expects exactly 3 arguments, got 1.', - ]); - }); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(integerField, integerField) by var1 = round(doubleField / 2), ipField', + ['Argument of [=] must be a constant, received [percentile(integerField,integerField)]'] + ); - describe('limit must be a literal', () => { - testErrorsAndWarnings('from a_index | stats var = top(stringField, numberField, "asc")', [ - 'Argument of [=] must be a constant, received [top(stringField,numberField,"asc")]', - ]); - testErrorsAndWarnings( - 'from a_index | stats var = top(stringField, 100 + numberField, "asc")', - [ - 'Argument of [=] must be a constant, received [top(stringField,100+numberField,"asc")]', - ] - ); - }); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), percentile(integerField, integerField) by round(doubleField / 2), doubleField / 2', + ['Argument of [percentile] must be a constant, received [integerField]'] + ); - describe('order must be "asc" or "desc"', () => { - testErrorsAndWarnings('from a_index | stats var = top(stringField, 1, stringField)', [ - 'Argument of [=] must be a constant, received [top(stringField,1,stringField)]', - ]); - testErrorsAndWarnings( - 'from a_index | stats var = top(stringField, 1, "asdf")', - [], - ['Invalid option ["asdf"] for top. Supported options: ["asc", "desc"].'] - ); - }); + testErrorsAndWarnings( + 'from a_index | stats avg(doubleField), var0 = percentile(integerField, integerField) by var1 = round(doubleField / 2), doubleField / 2', + ['Argument of [=] must be a constant, received [percentile(integerField,integerField)]'] + ); - testErrorsAndWarnings('from a_index | sort top(stringField, numberField, "asc")', [ - 'SORT does not support function top', + testErrorsAndWarnings('from a_index | sort percentile(doubleField, doubleField)', [ + 'SORT does not support function percentile', ]); - testErrorsAndWarnings('from a_index | where top(stringField, numberField, "asc")', [ - 'WHERE does not support function top', + testErrorsAndWarnings('from a_index | where percentile(doubleField, doubleField)', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | where top(stringField, numberField, "asc") > 0', [ - 'WHERE does not support function top', + testErrorsAndWarnings('from a_index | where percentile(doubleField, doubleField) > 0', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | eval var = top(stringField, numberField, "asc")', [ - 'EVAL does not support function top', + testErrorsAndWarnings('from a_index | where percentile(doubleField, longField)', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings( - 'from a_index | eval var = top(stringField, numberField, "asc") > 0', - ['EVAL does not support function top'] - ); - - testErrorsAndWarnings('from a_index | eval top(stringField, numberField, "asc")', [ - 'EVAL does not support function top', + testErrorsAndWarnings('from a_index | where percentile(doubleField, longField) > 0', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | eval top(stringField, numberField, "asc") > 0', [ - 'EVAL does not support function top', + testErrorsAndWarnings('from a_index | where percentile(doubleField, integerField)', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | sort top(stringField, 5, "asc")', [ - 'SORT does not support function top', + testErrorsAndWarnings('from a_index | where percentile(doubleField, integerField) > 0', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | where top(stringField, 5, "asc")', [ - 'WHERE does not support function top', + testErrorsAndWarnings('from a_index | where percentile(longField, doubleField)', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | where top(stringField, 5, "asc") > 0', [ - 'WHERE does not support function top', + testErrorsAndWarnings('from a_index | where percentile(longField, doubleField) > 0', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | eval var = top(stringField, 5, "asc")', [ - 'EVAL does not support function top', + testErrorsAndWarnings('from a_index | where percentile(longField, longField)', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | eval var = top(stringField, 5, "asc") > 0', [ - 'EVAL does not support function top', + testErrorsAndWarnings('from a_index | where percentile(longField, longField) > 0', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | eval top(stringField, 5, "asc")', [ - 'EVAL does not support function top', + testErrorsAndWarnings('from a_index | where percentile(longField, integerField)', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | eval top(stringField, 5, "asc") > 0', [ - 'EVAL does not support function top', + testErrorsAndWarnings('from a_index | where percentile(longField, integerField) > 0', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | stats var = top(stringField, 5, "asc")', []); - testErrorsAndWarnings('from a_index | stats top(stringField, 5, "asc")', []); - testErrorsAndWarnings('from a_index | stats top(stringField, numberField, "asc")', [ - 'Argument of [top] must be a constant, received [numberField]', + testErrorsAndWarnings('from a_index | where percentile(integerField, doubleField)', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings('from a_index | stats top(null, null, null)', []); - testErrorsAndWarnings('row nullVar = null | stats top(nullVar, nullVar, nullVar)', [ - 'Argument of [top] must be a constant, received [nullVar]', - 'Argument of [top] must be a constant, received [nullVar]', + testErrorsAndWarnings('from a_index | where percentile(integerField, doubleField) > 0', [ + 'WHERE does not support function percentile', ]); - }); - - describe('st_distance', () => { - testErrorsAndWarnings( - 'row var = st_distance(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', - [] - ); - - testErrorsAndWarnings( - 'row st_distance(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', - [] - ); - - testErrorsAndWarnings( - 'row var = st_distance(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', - [] - ); - - testErrorsAndWarnings( - 'row var = st_distance(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', - [] - ); - - testErrorsAndWarnings( - 'row st_distance(to_geopoint("POINT (30 10)"), to_geopoint("POINT (30 10)"))', - [] - ); - - testErrorsAndWarnings( - 'row var = st_distance(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', - [] - ); - testErrorsAndWarnings('row var = st_distance(true, true)', [ - 'Argument of [st_distance] must be [cartesian_point], found value [true] type [boolean]', - 'Argument of [st_distance] must be [cartesian_point], found value [true] type [boolean]', + testErrorsAndWarnings('from a_index | where percentile(integerField, longField)', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings( - 'from a_index | eval var = st_distance(cartesianPointField, cartesianPointField)', - [] - ); - - testErrorsAndWarnings( - 'from a_index | eval st_distance(cartesianPointField, cartesianPointField)', - [] - ); + testErrorsAndWarnings('from a_index | where percentile(integerField, longField) > 0', [ + 'WHERE does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | eval var = st_distance(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', - [] - ); + testErrorsAndWarnings('from a_index | where percentile(integerField, integerField)', [ + 'WHERE does not support function percentile', + ]); - testErrorsAndWarnings('from a_index | eval st_distance(booleanField, booleanField)', [ - 'Argument of [st_distance] must be [cartesian_point], found value [booleanField] type [boolean]', - 'Argument of [st_distance] must be [cartesian_point], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | where percentile(integerField, integerField) > 0', [ + 'WHERE does not support function percentile', ]); - testErrorsAndWarnings( - 'from a_index | eval var = st_distance(geoPointField, geoPointField)', - [] - ); - testErrorsAndWarnings('from a_index | eval st_distance(geoPointField, geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = percentile(doubleField, doubleField)', [ + 'EVAL does not support function percentile', + ]); testErrorsAndWarnings( - 'from a_index | eval var = st_distance(to_geopoint(geoPointField), to_geopoint(geoPointField))', - [] + 'from a_index | eval var = percentile(doubleField, doubleField) > 0', + ['EVAL does not support function percentile'] ); - testErrorsAndWarnings( - 'from a_index | eval st_distance(cartesianPointField, cartesianPointField, extraArg)', - ['Error: [st_distance] function expects exactly 2 arguments, got 3.'] - ); + testErrorsAndWarnings('from a_index | eval percentile(doubleField, doubleField)', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | sort st_distance(cartesianPointField, cartesianPointField)', - [] - ); + testErrorsAndWarnings('from a_index | eval percentile(doubleField, doubleField) > 0', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings('from a_index | eval st_distance(null, null)', []); - testErrorsAndWarnings('row nullVar = null | eval st_distance(nullVar, nullVar)', []); - }); + testErrorsAndWarnings('from a_index | eval var = percentile(doubleField, longField)', [ + 'EVAL does not support function percentile', + ]); - describe('weighted_avg', () => { - testErrorsAndWarnings( - 'from a_index | stats var = weighted_avg(numberField, numberField)', - [] - ); - testErrorsAndWarnings('from a_index | stats weighted_avg(numberField, numberField)', []); + testErrorsAndWarnings('from a_index | eval var = percentile(doubleField, longField) > 0', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats var = round(weighted_avg(numberField, numberField))', - [] - ); + testErrorsAndWarnings('from a_index | eval percentile(doubleField, longField)', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats round(weighted_avg(numberField, numberField))', - [] - ); + testErrorsAndWarnings('from a_index | eval percentile(doubleField, longField) > 0', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats var = round(weighted_avg(numberField, numberField)) + weighted_avg(numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval var = percentile(doubleField, integerField)', [ + 'EVAL does not support function percentile', + ]); testErrorsAndWarnings( - 'from a_index | stats round(weighted_avg(numberField, numberField)) + weighted_avg(numberField, numberField)', - [] + 'from a_index | eval var = percentile(doubleField, integerField) > 0', + ['EVAL does not support function percentile'] ); - testErrorsAndWarnings( - 'from a_index | stats weighted_avg(numberField / 2, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval percentile(doubleField, integerField)', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats var0 = weighted_avg(numberField / 2, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval percentile(doubleField, integerField) > 0', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), weighted_avg(numberField / 2, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval var = percentile(longField, doubleField)', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = weighted_avg(numberField / 2, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval var = percentile(longField, doubleField) > 0', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats var0 = weighted_avg(numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval percentile(longField, doubleField)', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), weighted_avg(numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval percentile(longField, doubleField) > 0', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = weighted_avg(numberField, numberField)', - [] - ); + testErrorsAndWarnings('from a_index | eval var = percentile(longField, longField)', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats weighted_avg(numberField, numberField) by round(numberField / 2)', - [] - ); + testErrorsAndWarnings('from a_index | eval var = percentile(longField, longField) > 0', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats var0 = weighted_avg(numberField, numberField) by var1 = round(numberField / 2)', - [] - ); + testErrorsAndWarnings('from a_index | eval percentile(longField, longField)', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), weighted_avg(numberField, numberField) by round(numberField / 2), ipField', - [] - ); + testErrorsAndWarnings('from a_index | eval percentile(longField, longField) > 0', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = weighted_avg(numberField, numberField) by var1 = round(numberField / 2), ipField', - [] - ); + testErrorsAndWarnings('from a_index | eval var = percentile(longField, integerField)', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), weighted_avg(numberField, numberField) by round(numberField / 2), numberField / 2', - [] - ); + testErrorsAndWarnings('from a_index | eval var = percentile(longField, integerField) > 0', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats avg(numberField), var0 = weighted_avg(numberField, numberField) by var1 = round(numberField / 2), numberField / 2', - [] - ); + testErrorsAndWarnings('from a_index | eval percentile(longField, integerField)', [ + 'EVAL does not support function percentile', + ]); - testErrorsAndWarnings( - 'from a_index | stats var = weighted_avg(avg(numberField), avg(numberField))', - [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ] - ); + testErrorsAndWarnings('from a_index | eval percentile(longField, integerField) > 0', [ + 'EVAL does not support function percentile', + ]); + + testErrorsAndWarnings('from a_index | eval var = percentile(integerField, doubleField)', [ + 'EVAL does not support function percentile', + ]); testErrorsAndWarnings( - 'from a_index | stats weighted_avg(avg(numberField), avg(numberField))', - [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]", - ] + 'from a_index | eval var = percentile(integerField, doubleField) > 0', + ['EVAL does not support function percentile'] ); - testErrorsAndWarnings('from a_index | stats weighted_avg(booleanField, booleanField)', [ - 'Argument of [weighted_avg] must be [number], found value [booleanField] type [boolean]', - 'Argument of [weighted_avg] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval percentile(integerField, doubleField)', [ + 'EVAL does not support function percentile', ]); - testErrorsAndWarnings('from a_index | sort weighted_avg(numberField, numberField)', [ - 'SORT does not support function weighted_avg', + testErrorsAndWarnings('from a_index | eval percentile(integerField, doubleField) > 0', [ + 'EVAL does not support function percentile', ]); - testErrorsAndWarnings('from a_index | where weighted_avg(numberField, numberField)', [ - 'WHERE does not support function weighted_avg', + testErrorsAndWarnings('from a_index | eval var = percentile(integerField, longField)', [ + 'EVAL does not support function percentile', ]); - testErrorsAndWarnings('from a_index | where weighted_avg(numberField, numberField) > 0', [ - 'WHERE does not support function weighted_avg', + testErrorsAndWarnings('from a_index | eval var = percentile(integerField, longField) > 0', [ + 'EVAL does not support function percentile', ]); - testErrorsAndWarnings('from a_index | eval var = weighted_avg(numberField, numberField)', [ - 'EVAL does not support function weighted_avg', + testErrorsAndWarnings('from a_index | eval percentile(integerField, longField)', [ + 'EVAL does not support function percentile', + ]); + + testErrorsAndWarnings('from a_index | eval percentile(integerField, longField) > 0', [ + 'EVAL does not support function percentile', + ]); + + testErrorsAndWarnings('from a_index | eval var = percentile(integerField, integerField)', [ + 'EVAL does not support function percentile', ]); testErrorsAndWarnings( - 'from a_index | eval var = weighted_avg(numberField, numberField) > 0', - ['EVAL does not support function weighted_avg'] + 'from a_index | eval var = percentile(integerField, integerField) > 0', + ['EVAL does not support function percentile'] ); - testErrorsAndWarnings('from a_index | eval weighted_avg(numberField, numberField)', [ - 'EVAL does not support function weighted_avg', + testErrorsAndWarnings('from a_index | eval percentile(integerField, integerField)', [ + 'EVAL does not support function percentile', ]); - testErrorsAndWarnings('from a_index | eval weighted_avg(numberField, numberField) > 0', [ - 'EVAL does not support function weighted_avg', + testErrorsAndWarnings('from a_index | eval percentile(integerField, integerField) > 0', [ + 'EVAL does not support function percentile', ]); - testErrorsAndWarnings('from a_index | stats weighted_avg(null, null)', []); - testErrorsAndWarnings('row nullVar = null | stats weighted_avg(nullVar, nullVar)', []); + testErrorsAndWarnings('from a_index | stats percentile(null, null)', []); + testErrorsAndWarnings('row nullVar = null | stats percentile(nullVar, nullVar)', [ + 'Argument of [percentile] must be a constant, received [nullVar]', + ]); }); - describe('exp', () => { - testErrorsAndWarnings('row var = exp(5)', []); - testErrorsAndWarnings('row exp(5)', []); - testErrorsAndWarnings('row var = exp(to_integer(true))', []); - - testErrorsAndWarnings('row var = exp(true)', [ - 'Argument of [exp] must be [number], found value [true] type [boolean]', + describe('to_string', () => { + testErrorsAndWarnings('row var = to_string(true)', []); + testErrorsAndWarnings('row to_string(true)', []); + testErrorsAndWarnings('row var = to_str(true)', []); + testErrorsAndWarnings('row var = to_string(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_string(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row to_string(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = to_str(cartesianPointField)', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = to_string(to_cartesianpoint(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', ]); + testErrorsAndWarnings('row var = to_string(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row to_string(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_str(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_string(to_cartesianshape(cartesianPointField))', [ + 'Unknown column [cartesianPointField]', + ]); + testErrorsAndWarnings('row var = to_string(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row to_string(to_datetime("2021-01-01T00:00:00Z"))', []); + testErrorsAndWarnings('row var = to_str(to_datetime("2021-01-01T00:00:00Z"))', []); - testErrorsAndWarnings('from a_index | where exp(numberField) > 0', []); + testErrorsAndWarnings( + 'row var = to_string(to_datetime(to_datetime("2021-01-01T00:00:00Z")))', + [] + ); - testErrorsAndWarnings('from a_index | where exp(booleanField) > 0', [ - 'Argument of [exp] must be [number], found value [booleanField] type [boolean]', - ]); + testErrorsAndWarnings('row var = to_string(5.5)', []); - testErrorsAndWarnings('from a_index | eval var = exp(numberField)', []); - testErrorsAndWarnings('from a_index | eval exp(numberField)', []); - testErrorsAndWarnings('from a_index | eval var = exp(to_integer(booleanField))', []); + testErrorsAndWarnings('row to_string(5.5)', []); + testErrorsAndWarnings('row var = to_str(5.5)', []); + testErrorsAndWarnings('row var = to_string(to_double(true))', []); + testErrorsAndWarnings('row var = to_string(geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row to_string(geoPointField)', ['Unknown column [geoPointField]']); + testErrorsAndWarnings('row var = to_str(geoPointField)', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = to_string(to_geopoint(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = to_string(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row to_string(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_str(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_string(to_geoshape(geoPointField))', [ + 'Unknown column [geoPointField]', + ]); + testErrorsAndWarnings('row var = to_string(5)', []); + testErrorsAndWarnings('row to_string(5)', []); + testErrorsAndWarnings('row var = to_str(5)', []); + testErrorsAndWarnings('row var = to_string(to_integer(true))', []); + testErrorsAndWarnings('row var = to_string(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row to_string(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = to_str(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = to_string(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = to_string("a")', []); + testErrorsAndWarnings('row to_string("a")', []); + testErrorsAndWarnings('row var = to_str("a")', []); + testErrorsAndWarnings('row var = to_string(to_string(true))', []); + testErrorsAndWarnings('row var = to_string(to_version("1.0.0"))', []); + testErrorsAndWarnings('row to_string(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = to_str(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = to_string(to_version("a"))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_string(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_boolean(booleanField))', []); - testErrorsAndWarnings('from a_index | eval exp(booleanField)', [ - 'Argument of [exp] must be [number], found value [booleanField] type [boolean]', + testErrorsAndWarnings('from a_index | eval to_string(counterDoubleField)', [ + 'Argument of [to_string] must be [boolean], found value [counterDoubleField] type [counter_double]', ]); - testErrorsAndWarnings('from a_index | eval var = exp(*)', [ - 'Using wildcards (*) in exp is not allowed', + testErrorsAndWarnings('from a_index | eval var = to_string(*)', [ + 'Using wildcards (*) in to_string is not allowed', ]); - testErrorsAndWarnings('from a_index | eval exp(numberField, extraArg)', [ - 'Error: [exp] function expects exactly one argument, got 2.', + testErrorsAndWarnings('from a_index | eval var = to_string(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval to_string(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = to_string(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = to_string(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval to_string(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = to_string(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = to_string(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_string(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(doubleField)', []); + testErrorsAndWarnings('from a_index | eval to_string(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(doubleField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_double(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval to_string(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(geoPointField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_string(to_geopoint(geoPointField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = to_string(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval to_string(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(geoShapeField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_string(to_geoshape(geoPointField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = to_string(integerField)', []); + testErrorsAndWarnings('from a_index | eval to_string(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(integerField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(ipField)', []); + testErrorsAndWarnings('from a_index | eval to_string(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(keywordField)', []); + testErrorsAndWarnings('from a_index | eval to_string(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(keywordField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(longField)', []); + testErrorsAndWarnings('from a_index | eval to_string(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(longField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(textField)', []); + testErrorsAndWarnings('from a_index | eval to_string(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(textField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval to_string(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(unsignedLongField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(versionField)', []); + testErrorsAndWarnings('from a_index | eval to_string(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_version(keywordField))', []); + + testErrorsAndWarnings('from a_index | eval to_string(booleanField, extraArg)', [ + 'Error: [to_string] function expects exactly one argument, got 2.', ]); - testErrorsAndWarnings('from a_index | sort exp(numberField)', []); - testErrorsAndWarnings('from a_index | eval exp(null)', []); - testErrorsAndWarnings('row nullVar = null | eval exp(nullVar)', []); + testErrorsAndWarnings('from a_index | sort to_string(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_string(null)', []); + testErrorsAndWarnings('row nullVar = null | eval to_string(nullVar)', []); + testErrorsAndWarnings('from a_index | eval to_string("2022")', []); + testErrorsAndWarnings('from a_index | eval to_string(concat("20", "22"))', []); }); }); }); diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts b/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts index cea9dccbd8d97..6cc515dc4ac74 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts @@ -76,6 +76,7 @@ import { import { collapseWrongArgumentTypeMessages, getMaxMinNumberOfParams } from './helpers'; import { getParamAtPosition } from '../autocomplete/helper'; import { METADATA_FIELDS } from '../shared/constants'; +import { isStringType } from '../shared/esql_types'; function validateFunctionLiteralArg( astFunction: ESQLFunction, @@ -879,6 +880,7 @@ function validateColumnForCommand( if (columnParamsWithInnerTypes.length) { const hasSomeWrongInnerTypes = columnParamsWithInnerTypes.every(({ innerType }) => { + if (innerType === 'string' && isStringType(columnRef.type)) return false; return innerType !== 'any' && innerType !== columnRef.type; }); if (hasSomeWrongInnerTypes) { diff --git a/packages/kbn-text-based-editor/src/ecs_metadata_helper.test.ts b/packages/kbn-text-based-editor/src/ecs_metadata_helper.test.ts index aa60c10a4a4a6..4cfebe1597607 100644 --- a/packages/kbn-text-based-editor/src/ecs_metadata_helper.test.ts +++ b/packages/kbn-text-based-editor/src/ecs_metadata_helper.test.ts @@ -13,9 +13,9 @@ import type { FieldsMetadataPublicStart } from '@kbn/fields-metadata-plugin/publ describe('getColumnsWithMetadata', () => { it('should return original columns if fieldsMetadata is not provided', async () => { const columns = [ - { name: 'ecs.version', type: 'string' as DatatableColumnType }, - { name: 'field1', type: 'string' as DatatableColumnType }, - { name: 'field2', type: 'number' as DatatableColumnType }, + { name: 'ecs.version', type: 'keyword' as DatatableColumnType }, + { name: 'field1', type: 'text' as DatatableColumnType }, + { name: 'field2', type: 'double' as DatatableColumnType }, ]; const result = await getColumnsWithMetadata(columns); @@ -24,16 +24,16 @@ describe('getColumnsWithMetadata', () => { it('should return columns with metadata if both name and type match with ECS fields', async () => { const columns = [ - { name: 'ecs.field', type: 'string' as DatatableColumnType }, + { name: 'ecs.field', type: 'text' as DatatableColumnType }, { name: 'ecs.fakeBooleanField', type: 'boolean' as DatatableColumnType }, - { name: 'field2', type: 'number' as DatatableColumnType }, + { name: 'field2', type: 'double' as DatatableColumnType }, ]; const fieldsMetadata = { getClient: jest.fn().mockResolvedValue({ find: jest.fn().mockResolvedValue({ fields: { 'ecs.version': { description: 'ECS version field', type: 'keyword' }, - 'ecs.field': { description: 'ECS field description', type: 'keyword' }, + 'ecs.field': { description: 'ECS field description', type: 'text' }, 'ecs.fakeBooleanField': { description: 'ECS fake boolean field description', type: 'keyword', @@ -48,19 +48,19 @@ describe('getColumnsWithMetadata', () => { expect(result).toEqual([ { name: 'ecs.field', - type: 'string', + type: 'text', metadata: { description: 'ECS field description' }, }, { name: 'ecs.fakeBooleanField', type: 'boolean' }, - { name: 'field2', type: 'number' }, + { name: 'field2', type: 'double' }, ]); }); it('should handle keyword suffix correctly', async () => { const columns = [ - { name: 'ecs.version', type: 'string' as DatatableColumnType }, - { name: 'ecs.version.keyword', type: 'string' as DatatableColumnType }, - { name: 'field2', type: 'number' as DatatableColumnType }, + { name: 'ecs.version', type: 'keyword' as DatatableColumnType }, + { name: 'ecs.version.keyword', type: 'keyword' as DatatableColumnType }, + { name: 'field2', type: 'double' as DatatableColumnType }, ]; const fieldsMetadata = { getClient: jest.fn().mockResolvedValue({ @@ -75,13 +75,13 @@ describe('getColumnsWithMetadata', () => { const result = await getColumnsWithMetadata(columns, fieldsMetadata); expect(result).toEqual([ - { name: 'ecs.version', type: 'string', metadata: { description: 'ECS version field' } }, + { name: 'ecs.version', type: 'keyword', metadata: { description: 'ECS version field' } }, { name: 'ecs.version.keyword', - type: 'string', + type: 'keyword', metadata: { description: 'ECS version field' }, }, - { name: 'field2', type: 'number' }, + { name: 'field2', type: 'double' }, ]); }); }); diff --git a/packages/kbn-text-based-editor/src/ecs_metadata_helper.ts b/packages/kbn-text-based-editor/src/ecs_metadata_helper.ts index 687999350be0e..14198ab9d911a 100644 --- a/packages/kbn-text-based-editor/src/ecs_metadata_helper.ts +++ b/packages/kbn-text-based-editor/src/ecs_metadata_helper.ts @@ -7,7 +7,6 @@ */ import type { ESQLRealField } from '@kbn/esql-validation-autocomplete'; -import { esFieldTypeToKibanaFieldType } from '@kbn/field-types'; import type { FieldsMetadataPublicStart } from '@kbn/fields-metadata-plugin/public'; import { chunk } from 'lodash'; @@ -45,11 +44,7 @@ export async function getColumnsWithMetadata( const metadata = fields.fields[removeKeywordSuffix(c.name)]; // Need to convert metadata's type (e.g. keyword) to ES|QL type (e.g. string) to check if they are the same - if ( - !metadata || - (metadata?.type && esFieldTypeToKibanaFieldType(metadata.type) !== c.type) - ) - return c; + if (!metadata || (metadata?.type && metadata.type !== c.type)) return c; return { ...c, metadata: { description: metadata.description }, diff --git a/packages/kbn-text-based-editor/src/text_based_languages_editor.tsx b/packages/kbn-text-based-editor/src/text_based_languages_editor.tsx index e2d3fd630999d..110e803fdf54e 100644 --- a/packages/kbn-text-based-editor/src/text_based_languages_editor.tsx +++ b/packages/kbn-text-based-editor/src/text_based_languages_editor.tsx @@ -468,7 +468,14 @@ export const TextBasedLanguagesEditor = memo(function TextBasedLanguagesEditor({ undefined, abortController ).result; - const columns = table?.columns.map((c) => ({ name: c.name, type: c.meta.type })) || []; + const columns = + table?.columns.map((c) => { + // Casting unsupported as unknown to avoid plethora of warnings + // Remove when addressed https://github.com/elastic/kibana/issues/189666 + if (!c.meta.esType || c.meta.esType === 'unsupported') + return { name: c.name, type: 'unknown' }; + return { name: c.name, type: c.meta.esType }; + }) || []; return await getRateLimitedColumnsWithMetadata(columns, fieldsMetadata); } catch (e) { // no action yet diff --git a/packages/kbn-text-based-editor/tsconfig.json b/packages/kbn-text-based-editor/tsconfig.json index 632dd05753459..c141fe2c2e8fa 100644 --- a/packages/kbn-text-based-editor/tsconfig.json +++ b/packages/kbn-text-based-editor/tsconfig.json @@ -28,7 +28,6 @@ "@kbn/shared-ux-markdown", "@kbn/fields-metadata-plugin", "@kbn/esql-validation-autocomplete", - "@kbn/field-types" ], "exclude": [ "target/**/*", diff --git a/test/api_integration/apis/esql/errors.ts b/test/api_integration/apis/esql/errors.ts index e74f86efcb44c..193d48c478209 100644 --- a/test/api_integration/apis/esql/errors.ts +++ b/test/api_integration/apis/esql/errors.ts @@ -137,6 +137,7 @@ export default function ({ getService }: FtrProviderContext) { describe('error messages', () => { const config = readSetupFromESQLPackage(); const { queryToErrors, indexes, policies } = parseConfig(config); + const missmatches: Array<{ query: string; error: string }> = []; // Swap these for DEBUG/further investigation on ES bugs const stringVariants = ['text', 'keyword'] as const; @@ -182,11 +183,18 @@ export default function ({ getService }: FtrProviderContext) { for (const index of indexes) { // setup all indexes, mappings and policies here - log.info(`creating a index "${index}" with mapping...`); + log.info( + `creating a index "${index}" with mapping...\n${JSON.stringify(config.fields)}` + ); + const fieldsExcludingCounterType = config.fields.filter( + // ES|QL supports counter_integer, counter_long, counter_double, date_period, etc. + // but they are not types suitable for Elasticsearch indices + (c: { type: string }) => !c.type.startsWith('counter_') && c.type !== 'date_period' + ); await es.indices.create( createIndexRequest( index, - /unsupported/.test(index) ? config.unsupported_field : config.fields, + /unsupported/.test(index) ? config.unsupported_field : fieldsExcludingCounterType, stringFieldType, numberFieldType ),