[FEATURE] Support eval-style expressions inside stats command in PPL. #3949
Description
Currently, OpenSearch PPL (stats command) does not support inline eval-style expressions, such as conditional aggregation using functions like if() or case(). In tools like Splunk, it is common to write expressions such as:
... | stats count(eval(status="200")) as success_count, count(eval(status="400")) as bad_request_count
... | stats sum(eval(duration * 2)) as total_doubled_duration
This allows users to write intuitive conditional aggregations without needing to add an extra eval stage.
One of the use cases that customer reported is the following:
Index=xxxx
| stats count avg(duration) as “Average Request Duration (MS)” count)eval(http_status LIKE “0%)) as “Zero” count(eval(http_status LIKE “2%”)) as “TwoX” count(eval(http_status_status LIKE “3%”)) as “ThreeX” count(eval(http_status LIKE “4%”)) as “FourX” count(eval(http_status LIKE “5%”)) as “FiveX”
| eval 0% = round ((Zero/count),4*)*100
| eval 2xx% = round ((TwoX/count),4*)*100
| eval 3xx% = round ((ThreeX/count),4*)*100
| eval 4xx% = round ((FourX/count),4*)*100
| eval 5xx% = round ((FiveX/count),4*)*100
| fields “Average Request Duration (MS)” 2xx% 3xx% 4xx% 5xx%
Metadata
Metadata
Assignees
Type
Projects
Status
Status