[BUG] IF function contain equal expression return ExpressionEvaluationException

[penghuo]

What is the bug?

• = expression works as expected in eval

source=logs-otel | parse body 'HTTP/1.1 (?<httpstatus>\\d+)' | eval status200=httpstatus='200' | fields httpstatus, status200

• = throw expression when used inside if expression

source=logs-otel | parse body 'HTTP/1.1 (?<httpstatus>\\d+)' | eval status200=if(httpstatus='200', 1, 0) | fields httpstatus, status200

{
  "error": {
    "reason": "Invalid Query",
    "details": "IF function expects {[BOOLEAN,ANY,ANY]}, but got [STRING,INTEGER,INTEGER]",
    "type": "ExpressionEvaluationException"
  },
  "status": 400
}

What is the expected behavior?
No exception.

Do you have any screenshots?
n/a

Do you have any additional context?

###
PUT {{baseUrl}}/_plugins/_query/settings
Content-Type: application/x-ndjson

{
  "transient" : {
    "plugins.calcite.enabled" : true
  }
}


###
POST {{baseUrl}}/logs-otel/_bulk
Content-Type: application/x-ndjson

{"index": {}}
{"regionId": 1, "body": "HTTP/1.1 200 UT response_timeout - \"-\" 380 24 15000"}
{"index": {}}
{"regionId": 1, "body": "HTTP/1.1 301 UT response_timeout - \"-\" 380 24 15000"}
{"index": {}}
{"regionId": 2, "body": "HTTP/1.1 404 UT response_timeout - \"-\" 380 24 15000"}
{"index": {}}
{"regionId": 2, "body": "HTTP/1.1 504 UT response_timeout - \"-\" 380 24 15000"}
{"index": {}}
{"regionId": 2, "body": "HTTP/1.1 900 UT response_timeout - \"-\" 380 24 15000"}

[yuancu]

Root cause analysis:

The problem arises from the PPL grammar at OpenSearchPPLParser.g4#L597

functionArg
   : (ident EQUAL)? functionArgExpression
   ;

For each argument, it allows you to specify a name for it. The name is dropped afterwards. Therefore, foo(param1=1, param2='b') is equivalent to foo(1, 'b'). In the same manner, if(httpstatus='200', 1, 0) is interpreted as if('200', 1, 0).

Other comparison operator works: if(httpstatus!='200', 1, 0) or if(httpstatus>'200', 1, 0)

[yuancu]

It turns out that named parameters are exclusively used in table functions. I'll fix it by eliminating name parameters in other functions.