diff --git a/packages/kbn-esql-validation-autocomplete/BUILD.bazel b/packages/kbn-esql-validation-autocomplete/BUILD.bazel index 366eaa3d1a66f..07106718615d1 100644 --- a/packages/kbn-esql-validation-autocomplete/BUILD.bazel +++ b/packages/kbn-esql-validation-autocomplete/BUILD.bazel @@ -3,6 +3,7 @@ load("@build_bazel_rules_nodejs//:index.bzl", "js_library") SRCS = glob( [ "**/*.ts", + "**/*functions.json", ], exclude = [ "**/*.config.js", diff --git a/packages/kbn-esql-validation-autocomplete/package.json b/packages/kbn-esql-validation-autocomplete/package.json index 5d3773ed082b8..892ffd6999656 100644 --- a/packages/kbn-esql-validation-autocomplete/package.json +++ b/packages/kbn-esql-validation-autocomplete/package.json @@ -5,6 +5,11 @@ "license": "SSPL-1.0 OR Elastic License 2.0", "sideEffects": false, "scripts": { - "maketests": "ts-node --transpileOnly ./scripts/generate_function_validation_tests.ts" + "make:tests": "ts-node --transpileOnly ./scripts/generate_function_validation_tests.ts", + "postmake:tests": "yarn run lint:fix", + "make:defs": "ts-node --transpileOnly ./scripts/generate_function_definitions.ts", + "postmake:defs": "yarn run lint:fix && yarn run i18n:fix", + "lint:fix": "cd ../.. && node ./scripts/eslint --fix ./packages/kbn-esql-validation-autocomplete/src/**/*.ts", + "i18n:fix": "cd ../.. && node ./scripts/i18n_check.js --fix" } } diff --git a/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts b/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts new file mode 100644 index 0000000000000..b7cd905c63baf --- /dev/null +++ b/packages/kbn-esql-validation-autocomplete/scripts/generate_function_definitions.ts @@ -0,0 +1,385 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { readdirSync, readFileSync } from 'fs'; +import { writeFile } from 'fs/promises'; +import { join } from 'path'; +import _ from 'lodash'; +import type { RecursivePartial } from '@kbn/utility-types'; +import { FunctionDefinition, supportedFieldTypes } from '../src/definitions/types'; + +const aliasTable: Record = { + to_version: ['to_ver'], + to_unsigned_long: ['to_ul', 'to_ulong'], + to_boolean: ['to_bool'], + to_string: ['to_str'], + to_datetime: ['to_dt'], + to_double: ['to_dbl'], + to_integer: ['to_int'], +}; +const aliases = new Set(Object.values(aliasTable).flat()); + +const evalSupportedCommandsAndOptions = { + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], +}; + +const excludedFunctions = new Set(['bucket', 'case']); + +const extraFunctions: FunctionDefinition[] = [ + { + type: 'eval', + name: 'case', + description: + 'Accepts pairs of conditions and values. The function returns the value that belongs to the first condition that evaluates to `true`. If the number of arguments is odd, the last argument is the default value which is returned when no condition matches.', + ...evalSupportedCommandsAndOptions, + signatures: [ + { + params: [ + { name: 'condition', type: 'boolean' }, + { name: 'value', type: 'any' }, + ], + minParams: 2, + returnType: 'any', + }, + ], + examples: [ + `from index | eval type = case(languages <= 1, "monolingual", languages <= 2, "bilingual", "polyglot")`, + ], + }, +]; + +const elasticsearchToKibanaType = (elasticsearchType: string) => { + if ( + [ + 'double', + 'unsigned_long', + 'long', + 'integer', + 'counter_integer', + 'counter_long', + 'counter_double', + ].includes(elasticsearchType) + ) { + return 'number'; + } + + if (['text', 'keyword'].includes(elasticsearchType)) { + return 'string'; + } + + if (['datetime', 'time_duration'].includes(elasticsearchType)) { + return 'date'; + } + + if (elasticsearchType === 'date_period') { + return 'time_literal'; // TODO - consider aligning with Elasticsearch + } + + return elasticsearchType; +}; + +const validateLogFunctions = `(fnDef: ESQLFunction) => { + const messages = []; + // do not really care here about the base and field + // just need to check both values are not negative + for (const arg of fnDef.args) { + if (isLiteralItem(arg) && arg.value < 0) { + messages.push({ + type: 'warning' as const, + code: 'logOfNegativeValue', + text: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.divide.warning.logOfNegativeValue', + { + defaultMessage: 'Log of a negative number results in null: {value}', + values: { + value: arg.value, + }, + } + ), + location: arg.location, + }); + } + } + return messages; +}`; + +const dateDiffSuggestions = [ + 'year', + 'quarter', + 'month', + 'week', + 'day', + 'hour', + 'minute', + 'second', + 'millisecond', + 'microsecond', + 'nanosecond', +]; + +const dateDiffOptions = [ + 'year', + 'years', + 'yy', + 'yyyy', + 'quarter', + 'quarters', + 'qq', + 'q', + 'month', + 'months', + 'mm', + 'm', + 'dayofyear', + 'dy', + 'y', + 'day', + 'days', + 'dd', + 'd', + 'week', + 'weeks', + 'wk', + 'ww', + 'weekday', + 'weekdays', + 'dw', + 'hour', + 'hours', + 'hh', + 'minute', + 'minutes', + 'mi', + 'n', + 'second', + 'seconds', + 'ss', + 's', + 'millisecond', + 'milliseconds', + 'ms', + 'microsecond', + 'microseconds', + 'mcs', + 'nanosecond', + 'nanoseconds', + 'ns', +]; + +/** + * Enrichments for function definitions + * + * This is the place to put information that is not provided by Elasticsearch + * and, hence, won't be present in the JSON file. + */ +const functionEnrichments: Record> = { + log10: { + validate: validateLogFunctions, + }, + log: { + validate: validateLogFunctions, + }, + date_diff: { + signatures: [ + { + params: [{ literalOptions: dateDiffOptions, literalSuggestions: dateDiffSuggestions }], + }, + ], + }, + date_extract: { + signatures: [ + { + // override the first param as type chrono_literal + params: [{ type: 'chrono_literal' }], + }, + ], + }, + date_trunc: { + signatures: [ + { + // override the first param to be of type time_literal + params: [{ type: 'time_literal' }], + }, + ], + }, + mv_sort: { + signatures: new Array(6).fill({ + params: [{}, { literalOptions: ['asc', 'desc'] }], + }), + }, + // can be removed when https://github.com/elastic/elasticsearch/issues/108982 is complete + coalesce: { + signatures: supportedFieldTypes + .map((type) => [ + { + params: [ + { + name: 'first', + type, + optional: false, + }, + ], + returnType: type, + minParams: 1, + }, + { + params: [ + { + name: 'first', + type, + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: type, + minParams: 1, + }, + ]) + .flat(), + }, + // can be removed when https://github.com/elastic/elasticsearch/issues/108982 is complete + mv_dedupe: { + signatures: supportedFieldTypes.map((type) => ({ + params: [ + { + name: 'field', + type, + optional: false, + }, + ], + returnType: type, + })), + }, +}; + +/** + * Builds a function definition object from a row of the "meta functions" table + * @param {Array} value — the row of the "meta functions" table, corresponding to a single function definition + * @param {*} columnIndices — the indices of the columns in the "meta functions" table + * @returns + */ +function getFunctionDefinition(ESFunctionDefinition: Record): FunctionDefinition { + const ret = { + type: ESFunctionDefinition.type, + name: ESFunctionDefinition.name, + ...(ESFunctionDefinition.type === 'eval' + ? evalSupportedCommandsAndOptions + : { supportedCommands: ['stats'] }), + description: ESFunctionDefinition.description, + alias: aliasTable[ESFunctionDefinition.name], + signatures: _.uniqBy( + ESFunctionDefinition.signatures.map((signature: any) => ({ + ...signature, + params: signature.params.map((param: any) => ({ + ...param, + type: elasticsearchToKibanaType(param.type), + description: undefined, + })), + returnType: elasticsearchToKibanaType(signature.returnType), + variadic: undefined, // we don't support variadic property + minParams: signature.variadic + ? signature.params.filter((param: any) => !param.optional).length + : undefined, + })), + (el) => JSON.stringify(el) + ), + examples: ESFunctionDefinition.examples, + }; + + if (functionEnrichments[ret.name]) { + _.merge(ret, functionEnrichments[ret.name]); + } + + return ret as FunctionDefinition; +} + +function printGeneratedFunctionsFile(functionDefinitions: FunctionDefinition[]) { + const removeInlineAsciiDocLinks = (asciidocString: string) => { + const inlineLinkRegex = /\{.+?\}\/.+?\[(.+?)\]/g; + return asciidocString.replace(inlineLinkRegex, '$1'); + }; + + const getDefinitionName = (name: string) => _.camelCase(`${name}Definition`); + + const printFunctionDefinition = (functionDefinition: FunctionDefinition) => { + const { type, name, description, alias, signatures } = functionDefinition; + + return `const ${getDefinitionName(name)}: FunctionDefinition = { + type: '${type}', + name: '${name}', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.${name}', { defaultMessage: ${JSON.stringify( + removeInlineAsciiDocLinks(description) + )} }), + alias: ${alias ? `['${alias.join("', '")}']` : 'undefined'}, + signatures: ${JSON.stringify(signatures, null, 2)}, + supportedCommands: ${JSON.stringify(functionDefinition.supportedCommands)}, + supportedOptions: ${JSON.stringify(functionDefinition.supportedOptions)}, + validate: ${functionDefinition.validate || 'undefined'}, + examples: ${JSON.stringify(functionDefinition.examples || [])}, +}`; + }; + + const fileHeader = `// NOTE: This file is generated by the generate_function_definitions.js script +// Do not edit it manually + +import type { ESQLFunction } from '@kbn/esql-ast'; +import { i18n } from '@kbn/i18n'; +import { isLiteralItem } from '../shared/helpers'; +import type { FunctionDefinition } from './types'; + + +`; + + const functionDefinitionsString = functionDefinitions.map(printFunctionDefinition).join('\n\n'); + + const fileContents = `${fileHeader}${functionDefinitionsString} + export const evalFunctionDefinitions = [${functionDefinitions + .map(({ name }) => getDefinitionName(name)) + .join(',\n')}];`; + + return fileContents; +} + +(async function main() { + const pathToElasticsearch = process.argv[2]; + + const ESFunctionDefinitionsDirectory = join( + __dirname, + pathToElasticsearch, + 'docs/reference/esql/functions/kibana/definition' + ); + + // read all ES function definitions (the directory is full of JSON files) and create an array of definitions + const ESFunctionDefinitions = readdirSync(ESFunctionDefinitionsDirectory).map((file) => + JSON.parse(readFileSync(`${ESFunctionDefinitionsDirectory}/${file}`, 'utf-8')) + ); + + const evalFunctionDefinitions: FunctionDefinition[] = []; + // const aggFunctionDefinitions = []; + for (const ESDefinition of ESFunctionDefinitions) { + if (aliases.has(ESDefinition.name) || excludedFunctions.has(ESDefinition.name)) { + continue; + } + + const functionDefinition = getFunctionDefinition(ESDefinition); + + evalFunctionDefinitions.push(functionDefinition); + } + + evalFunctionDefinitions.push(...extraFunctions); + + await writeFile( + join(__dirname, '../src/definitions/functions.ts'), + printGeneratedFunctionsFile(evalFunctionDefinitions) + ); +})(); diff --git a/packages/kbn-esql-validation-autocomplete/scripts/generate_function_validation_tests.ts b/packages/kbn-esql-validation-autocomplete/scripts/generate_function_validation_tests.ts index 2b68d96a4195c..bcf11337117f4 100644 --- a/packages/kbn-esql-validation-autocomplete/scripts/generate_function_validation_tests.ts +++ b/packages/kbn-esql-validation-autocomplete/scripts/generate_function_validation_tests.ts @@ -7,22 +7,30 @@ */ import { readFileSync, writeFileSync } from 'fs'; -import { camelCase } from 'lodash'; import { join } from 'path'; import * as recast from 'recast'; +import { camelCase } from 'lodash'; +import { getParamAtPosition } from '../src/autocomplete/helper'; import { statsAggregationFunctionDefinitions } from '../src/definitions/aggs'; -import { evalFunctionsDefinitions } from '../src/definitions/functions'; +import { evalFunctionDefinitions } from '../src/definitions/functions'; import { groupingFunctionDefinitions } from '../src/definitions/grouping'; import { getFunctionSignatures } from '../src/definitions/helpers'; import { chronoLiterals, timeLiterals } from '../src/definitions/literals'; -import { FunctionDefinition } from '../src/definitions/types'; import { nonNullable } from '../src/shared/helpers'; +import { + SupportedFieldType, + FunctionDefinition, + supportedFieldTypes, + isSupportedFieldType, +} from '../src/definitions/types'; import { FUNCTION_DESCRIBE_BLOCK_NAME } from '../src/validation/function_describe_block_name'; +export const fieldNameFromType = (type: SupportedFieldType) => `${camelCase(type)}Field`; + function main() { const testCasesByFunction: Map> = new Map(); - for (const definition of evalFunctionsDefinitions) { + for (const definition of evalFunctionDefinitions) { testCasesByFunction.set(definition.name, generateTestsForEvalFunction(definition)); } @@ -131,26 +139,27 @@ function generateRowCommandTestsForEvalFunction( ); testCases.set(`row var = ${signatureString}`, []); - - const { wrongFieldMapping, expectedErrors } = generateIncorrectlyTypedParameters( - name, - signatures, - params, - { - stringField: '"a"', - numberField: '5', - booleanField: 'true', - } - ); - const wrongSignatureString = tweakSignatureForRowCommand( - getFunctionSignatures( - { name, ...defRest, signatures: [{ params: wrongFieldMapping, ...signRest }] }, - { withTypes: false } - )[0].declaration - ); - testCases.set(`row var = ${wrongSignatureString}`, expectedErrors); } } + + // Test the parameter type checking + const signatureWithMostParams = signatures.reduce((acc, curr) => + acc.params.length > curr.params.length ? acc : curr + ); + + const { wrongFieldMapping, expectedErrors } = generateIncorrectlyTypedParameters( + name, + signatures, + signatureWithMostParams.params, + supportedTypesAndConstants + ); + const wrongSignatureString = tweakSignatureForRowCommand( + getFunctionSignatures( + { name, ...defRest, signatures: [{ ...signatureWithMostParams, params: wrongFieldMapping }] }, + { withTypes: false } + )[0].declaration + ); + testCases.set(`row var = ${wrongSignatureString}`, expectedErrors); } function generateWhereCommandTestsForEvalFunction( @@ -195,7 +204,7 @@ function generateWhereCommandTestsForEvalFunction( name, signatures, params, - { stringField: 'stringField', numberField: 'numberField', booleanField: 'booleanField' } + supportedTypesAndFieldNames ); testCases.set( `from a_index | where ${returnType !== 'number' ? 'length(' : ''}${ @@ -349,11 +358,7 @@ function generateEvalCommandTestsForEvalFunction( name, signatures, params, - { - stringField: 'stringField', - numberField: 'numberField', - booleanField: 'booleanField', - } + supportedTypesAndFieldNames ); testCases.set( `from a_index | eval ${ @@ -364,50 +369,6 @@ function generateEvalCommandTestsForEvalFunction( }`, expectedErrors ); - - if (!signRest.minParams) { - // test that additional args are spotted - const fieldMappingWithOneExtraArg = getFieldMapping(params).concat({ - name: 'extraArg', - type: 'number', - }); - const refSignature = signatures[0]; - // get the expected args from the first signature in case of errors - const minNumberOfArgs = refSignature.params.filter(({ optional }) => !optional).length; - const fullNumberOfArgs = refSignature.params.length; - const hasOptionalArgs = minNumberOfArgs < fullNumberOfArgs; - const hasTooManyArgs = fieldMappingWithOneExtraArg.length > fullNumberOfArgs; - - // the validation engine tries to be smart about signatures with optional args - let messageQuantifier = 'exactly '; - if (hasOptionalArgs && hasTooManyArgs) { - messageQuantifier = 'no more than '; - } - if (!hasOptionalArgs && !hasTooManyArgs) { - messageQuantifier = 'at least '; - } - testCases.set( - `from a_index | eval ${ - getFunctionSignatures( - { - name, - ...defRest, - signatures: [{ params: fieldMappingWithOneExtraArg, ...signRest }], - }, - { withTypes: false } - )[0].declaration - }`, - [ - `Error: [${name}] function expects ${messageQuantifier}${ - fullNumberOfArgs === 1 - ? 'one argument' - : fullNumberOfArgs === 0 - ? '0 arguments' - : `${fullNumberOfArgs} arguments` - }, got ${fieldMappingWithOneExtraArg.length}.`, - ] - ); - } } // test that wildcard won't work as arg @@ -430,6 +391,79 @@ function generateEvalCommandTestsForEvalFunction( ); } } + + // test that the function can have too many args + if (signatures.some(({ minParams }) => minParams)) { + // at least one signature is variadic, so no way + // to have too many arguments + return; + } + + // test that additional args are spotted + + const getNumberOfParams = (signature: FunctionDefinition['signatures'][number]) => ({ + all: signature.params.length, + required: signature.params.filter(({ optional }) => !optional).length, + }); + + // get the signature with the greatest number of params + const [first, ...rest] = signatures; + let signatureWithGreatestNumberOfParams = first; + let { all: maxNumberOfArgs, required: minNumberOfArgs } = getNumberOfParams(first); + + for (const signature of rest) { + const numberOfParams = signature.params.length; + if (numberOfParams > signatureWithGreatestNumberOfParams.params.length) { + signatureWithGreatestNumberOfParams = signature; + } + + maxNumberOfArgs = Math.max(maxNumberOfArgs, numberOfParams); + const numberOfRequiredParams = signature.params.filter(({ optional }) => !optional).length; + minNumberOfArgs = Math.min(minNumberOfArgs, numberOfRequiredParams); + } + + const fieldMappingWithOneExtraArg = getFieldMapping( + signatureWithGreatestNumberOfParams.params + ).concat({ + name: 'extraArg', + type: 'number', + }); + + // get the expected args from the first signature in case of errors + const hasOptionalArgs = minNumberOfArgs < maxNumberOfArgs; + const hasTooManyArgs = fieldMappingWithOneExtraArg.length > maxNumberOfArgs; + + // the validation engine tries to be smart about signatures with optional args + let messageQuantifier = 'exactly '; + if (hasOptionalArgs && hasTooManyArgs) { + messageQuantifier = 'no more than '; + } + if (!hasOptionalArgs && !hasTooManyArgs) { + messageQuantifier = 'at least '; + } + testCases.set( + `from a_index | eval ${ + getFunctionSignatures( + { + name, + ...defRest, + signatures: [ + { ...signatureWithGreatestNumberOfParams, params: fieldMappingWithOneExtraArg }, + ], + }, + { withTypes: false } + )[0].declaration + }`, + [ + `Error: [${name}] function expects ${messageQuantifier}${ + maxNumberOfArgs === 1 + ? 'one argument' + : maxNumberOfArgs === 0 + ? '0 arguments' + : `${maxNumberOfArgs} arguments` + }, got ${fieldMappingWithOneExtraArg.length}.`, + ] + ); } function generateEvalCommandTestsForAggFunction( @@ -680,11 +714,7 @@ function generateStatsCommandTestsForAggFunction( name, signatures, params, - { - stringField: 'stringField', - numberField: 'numberField', - booleanField: 'booleanField', - } + supportedTypesAndFieldNames ); // and the message is case of wrong argument type is passed testCases.set( @@ -818,18 +848,28 @@ function generateSortCommandTestsForAggFunction( const generateSortCommandTestsForGroupingFunction = generateSortCommandTestsForAggFunction; -const fieldTypes = [ - 'number', - 'date', - 'boolean', - 'version', - 'ip', - 'string', - 'cartesian_point', - 'cartesian_shape', - 'geo_point', - 'geo_shape', -]; +const fieldTypesToConstants: Record = { + string: '"a"', + number: '5', + date: 'now()', + boolean: 'true', + version: 'to_version("1.0.0")', + ip: 'to_ip("127.0.0.1")', + geo_point: 'to_geopoint("POINT (30 10)")', + geo_shape: 'to_geoshape("POINT (30 10)")', + cartesian_point: 'to_cartesianpoint("POINT (30 10)")', + cartesian_shape: 'to_cartesianshape("POINT (30 10)")', +}; + +const supportedTypesAndFieldNames = supportedFieldTypes.map((type) => ({ + name: fieldNameFromType(type), + type, +})); + +const supportedTypesAndConstants = supportedFieldTypes.map((type) => ({ + name: fieldTypesToConstants[type], + type, +})); function prepareNestedFunction(fnSignature: FunctionDefinition): string { return getFunctionSignatures( @@ -848,28 +888,36 @@ function prepareNestedFunction(fnSignature: FunctionDefinition): string { const toAvgSignature = statsAggregationFunctionDefinitions.find(({ name }) => name === 'avg')!; -const toInteger = evalFunctionsDefinitions.find(({ name }) => name === 'to_integer')!; -const toStringSignature = evalFunctionsDefinitions.find(({ name }) => name === 'to_string')!; -const toDateSignature = evalFunctionsDefinitions.find(({ name }) => name === 'to_datetime')!; -const toBooleanSignature = evalFunctionsDefinitions.find(({ name }) => name === 'to_boolean')!; -const toIpSignature = evalFunctionsDefinitions.find(({ name }) => name === 'to_ip')!; -const toGeoPointSignature = evalFunctionsDefinitions.find(({ name }) => name === 'to_geopoint')!; -const toCartesianPointSignature = evalFunctionsDefinitions.find( +const toInteger = evalFunctionDefinitions.find(({ name }) => name === 'to_integer')!; +const toStringSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_string')!; +const toDateSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_datetime')!; +const toBooleanSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_boolean')!; +const toIpSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_ip')!; +const toGeoPointSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_geopoint')!; +const toGeoShapeSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_geoshape')!; +const toCartesianPointSignature = evalFunctionDefinitions.find( ({ name }) => name === 'to_cartesianpoint' )!; +const toCartesianShapeSignature = evalFunctionDefinitions.find( + ({ name }) => name === 'to_cartesianshape' +)!; +const toVersionSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_version')!; -const nestedFunctions = { +const nestedFunctions: Record = { number: prepareNestedFunction(toInteger), string: prepareNestedFunction(toStringSignature), date: prepareNestedFunction(toDateSignature), boolean: prepareNestedFunction(toBooleanSignature), ip: prepareNestedFunction(toIpSignature), + version: prepareNestedFunction(toVersionSignature), geo_point: prepareNestedFunction(toGeoPointSignature), + geo_shape: prepareNestedFunction(toGeoShapeSignature), cartesian_point: prepareNestedFunction(toCartesianPointSignature), + cartesian_shape: prepareNestedFunction(toCartesianShapeSignature), }; function getFieldName( - typeString: string, + typeString: SupportedFieldType, { useNestedFunction, isStats }: { useNestedFunction: boolean; isStats: boolean } ) { if (useNestedFunction && isStats) { @@ -877,7 +925,7 @@ function getFieldName( } return useNestedFunction && typeString in nestedFunctions ? nestedFunctions[typeString as keyof typeof nestedFunctions] - : `${camelCase(typeString)}Field`; + : fieldNameFromType(typeString); } const literals = { @@ -902,21 +950,16 @@ function getMultiValue(type: string) { return `[true, false]`; } -function tweakSignatureForRowCommand(signature: string) { +function tweakSignatureForRowCommand(signature: string): string { /** * row has no access to any field, so replace it with literal * or functions (for dates) */ - return signature - .replace(/numberField/g, '5') - .replace(/stringField/g, '"a"') - .replace(/dateField/g, 'now()') - .replace(/booleanField/g, 'true') - .replace(/ipField/g, 'to_ip("127.0.0.1")') - .replace(/geoPointField/g, 'to_geopoint("POINT (30 10)")') - .replace(/geoShapeField/g, 'to_geoshape("POINT (30 10)")') - .replace(/cartesianPointField/g, 'to_cartesianpoint("POINT (30 10)")') - .replace(/cartesianShapeField/g, 'to_cartesianshape("POINT (30 10)")'); + let ret = signature; + for (const [type, value] of Object.entries(fieldTypesToConstants)) { + ret = ret.replace(new RegExp(fieldNameFromType(type as SupportedFieldType), 'g'), value); + } + return ret; } function getFieldMapping( @@ -933,7 +976,7 @@ function getFieldMapping( }; return params.map(({ name: _name, type, constantOnly, literalOptions, ...rest }) => { const typeString: string = type; - if (fieldTypes.includes(typeString)) { + if (isSupportedFieldType(typeString)) { if (useLiterals && literalOptions) { return { name: `"${literalOptions[0]}"`, @@ -977,48 +1020,68 @@ function generateIncorrectlyTypedParameters( name: string, signatures: FunctionDefinition['signatures'], currentParams: FunctionDefinition['signatures'][number]['params'], - values: { stringField: string; numberField: string; booleanField: string } + availableFields: Array<{ name: string; type: SupportedFieldType }> ) { const literalValues = { string: `"a"`, number: '5', }; const wrongFieldMapping = currentParams.map( - ({ name: _name, constantOnly, literalOptions, type, ...rest }, i) => { + ({ name: paramName, constantOnly, literalOptions, type, ...rest }, i) => { // this thing is complex enough, let's not make it harder for constants if (constantOnly) { return { name: literalValues[type as keyof typeof literalValues], type, + actualType: type, wrong: false, ...rest, }; } - const canBeFieldButNotString = Boolean( - fieldTypes.filter((t) => t !== 'string').includes(type) && - signatures.every(({ params: fnParams }) => fnParams[i].type !== 'string') - ); - const canBeFieldButNotNumber = - fieldTypes.filter((t) => t !== 'number').includes(type) && - signatures.every(({ params: fnParams }) => fnParams[i].type !== 'number'); - const isLiteralType = /literal$/.test(type); - // pick a field name purposely wrong - const nameValue = - canBeFieldButNotString || isLiteralType - ? values.stringField - : canBeFieldButNotNumber - ? values.numberField - : values.booleanField; - return { name: nameValue, type, wrong: true, ...rest }; + + if (type !== 'any') { + // try to find an unacceptable field + const unacceptableField: { name: string; type: SupportedFieldType } | undefined = + availableFields + // sort to make the test deterministic + .sort((a, b) => a.type.localeCompare(b.type)) + .find(({ type: fieldType }) => + signatures.every((signature) => getParamAtPosition(signature, i)?.type !== fieldType) + ); + + if (unacceptableField) { + return { + name: unacceptableField.name, + type, + actualType: unacceptableField.type, + wrong: true, + ...rest, + }; + } + } + + // failed to find a bad field... they must all be acceptable + const acceptableField: { name: string; type: SupportedFieldType } | undefined = + type === 'any' + ? availableFields[0] + : availableFields.find(({ type: fieldType }) => fieldType === type); + + if (!acceptableField) { + throw new Error( + `Unable to find an acceptable field for type ${type}... this should never happen` + ); + } + + return { + name: acceptableField.name, + type: acceptableField.type, + actualType: acceptableField.type, + wrong: false, + ...rest, + }; } ); - const generatedFieldTypes = { - [values.stringField]: 'string', - [values.numberField]: 'number', - [values.booleanField]: 'boolean', - }; - // Try to predict which signature will be used to generate the errors // in the validation engine. The validator currently uses the signature // which generates the fewest errors. @@ -1027,12 +1090,15 @@ function generateIncorrectlyTypedParameters( // // This is not future-proof... const misMatchesBySignature = signatures.map(({ params: fnParams }) => { + if (fnParams.length !== wrongFieldMapping.length) { + return Infinity; + } const typeMatches = fnParams.map(({ type }, i) => { if (wrongFieldMapping[i].wrong) { - const typeFromIncorrectMapping = generatedFieldTypes[wrongFieldMapping[i].name]; + const typeFromIncorrectMapping = wrongFieldMapping[i].actualType; return type === typeFromIncorrectMapping; } - return type === wrongFieldMapping[i].type; + return type === wrongFieldMapping[i].actualType; }); return typeMatches.filter((t) => !t).length; })!; @@ -1042,14 +1108,17 @@ function generateIncorrectlyTypedParameters( const expectedErrors = signatureToUse.params .filter(({ constantOnly }) => !constantOnly) .map(({ type }, i) => { + if (!wrongFieldMapping[i].wrong) { + return; + } const fieldName = wrongFieldMapping[i].name; if ( fieldName === 'numberField' && - signatures.every(({ params: fnParams }) => fnParams[i].type !== 'string') + signatures.every((signature) => getParamAtPosition(signature, i)?.type !== 'string') ) { return; } - return `Argument of [${name}] must be [${type}], found value [${fieldName}] type [${generatedFieldTypes[fieldName]}]`; + return `Argument of [${name}] must be [${type}], found value [${fieldName}] type [${wrongFieldMapping[i].actualType}]`; }) .filter(nonNullable); diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts index 3e68887c86f39..efff60c382d34 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts @@ -7,7 +7,7 @@ */ import { suggest } from './autocomplete'; -import { evalFunctionsDefinitions } from '../definitions/functions'; +import { evalFunctionDefinitions } from '../definitions/functions'; import { builtinFunctions } from '../definitions/builtin'; import { statsAggregationFunctionDefinitions } from '../definitions/aggs'; import { chronoLiterals, timeLiterals } from '../definitions/literals'; @@ -17,6 +17,8 @@ import { camelCase, partition } from 'lodash'; import { getAstAndSyntaxErrors } from '@kbn/esql-ast'; import { groupingFunctionDefinitions } from '../definitions/grouping'; import { FunctionArgSignature } from '../definitions/types'; +import { getParamAtPosition } from './helper'; +import { nonNullable } from '../shared/helpers'; import { METADATA_FIELDS } from '../shared/constants'; const triggerCharacters = [',', '(', '=', ' ']; @@ -118,7 +120,7 @@ function getFunctionSignaturesByReturnType( } // eval functions (eval is a special keyword in JS) if (evalMath) { - list.push(...evalFunctionsDefinitions); + list.push(...evalFunctionDefinitions); } if (builtin) { list.push(...builtinFunctions.filter(({ name }) => (skipAssign ? name !== '=' : true))); @@ -1129,22 +1131,27 @@ describe('autocomplete', () => { ); // Test suggestions for each possible param, within each signature variation, for each function - for (const fn of evalFunctionsDefinitions) { + for (const fn of evalFunctionDefinitions) { // skip this fn for the moment as it's quite hard to test if (fn.name !== 'bucket') { for (const signature of fn.signatures) { signature.params.forEach((param, i) => { if (i < signature.params.length) { - const canHaveMoreArgs = - i + 1 < (signature.minParams ?? 0) || - signature.params.filter(({ optional }, j) => !optional && j > i).length > 0; + // This ref signature thing is probably wrong in a few cases, but it matches + // the logic in getFunctionArgsSuggestions. They should both be updated + const refSignature = fn.signatures[0]; + const requiresMoreArgs = + i + 1 < (refSignature.minParams ?? 0) || + refSignature.params.filter(({ optional }, j) => !optional && j > i).length > 0; - const allParamDefs = fn.signatures.map((s) => s.params[i]); + const allParamDefs = fn.signatures + .map((s) => getParamAtPosition(s, i)) + .filter(nonNullable); // get all possible types for this param const [constantOnlyParamDefs, acceptsFieldParamDefs] = partition( allParamDefs, - (p) => p.constantOnly || /_literal/.test(param.type) + (p) => p.constantOnly || /_literal/.test(p.type) ); const getTypesFromParamDefs = (paramDefs: FunctionArgSignature[]) => @@ -1155,10 +1162,10 @@ describe('autocomplete', () => { testSuggestions( `from a | eval ${fn.name}(${Array(i).fill('field').join(', ')}${i ? ',' : ''} )`, suggestedConstants?.length - ? suggestedConstants.map((option) => `"${option}"${canHaveMoreArgs ? ',' : ''}`) + ? suggestedConstants.map((option) => `"${option}"${requiresMoreArgs ? ',' : ''}`) : [ ...getFieldNamesByType(getTypesFromParamDefs(acceptsFieldParamDefs)).map( - (f) => (canHaveMoreArgs ? `${f},` : f) + (f) => (requiresMoreArgs ? `${f},` : f) ), ...getFunctionSignaturesByReturnType( 'eval', @@ -1166,9 +1173,9 @@ describe('autocomplete', () => { { evalMath: true }, undefined, [fn.name] - ).map((l) => (canHaveMoreArgs ? `${l},` : l)), + ).map((l) => (requiresMoreArgs ? `${l},` : l)), ...getLiteralsByType(getTypesFromParamDefs(constantOnlyParamDefs)).map((d) => - canHaveMoreArgs ? `${d},` : d + requiresMoreArgs ? `${d},` : d ), ] ); @@ -1177,10 +1184,10 @@ describe('autocomplete', () => { i ? ',' : '' } )`, suggestedConstants?.length - ? suggestedConstants.map((option) => `"${option}"${canHaveMoreArgs ? ',' : ''}`) + ? suggestedConstants.map((option) => `"${option}"${requiresMoreArgs ? ',' : ''}`) : [ ...getFieldNamesByType(getTypesFromParamDefs(acceptsFieldParamDefs)).map( - (f) => (canHaveMoreArgs ? `${f},` : f) + (f) => (requiresMoreArgs ? `${f},` : f) ), ...getFunctionSignaturesByReturnType( 'eval', @@ -1188,9 +1195,9 @@ describe('autocomplete', () => { { evalMath: true }, undefined, [fn.name] - ).map((l) => (canHaveMoreArgs ? `${l},` : l)), + ).map((l) => (requiresMoreArgs ? `${l},` : l)), ...getLiteralsByType(getTypesFromParamDefs(constantOnlyParamDefs)).map((d) => - canHaveMoreArgs ? `${d},` : d + requiresMoreArgs ? `${d},` : d ), ] ); @@ -1236,7 +1243,13 @@ describe('autocomplete', () => { ]); testSuggestions( 'from a | eval var0=date_trunc()', - [...getLiteralsByType('time_literal').map((t) => `${t},`)], + [ + ...getLiteralsByType('time_literal').map((t) => `${t},`), + ...getFunctionSignaturesByReturnType('eval', 'date', { evalMath: true }, undefined, [ + 'date_trunc', + ]).map((t) => `${t},`), + ...getFieldNamesByType('date').map((t) => `${t},`), + ], '(' ); testSuggestions('from a | eval var0=date_trunc(2 )', [ diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts index cc16a8d8c7699..2d0c2cd9e757e 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.ts @@ -80,7 +80,11 @@ import { getSourcesHelper, } from '../shared/resources_helpers'; import { ESQLCallbacks } from '../shared/types'; -import { getFunctionsToIgnoreForStats, isAggFunctionUsedAlready } from './helper'; +import { + getFunctionsToIgnoreForStats, + getParamAtPosition, + isAggFunctionUsedAlready, +} from './helper'; import { FunctionArgSignature } from '../definitions/types'; type GetSourceFn = () => Promise; @@ -1082,6 +1086,7 @@ async function getFunctionArgsSuggestions( const arg = node.args[argIndex]; // the first signature is used as reference + // TODO - take into consideration all signatures that match the current args const refSignature = fnDefinition.signatures[0]; const hasMoreMandatoryArgs = @@ -1182,13 +1187,7 @@ async function getFunctionArgsSuggestions( * for the current parameter position in the given function definition, */ const allParamDefinitionsForThisPosition = validSignatures - .map((signature) => - signature.params.length > argIndex - ? signature.params[argIndex] - : signature.minParams - ? signature.params[signature.params.length - 1] - : null - ) + .map((signature) => getParamAtPosition(signature, argIndex)) .filter(nonNullable); // Separate the param definitions into two groups: diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/documentation_util.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/documentation_util.ts index 0e46046320430..692ac590e8c46 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/documentation_util.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/documentation_util.ts @@ -26,8 +26,8 @@ const examplesLabel = i18n.translate( export const buildFunctionDocumentation = ( signatures: Array<{ declaration: string; - examples?: string[]; - }> + }>, + examples: string[] | undefined ) => ` --- \ @@ -41,28 +41,23 @@ ${signatures ` ) .join('\n\n')} + ${ + examples?.length + ? `\ --- -${ - signatures.some((examples) => examples) - ? `\ ***${examplesLabel}*** \ -${signatures - .filter(({ examples }) => examples) - .map( - ({ examples }) => ` - ${examples! + ${examples .map( (i) => ` - - \`\`${i}\`\`) + - \`\`${i}\`\` ` ) .join('')} ` - )}` - : '' -}`; + : '' + }`; /** @internal **/ export const buildDocumentation = (declaration: string, examples?: string[]) => ` diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts index 481399edfb4d5..4b2e74729db78 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/factories.ts @@ -10,7 +10,7 @@ import { i18n } from '@kbn/i18n'; import { SuggestionRawDefinition } from './types'; import { groupingFunctionDefinitions } from '../definitions/grouping'; import { statsAggregationFunctionDefinitions } from '../definitions/aggs'; -import { evalFunctionsDefinitions } from '../definitions/functions'; +import { evalFunctionDefinitions } from '../definitions/functions'; import { getFunctionSignatures, getCommandSignature } from '../definitions/helpers'; import { chronoLiterals, timeLiterals } from '../definitions/literals'; import { @@ -24,7 +24,7 @@ import { buildDocumentation, buildFunctionDocumentation } from './documentation_ import { DOUBLE_BACKTICK, SINGLE_TICK_REGEX } from '../shared/constants'; const allFunctions = statsAggregationFunctionDefinitions - .concat(evalFunctionsDefinitions) + .concat(evalFunctionDefinitions) .concat(groupingFunctionDefinitions); export const TRIGGER_SUGGESTION_COMMAND = { @@ -47,7 +47,7 @@ export function getSuggestionFunctionDefinition(fn: FunctionDefinition): Suggest kind: 'Function', detail: fn.description, documentation: { - value: buildFunctionDocumentation(fullSignatures), + value: buildFunctionDocumentation(fullSignatures, fn.examples), }, // agg functgions have priority over everything else sortText: fn.type === 'agg' ? '1A' : 'C', diff --git a/packages/kbn-esql-validation-autocomplete/src/autocomplete/helper.ts b/packages/kbn-esql-validation-autocomplete/src/autocomplete/helper.ts index 11b853c2d3cf0..c52c18b822068 100644 --- a/packages/kbn-esql-validation-autocomplete/src/autocomplete/helper.ts +++ b/packages/kbn-esql-validation-autocomplete/src/autocomplete/helper.ts @@ -7,6 +7,7 @@ */ import type { ESQLAstItem, ESQLCommand, ESQLFunction } from '@kbn/esql-ast'; +import { FunctionDefinition } from '../definitions/types'; import { getFunctionDefinition, isAssignment, isFunctionItem } from '../shared/helpers'; function extractFunctionArgs(args: ESQLAstItem[]): ESQLFunction[] { @@ -37,3 +38,20 @@ export function getFunctionsToIgnoreForStats(command: ESQLCommand, argIndex: num const arg = command.args[argIndex]; return isFunctionItem(arg) ? getFnContent(arg) : []; } + +/** + * Given a function signature, returns the parameter at the given position. + * + * Takes into account variadic functions (minParams), returning the last + * parameter if the position is greater than the number of parameters. + * + * @param signature + * @param position + * @returns + */ +export function getParamAtPosition( + { params, minParams }: FunctionDefinition['signatures'][number], + position: number +) { + return params.length > position ? params[position] : minParams ? params[params.length - 1] : null; +} diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts index cafaf2d09fa97..2d20b871e251b 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/aggs.ts @@ -41,12 +41,12 @@ function createNumericAggDefinition({ })), ], returnType: 'number', - examples: [ - `from index | stats result = ${name}(field${extraParamsExample})`, - `from index | stats ${name}(field${extraParamsExample})`, - ], }, ], + examples: [ + `from index | stats result = ${name}(field${extraParamsExample})`, + `from index | stats ${name}(field${extraParamsExample})`, + ], }; } @@ -103,14 +103,13 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ { params: [{ name: 'column', type: 'number', noNestingFunctions: true }], returnType: 'number', - examples: [`from index | stats result = max(field)`, `from index | stats max(field)`], }, { params: [{ name: 'column', type: 'date', noNestingFunctions: true }], returnType: 'number', - examples: [`from index | stats result = max(field)`, `from index | stats max(field)`], }, ], + examples: [`from index | stats result = max(field)`, `from index | stats max(field)`], }, { name: 'min', @@ -123,14 +122,13 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ { params: [{ name: 'column', type: 'number', noNestingFunctions: true }], returnType: 'number', - examples: [`from index | stats result = min(field)`, `from index | stats min(field)`], }, { params: [{ name: 'column', type: 'date', noNestingFunctions: true }], returnType: 'number', - examples: [`from index | stats result = min(field)`, `from index | stats min(field)`], }, ], + examples: [`from index | stats result = min(field)`, `from index | stats min(field)`], }, ]) .concat([ @@ -153,9 +151,9 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ }, ], returnType: 'number', - examples: [`from index | stats result = count(field)`, `from index | stats count(field)`], }, ], + examples: [`from index | stats result = count(field)`, `from index | stats count(field)`], }, { name: 'count_distinct', @@ -174,12 +172,12 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ { name: 'precision', type: 'number', noNestingFunctions: true, optional: true }, ], returnType: 'number', - examples: [ - `from index | stats result = count_distinct(field)`, - `from index | stats count_distinct(field)`, - ], }, ], + examples: [ + `from index | stats result = count_distinct(field)`, + `from index | stats count_distinct(field)`, + ], }, { name: 'st_centroid_agg', @@ -195,20 +193,18 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ { params: [{ name: 'column', type: 'cartesian_point', noNestingFunctions: true }], returnType: 'cartesian_point', - examples: [ - `from index | stats result = st_centroid_agg(cartesian_field)`, - `from index | stats st_centroid_agg(cartesian_field)`, - ], }, { params: [{ name: 'column', type: 'geo_point', noNestingFunctions: true }], returnType: 'geo_point', - examples: [ - `from index | stats result = st_centroid_agg(geo_field)`, - `from index | stats st_centroid_agg(geo_field)`, - ], }, ], + examples: [ + `from index | stats result = st_centroid_agg(cartesian_field)`, + `from index | stats st_centroid_agg(cartesian_field)`, + `from index | stats result = st_centroid_agg(geo_field)`, + `from index | stats st_centroid_agg(geo_field)`, + ], }, { name: 'values', @@ -221,11 +217,11 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ { params: [{ name: 'expression', type: 'any', noNestingFunctions: true }], returnType: 'any', - examples: [ - 'from index | stats all_agents=values(agents.keyword)', - 'from index | stats all_sorted_agents=mv_sort(values(agents.keyword))', - ], }, ], + examples: [ + 'from index | stats all_agents=values(agents.keyword)', + 'from index | stats all_sorted_agents=mv_sort(values(agents.keyword))', + ], }, ]); diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts index 7347f4d18953e..d48baaf903541 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts @@ -6,1780 +6,4630 @@ * Side Public License, v 1. */ -import { i18n } from '@kbn/i18n'; +// NOTE: This file is generated by the generate_function_definitions.js script +// Do not edit it manually + import type { ESQLFunction } from '@kbn/esql-ast'; +import { i18n } from '@kbn/i18n'; import { isLiteralItem } from '../shared/helpers'; import type { FunctionDefinition } from './types'; -const validateLogFunctions = (fnDef: ESQLFunction) => { - const messages = []; - // do not really care here about the base and field - // just need to check both values are not negative - for (const arg of fnDef.args) { - if (isLiteralItem(arg) && arg.value < 0) { - messages.push({ - type: 'warning' as const, - code: 'logOfNegativeValue', - text: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.divide.warning.logOfNegativeValue', - { - defaultMessage: 'Log of a negative number results in null: {value}', - values: { - value: arg.value, - }, - } - ), - location: arg.location, - }); - } - } - return messages; -}; - -const dateDiffSuggestions = [ - 'year', - 'quarter', - 'month', - 'dayofyear', - 'day', - 'week', - 'weekday', - 'hour', - 'minute', - 'second', - 'millisecond', - 'microsecond', - 'nanosecond', -]; +const absDefinition: FunctionDefinition = { + type: 'eval', + name: 'abs', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.abs', { + defaultMessage: 'Returns the absolute value.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW number = -1.0 \n| EVAL abs_number = ABS(number)', + 'FROM employees\n| KEEP first_name, last_name, height\n| EVAL abs_height = ABS(0.0 - height)', + ], +}; -const dateDiffOptions = [ - 'year', - 'years', - 'yy', - 'yyyy', - 'quarter', - 'quarters', - 'qq', - 'q', - 'month', - 'months', - 'mm', - 'm', - 'dayofyear', - 'dy', - 'y', - 'day', - 'days', - 'dd', - 'd', - 'week', - 'weeks', - 'wk', - 'ww', - 'weekday', - 'weekdays', - 'dw', - 'hour', - 'hours', - 'hh', - 'minute', - 'minutes', - 'mi', - 'n', - 'second', - 'seconds', - 'ss', - 's', - 'millisecond', - 'milliseconds', - 'ms', - 'microsecond', - 'microseconds', - 'mcs', - 'nanosecond', - 'nanoseconds', - 'ns', -]; +const acosDefinition: FunctionDefinition = { + type: 'eval', + name: 'acos', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.acos', { + defaultMessage: 'Returns the arccosine of `n` as an angle, expressed in radians.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=.9\n| EVAL acos=ACOS(a)'], +}; -export const evalFunctionsDefinitions: FunctionDefinition[] = [ - { - name: 'round', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.roundDoc', { - defaultMessage: - 'Returns a number rounded to the decimal, specified by he closest integer value. The default is to round to an integer.', - }), - signatures: [ - { - params: [ - { name: 'field', type: 'number' as const }, - { name: 'decimals', type: 'number' as const, optional: true }, - ], - returnType: 'number' as const, - examples: [ - `from index | eval round_value = round(field)`, - `from index | eval round_value = round(field, 2)`, - ], - }, - ], - }, - { - name: 'signum', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.signumDoc', { - defaultMessage: - 'Returns the sign of the given number. It returns -1 for negative numbers, 0 for 0 and 1 for positive numbers.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval s = signum(field)`], - }, - ], - }, - { - name: 'abs', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.absDoc', { - defaultMessage: 'Returns the absolute value.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval abs_value = abs(field)`], - }, - ], - }, - { - name: 'ceil', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ceilDoc', { - defaultMessage: 'Round a number up to the nearest integer.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval ceil_value = ceil(field)`], - }, - ], - }, - { - name: 'log10', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.log10Doc', { - defaultMessage: 'Returns the log base 10.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval log10_value = log10(field)`], - }, - ], - validate: validateLogFunctions, - }, - { - name: 'log', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.logDoc', { - defaultMessage: - 'A scalar function log(based, value) returns the logarithm of a value for a particular base, as specified in the argument', - }), - signatures: [ - { - params: [ - { name: 'baseOrField', type: 'number' as const }, - { name: 'field', type: 'number' as const, optional: true }, - ], - returnType: 'number' as const, - examples: [ - `from index | eval log2_value = log(2, field)`, - `from index | eval loge_value = log(field)`, - ], - }, - ], - validate: validateLogFunctions, - }, - { - name: 'pow', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.powDoc', { - defaultMessage: - 'Returns the the value of a base (first argument) raised to a power (second argument).', - }), - signatures: [ - { - params: [ - { name: 'field', type: 'number' as const }, - { name: 'exponent', type: 'number' as const }, - ], - returnType: 'number' as const, - examples: ['from index | eval s = POW(field, exponent)'], - }, - ], - }, - { - name: 'concat', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.concatDoc', { - defaultMessage: 'Concatenates two or more strings.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'string' as const }], - minParams: 2, - returnType: 'string' as const, - examples: ['from index | eval concatenated = concat(field1, "-", field2)'], - }, - ], - }, - { - name: 'replace', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.replaceDoc', { - defaultMessage: - 'The function substitutes in the string (1st argument) any match of the regular expression (2nd argument) with the replacement string (3rd argument). If any of the arguments are NULL, the result is NULL.', - }), - signatures: [ - { - params: [ - { name: 'field', type: 'string' as const }, - { name: 'regexp', type: 'string' as const }, - { name: 'replacement', type: 'string' as const }, - ], - returnType: 'string' as const, - examples: ['from index | eval newStr = replace(field, "Hello", "World")'], - }, - ], - }, - { - name: 'substring', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.substringDoc', { - defaultMessage: - 'Returns a substring of a string, specified by a start position and an optional length.', - }), - signatures: [ - { - params: [ - { name: 'field', type: 'string' as const }, - { name: 'startIndex', type: 'number' as const }, - { name: 'endIndex', type: 'number' as const }, - ], - returnType: 'string' as const, - examples: ['from index | eval new_string = substring(field, 1, 3)'], - }, - ], - }, - { - name: 'to_lower', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toLowerDoc', { - defaultMessage: 'Returns a new string representing the input string converted to lower case.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'string' as const }], - returnType: 'string' as const, - examples: ['from index | eval to_lower(field1)'], - }, - ], - }, - { - name: 'to_upper', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toUpperDoc', { - defaultMessage: 'Returns a new string representing the input string converted to upper case.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'string' as const }], - returnType: 'string' as const, - examples: ['from index | eval to_upper(field1)'], - }, - ], - }, - { - name: 'trim', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.trimDoc', { - defaultMessage: 'Removes leading and trailing whitespaces from strings.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'string' as const }], - returnType: 'string' as const, - examples: ['from index | eval new_string = trim(field)'], - }, - ], - }, - { - name: 'starts_with', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.startsWithDoc', { - defaultMessage: - 'Returns a boolean that indicates whether a keyword string starts with another string.', - }), - signatures: [ - { - params: [ - { name: 'field', type: 'string' as const }, - { name: 'prefix', type: 'string' as const }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval starts_with_a = starts_with(field, "a")'], - }, - ], - }, - { - name: 'ends_with', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.endsWithDoc', { - defaultMessage: - 'Returns a boolean that indicates whether a keyword string ends with another string:', - }), - signatures: [ - { - params: [ - { name: 'field', type: 'string' as const }, - { name: 'prefix', type: 'string' as const }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval ends_with_a = ends_with(field, "a")'], - }, - ], - }, - { - name: 'split', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.splitDoc', { - defaultMessage: 'Splits a single valued string into multiple strings.', - }), - signatures: [ - { - params: [ - { name: 'words', type: 'string' as const }, - { name: 'separator', type: 'string' as const }, - ], - returnType: 'string' as const, - examples: [`ROW words="foo;bar;baz;qux;quux;corge" | EVAL word = SPLIT(words, ";")`], - }, - ], - }, - { - name: 'to_string', - alias: ['to_str'], - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toStringDoc', { - defaultMessage: 'Converts to string.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'string' as const, - examples: [`from index" | EVAL string = to_string(field)`], - }, - ], - }, - { - name: 'to_boolean', - alias: ['to_bool'], - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toBooleanDoc', { - defaultMessage: 'Converts to boolean.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'boolean' as const, - examples: [`from index" | EVAL bool = to_boolean(field)`], - }, - ], - }, - { - name: 'to_cartesianpoint', - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.toCartesianPointDoc', - { - defaultMessage: 'Converts an input value to a `point` value.', - } - ), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'cartesian_point' as const, - examples: [`from index | EVAL point = to_cartesianpoint(field)`], - }, - ], - }, - { - name: 'to_cartesianshape', - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.toCartesianshapeDoc', - { - defaultMessage: 'Converts an input value to a cartesian_shape value.', - } - ), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'cartesian_shape' as const, - examples: [`from index | EVAL cartesianshape = to_cartesianshape(field)`], - }, - ], - }, - { - name: 'to_datetime', - alias: ['to_dt'], - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toDateTimeDoc', { - defaultMessage: 'Converts to date.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'date' as const, - examples: [`from index" | EVAL datetime = to_datetime(field)`], - }, - ], - }, - { - name: 'to_degrees', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toDegreesDoc', { - defaultMessage: 'Coverts to degrees', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval degrees = to_degrees(field)`], - }, - ], - }, - { - name: 'to_double', - alias: ['to_dbl'], - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toDoubleDoc', { - defaultMessage: 'Converts to double.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'number' as const, - examples: [`from index | EVAL double = to_double(field)`], - }, - ], - }, - { - name: 'to_geopoint', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toGeopointDoc', { - defaultMessage: 'Converts to geo_point.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'geo_point' as const, - examples: [`from index | EVAL geopoint = to_geopoint(field)`], - }, - ], - }, - { - name: 'to_geoshape', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toGeoshapeDoc', { - defaultMessage: 'Converts an input value to a geo_shape value.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'geo_shape' as const, - examples: [`from index | EVAL geoshape = to_geoshape(field)`], - }, - ], - }, - { - name: 'to_integer', - alias: ['to_int'], - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toIntegerDoc', { - defaultMessage: 'Converts to integer.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'number' as const, - examples: [`from index | EVAL integer = to_integer(field)`], - }, - ], - }, - { - name: 'to_long', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toLongDoc', { - defaultMessage: 'Converts to long.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'number' as const, - examples: [`from index | EVAL long = to_long(field)`], - }, - ], - }, - { - name: 'to_radians', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toRadiansDoc', { - defaultMessage: 'Converts to radians', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval radians = to_radians(field)`], - }, - ], - }, - { - name: 'to_unsigned_long', - alias: ['to_ul', 'to_ulong'], - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.toUnsignedLongDoc', - { - defaultMessage: 'Converts to unsigned long.', +const asinDefinition: FunctionDefinition = { + type: 'eval', + name: 'asin', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.asin', { + defaultMessage: + 'Returns the arcsine of the input\nnumeric expression as an angle, expressed in radians.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=.9\n| EVAL asin=ASIN(a)'], +}; + +const atanDefinition: FunctionDefinition = { + type: 'eval', + name: 'atan', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.atan', { + defaultMessage: + 'Returns the arctangent of the input\nnumeric expression as an angle, expressed in radians.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=12.9\n| EVAL atan=ATAN(a)'], +}; + +const atan2Definition: FunctionDefinition = { + type: 'eval', + name: 'atan2', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.atan2', { + defaultMessage: + 'The angle between the positive x-axis and the ray from the\norigin to the point (x , y) in the Cartesian plane, expressed in radians.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'y_coordinate', + type: 'number', + optional: false, + }, + { + name: 'x_coordinate', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW y=12.9, x=.6\n| EVAL atan2=ATAN2(y, x)'], +}; + +const cbrtDefinition: FunctionDefinition = { + type: 'eval', + name: 'cbrt', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cbrt', { + defaultMessage: + 'Returns the cube root of a number. The input can be any numeric value, the return value is always a double.\nCube roots of infinities are null.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW d = 1000.0\n| EVAL c = cbrt(d)'], +}; + +const ceilDefinition: FunctionDefinition = { + type: 'eval', + name: 'ceil', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ceil', { + defaultMessage: 'Round a number up to the nearest integer.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8\n| EVAL a=CEIL(a)'], +}; + +const cidrMatchDefinition: FunctionDefinition = { + type: 'eval', + name: 'cidr_match', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cidr_match', { + defaultMessage: + 'Returns true if the provided IP is contained in one of the provided CIDR blocks.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'ip', + type: 'ip', + optional: false, + }, + { + name: 'blockX', + type: 'string', + optional: false, + }, + ], + returnType: 'boolean', + minParams: 2, + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM hosts \n| WHERE CIDR_MATCH(ip1, "127.0.0.2/32", "127.0.0.3/32") \n| KEEP card, host, ip0, ip1', + ], +}; + +const coalesceDefinition: FunctionDefinition = { + type: 'eval', + name: 'coalesce', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.coalesce', { + defaultMessage: + 'Returns the first of its arguments that is not null. If all arguments are null, it returns `null`.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'first', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'number', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'number', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'date', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'date', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'string', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'string', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'ip', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'ip', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'cartesian_point', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'cartesian_point', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'cartesian_point', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'cartesian_shape', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'cartesian_shape', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'geo_point', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'geo_point', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'geo_point', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'geo_shape', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'geo_shape', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'geo_shape', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'version', + optional: false, + }, + ], + returnType: 'version', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'version', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'version', + minParams: 1, + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=null, b="b"\n| EVAL COALESCE(a, b)'], +}; + +const concatDefinition: FunctionDefinition = { + type: 'eval', + name: 'concat', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.concat', { + defaultMessage: 'Concatenates two or more strings.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string1', + type: 'string', + optional: false, + }, + { + name: 'string2', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + minParams: 2, + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP first_name, last_name\n| EVAL fullname = CONCAT(first_name, " ", last_name)', + ], +}; + +const cosDefinition: FunctionDefinition = { + type: 'eval', + name: 'cos', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cos', { + defaultMessage: 'Returns the cosine of an angle.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'angle', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8 \n| EVAL cos=COS(a)'], +}; + +const coshDefinition: FunctionDefinition = { + type: 'eval', + name: 'cosh', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cosh', { + defaultMessage: 'Returns the hyperbolic cosine of an angle.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'angle', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8 \n| EVAL cosh=COSH(a)'], +}; + +const dateDiffDefinition: FunctionDefinition = { + type: 'eval', + name: 'date_diff', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_diff', { + defaultMessage: + 'Subtracts the `startTimestamp` from the `endTimestamp` and returns the difference in multiples of `unit`.\nIf `startTimestamp` is later than the `endTimestamp`, negative values are returned.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'unit', + type: 'string', + optional: false, + literalOptions: [ + 'year', + 'years', + 'yy', + 'yyyy', + 'quarter', + 'quarters', + 'qq', + 'q', + 'month', + 'months', + 'mm', + 'm', + 'dayofyear', + 'dy', + 'y', + 'day', + 'days', + 'dd', + 'd', + 'week', + 'weeks', + 'wk', + 'ww', + 'weekday', + 'weekdays', + 'dw', + 'hour', + 'hours', + 'hh', + 'minute', + 'minutes', + 'mi', + 'n', + 'second', + 'seconds', + 'ss', + 's', + 'millisecond', + 'milliseconds', + 'ms', + 'microsecond', + 'microseconds', + 'mcs', + 'nanosecond', + 'nanoseconds', + 'ns', + ], + literalSuggestions: [ + 'year', + 'quarter', + 'month', + 'week', + 'day', + 'hour', + 'minute', + 'second', + 'millisecond', + 'microsecond', + 'nanosecond', + ], + }, + { + name: 'startTimestamp', + type: 'date', + optional: false, + }, + { + name: 'endTimestamp', + type: 'date', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW date1 = TO_DATETIME("2023-12-02T11:00:00.000Z"), date2 = TO_DATETIME("2023-12-02T11:00:00.001Z")\n| EVAL dd_ms = DATE_DIFF("microseconds", date1, date2)', + ], +}; + +const dateExtractDefinition: FunctionDefinition = { + type: 'eval', + name: 'date_extract', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_extract', { + defaultMessage: 'Extracts parts of a date, like year, month, day, hour.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'datePart', + type: 'chrono_literal', + optional: false, + }, + { + name: 'date', + type: 'date', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW date = DATE_PARSE("yyyy-MM-dd", "2022-05-06")\n| EVAL year = DATE_EXTRACT("year", date)', + 'FROM sample_data\n| WHERE DATE_EXTRACT("hour_of_day", @timestamp) < 9 AND DATE_EXTRACT("hour_of_day", @timestamp) >= 17', + ], +}; + +const dateFormatDefinition: FunctionDefinition = { + type: 'eval', + name: 'date_format', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_format', { + defaultMessage: 'Returns a string representation of a date, in the provided format.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'dateFormat', + type: 'string', + optional: true, + }, + { + name: 'date', + type: 'date', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP first_name, last_name, hire_date\n| EVAL hired = DATE_FORMAT("YYYY-MM-dd", hire_date)', + ], +}; + +const dateParseDefinition: FunctionDefinition = { + type: 'eval', + name: 'date_parse', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_parse', { + defaultMessage: + 'Returns a date by parsing the second argument using the format specified in the first argument.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'datePattern', + type: 'string', + optional: true, + }, + { + name: 'dateString', + type: 'string', + optional: false, + }, + ], + returnType: 'date', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW date_string = "2022-05-06"\n| EVAL date = DATE_PARSE("yyyy-MM-dd", date_string)'], +}; + +const dateTruncDefinition: FunctionDefinition = { + type: 'eval', + name: 'date_trunc', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.date_trunc', { + defaultMessage: 'Rounds down a date to the closest interval.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'interval', + type: 'time_literal', + optional: false, + }, + { + name: 'date', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'interval', + type: 'date', + optional: false, + }, + { + name: 'date', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP first_name, last_name, hire_date\n| EVAL year_hired = DATE_TRUNC(1 year, hire_date)', + 'FROM employees\n| EVAL year = DATE_TRUNC(1 year, hire_date)\n| STATS hires = COUNT(emp_no) BY year\n| SORT year', + 'FROM sample_data\n| EVAL error = CASE(message LIKE "*error*", 1, 0)\n| EVAL hour = DATE_TRUNC(1 hour, @timestamp)\n| STATS error_rate = AVG(error) by hour\n| SORT hour', + ], +}; + +const eDefinition: FunctionDefinition = { + type: 'eval', + name: 'e', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.e', { + defaultMessage: "Returns Euler's number.", + }), + alias: undefined, + signatures: [ + { + params: [], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW E()'], +}; + +const endsWithDefinition: FunctionDefinition = { + type: 'eval', + name: 'ends_with', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ends_with', { + defaultMessage: + 'Returns a boolean that indicates whether a keyword string ends with another string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'str', + type: 'string', + optional: false, + }, + { + name: 'suffix', + type: 'string', + optional: false, + }, + ], + returnType: 'boolean', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['FROM employees\n| KEEP last_name\n| EVAL ln_E = ENDS_WITH(last_name, "d")'], +}; + +const floorDefinition: FunctionDefinition = { + type: 'eval', + name: 'floor', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.floor', { + defaultMessage: 'Round a number down to the nearest integer.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8\n| EVAL a=FLOOR(a)'], +}; + +const fromBase64Definition: FunctionDefinition = { + type: 'eval', + name: 'from_base64', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.from_base64', { + defaultMessage: 'Decode a base64 string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['row a = "ZWxhc3RpYw==" \n| eval d = from_base64(a)'], +}; + +const greatestDefinition: FunctionDefinition = { + type: 'eval', + name: 'greatest', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.greatest', { + defaultMessage: + 'Returns the maximum value from multiple columns. This is similar to <>\nexcept it is intended to run on multiple columns at once.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'number', + optional: false, + }, + { + name: 'rest', + type: 'number', + optional: true, + }, + ], + returnType: 'number', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'ip', + optional: false, + }, + { + name: 'rest', + type: 'ip', + optional: true, + }, + ], + returnType: 'ip', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'string', + optional: false, + }, + { + name: 'rest', + type: 'string', + optional: true, + }, + ], + returnType: 'string', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'version', + optional: false, + }, + { + name: 'rest', + type: 'version', + optional: true, + }, + ], + returnType: 'version', + minParams: 1, + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a = 10, b = 20\n| EVAL g = GREATEST(a, b)'], +}; + +const leastDefinition: FunctionDefinition = { + type: 'eval', + name: 'least', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.least', { + defaultMessage: + 'Returns the minimum value from multiple columns. This is similar to <> except it is intended to run on multiple columns at once.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'boolean', + optional: false, + }, + { + name: 'rest', + type: 'boolean', + optional: true, + }, + ], + returnType: 'boolean', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'number', + optional: false, + }, + { + name: 'rest', + type: 'number', + optional: true, + }, + ], + returnType: 'number', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'ip', + optional: false, + }, + { + name: 'rest', + type: 'ip', + optional: true, + }, + ], + returnType: 'ip', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'string', + optional: false, + }, + { + name: 'rest', + type: 'string', + optional: true, + }, + ], + returnType: 'string', + minParams: 1, + }, + { + params: [ + { + name: 'first', + type: 'version', + optional: false, + }, + { + name: 'rest', + type: 'version', + optional: true, + }, + ], + returnType: 'version', + minParams: 1, + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a = 10, b = 20\n| EVAL l = LEAST(a, b)'], +}; + +const leftDefinition: FunctionDefinition = { + type: 'eval', + name: 'left', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.left', { + defaultMessage: + "Returns the substring that extracts 'length' chars from 'string' starting from the left.", + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + { + name: 'length', + type: 'number', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP last_name\n| EVAL left = LEFT(last_name, 3)\n| SORT last_name ASC\n| LIMIT 5', + ], +}; + +const lengthDefinition: FunctionDefinition = { + type: 'eval', + name: 'length', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.length', { + defaultMessage: 'Returns the character length of a string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['FROM employees\n| KEEP first_name, last_name\n| EVAL fn_length = LENGTH(first_name)'], +}; + +const locateDefinition: FunctionDefinition = { + type: 'eval', + name: 'locate', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.locate', { + defaultMessage: + 'Returns an integer that indicates the position of a keyword substring within another string', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + { + name: 'substring', + type: 'string', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + { + name: 'substring', + type: 'string', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: true, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['row a = "hello"\n| eval a_ll = locate(a, "ll")'], +}; + +const logDefinition: FunctionDefinition = { + type: 'eval', + name: 'log', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.log', { + defaultMessage: + 'Returns the logarithm of a value to a base. The input can be any numeric value, the return value is always a double.\n\nLogs of zero, negative numbers, and base of one return `null` as well as a warning.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'base', + type: 'number', + optional: true, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'base', + type: 'number', + optional: true, + }, + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: (fnDef: ESQLFunction) => { + const messages = []; + // do not really care here about the base and field + // just need to check both values are not negative + for (const arg of fnDef.args) { + if (isLiteralItem(arg) && arg.value < 0) { + messages.push({ + type: 'warning' as const, + code: 'logOfNegativeValue', + text: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.divide.warning.logOfNegativeValue', + { + defaultMessage: 'Log of a negative number results in null: {value}', + values: { + value: arg.value, + }, + } + ), + location: arg.location, + }); } - ), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'number' as const, - examples: [`from index | EVAL unsigned_long = to_unsigned_long(field)`], - }, - ], - }, - { - name: 'to_ip', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toIpDoc', { - defaultMessage: 'Converts to ip.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - returnType: 'ip' as const, - examples: [`from index | EVAL ip = to_ip(field)`], - }, - ], - }, - { - name: 'to_version', - alias: ['to_ver'], - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.toVersionDoc', { - defaultMessage: 'Converts to version.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'string' as const }], - returnType: 'version' as const, - examples: [`from index | EVAL version = to_version(stringField)`], - }, - ], + } + return messages; }, - { - name: 'date_extract', - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.dateExtractDoc', - { - defaultMessage: `Extracts parts of a date, like year, month, day, hour. The supported field types are those provided by java.time.temporal.ChronoField`, + examples: [ + 'ROW base = 2.0, value = 8.0\n| EVAL s = LOG(base, value)', + 'row value = 100\n| EVAL s = LOG(value);', + ], +}; + +const log10Definition: FunctionDefinition = { + type: 'eval', + name: 'log10', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.log10', { + defaultMessage: + 'Returns the logarithm of a value to base 10. The input can be any numeric value, the return value is always a double.\n\nLogs of 0 and negative numbers return `null` as well as a warning.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: (fnDef: ESQLFunction) => { + const messages = []; + // do not really care here about the base and field + // just need to check both values are not negative + for (const arg of fnDef.args) { + if (isLiteralItem(arg) && arg.value < 0) { + messages.push({ + type: 'warning' as const, + code: 'logOfNegativeValue', + text: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.divide.warning.logOfNegativeValue', + { + defaultMessage: 'Log of a negative number results in null: {value}', + values: { + value: arg.value, + }, + } + ), + location: arg.location, + }); } - ), - signatures: [ - { - params: [ - { - name: 'date_part', - type: 'chrono_literal' as const, - }, - { name: 'field', type: 'date' as const }, - ], - returnType: 'number' as const, - examples: [ - `ROW date = DATE_PARSE("yyyy-MM-dd", "2022-05-06") | EVAL year = DATE_EXTRACT("year", date)`, - ], - }, - ], - }, - { - name: 'date_diff', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.dateDiffDoc', { - defaultMessage: `Subtracts the startTimestamp from the endTimestamp and returns the difference in multiples of unit. If startTimestamp is later than the endTimestamp, negative values are returned.`, - }), - signatures: [ - { - params: [ - { - name: 'unit', - type: 'string' as const, - literalOptions: dateDiffOptions, - literalSuggestions: dateDiffSuggestions, - }, - { name: 'startTimestamp', type: 'date' as const }, - { name: 'endTimestamp', type: 'date' as const }, - ], - returnType: 'number' as const, - examples: [], - }, - ], - }, - { - name: 'date_format', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.dateFormatDoc', { - defaultMessage: `Returns a string representation of a date in the provided format. If no format is specified, the "yyyy-MM-dd'T'HH:mm:ss.SSSZ" format is used.`, - }), - signatures: [ - { - params: [ - { name: 'field', type: 'date' as const }, - { name: 'format_string', type: 'string' as const, optional: true }, - ], - returnType: 'string' as const, - examples: ['from index | eval hired = date_format("YYYY-MM-dd", hire_date)'], - }, - ], - }, - { - name: 'date_trunc', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.dateTruncDoc', { - defaultMessage: `Rounds down a date to the closest interval. Intervals can be expressed using the timespan literal syntax.`, - }), - signatures: [ - { - params: [ - { name: 'time', type: 'time_literal' as const }, - { name: 'field', type: 'date' as const }, - ], - returnType: 'date' as const, - examples: [`from index | eval year_hired = DATE_TRUNC(1 year, hire_date)`], - }, - ], - }, - { - name: 'date_parse', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.dateParseDoc', { - defaultMessage: `Parse dates from strings.`, - }), - signatures: [ - { - params: [ - { name: 'field', type: 'string' as const }, - { name: 'format_string', type: 'string' as const }, - ], - returnType: 'date' as const, - examples: [ - `from index | eval year_hired = date_parse("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'", hire_date)`, - ], - }, - ], - }, - { - name: 'case', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.caseDoc', { - defaultMessage: - 'Accepts pairs of conditions and values. The function returns the value that belongs to the first condition that evaluates to `true`. If the number of arguments is odd, the last argument is the default value which is returned when no condition matches.', - }), - signatures: [ - { - params: [ - { name: 'condition', type: 'boolean' as const }, - { name: 'value', type: 'any' as const }, - ], - minParams: 2, - returnType: 'any' as const, - examples: [ - `from index | eval type = case(languages <= 1, "monolingual", languages <= 2, "bilingual", "polyglot")`, - ], - }, - ], - }, - { - name: 'length', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.lengthDoc', { - defaultMessage: 'Returns the character length of a string.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'string' as const }], - returnType: 'number' as const, - examples: [`from index | eval fn_length = length(field)`], - }, - ], - }, - { - name: 'acos', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.acosDoc', { - defaultMessage: 'Inverse cosine trigonometric function', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval acos = acos(field)`], - }, - ], - }, - { - name: 'asin', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.asinDoc', { - defaultMessage: 'Inverse sine trigonometric function', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval asin = asin(field)`], - }, - ], - }, - { - name: 'atan', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.atanDoc', { - defaultMessage: 'Inverse tangent trigonometric function', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval atan = atan(field)`], - }, - ], - }, - { - name: 'atan2', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.atan2Doc', { - defaultMessage: - 'The angle between the positive x-axis and the ray from the origin to the point (x , y) in the Cartesian plane', - }), - signatures: [ - { - params: [ - { name: 'x', type: 'number' as const }, - { name: 'y', type: 'number' as const }, - ], - returnType: 'number' as const, - examples: [`from index | eval atan2 = atan2(x, y)`], - }, - ], - }, - { - name: 'coalesce', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.coalesceDoc', { - defaultMessage: 'Returns the first non-null value.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - minParams: 1, - returnType: 'any' as const, - examples: [`ROW a=null, b="b" | EVAL COALESCE(a, b)`], - }, - ], - }, - { - name: 'cos', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cosDoc', { - defaultMessage: 'Cosine trigonometric function', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval cos = cos(field)`], - }, - ], - }, - { - name: 'cosh', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.coshDoc', { - defaultMessage: 'Cosine hyperbolic function', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval cosh = cosh(field)`], - }, - ], - }, - { - name: 'floor', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.floorDoc', { - defaultMessage: 'Round a number down to the nearest integer.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`from index | eval a = floor(field)`], - }, - ], - }, - { - name: 'greatest', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.greatestDoc', { - defaultMessage: 'Returns the maximum value from many columns.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'any' as const }], - minParams: 1, - returnType: 'any' as const, - examples: [`ROW a = 10, b = 20 | EVAL g = GREATEST(a, b)`], - }, - ], - }, - { - name: 'least', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.leastDoc', { - defaultMessage: 'Returns the minimum value from many columns.', - }), - signatures: [ - { - params: [{ name: 'first', type: 'any' as const }], - minParams: 1, - returnType: 'any' as const, - examples: ['from index | eval l = least(a, b)'], - }, - ], - }, - { - name: 'left', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.leftDoc', { - defaultMessage: - 'Return the substring that extracts length chars from the string starting from the left.', - }), - signatures: [ - { - params: [ - { name: 'field', type: 'string' as const }, - { name: 'length', type: 'number' as const }, - ], - returnType: 'string' as const, - examples: [`from index | eval substr = left(field, 3)`], - }, - ], - }, - { - name: 'ltrim', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ltrimDoc', { - defaultMessage: 'Removes leading whitespaces from strings.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'string' as const }], - returnType: 'string' as const, - examples: [`ROW message = " some text "| EVAL message = LTRIM(message)`], - }, - ], - }, - { - name: 'now', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.nowDoc', { - defaultMessage: 'Returns current date and time.', - }), - signatures: [ - { - params: [], - returnType: 'date' as const, - examples: [`ROW current_date = NOW()`], - }, - ], - }, - { - name: 'right', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.rightDoc', { - defaultMessage: - 'Return the substring that extracts length chars from the string starting from the right.', - }), - signatures: [ - { - params: [ - { name: 'field', type: 'string' as const }, - { name: 'length', type: 'number' as const }, - ], - returnType: 'string' as const, - examples: [`from index | eval string = right(field, 3)`], - }, - ], - }, - { - name: 'rtrim', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.rtrimDoc', { - defaultMessage: 'Removes trailing whitespaces from strings.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'string' as const }], - returnType: 'string' as const, - examples: [`ROW message = " some text " | EVAL message = RTRIM(message)`], - }, - ], - }, - { - name: 'sin', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sinDoc', { - defaultMessage: 'Sine trigonometric function.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`ROW a=1.8 | EVAL sin=SIN(a)`], - }, - ], - }, - { - name: 'sinh', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sinhDoc', { - defaultMessage: 'Sine hyperbolic function.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`ROW a=1.8 | EVAL sinh=SINH(a)`], - }, - ], - }, - { - name: 'sqrt', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sqrtDoc', { - defaultMessage: 'Returns the square root of a number. ', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`ROW d = 100.0 | EVAL s = SQRT(d)`], - }, - ], - }, - { - name: 'tan', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.tanDoc', { - defaultMessage: 'Tangent trigonometric function.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`ROW a=1.8 | EVAL tan=TAN(a)`], - }, - ], - }, - { - name: 'tanh', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.tanhDoc', { - defaultMessage: 'Tangent hyperbolic function.', - }), - signatures: [ - { - params: [{ name: 'field', type: 'number' as const }], - returnType: 'number' as const, - examples: [`ROW a=1.8 | EVAL tanh=TANH(a)`], - }, - ], - }, - { - name: 'cidr_match', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.cidrMatchDoc', { - defaultMessage: - 'The function takes a first parameter of type IP, followed by one or more parameters evaluated to a CIDR specificatione.', - }), - signatures: [ - { - minParams: 2, - params: [ - { name: 'ip', type: 'ip' as const }, - { name: 'cidr_block', type: 'string' as const }, - ], - returnType: 'boolean' as const, - examples: [ - 'from index | where cidr_match(ip_field, "127.0.0.1/30")', - 'from index | eval cidr="10.0.0.0/8" | where cidr_match(ip_field, "127.0.0.1/30", cidr)', - ], - }, - ], - }, - { - name: 'mv_sort', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvSortDoc', { - defaultMessage: 'Sorts a multivalue expression in lexicographical order.', - }), - signatures: [ - { - params: [ - { name: 'field', type: 'any' as const }, - { - name: 'order', - type: 'string' as const, - optional: true, - literalOptions: ['asc', 'desc'], - }, - ], - returnType: 'any' as const, - examples: [ - 'row a = [4, 2, -3, 2] | eval sorted = mv_sort(a)', - 'row a = ["b", "c", "a"] | sorted = mv_sort(a, "DESC")', - ], - }, - ], - }, - { - name: 'mv_avg', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvAvgDoc', { - defaultMessage: - 'Converts a multivalued field into a single valued field containing the average of all of the values.', - }), - signatures: [ - { - params: [{ name: 'multivalue', type: 'number' as const }], - returnType: 'number' as const, - examples: ['row a = [1, 2, 3] | eval mv_avg(a)'], - }, - ], - }, - { - name: 'mv_concat', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvConcatDoc', { - defaultMessage: - 'Converts a multivalued string field into a single valued field containing the concatenation of all values separated by a delimiter', - }), - signatures: [ - { - params: [ - { name: 'multivalue', type: 'string' as const }, - { name: 'delimeter', type: 'string' as const }, - ], - returnType: 'string' as const, - examples: ['row a = ["1", "2", "3"] | eval mv_concat(a, ", ")'], - }, - ], - }, - { - name: 'mv_count', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvCountDoc', { - defaultMessage: - 'Converts a multivalued field into a single valued field containing a count of the number of values', - }), - signatures: [ - { - params: [{ name: 'multivalue', type: 'any' as const }], - returnType: 'number' as const, - examples: ['row a = [1, 2, 3] | eval mv_count(a)'], - }, - ], - }, - { - name: 'mv_dedupe', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvDedupeDoc', { - defaultMessage: 'Removes duplicates from a multivalued field', - }), - signatures: [ - { - params: [{ name: 'multivalue', type: 'any' as const }], - returnType: 'any' as const, - examples: ['row a = [2, 2, 3] | eval mv_dedupe(a)'], - }, - ], - }, - { - name: 'mv_first', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvFirstDoc', { - defaultMessage: - 'Reduce a multivalued field to a single valued field containing the first value.', - }), - signatures: [ - { - params: [{ name: 'multivalue', type: 'any' as const }], - returnType: 'any' as const, - examples: ['row a = [1, 2, 3] | eval one = mv_first(a)'], - }, - ], - }, - { - name: 'mv_last', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvLastDoc', { - defaultMessage: - 'Reduce a multivalued field to a single valued field containing the last value.', - }), - signatures: [ - { - params: [{ name: 'multivalue', type: 'any' as const }], - returnType: 'any' as const, - examples: ['row a = [1, 2, 3] | eval three = mv_last(a)'], - }, - ], - }, - { - name: 'mv_max', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvMaxDoc', { - defaultMessage: - 'Converts a multivalued field into a single valued field containing the maximum value.', - }), - signatures: [ - { - params: [{ name: 'multivalue', type: 'any' as const }], - returnType: 'any' as const, - examples: ['row a = [1, 2, 3] | eval mv_max(a)'], - }, - ], - }, - { - name: 'mv_min', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvMinDoc', { - defaultMessage: - 'Converts a multivalued field into a single valued field containing the minimum value.', - }), - signatures: [ - { - params: [{ name: 'multivalue', type: 'any' as const }], - returnType: 'any' as const, - examples: ['row a = [1, 2, 3] | eval mv_min(a)'], - }, - ], - }, - { - name: 'mv_median', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvMedianDoc', { - defaultMessage: - 'Converts a multivalued field into a single valued field containing the median value.', - }), - signatures: [ - { - params: [{ name: 'multivalue', type: 'number' as const }], - returnType: 'number' as const, - examples: ['row a = [1, 2, 3] | eval mv_median(a)'], - }, - ], - }, - { - name: 'mv_sum', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvSumDoc', { - defaultMessage: - 'Converts a multivalued field into a single valued field containing the sum of all of the values.', - }), - signatures: [ - { - params: [{ name: 'multivalue', type: 'number' as const }], - returnType: 'number' as const, - examples: ['row a = [1, 2, 3] | eval mv_sum(a)'], - }, - ], - }, - { - name: 'mv_slice', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvSliceDoc', { - defaultMessage: - 'Returns a subset of the multivalued field using the start and end index values.', - }), - signatures: [ - { - params: [ - { name: 'multivalue', type: 'any' as const }, - { name: 'start', type: 'number' as const }, - { name: 'end', type: 'number' as const }, - ], - returnType: 'number' as const, - examples: ['row a = [1, 2, 2, 3] | eval a1 = mv_slice(a, 1), a2 = mv_slice(a, 2, 3)'], - }, - ], + } + return messages; }, - { - name: 'mv_zip', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mvZipDoc', { + examples: ['ROW d = 1000.0 \n| EVAL s = LOG10(d)'], +}; + +const ltrimDefinition: FunctionDefinition = { + type: 'eval', + name: 'ltrim', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.ltrim', { + defaultMessage: 'Removes leading whitespaces from a string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW message = " some text ", color = " red "\n| EVAL message = LTRIM(message)\n| EVAL color = LTRIM(color)\n| EVAL message = CONCAT("\'", message, "\'")\n| EVAL color = CONCAT("\'", color, "\'")', + ], +}; + +const mvAvgDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_avg', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_avg', { + defaultMessage: + 'Converts a multivalued field into a single valued field containing the average of all of the values.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=[3, 5, 1, 6]\n| EVAL avg_a = MV_AVG(a)'], +}; + +const mvConcatDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_concat', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_concat', { + defaultMessage: + 'Converts a multivalued string expression into a single valued column containing the concatenation of all values separated by a delimiter.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + { + name: 'delim', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW a=["foo", "zoo", "bar"]\n| EVAL j = MV_CONCAT(a, ", ")', + 'ROW a=[10, 9, 8]\n| EVAL j = MV_CONCAT(TO_STRING(a), ", ")', + ], +}; + +const mvCountDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_count', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_count', { + defaultMessage: + 'Converts a multivalued expression into a single valued column containing a count of the number of values.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=["foo", "zoo", "bar"]\n| EVAL count_a = MV_COUNT(a)'], +}; + +const mvDedupeDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_dedupe', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_dedupe', { + defaultMessage: 'Remove duplicate values from a multivalued field.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'cartesian_point', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'cartesian_shape', + }, + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'geo_point', + }, + { + params: [ + { + name: 'field', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'geo_shape', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=["foo", "foo", "bar", "foo"]\n| EVAL dedupe_a = MV_DEDUPE(a)'], +}; + +const mvFirstDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_first', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_first', { + defaultMessage: + "Converts a multivalued expression into a single valued column containing the\nfirst value. This is most useful when reading from a function that emits\nmultivalued columns in a known order like <>.\n\nThe order that <> are read from\nunderlying storage is not guaranteed. It is *frequently* ascending, but don't\nrely on that. If you need the minimum value use <> instead of\n`MV_FIRST`. `MV_MIN` has optimizations for sorted values so there isn't a\nperformance benefit to `MV_FIRST`.", + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'cartesian_point', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'cartesian_shape', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'geo_point', + }, + { + params: [ + { + name: 'field', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'geo_shape', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a="foo;bar;baz"\n| EVAL first_a = MV_FIRST(SPLIT(a, ";"))'], +}; + +const mvLastDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_last', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_last', { + defaultMessage: + "Converts a multivalue expression into a single valued column containing the last\nvalue. This is most useful when reading from a function that emits multivalued\ncolumns in a known order like <>.\n\nThe order that <> are read from\nunderlying storage is not guaranteed. It is *frequently* ascending, but don't\nrely on that. If you need the maximum value use <> instead of\n`MV_LAST`. `MV_MAX` has optimizations for sorted values so there isn't a\nperformance benefit to `MV_LAST`.", + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'cartesian_point', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'cartesian_shape', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'geo_point', + }, + { + params: [ + { + name: 'field', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'geo_shape', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a="foo;bar;baz"\n| EVAL last_a = MV_LAST(SPLIT(a, ";"))'], +}; + +const mvMaxDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_max', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_max', { + defaultMessage: + 'Converts a multivalued expression into a single valued column containing the maximum value.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW a=[3, 5, 1]\n| EVAL max_a = MV_MAX(a)', + 'ROW a=["foo", "zoo", "bar"]\n| EVAL max_a = MV_MAX(a)', + ], +}; + +const mvMedianDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_median', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_median', { + defaultMessage: + 'Converts a multivalued field into a single valued field containing the median value.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW a=[3, 5, 1]\n| EVAL median_a = MV_MEDIAN(a)', + 'ROW a=[3, 7, 1, 6]\n| EVAL median_a = MV_MEDIAN(a)', + ], +}; + +const mvMinDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_min', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_min', { + defaultMessage: + 'Converts a multivalued expression into a single valued column containing the minimum value.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW a=[2, 1]\n| EVAL min_a = MV_MIN(a)', + 'ROW a=["foo", "bar"]\n| EVAL min_a = MV_MIN(a)', + ], +}; + +const mvSliceDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_slice', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_slice', { + defaultMessage: + 'Returns a subset of the multivalued field using the start and end index values.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'end', + type: 'number', + optional: true, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'end', + type: 'number', + optional: true, + }, + ], + returnType: 'cartesian_point', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'end', + type: 'number', + optional: true, + }, + ], + returnType: 'cartesian_shape', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'end', + type: 'number', + optional: true, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'end', + type: 'number', + optional: true, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'end', + type: 'number', + optional: true, + }, + ], + returnType: 'geo_point', + }, + { + params: [ + { + name: 'field', + type: 'geo_shape', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'end', + type: 'number', + optional: true, + }, + ], + returnType: 'geo_shape', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'end', + type: 'number', + optional: true, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'end', + type: 'number', + optional: true, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'end', + type: 'number', + optional: true, + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'row a = [1, 2, 2, 3]\n| eval a1 = mv_slice(a, 1), a2 = mv_slice(a, 2, 3)', + 'row a = [1, 2, 2, 3]\n| eval a1 = mv_slice(a, -2), a2 = mv_slice(a, -3, -1)', + ], +}; + +const mvSortDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_sort', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_sort', { + defaultMessage: 'Sorts a multivalued field in lexicographical order.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + { + name: 'order', + type: 'string', + optional: true, + literalOptions: ['asc', 'desc'], + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + { + name: 'order', + type: 'string', + optional: true, + literalOptions: ['asc', 'desc'], + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + { + name: 'order', + type: 'string', + optional: true, + literalOptions: ['asc', 'desc'], + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + { + name: 'order', + type: 'string', + optional: true, + literalOptions: ['asc', 'desc'], + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + { + name: 'order', + type: 'string', + optional: true, + literalOptions: ['asc', 'desc'], + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + { + name: 'order', + type: 'string', + optional: true, + literalOptions: ['asc', 'desc'], + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a = [4, 2, -3, 2]\n| EVAL sa = mv_sort(a), sd = mv_sort(a, "DESC")'], +}; + +const mvSumDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_sum', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_sum', { + defaultMessage: + 'Converts a multivalued field into a single valued field containing the sum of all of the values.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=[3, 5, 6]\n| EVAL sum_a = MV_SUM(a)'], +}; + +const mvZipDefinition: FunctionDefinition = { + type: 'eval', + name: 'mv_zip', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.mv_zip', { + defaultMessage: + 'Combines the values from two multivalued fields with a delimiter that joins them together.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string1', + type: 'string', + optional: false, + }, + { + name: 'string2', + type: 'string', + optional: false, + }, + { + name: 'delim', + type: 'string', + optional: true, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW a = ["x", "y", "z"], b = ["1", "2"]\n| EVAL c = mv_zip(a, b, "-")\n| KEEP a, b, c', + ], +}; + +const nowDefinition: FunctionDefinition = { + type: 'eval', + name: 'now', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.now', { + defaultMessage: 'Returns current date and time.', + }), + alias: undefined, + signatures: [ + { + params: [], + returnType: 'date', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW current_date = NOW()', 'FROM sample_data\n| WHERE @timestamp > NOW() - 1 hour'], +}; + +const piDefinition: FunctionDefinition = { + type: 'eval', + name: 'pi', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.pi', { + defaultMessage: "Returns Pi, the ratio of a circle's circumference to its diameter.", + }), + alias: undefined, + signatures: [ + { + params: [], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW PI()'], +}; + +const powDefinition: FunctionDefinition = { + type: 'eval', + name: 'pow', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.pow', { + defaultMessage: 'Returns the value of `base` raised to the power of `exponent`.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'base', + type: 'number', + optional: false, + }, + { + name: 'exponent', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW base = 2.0, exponent = 2\n| EVAL result = POW(base, exponent)', + 'ROW base = 4, exponent = 0.5\n| EVAL s = POW(base, exponent)', + ], +}; + +const replaceDefinition: FunctionDefinition = { + type: 'eval', + name: 'replace', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.replace', { + defaultMessage: + 'The function substitutes in the string `str` any match of the regular expression `regex`\nwith the replacement string `newStr`.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + { + name: 'regex', + type: 'string', + optional: false, + }, + { + name: 'newString', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW str = "Hello World"\n| EVAL str = REPLACE(str, "World", "Universe")\n| KEEP str'], +}; + +const rightDefinition: FunctionDefinition = { + type: 'eval', + name: 'right', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.right', { + defaultMessage: + "Return the substring that extracts 'length' chars from 'str' starting from the right.", + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + { + name: 'length', + type: 'number', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP last_name\n| EVAL right = RIGHT(last_name, 3)\n| SORT last_name ASC\n| LIMIT 5', + ], +}; + +const roundDefinition: FunctionDefinition = { + type: 'eval', + name: 'round', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.round', { + defaultMessage: + 'Rounds a number to the specified number of decimal places.\nDefaults to 0, which returns the nearest integer. If the\nprecision is a negative number, rounds to the number of digits left\nof the decimal point.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + { + name: 'decimals', + type: 'number', + optional: true, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP first_name, last_name, height\n| EVAL height_ft = ROUND(height * 3.281, 1)', + ], +}; + +const rtrimDefinition: FunctionDefinition = { + type: 'eval', + name: 'rtrim', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.rtrim', { + defaultMessage: 'Removes trailing whitespaces from a string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW message = " some text ", color = " red "\n| EVAL message = RTRIM(message)\n| EVAL color = RTRIM(color)\n| EVAL message = CONCAT("\'", message, "\'")\n| EVAL color = CONCAT("\'", color, "\'")', + ], +}; + +const signumDefinition: FunctionDefinition = { + type: 'eval', + name: 'signum', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.signum', { + defaultMessage: + 'Returns the sign of the given number.\nIt returns `-1` for negative numbers, `0` for `0` and `1` for positive numbers.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW d = 100.0\n| EVAL s = SIGNUM(d)'], +}; + +const sinDefinition: FunctionDefinition = { + type: 'eval', + name: 'sin', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sin', { + defaultMessage: 'Returns ths Sine trigonometric function of an angle.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'angle', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8 \n| EVAL sin=SIN(a)'], +}; + +const sinhDefinition: FunctionDefinition = { + type: 'eval', + name: 'sinh', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sinh', { + defaultMessage: 'Returns the hyperbolic sine of an angle.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'angle', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8 \n| EVAL sinh=SINH(a)'], +}; + +const splitDefinition: FunctionDefinition = { + type: 'eval', + name: 'split', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.split', { + defaultMessage: 'Split a single valued string into multiple strings.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + { + name: 'delim', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW words="foo;bar;baz;qux;quux;corge"\n| EVAL word = SPLIT(words, ";")'], +}; + +const sqrtDefinition: FunctionDefinition = { + type: 'eval', + name: 'sqrt', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.sqrt', { + defaultMessage: + 'Returns the square root of a number. The input can be any numeric value, the return value is always a double.\nSquare roots of negative numbers and infinities are null.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW d = 100.0\n| EVAL s = SQRT(d)'], +}; + +const stContainsDefinition: FunctionDefinition = { + type: 'eval', + name: 'st_contains', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.st_contains', { + defaultMessage: + 'Returns whether the first geometry contains the second geometry.\nThis is the inverse of the <> function.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'geomA', + type: 'cartesian_point', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_point', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_point', + optional: false, + }, + { + name: 'geomB', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_point', + optional: false, + }, + { + name: 'geomB', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_shape', + optional: false, + }, + { + name: 'geomB', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_shape', + optional: false, + }, + { + name: 'geomB', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM airport_city_boundaries\n| WHERE ST_CONTAINS(city_boundary, TO_GEOSHAPE("POLYGON((109.35 18.3, 109.45 18.3, 109.45 18.4, 109.35 18.4, 109.35 18.3))"))\n| KEEP abbrev, airport, region, city, city_location', + ], +}; + +const stDisjointDefinition: FunctionDefinition = { + type: 'eval', + name: 'st_disjoint', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.st_disjoint', { + defaultMessage: + 'Returns whether the two geometries or geometry columns are disjoint.\nThis is the inverse of the <> function.\nIn mathematical terms: ST_Disjoint(A, B) ⇔ A ⋂ B = ∅', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'geomA', + type: 'cartesian_point', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_point', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_point', + optional: false, + }, + { + name: 'geomB', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_point', + optional: false, + }, + { + name: 'geomB', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_shape', + optional: false, + }, + { + name: 'geomB', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_shape', + optional: false, + }, + { + name: 'geomB', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM airport_city_boundaries\n| WHERE ST_DISJOINT(city_boundary, TO_GEOSHAPE("POLYGON((-10 -60, 120 -60, 120 60, -10 60, -10 -60))"))\n| KEEP abbrev, airport, region, city, city_location', + ], +}; + +const stIntersectsDefinition: FunctionDefinition = { + type: 'eval', + name: 'st_intersects', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.st_intersects', { + defaultMessage: + 'Returns true if two geometries intersect.\nThey intersect if they have any point in common, including their interior points\n(points along lines or within polygons).\nThis is the inverse of the <> function.\nIn mathematical terms: ST_Intersects(A, B) ⇔ A ⋂ B ≠ ∅', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'geomA', + type: 'cartesian_point', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_point', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_point', + optional: false, + }, + { + name: 'geomB', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_point', + optional: false, + }, + { + name: 'geomB', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_shape', + optional: false, + }, + { + name: 'geomB', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_shape', + optional: false, + }, + { + name: 'geomB', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM airports\n| WHERE ST_INTERSECTS(location, TO_GEOSHAPE("POLYGON((42 14, 43 14, 43 15, 42 15, 42 14))"))', + ], +}; + +const stWithinDefinition: FunctionDefinition = { + type: 'eval', + name: 'st_within', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.st_within', { + defaultMessage: + 'Returns whether the first geometry is within the second geometry.\nThis is the inverse of the <> function.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'geomA', + type: 'cartesian_point', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_point', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'cartesian_shape', + optional: false, + }, + { + name: 'geomB', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_point', + optional: false, + }, + { + name: 'geomB', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_point', + optional: false, + }, + { + name: 'geomB', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_shape', + optional: false, + }, + { + name: 'geomB', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'geomA', + type: 'geo_shape', + optional: false, + }, + { + name: 'geomB', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'boolean', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM airport_city_boundaries\n| WHERE ST_WITHIN(city_boundary, TO_GEOSHAPE("POLYGON((109.1 18.15, 109.6 18.15, 109.6 18.65, 109.1 18.65, 109.1 18.15))"))\n| KEEP abbrev, airport, region, city, city_location', + ], +}; + +const stXDefinition: FunctionDefinition = { + type: 'eval', + name: 'st_x', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.st_x', { + defaultMessage: + 'Extracts the `x` coordinate from the supplied point.\nIf the points is of type `geo_point` this is equivalent to extracting the `longitude` value.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'point', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'point', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW point = TO_GEOPOINT("POINT(42.97109629958868 14.7552534006536)")\n| EVAL x = ST_X(point), y = ST_Y(point)', + ], +}; + +const stYDefinition: FunctionDefinition = { + type: 'eval', + name: 'st_y', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.st_y', { + defaultMessage: + 'Extracts the `y` coordinate from the supplied point.\nIf the points is of type `geo_point` this is equivalent to extracting the `latitude` value.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'point', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'point', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW point = TO_GEOPOINT("POINT(42.97109629958868 14.7552534006536)")\n| EVAL x = ST_X(point), y = ST_Y(point)', + ], +}; + +const startsWithDefinition: FunctionDefinition = { + type: 'eval', + name: 'starts_with', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.starts_with', { + defaultMessage: + 'Returns a boolean that indicates whether a keyword string starts with another string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'str', + type: 'string', + optional: false, + }, + { + name: 'prefix', + type: 'string', + optional: false, + }, + ], + returnType: 'boolean', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['FROM employees\n| KEEP last_name\n| EVAL ln_S = STARTS_WITH(last_name, "B")'], +}; + +const substringDefinition: FunctionDefinition = { + type: 'eval', + name: 'substring', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.substring', { + defaultMessage: + 'Returns a substring of a string, specified by a start position and an optional length', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + { + name: 'start', + type: 'number', + optional: false, + }, + { + name: 'length', + type: 'number', + optional: true, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'FROM employees\n| KEEP last_name\n| EVAL ln_sub = SUBSTRING(last_name, 1, 3)', + 'FROM employees\n| KEEP last_name\n| EVAL ln_sub = SUBSTRING(last_name, -3, 3)', + 'FROM employees\n| KEEP last_name\n| EVAL ln_sub = SUBSTRING(last_name, 2)', + ], +}; + +const tanDefinition: FunctionDefinition = { + type: 'eval', + name: 'tan', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.tan', { + defaultMessage: 'Returns the Tangent trigonometric function of an angle.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'angle', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8 \n| EVAL tan=TAN(a)'], +}; + +const tanhDefinition: FunctionDefinition = { + type: 'eval', + name: 'tanh', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.tanh', { + defaultMessage: 'Returns the Tangent hyperbolic function of an angle.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'angle', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=1.8 \n| EVAL tanh=TANH(a)'], +}; + +const tauDefinition: FunctionDefinition = { + type: 'eval', + name: 'tau', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.tau', { + defaultMessage: "Returns the ratio of a circle's circumference to its radius.", + }), + alias: undefined, + signatures: [ + { + params: [], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW TAU()'], +}; + +const toBase64Definition: FunctionDefinition = { + type: 'eval', + name: 'to_base64', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_base64', { + defaultMessage: 'Encode a string to a base64 string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['row a = "elastic" \n| eval e = to_base64(a)'], +}; + +const toBooleanDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_boolean', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_boolean', { + defaultMessage: + 'Converts an input value to a boolean value.\nA string value of *true* will be case-insensitive converted to the Boolean *true*.\nFor anything else, including the empty string, the function will return *false*.\nThe numerical value of *0* will be converted to *false*, anything else will be converted to *true*.', + }), + alias: ['to_bool'], + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'boolean', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'boolean', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW str = ["true", "TRuE", "false", "", "yes", "1"]\n| EVAL bool = TO_BOOLEAN(str)'], +}; + +const toCartesianpointDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_cartesianpoint', + description: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.definitions.to_cartesianpoint', + { defaultMessage: - 'Combines the values from two multivalued fields with a delimiter that joins them together.', - }), - signatures: [ - { - params: [ - { name: 'mvLeft', type: 'string' as const }, - { name: 'mvRight', type: 'string' as const }, - { name: 'delim', type: 'string' as const }, - ], - returnType: 'string' as const, - examples: [ - 'ROW a = ["x", "y", "z"], b = ["1", "2"] \n| EVAL c = mv_zip(a, b, "-") \n| KEEP a, b, c', - ], - }, - ], - }, - { - name: 'pi', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.piDoc', { - defaultMessage: 'The ratio of a circle’s circumference to its diameter.', - }), - signatures: [ - { - params: [], - returnType: 'number' as const, - examples: ['row a = 1 | eval pi()'], - }, - ], - }, - { - name: 'e', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.eDoc', { - defaultMessage: 'Euler’s number.', - }), - signatures: [ - { - params: [], - returnType: 'number' as const, - examples: ['row a = 1 | eval e()'], - }, - ], - }, - { - name: 'tau', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.tauDoc', { - defaultMessage: 'The ratio of a circle’s circumference to its radius.', - }), - signatures: [ - { - params: [], - returnType: 'number' as const, - examples: ['row a = 1 | eval tau()'], - }, - ], - }, - // begin spatial functions - { - name: 'st_contains', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.stContainsDoc', { - defaultMessage: 'Returns whether the first geometry contains the second geometry.', - }), - signatures: [ - { - params: [ - { - name: 'geomA', - type: 'geo_point' as const, - }, - { - name: 'geomB', - type: 'geo_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_contains(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_point' as const, - }, - { - name: 'geomB', - type: 'geo_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_contains(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_shape' as const, - }, - { - name: 'geomB', - type: 'geo_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_contains(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_shape' as const, - }, - { - name: 'geomB', - type: 'geo_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_contains(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_point' as const, - }, - { - name: 'geomB', - type: 'cartesian_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_contains(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_point' as const, - }, - { - name: 'geomB', - type: 'cartesian_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_contains(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_shape' as const, - }, - { - name: 'geomB', - type: 'cartesian_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_contains(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_shape' as const, - }, - { - name: 'geomB', - type: 'cartesian_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_contains(geometryA, geometryB)'], - }, - ], - }, - { - name: 'st_within', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.stWithinDoc', { - defaultMessage: 'Returns whether the first geometry is within the second geometry.', - }), - signatures: [ - { - params: [ - { - name: 'geomA', - type: 'geo_point' as const, - }, - { - name: 'geomB', - type: 'geo_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_within(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_point' as const, - }, - { - name: 'geomB', - type: 'geo_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_within(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_shape' as const, - }, - { - name: 'geomB', - type: 'geo_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_within(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_shape' as const, - }, - { - name: 'geomB', - type: 'geo_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_within(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_point' as const, - }, - { - name: 'geomB', - type: 'cartesian_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_within(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_point' as const, - }, - { - name: 'geomB', - type: 'cartesian_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_within(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_shape' as const, - }, - { - name: 'geomB', - type: 'cartesian_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_within(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_shape' as const, - }, - { - name: 'geomB', - type: 'cartesian_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_within(geometryA, geometryB)'], - }, - ], - }, - { - name: 'st_disjoint', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.stDisjointDoc', { - defaultMessage: 'Returns whether the two geometries or geometry columns are disjoint.', - }), - signatures: [ - { - params: [ - { - name: 'geomA', - type: 'geo_point' as const, - }, - { - name: 'geomB', - type: 'geo_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_disjoint(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_point' as const, - }, - { - name: 'geomB', - type: 'geo_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_disjoint(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_shape' as const, - }, - { - name: 'geomB', - type: 'geo_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_disjoint(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_shape' as const, - }, - { - name: 'geomB', - type: 'geo_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_disjoint(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_point' as const, - }, - { - name: 'geomB', - type: 'cartesian_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_disjoint(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_point' as const, - }, - { - name: 'geomB', - type: 'cartesian_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_disjoint(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_shape' as const, - }, - { - name: 'geomB', - type: 'cartesian_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_disjoint(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_shape' as const, - }, - { - name: 'geomB', - type: 'cartesian_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_disjoint(geometryA, geometryB)'], - }, - ], - }, - { - name: 'st_intersects', - description: i18n.translate( - 'kbn-esql-validation-autocomplete.esql.definitions.stIntersectsDoc', - { - defaultMessage: - 'Returns true if two geometries intersect. They intersect if they have any point in common, including their interior points (points along lines or within polygons).', - } - ), - signatures: [ - { - params: [ - { - name: 'geomA', - type: 'geo_point' as const, - }, - { - name: 'geomB', - type: 'geo_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_intersects(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_point' as const, - }, - { - name: 'geomB', - type: 'geo_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_intersects(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_shape' as const, - }, - { - name: 'geomB', - type: 'geo_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_intersects(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'geo_shape' as const, - }, - { - name: 'geomB', - type: 'geo_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_intersects(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_point' as const, - }, - { - name: 'geomB', - type: 'cartesian_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_intersects(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_point' as const, - }, - { - name: 'geomB', - type: 'cartesian_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_intersects(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_shape' as const, - }, - { - name: 'geomB', - type: 'cartesian_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_intersects(geometryA, geometryB)'], - }, - { - params: [ - { - name: 'geomA', - type: 'cartesian_shape' as const, - }, - { - name: 'geomB', - type: 'cartesian_shape' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_intersects(geometryA, geometryB)'], - }, - ], - }, - { - name: 'st_x', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.stXDoc', { + 'Converts an input value to a `cartesian_point` value.\nA string will only be successfully converted if it respects WKT Point format.', + } + ), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'cartesian_point', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'cartesian_point', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW wkt = ["POINT(4297.11 -1475.53)", "POINT(7580.93 2272.77)"]\n| MV_EXPAND wkt\n| EVAL pt = TO_CARTESIANPOINT(wkt)', + ], +}; + +const toCartesianshapeDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_cartesianshape', + description: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.definitions.to_cartesianshape', + { defaultMessage: - 'Extracts the x coordinate from the supplied point. If the points is of type geo_point this is equivalent to extracting the longitude value.', - }), - signatures: [ - { - params: [ - { - name: 'point', - type: 'geo_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_x(point)'], - }, - { - params: [ - { - name: 'point', - type: 'cartesian_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_x(point)'], - }, - ], - }, - { - name: 'st_y', - description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.stYDoc', { + 'Converts an input value to a `cartesian_shape` value.\nA string will only be successfully converted if it respects WKT format.', + } + ), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'cartesian_shape', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'cartesian_shape', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'cartesian_shape', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW wkt = ["POINT(4297.11 -1475.53)", "POLYGON ((3339584.72 1118889.97, 4452779.63 4865942.27, 2226389.81 4865942.27, 1113194.90 2273030.92, 3339584.72 1118889.97))"]\n| MV_EXPAND wkt\n| EVAL geom = TO_CARTESIANSHAPE(wkt)', + ], +}; + +const toDatetimeDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_datetime', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_datetime', { + defaultMessage: + "Converts an input value to a date value.\nA string will only be successfully converted if it's respecting the format `yyyy-MM-dd'T'HH:mm:ss.SSS'Z'`.\nTo convert dates in other formats, use <>.", + }), + alias: ['to_dt'], + signatures: [ + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'date', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'date', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW string = ["1953-09-02T00:00:00.000Z", "1964-06-02T00:00:00.000Z", "1964-06-02 00:00:00"]\n| EVAL datetime = TO_DATETIME(string)', + 'ROW int = [0, 1]\n| EVAL dt = TO_DATETIME(int)', + ], +}; + +const toDegreesDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_degrees', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_degrees', { + defaultMessage: 'Converts a number in radians to degrees.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW rad = [1.57, 3.14, 4.71]\n| EVAL deg = TO_DEGREES(rad)'], +}; + +const toDoubleDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_double', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_double', { + defaultMessage: + 'Converts an input value to a double value. If the input parameter is of a date type,\nits value will be interpreted as milliseconds since the Unix epoch,\nconverted to double. Boolean *true* will be converted to double *1.0*, *false* to *0.0*.', + }), + alias: ['to_dbl'], + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW str1 = "5.20128E11", str2 = "foo"\n| EVAL dbl = TO_DOUBLE("520128000000"), dbl1 = TO_DOUBLE(str1), dbl2 = TO_DOUBLE(str2)', + ], +}; + +const toGeopointDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_geopoint', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_geopoint', { + defaultMessage: + 'Converts an input value to a `geo_point` value.\nA string will only be successfully converted if it respects WKT Point format.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'geo_point', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'geo_point', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW wkt = "POINT(42.97109630194 14.7552534413725)"\n| EVAL pt = TO_GEOPOINT(wkt)'], +}; + +const toGeoshapeDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_geoshape', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_geoshape', { + defaultMessage: + 'Converts an input value to a `geo_shape` value.\nA string will only be successfully converted if it respects WKT format.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'geo_shape', + }, + { + params: [ + { + name: 'field', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'geo_shape', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'geo_shape', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW wkt = "POLYGON ((30 10, 40 40, 20 40, 10 20, 30 10))"\n| EVAL geom = TO_GEOSHAPE(wkt)', + ], +}; + +const toIntegerDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_integer', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_integer', { + defaultMessage: + 'Converts an input value to an integer value.\nIf the input parameter is of a date type, its value will be interpreted as milliseconds\nsince the Unix epoch, converted to integer.\nBoolean *true* will be converted to integer *1*, *false* to *0*.', + }), + alias: ['to_int'], + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW long = [5013792, 2147483647, 501379200000]\n| EVAL int = TO_INTEGER(long)'], +}; + +const toIpDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_ip', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_ip', { + defaultMessage: 'Converts an input string to an IP value.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'ip', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'ip', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW str1 = "1.1.1.1", str2 = "foo"\n| EVAL ip1 = TO_IP(str1), ip2 = TO_IP(str2)\n| WHERE CIDR_MATCH(ip1, "1.0.0.0/8")', + ], +}; + +const toLongDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_long', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_long', { + defaultMessage: + 'Converts an input value to a long value. If the input parameter is of a date type,\nits value will be interpreted as milliseconds since the Unix epoch, converted to long.\nBoolean *true* will be converted to long *1*, *false* to *0*.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW str1 = "2147483648", str2 = "2147483648.2", str3 = "foo"\n| EVAL long1 = TO_LONG(str1), long2 = TO_LONG(str2), long3 = TO_LONG(str3)', + ], +}; + +const toLowerDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_lower', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_lower', { + defaultMessage: 'Returns a new string representing the input string converted to lower case.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'str', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW message = "Some Text"\n| EVAL message_lower = TO_LOWER(message)'], +}; + +const toRadiansDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_radians', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_radians', { + defaultMessage: 'Converts a number in degrees to radians.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'number', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW deg = [90.0, 180.0, 270.0]\n| EVAL rad = TO_RADIANS(deg)'], +}; + +const toStringDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_string', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_string', { + defaultMessage: 'Converts an input value into a string.', + }), + alias: ['to_str'], + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_point', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'cartesian_shape', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'geo_point', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'geo_shape', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'ip', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW a=10\n| EVAL j = TO_STRING(a)', 'ROW a=[10, 9, 8]\n| EVAL j = TO_STRING(a)'], +}; + +const toUnsignedLongDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_unsigned_long', + description: i18n.translate( + 'kbn-esql-validation-autocomplete.esql.definitions.to_unsigned_long', + { defaultMessage: - 'Extracts the y coordinate from the supplied point. If the points is of type geo_point this is equivalent to extracting the latitude value.', - }), - signatures: [ - { - params: [ - { - name: 'point', - type: 'geo_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_y(point)'], - }, - { - params: [ - { - name: 'point', - type: 'cartesian_point' as const, - }, - ], - returnType: 'boolean' as const, - examples: ['from index | eval st_y(point)'], - }, - ], - }, -] - .sort(({ name: a }, { name: b }) => a.localeCompare(b)) - .map((def) => ({ - ...def, - supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], - supportedOptions: ['by'], - type: 'eval', - })); + 'Converts an input value to an unsigned long value. If the input parameter is of a date type,\nits value will be interpreted as milliseconds since the Unix epoch, converted to unsigned long.\nBoolean *true* will be converted to unsigned long *1*, *false* to *0*.', + } + ), + alias: ['to_ul', 'to_ulong'], + signatures: [ + { + params: [ + { + name: 'field', + type: 'boolean', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'date', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'number', + optional: false, + }, + ], + returnType: 'number', + }, + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'number', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW str1 = "2147483648", str2 = "2147483648.2", str3 = "foo"\n| EVAL long1 = TO_UNSIGNED_LONG(str1), long2 = TO_ULONG(str2), long3 = TO_UL(str3)', + ], +}; + +const toUpperDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_upper', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_upper', { + defaultMessage: 'Returns a new string representing the input string converted to upper case.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'str', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW message = "Some Text"\n| EVAL message_upper = TO_UPPER(message)'], +}; + +const toVersionDefinition: FunctionDefinition = { + type: 'eval', + name: 'to_version', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.to_version', { + defaultMessage: 'Converts an input string to a version value.', + }), + alias: ['to_ver'], + signatures: [ + { + params: [ + { + name: 'field', + type: 'string', + optional: false, + }, + ], + returnType: 'version', + }, + { + params: [ + { + name: 'field', + type: 'version', + optional: false, + }, + ], + returnType: 'version', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: ['ROW v = TO_VERSION("1.2.3")'], +}; + +const trimDefinition: FunctionDefinition = { + type: 'eval', + name: 'trim', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.trim', { + defaultMessage: 'Removes leading and trailing whitespaces from a string.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'string', + type: 'string', + optional: false, + }, + ], + returnType: 'string', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'ROW message = " some text ", color = " red "\n| EVAL message = TRIM(message)\n| EVAL color = TRIM(color)', + ], +}; + +const caseDefinition: FunctionDefinition = { + type: 'eval', + name: 'case', + description: i18n.translate('kbn-esql-validation-autocomplete.esql.definitions.case', { + defaultMessage: + 'Accepts pairs of conditions and values. The function returns the value that belongs to the first condition that evaluates to `true`. If the number of arguments is odd, the last argument is the default value which is returned when no condition matches.', + }), + alias: undefined, + signatures: [ + { + params: [ + { + name: 'condition', + type: 'boolean', + }, + { + name: 'value', + type: 'any', + }, + ], + minParams: 2, + returnType: 'any', + }, + ], + supportedCommands: ['stats', 'eval', 'where', 'row', 'sort'], + supportedOptions: ['by'], + validate: undefined, + examples: [ + 'from index | eval type = case(languages <= 1, "monolingual", languages <= 2, "bilingual", "polyglot")', + ], +}; +export const evalFunctionDefinitions = [ + absDefinition, + acosDefinition, + asinDefinition, + atanDefinition, + atan2Definition, + cbrtDefinition, + ceilDefinition, + cidrMatchDefinition, + coalesceDefinition, + concatDefinition, + cosDefinition, + coshDefinition, + dateDiffDefinition, + dateExtractDefinition, + dateFormatDefinition, + dateParseDefinition, + dateTruncDefinition, + eDefinition, + endsWithDefinition, + floorDefinition, + fromBase64Definition, + greatestDefinition, + leastDefinition, + leftDefinition, + lengthDefinition, + locateDefinition, + logDefinition, + log10Definition, + ltrimDefinition, + mvAvgDefinition, + mvConcatDefinition, + mvCountDefinition, + mvDedupeDefinition, + mvFirstDefinition, + mvLastDefinition, + mvMaxDefinition, + mvMedianDefinition, + mvMinDefinition, + mvSliceDefinition, + mvSortDefinition, + mvSumDefinition, + mvZipDefinition, + nowDefinition, + piDefinition, + powDefinition, + replaceDefinition, + rightDefinition, + roundDefinition, + rtrimDefinition, + signumDefinition, + sinDefinition, + sinhDefinition, + splitDefinition, + sqrtDefinition, + stContainsDefinition, + stDisjointDefinition, + stIntersectsDefinition, + stWithinDefinition, + stXDefinition, + stYDefinition, + startsWithDefinition, + substringDefinition, + tanDefinition, + tanhDefinition, + tauDefinition, + toBase64Definition, + toBooleanDefinition, + toCartesianpointDefinition, + toCartesianshapeDefinition, + toDatetimeDefinition, + toDegreesDefinition, + toDoubleDefinition, + toGeopointDefinition, + toGeoshapeDefinition, + toIntegerDefinition, + toIpDefinition, + toLongDefinition, + toLowerDefinition, + toRadiansDefinition, + toStringDefinition, + toUnsignedLongDefinition, + toUpperDefinition, + toVersionDefinition, + trimDefinition, + caseDefinition, +]; diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts index fc725cbe0b429..79ac91d14403a 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/grouping.ts @@ -27,7 +27,6 @@ export const groupingFunctionDefinitions: FunctionDefinition[] = [ { name: 'buckets', type: 'time_literal', constantOnly: true }, ], returnType: 'date', - examples: ['from index | eval hd = bucket(hire_date, 1 hour)'], }, { params: [ @@ -35,7 +34,6 @@ export const groupingFunctionDefinitions: FunctionDefinition[] = [ { name: 'buckets', type: 'number', constantOnly: true }, ], returnType: 'number', - examples: ['from index | eval hd = bucket(bytes, 1 hour)'], }, { params: [ @@ -45,9 +43,6 @@ export const groupingFunctionDefinitions: FunctionDefinition[] = [ { name: 'endDate', type: 'string', constantOnly: true }, ], returnType: 'date', - examples: [ - 'from index | eval hd = bucket(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")', - ], }, { params: [ @@ -57,9 +52,6 @@ export const groupingFunctionDefinitions: FunctionDefinition[] = [ { name: 'endDate', type: 'date', constantOnly: true }, ], returnType: 'date', - examples: [ - 'from index | eval hd = bucket(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")', - ], }, { params: [ @@ -69,9 +61,6 @@ export const groupingFunctionDefinitions: FunctionDefinition[] = [ { name: 'endDate', type: 'date', constantOnly: true }, ], returnType: 'date', - examples: [ - 'from index | eval hd = bucket(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")', - ], }, { params: [ @@ -81,9 +70,6 @@ export const groupingFunctionDefinitions: FunctionDefinition[] = [ { name: 'endDate', type: 'string', constantOnly: true }, ], returnType: 'date', - examples: [ - 'from index | eval hd = bucket(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")', - ], }, { params: [ @@ -93,8 +79,14 @@ export const groupingFunctionDefinitions: FunctionDefinition[] = [ { name: 'endValue', type: 'number', constantOnly: true }, ], returnType: 'number', - examples: ['from index | eval bs = bucket(bytes, 20, 25324, 74999)'], }, ], + examples: [ + 'from index | eval hd = bucket(bytes, 1 hour)', + 'from index | eval hd = bucket(hire_date, 1 hour)', + 'from index | eval hd = bucket(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")', + 'from index | eval hd = bucket(hire_date, 20, "1985-01-01T00:00:00Z", "1986-01-01T00:00:00Z")', + 'from index | eval bs = bucket(bytes, 20, 25324, 74999)', + ], }, ]; diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/helpers.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/helpers.ts index 89485f2174a42..0380a07385a73 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/helpers.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/helpers.ts @@ -19,7 +19,7 @@ export function getFunctionSignatures( { name, signatures }: FunctionDefinition, { withTypes }: { withTypes: boolean } = { withTypes: true } ) { - return signatures.map(({ params, returnType, minParams, examples }) => { + return signatures.map(({ params, returnType, minParams }) => { // for functions with a minimum number of args, repeat the last arg multiple times // just make sure to compute the right number of args to add const minParamsToAdd = Math.max((minParams || 0) - params.length, 0); @@ -30,7 +30,6 @@ export function getFunctionSignatures( .join(', ')}${handleAdditionalArgs(minParamsToAdd > 0, extraArg, withTypes)})${ withTypes ? `: ${returnType}` : '' }`, - examples, }; }); } diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts index 0a614620ac08b..dbfbf08cca08a 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/types.ts @@ -8,21 +8,30 @@ import type { ESQLCommand, ESQLCommandOption, ESQLFunction, ESQLMessage } from '@kbn/esql-ast'; +export const supportedFieldTypes = [ + 'number', + 'date', + 'string', + 'boolean', + 'ip', + 'cartesian_point', + 'cartesian_shape', + 'geo_point', + 'geo_shape', + 'version', +] as const; + +export const isSupportedFieldType = (type: string): type is SupportedFieldType => + supportedFieldTypes.includes(type as SupportedFieldType); + +export type SupportedFieldType = typeof supportedFieldTypes[number]; + export type FunctionParameterType = - | 'number' - | 'date' - | 'string' - | 'boolean' + | SupportedFieldType | 'null' | 'any' - | 'ip' | 'chrono_literal' | 'time_literal' - | 'cartesian_point' - | 'cartesian_shape' - | 'geo_point' - | 'geo_shape' - | 'version' | 'number[]' | 'string[]' | 'boolean[]' @@ -88,8 +97,8 @@ export interface FunctionDefinition { }>; minParams?: number; returnType: FunctionReturnType; - examples?: string[]; }>; + examples?: string[]; validate?: (fnDef: ESQLFunction) => ESQLMessage[]; } diff --git a/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts b/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts index 5689b81c1b54d..e17788eba21b8 100644 --- a/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts +++ b/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts @@ -20,7 +20,7 @@ import type { import { statsAggregationFunctionDefinitions } from '../definitions/aggs'; import { builtinFunctions } from '../definitions/builtin'; import { commandDefinitions } from '../definitions/commands'; -import { evalFunctionsDefinitions } from '../definitions/functions'; +import { evalFunctionDefinitions } from '../definitions/functions'; import { groupingFunctionDefinitions } from '../definitions/grouping'; import { getFunctionSignatures } from '../definitions/helpers'; import { chronoLiterals, timeLiterals } from '../definitions/literals'; @@ -132,7 +132,7 @@ function buildFunctionLookup() { if (!fnLookups) { fnLookups = builtinFunctions .concat( - evalFunctionsDefinitions, + evalFunctionDefinitions, statsAggregationFunctionDefinitions, groupingFunctionDefinitions ) diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json b/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json index 14b55dee73cd7..89c267dd01f2d 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json +++ b/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json @@ -17,21 +17,17 @@ "type": "date" }, { - "name": "booleanField", - "type": "boolean" + "name": "stringField", + "type": "string" }, { - "name": "versionField", - "type": "version" + "name": "booleanField", + "type": "boolean" }, { "name": "ipField", "type": "ip" }, - { - "name": "stringField", - "type": "string" - }, { "name": "cartesianPointField", "type": "cartesian_point" @@ -48,6 +44,10 @@ "name": "geoShapeField", "type": "geo_shape" }, + { + "name": "versionField", + "type": "version" + }, { "name": "any#Char$Field", "type": "number" @@ -3972,82 +3972,82 @@ "warning": [] }, { - "query": "from a_index | where booleanField IS NULL", + "query": "from a_index | where stringField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField IS null", + "query": "from a_index | where stringField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField is null", + "query": "from a_index | where stringField is null", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField is NULL", + "query": "from a_index | where stringField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField IS NOT NULL", + "query": "from a_index | where stringField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField IS NOT null", + "query": "from a_index | where stringField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField IS not NULL", + "query": "from a_index | where stringField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where booleanField Is nOt NuLL", + "query": "from a_index | where stringField Is nOt NuLL", "error": [], "warning": [] }, { - "query": "from a_index | where versionField IS NULL", + "query": "from a_index | where booleanField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | where versionField IS null", + "query": "from a_index | where booleanField IS null", "error": [], "warning": [] }, { - "query": "from a_index | where versionField is null", + "query": "from a_index | where booleanField is null", "error": [], "warning": [] }, { - "query": "from a_index | where versionField is NULL", + "query": "from a_index | where booleanField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | where versionField IS NOT NULL", + "query": "from a_index | where booleanField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | where versionField IS NOT null", + "query": "from a_index | where booleanField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | where versionField IS not NULL", + "query": "from a_index | where booleanField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | where versionField Is nOt NuLL", + "query": "from a_index | where booleanField Is nOt NuLL", "error": [], "warning": [] }, @@ -4091,46 +4091,6 @@ "error": [], "warning": [] }, - { - "query": "from a_index | where stringField IS NULL", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField IS null", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField is null", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField is NULL", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField IS NOT NULL", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField IS NOT null", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField IS not NULL", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField Is nOt NuLL", - "error": [], - "warning": [] - }, { "query": "from a_index | where cartesianPointField IS NULL", "error": [], @@ -4291,6 +4251,46 @@ "error": [], "warning": [] }, + { + "query": "from a_index | where versionField IS NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField IS null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField is null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField is NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField IS NOT NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField IS NOT null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField IS not NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField Is nOt NuLL", + "error": [], + "warning": [] + }, { "query": "from a_index | where stringField == \"a\" or null", "error": [], @@ -4493,72 +4493,72 @@ "warning": [] }, { - "query": "from a_index | eval booleanField IS NULL", + "query": "from a_index | eval stringField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField IS null", + "query": "from a_index | eval stringField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField is null", + "query": "from a_index | eval stringField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField is NULL", + "query": "from a_index | eval stringField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField IS NOT NULL", + "query": "from a_index | eval stringField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField IS NOT null", + "query": "from a_index | eval stringField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField IS not NULL", + "query": "from a_index | eval stringField IS not NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField IS NULL", + "query": "from a_index | eval booleanField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField IS null", + "query": "from a_index | eval booleanField IS null", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField is null", + "query": "from a_index | eval booleanField is null", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField is NULL", + "query": "from a_index | eval booleanField is NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField IS NOT NULL", + "query": "from a_index | eval booleanField IS NOT NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField IS NOT null", + "query": "from a_index | eval booleanField IS NOT null", "error": [], "warning": [] }, { - "query": "from a_index | eval versionField IS not NULL", + "query": "from a_index | eval booleanField IS not NULL", "error": [], "warning": [] }, @@ -4597,41 +4597,6 @@ "error": [], "warning": [] }, - { - "query": "from a_index | eval stringField IS NULL", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval stringField IS null", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval stringField is null", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval stringField is NULL", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval stringField IS NOT NULL", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval stringField IS NOT null", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval stringField IS not NULL", - "error": [], - "warning": [] - }, { "query": "from a_index | eval cartesianPointField IS NULL", "error": [], @@ -4772,6 +4737,41 @@ "error": [], "warning": [] }, + { + "query": "from a_index | eval versionField IS NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField IS null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField is null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField is NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField IS NOT NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField IS NOT null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField IS not NULL", + "error": [], + "warning": [] + }, { "query": "from a_index | eval - numberField", "error": [], @@ -9000,6 +9000,20 @@ "error": [], "warning": [] }, + { + "query": "from a_index | eval var = date_diff(\"year\", to_datetime(dateField), to_datetime(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval date_diff(booleanField, booleanField, booleanField)", + "error": [ + "Argument of [date_diff] must be [string], found value [booleanField] type [boolean]", + "Argument of [date_diff] must be [date], found value [booleanField] type [boolean]", + "Argument of [date_diff] must be [date], found value [booleanField] type [boolean]" + ], + "warning": [] + }, { "query": "row var = abs(5)", "error": [], @@ -9076,51 +9090,82 @@ "warning": [] }, { - "query": "row var = acos(5)", - "error": [], - "warning": [] - }, - { - "query": "row acos(5)", + "query": "row var = abs(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = acos(to_integer(\"a\"))", - "error": [], + "query": "row var = abs(true)", + "error": [ + "Argument of [abs] must be [number], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = acos(\"a\")", + "query": "from a_index | where abs(booleanField) > 0", "error": [ - "Argument of [acos] must be [number], found value [\"a\"] type [string]" + "Argument of [abs] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where acos(numberField) > 0", + "query": "from a_index | eval var = abs(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where acos(stringField) > 0", + "query": "from a_index | eval abs(booleanField)", "error": [ - "Argument of [acos] must be [number], found value [stringField] type [string]" + "Argument of [abs] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = acos(numberField)", + "query": "row var = acos(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval acos(numberField)", + "query": "row acos(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = acos(to_integer(stringField))", + "query": "row var = acos(to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = acos(\"a\")", + "error": [ + "Argument of [acos] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where acos(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where acos(stringField) > 0", + "error": [ + "Argument of [acos] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = acos(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval acos(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = acos(to_integer(stringField))", "error": [], "warning": [] }, @@ -9150,6 +9195,37 @@ "error": [], "warning": [] }, + { + "query": "row var = acos(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = acos(true)", + "error": [ + "Argument of [acos] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where acos(booleanField) > 0", + "error": [ + "Argument of [acos] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = acos(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval acos(booleanField)", + "error": [ + "Argument of [acos] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, { "query": "row var = asin(5)", "error": [], @@ -9225,6 +9301,37 @@ "error": [], "warning": [] }, + { + "query": "row var = asin(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = asin(true)", + "error": [ + "Argument of [asin] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where asin(booleanField) > 0", + "error": [ + "Argument of [asin] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = asin(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval asin(booleanField)", + "error": [ + "Argument of [asin] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, { "query": "row var = atan(5)", "error": [], @@ -9300,6 +9407,37 @@ "error": [], "warning": [] }, + { + "query": "row var = atan(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = atan(true)", + "error": [ + "Argument of [atan] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where atan(booleanField) > 0", + "error": [ + "Argument of [atan] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = atan(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval atan(booleanField)", + "error": [ + "Argument of [atan] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, { "query": "row var = atan2(5, 5)", "error": [], @@ -9371,6 +9509,40 @@ "error": [], "warning": [] }, + { + "query": "row var = atan2(to_integer(true), to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = atan2(true, true)", + "error": [ + "Argument of [atan2] must be [number], found value [true] type [boolean]", + "Argument of [atan2] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where atan2(booleanField, booleanField) > 0", + "error": [ + "Argument of [atan2] must be [number], found value [booleanField] type [boolean]", + "Argument of [atan2] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = atan2(to_integer(booleanField), to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval atan2(booleanField, booleanField)", + "error": [ + "Argument of [atan2] must be [number], found value [booleanField] type [boolean]", + "Argument of [atan2] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, { "query": "row var = case(true, \"a\")", "error": [], @@ -9396,6 +9568,13 @@ "error": [], "warning": [] }, + { + "query": "row var = case(to_cartesianpoint(\"POINT (30 10)\"), true)", + "error": [ + "Argument of [case] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, { "query": "row var = ceil(5)", "error": [], @@ -9471,6 +9650,37 @@ "error": [], "warning": [] }, + { + "query": "row var = ceil(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = ceil(true)", + "error": [ + "Argument of [ceil] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where ceil(booleanField) > 0", + "error": [ + "Argument of [ceil] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = ceil(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval ceil(booleanField)", + "error": [ + "Argument of [ceil] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, { "query": "row var = cidr_match(to_ip(\"127.0.0.1\"), \"a\")", "error": [], @@ -9522,6 +9732,32 @@ "error": [], "warning": [] }, + { + "query": "row var = cidr_match(to_ip(to_ip(\"127.0.0.1\")), to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = cidr_match(true, true)", + "error": [ + "Argument of [cidr_match] must be [ip], found value [true] type [boolean]", + "Argument of [cidr_match] must be [string], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = cidr_match(to_ip(ipField), to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval cidr_match(booleanField, booleanField)", + "error": [ + "Argument of [cidr_match] must be [ip], found value [booleanField] type [boolean]", + "Argument of [cidr_match] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, { "query": "row var = coalesce(\"a\")", "error": [], @@ -9548,6820 +9784,14400 @@ "warning": [] }, { - "query": "row var = concat(\"a\", \"a\")", + "query": "row var = coalesce(true)", "error": [], "warning": [] }, { - "query": "row concat(\"a\", \"a\")", + "query": "row coalesce(true)", "error": [], "warning": [] }, { - "query": "row var = concat(to_string(\"a\"), to_string(\"a\"))", + "query": "row var = coalesce(to_boolean(true))", "error": [], "warning": [] }, { - "query": "row var = concat(5, 5)", - "error": [ - "Argument of [concat] must be [string], found value [5] type [number]" - ], + "query": "row var = coalesce(true, true)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(concat(stringField, stringField)) > 0", + "query": "row coalesce(true, true)", "error": [], "warning": [] }, { - "query": "from a_index | where length(concat(numberField, numberField)) > 0", - "error": [ - "Argument of [concat] must be [string], found value [numberField] type [number]" - ], + "query": "row var = coalesce(to_boolean(true), to_boolean(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = concat(stringField, stringField)", + "query": "row var = coalesce(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval concat(stringField, stringField)", + "query": "row coalesce(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = concat(to_string(stringField), to_string(stringField))", + "query": "row var = coalesce(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval concat(numberField, numberField)", - "error": [ - "Argument of [concat] must be [string], found value [numberField] type [number]" - ], + "query": "row var = coalesce(5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | sort concat(stringField, stringField)", + "query": "row coalesce(5, 5)", "error": [], "warning": [] }, { - "query": "row var = cos(5)", + "query": "row var = coalesce(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "row cos(5)", + "query": "row var = coalesce(to_string(true))", "error": [], "warning": [] }, { - "query": "row var = cos(to_integer(\"a\"))", + "query": "row var = coalesce(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = cos(\"a\")", - "error": [ - "Argument of [cos] must be [number], found value [\"a\"] type [string]" - ], + "query": "row coalesce(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | where cos(numberField) > 0", + "query": "row var = coalesce(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | where cos(stringField) > 0", - "error": [ - "Argument of [cos] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | where coalesce(numberField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cos(numberField)", + "query": "from a_index | where coalesce(numberField, numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval cos(numberField)", + "query": "from a_index | where length(coalesce(stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = cos(to_integer(stringField))", + "query": "from a_index | where length(coalesce(stringField, stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval cos(stringField)", - "error": [ - "Argument of [cos] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = coalesce(booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval cos(numberField, extraArg)", - "error": [ - "Error: [cos] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval coalesce(booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cos(*)", - "error": [ - "Using wildcards (*) in cos is not allowed" - ], + "query": "from a_index | eval var = coalesce(to_boolean(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort cos(numberField)", + "query": "from a_index | eval var = coalesce(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "row var = cosh(5)", + "query": "from a_index | eval coalesce(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "row cosh(5)", + "query": "from a_index | eval var = coalesce(to_boolean(booleanField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = cosh(to_integer(\"a\"))", + "query": "from a_index | eval var = coalesce(numberField)", "error": [], "warning": [] }, { - "query": "row var = cosh(\"a\")", - "error": [ - "Argument of [cosh] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval coalesce(numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | where cosh(numberField) > 0", + "query": "from a_index | eval var = coalesce(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where cosh(stringField) > 0", - "error": [ - "Argument of [cosh] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = coalesce(numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cosh(numberField)", + "query": "from a_index | eval coalesce(numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval cosh(numberField)", + "query": "from a_index | eval var = coalesce(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = cosh(to_integer(stringField))", + "query": "from a_index | eval var = coalesce(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval cosh(stringField)", - "error": [ - "Argument of [cosh] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = coalesce(stringField, stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval cosh(numberField, extraArg)", - "error": [ - "Error: [cosh] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval coalesce(stringField, stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = cosh(*)", - "error": [ - "Using wildcards (*) in cosh is not allowed" - ], + "query": "from a_index | eval var = coalesce(to_string(booleanField), to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort cosh(numberField)", + "query": "from a_index | sort coalesce(booleanField)", "error": [], "warning": [] }, { - "query": "row var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", now())", + "query": "row var = coalesce(5, true)", "error": [], "warning": [] }, { - "query": "row date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", now())", + "query": "row coalesce(5, true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "query": "row var = coalesce(to_integer(true), to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "query": "row var = coalesce(now())", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(stringField))", + "query": "row coalesce(now())", "error": [], "warning": [] }, { - "query": "from a_index | eval date_extract(stringField, stringField)", - "error": [ - "Argument of [date_extract] must be [chrono_literal], found value [stringField] type [string]", - "Argument of [date_extract] must be [date], found value [stringField] type [string]" - ], + "query": "row var = coalesce(to_datetime(now()))", + "error": [], "warning": [] }, { - "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField, extraArg)", - "error": [ - "Error: [date_extract] function expects exactly 2 arguments, got 3." - ], + "query": "row var = coalesce(now(), true)", + "error": [], "warning": [] }, { - "query": "from a_index | sort date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "query": "row coalesce(now(), true)", "error": [], "warning": [] }, { - "query": "row var = date_format(now(), \"a\")", + "query": "row var = coalesce(to_datetime(now()), to_boolean(true))", "error": [], "warning": [] }, { - "query": "row date_format(now(), \"a\")", + "query": "row var = coalesce(\"a\", true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_format(dateField, stringField)", + "query": "row coalesce(\"a\", true)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_format(dateField, stringField)", + "query": "row var = coalesce(to_string(true), to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_format(to_datetime(stringField), to_string(stringField))", + "query": "row var = coalesce(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval date_format(stringField, numberField)", - "error": [ - "Argument of [date_format] must be [date], found value [stringField] type [string]", - "Argument of [date_format] must be [string], found value [numberField] type [number]" - ], + "query": "row coalesce(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval date_format(dateField, stringField, extraArg)", - "error": [ - "Error: [date_format] function expects no more than 2 arguments, got 3." - ], + "query": "row var = coalesce(to_ip(to_ip(\"127.0.0.1\")))", + "error": [], "warning": [] }, { - "query": "from a_index | sort date_format(dateField, stringField)", + "query": "row var = coalesce(to_ip(\"127.0.0.1\"), true)", "error": [], "warning": [] }, { - "query": "row var = date_parse(\"a\", \"a\")", + "query": "row coalesce(to_ip(\"127.0.0.1\"), true)", "error": [], "warning": [] }, { - "query": "row date_parse(\"a\", \"a\")", + "query": "row var = coalesce(to_ip(to_ip(\"127.0.0.1\")), to_boolean(true))", "error": [], "warning": [] }, { - "query": "row var = date_parse(to_string(\"a\"), to_string(\"a\"))", + "query": "row var = coalesce(to_cartesianpoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = date_parse(5, 5)", - "error": [ - "Argument of [date_parse] must be [string], found value [5] type [number]", - "Argument of [date_parse] must be [string], found value [5] type [number]" - ], + "query": "row coalesce(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_parse(stringField, stringField)", + "query": "row var = coalesce(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval date_parse(stringField, stringField)", + "query": "row var = coalesce(to_cartesianpoint(\"POINT (30 10)\"), true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_parse(to_string(stringField), to_string(stringField))", + "query": "row coalesce(to_cartesianpoint(\"POINT (30 10)\"), true)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_parse(numberField, numberField)", - "error": [ - "Argument of [date_parse] must be [string], found value [numberField] type [number]", - "Argument of [date_parse] must be [string], found value [numberField] type [number]" - ], + "query": "row var = coalesce(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_boolean(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval date_parse(stringField, stringField, extraArg)", - "error": [ - "Error: [date_parse] function expects exactly 2 arguments, got 3." - ], + "query": "row var = coalesce(to_cartesianshape(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | sort date_parse(stringField, stringField)", + "query": "row coalesce(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = date_trunc(1 year, now())", + "query": "row var = coalesce(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "row date_trunc(1 year, now())", + "query": "row var = coalesce(to_cartesianshape(\"POINT (30 10)\"), true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_trunc(1 year, dateField)", + "query": "row coalesce(to_cartesianshape(\"POINT (30 10)\"), true)", "error": [], "warning": [] }, { - "query": "from a_index | eval date_trunc(1 year, dateField)", + "query": "row var = coalesce(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = date_trunc(1 year, to_datetime(stringField))", + "query": "row var = coalesce(to_geopoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval date_trunc(stringField, stringField)", - "error": [ - "Argument of [date_trunc] must be [time_literal], found value [stringField] type [string]", - "Argument of [date_trunc] must be [date], found value [stringField] type [string]" - ], + "query": "row coalesce(to_geopoint(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval date_trunc(1 year, dateField, extraArg)", - "error": [ - "Error: [date_trunc] function expects exactly 2 arguments, got 3." - ], + "query": "row var = coalesce(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], "warning": [] }, { - "query": "from a_index | sort date_trunc(1 year, dateField)", + "query": "row var = coalesce(to_geopoint(\"POINT (30 10)\"), true)", "error": [], "warning": [] }, { - "query": "row var = e()", + "query": "row coalesce(to_geopoint(\"POINT (30 10)\"), true)", "error": [], "warning": [] }, { - "query": "row e()", + "query": "row var = coalesce(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | where e() > 0", + "query": "row var = coalesce(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = e()", + "query": "row coalesce(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval e()", + "query": "row var = coalesce(to_geoshape(to_geopoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval e(extraArg)", - "error": [ - "Error: [e] function expects exactly 0 arguments, got 1." - ], + "query": "row var = coalesce(to_geoshape(\"POINT (30 10)\"), true)", + "error": [], "warning": [] }, { - "query": "from a_index | sort e()", + "query": "row coalesce(to_geoshape(\"POINT (30 10)\"), true)", "error": [], "warning": [] }, { - "query": "row var = ends_with(\"a\", \"a\")", + "query": "row var = coalesce(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_boolean(true))", "error": [], "warning": [] }, { - "query": "row ends_with(\"a\", \"a\")", + "query": "row var = coalesce(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row var = ends_with(to_string(\"a\"), to_string(\"a\"))", + "query": "row coalesce(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row var = ends_with(5, 5)", - "error": [ - "Argument of [ends_with] must be [string], found value [5] type [number]", - "Argument of [ends_with] must be [string], found value [5] type [number]" - ], + "query": "row var = coalesce(to_version(\"a\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = ends_with(stringField, stringField)", + "query": "row var = coalesce(to_version(\"1.0.0\"), true)", "error": [], "warning": [] }, { - "query": "from a_index | eval ends_with(stringField, stringField)", + "query": "row coalesce(to_version(\"1.0.0\"), true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = ends_with(to_string(stringField), to_string(stringField))", + "query": "row var = coalesce(to_version(\"a\"), to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval ends_with(numberField, numberField)", - "error": [ - "Argument of [ends_with] must be [string], found value [numberField] type [number]", - "Argument of [ends_with] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | where coalesce(numberField, booleanField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval ends_with(stringField, stringField, extraArg)", - "error": [ - "Error: [ends_with] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | where length(coalesce(stringField, booleanField)) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | sort ends_with(stringField, stringField)", + "query": "from a_index | eval var = coalesce(numberField, booleanField)", "error": [], "warning": [] }, { - "query": "row var = floor(5)", + "query": "from a_index | eval coalesce(numberField, booleanField)", "error": [], "warning": [] }, { - "query": "row floor(5)", + "query": "from a_index | eval var = coalesce(to_integer(booleanField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = floor(to_integer(\"a\"))", + "query": "from a_index | eval var = coalesce(dateField)", "error": [], "warning": [] }, { - "query": "row var = floor(\"a\")", - "error": [ - "Argument of [floor] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval coalesce(dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | where floor(numberField) > 0", + "query": "from a_index | eval var = coalesce(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | where floor(stringField) > 0", - "error": [ - "Argument of [floor] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = coalesce(dateField, booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = floor(numberField)", + "query": "from a_index | eval coalesce(dateField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval floor(numberField)", + "query": "from a_index | eval var = coalesce(to_datetime(dateField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = floor(to_integer(stringField))", + "query": "from a_index | eval var = coalesce(stringField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval floor(stringField)", - "error": [ - "Argument of [floor] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval coalesce(stringField, booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval floor(numberField, extraArg)", - "error": [ - "Error: [floor] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = coalesce(to_string(booleanField), to_boolean(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = floor(*)", - "error": [ - "Using wildcards (*) in floor is not allowed" - ], + "query": "from a_index | eval var = coalesce(ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort floor(numberField)", + "query": "from a_index | eval coalesce(ipField)", "error": [], "warning": [] }, { - "query": "row var = greatest(\"a\")", + "query": "from a_index | eval var = coalesce(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "row greatest(\"a\")", + "query": "from a_index | eval var = coalesce(ipField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = greatest(stringField)", + "query": "from a_index | eval coalesce(ipField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval greatest(stringField)", + "query": "from a_index | eval var = coalesce(to_ip(ipField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | sort greatest(stringField)", + "query": "from a_index | eval var = coalesce(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = least(\"a\")", + "query": "from a_index | eval var = coalesce(to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row least(\"a\")", + "query": "from a_index | eval var = coalesce(cartesianPointField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = least(stringField)", + "query": "from a_index | eval coalesce(cartesianPointField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval least(stringField)", + "query": "from a_index | eval var = coalesce(to_cartesianpoint(cartesianPointField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | sort least(stringField)", + "query": "from a_index | eval var = coalesce(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = left(\"a\", 5)", + "query": "from a_index | eval coalesce(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row left(\"a\", 5)", + "query": "from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row var = left(to_string(\"a\"), to_integer(\"a\"))", + "query": "from a_index | eval var = coalesce(cartesianShapeField, booleanField)", "error": [], "warning": [] }, { - "query": "row var = left(5, \"a\")", - "error": [ - "Argument of [left] must be [string], found value [5] type [number]", - "Argument of [left] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval coalesce(cartesianShapeField, booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(left(stringField, numberField)) > 0", + "query": "from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where length(left(numberField, stringField)) > 0", - "error": [ - "Argument of [left] must be [string], found value [numberField] type [number]", - "Argument of [left] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = coalesce(geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = left(stringField, numberField)", + "query": "from a_index | eval coalesce(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval left(stringField, numberField)", + "query": "from a_index | eval var = coalesce(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = left(to_string(stringField), to_integer(stringField))", + "query": "from a_index | eval var = coalesce(geoPointField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval left(numberField, stringField)", - "error": [ - "Argument of [left] must be [string], found value [numberField] type [number]", - "Argument of [left] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval coalesce(geoPointField, booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval left(stringField, numberField, extraArg)", - "error": [ - "Error: [left] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | eval var = coalesce(to_geopoint(geoPointField), to_boolean(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort left(stringField, numberField)", + "query": "from a_index | eval var = coalesce(geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = length(\"a\")", + "query": "from a_index | eval coalesce(geoShapeField)", "error": [], "warning": [] }, { - "query": "row length(\"a\")", + "query": "from a_index | eval var = coalesce(to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = length(to_string(\"a\"))", + "query": "from a_index | eval var = coalesce(geoShapeField, booleanField)", "error": [], "warning": [] }, { - "query": "row var = length(5)", - "error": [ - "Argument of [length] must be [string], found value [5] type [number]" - ], + "query": "from a_index | eval coalesce(geoShapeField, booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | where length(stringField) > 0", + "query": "from a_index | eval var = coalesce(to_geoshape(geoPointField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where length(numberField) > 0", - "error": [ - "Argument of [length] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval var = coalesce(versionField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = length(stringField)", + "query": "from a_index | eval coalesce(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval length(stringField)", + "query": "from a_index | eval var = coalesce(to_version(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = length(to_string(stringField))", + "query": "from a_index | eval var = coalesce(versionField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval length(numberField)", - "error": [ - "Argument of [length] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval coalesce(versionField, booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval length(stringField, extraArg)", - "error": [ - "Error: [length] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = coalesce(to_version(stringField), to_boolean(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = length(*)", - "error": [ - "Using wildcards (*) in length is not allowed" - ], + "query": "from a_index | sort coalesce(numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort length(stringField)", + "query": "from a_index | eval coalesce(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = log(5, 5)", + "query": "row var = concat(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row log(5, 5)", + "query": "row concat(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = log(to_integer(\"a\"), to_integer(\"a\"))", + "query": "row var = concat(to_string(\"a\"), to_string(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = log(\"a\", \"a\")", + "query": "row var = concat(5, 5)", "error": [ - "Argument of [log] must be [number], found value [\"a\"] type [string]", - "Argument of [log] must be [number], found value [\"a\"] type [string]" + "Argument of [concat] must be [string], found value [5] type [number]", + "Argument of [concat] must be [string], found value [5] type [number]" ], "warning": [] }, { - "query": "from a_index | where log(numberField, numberField) > 0", + "query": "from a_index | where length(concat(stringField, stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where log(stringField, stringField) > 0", + "query": "from a_index | where length(concat(numberField, numberField)) > 0", "error": [ - "Argument of [log] must be [number], found value [stringField] type [string]", - "Argument of [log] must be [number], found value [stringField] type [string]" + "Argument of [concat] must be [string], found value [numberField] type [number]", + "Argument of [concat] must be [string], found value [numberField] type [number]" ], "warning": [] }, { - "query": "from a_index | eval var = log(numberField, numberField)", + "query": "from a_index | eval var = concat(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval log(numberField, numberField)", + "query": "from a_index | eval concat(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = log(to_integer(stringField), to_integer(stringField))", + "query": "from a_index | eval var = concat(to_string(stringField), to_string(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval log(stringField, stringField)", + "query": "from a_index | eval concat(numberField, numberField)", "error": [ - "Argument of [log] must be [number], found value [stringField] type [string]", - "Argument of [log] must be [number], found value [stringField] type [string]" + "Argument of [concat] must be [string], found value [numberField] type [number]", + "Argument of [concat] must be [string], found value [numberField] type [number]" ], "warning": [] }, { - "query": "from a_index | eval log(numberField, numberField, extraArg)", - "error": [ - "Error: [log] function expects no more than 2 arguments, got 3." - ], + "query": "from a_index | sort concat(stringField, stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort log(numberField, numberField)", + "query": "row var = concat(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "row var = log10(5)", - "error": [], + "query": "row var = concat(true, true)", + "error": [ + "Argument of [concat] must be [string], found value [true] type [boolean]", + "Argument of [concat] must be [string], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row log10(5)", - "error": [], + "query": "from a_index | where length(concat(booleanField, booleanField)) > 0", + "error": [ + "Argument of [concat] must be [string], found value [booleanField] type [boolean]", + "Argument of [concat] must be [string], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = log10(to_integer(\"a\"))", - "error": [], - "warning": [] - }, - { - "query": "row var = log10(\"a\")", - "error": [ - "Argument of [log10] must be [number], found value [\"a\"] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | where log10(numberField) > 0", + "query": "from a_index | eval var = concat(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where log10(stringField) > 0", + "query": "from a_index | eval concat(booleanField, booleanField)", "error": [ - "Argument of [log10] must be [number], found value [stringField] type [string]" + "Argument of [concat] must be [string], found value [booleanField] type [boolean]", + "Argument of [concat] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = log10(numberField)", + "query": "row var = cos(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval log10(numberField)", + "query": "row cos(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = log10(to_integer(stringField))", + "query": "row var = cos(to_integer(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval log10(stringField)", + "query": "row var = cos(\"a\")", "error": [ - "Argument of [log10] must be [number], found value [stringField] type [string]" + "Argument of [cos] must be [number], found value [\"a\"] type [string]" ], "warning": [] }, { - "query": "from a_index | eval log10(numberField, extraArg)", - "error": [ - "Error: [log10] function expects exactly one argument, got 2." - ], + "query": "from a_index | where cos(numberField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = log10(*)", + "query": "from a_index | where cos(stringField) > 0", "error": [ - "Using wildcards (*) in log10 is not allowed" + "Argument of [cos] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | sort log10(numberField)", - "error": [], - "warning": [] - }, - { - "query": "row var = ltrim(\"a\")", + "query": "from a_index | eval var = cos(numberField)", "error": [], "warning": [] }, { - "query": "row ltrim(\"a\")", + "query": "from a_index | eval cos(numberField)", "error": [], "warning": [] }, { - "query": "row var = ltrim(to_string(\"a\"))", + "query": "from a_index | eval var = cos(to_integer(stringField))", "error": [], "warning": [] }, { - "query": "row var = ltrim(5)", + "query": "from a_index | eval cos(stringField)", "error": [ - "Argument of [ltrim] must be [string], found value [5] type [number]" + "Argument of [cos] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | where length(ltrim(stringField)) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where length(ltrim(numberField)) > 0", + "query": "from a_index | eval cos(numberField, extraArg)", "error": [ - "Argument of [ltrim] must be [string], found value [numberField] type [number]" + "Error: [cos] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = ltrim(stringField)", - "error": [], + "query": "from a_index | eval var = cos(*)", + "error": [ + "Using wildcards (*) in cos is not allowed" + ], "warning": [] }, { - "query": "from a_index | eval ltrim(stringField)", + "query": "from a_index | sort cos(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = ltrim(to_string(stringField))", + "query": "row var = cos(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval ltrim(numberField)", + "query": "row var = cos(true)", "error": [ - "Argument of [ltrim] must be [string], found value [numberField] type [number]" + "Argument of [cos] must be [number], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval ltrim(stringField, extraArg)", + "query": "from a_index | where cos(booleanField) > 0", "error": [ - "Error: [ltrim] function expects exactly one argument, got 2." + "Argument of [cos] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = ltrim(*)", - "error": [ - "Using wildcards (*) in ltrim is not allowed" - ], + "query": "from a_index | eval var = cos(to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort ltrim(stringField)", - "error": [], + "query": "from a_index | eval cos(booleanField)", + "error": [ + "Argument of [cos] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = mv_avg(5)", + "query": "row var = cosh(5)", "error": [], "warning": [] }, { - "query": "row mv_avg(5)", + "query": "row cosh(5)", "error": [], "warning": [] }, { - "query": "row var = mv_avg(to_integer(\"a\"))", + "query": "row var = cosh(to_integer(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = mv_avg(\"a\")", + "query": "row var = cosh(\"a\")", "error": [ - "Argument of [mv_avg] must be [number], found value [\"a\"] type [string]" + "Argument of [cosh] must be [number], found value [\"a\"] type [string]" ], "warning": [] }, { - "query": "from a_index | where mv_avg(numberField) > 0", + "query": "from a_index | where cosh(numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where mv_avg(stringField) > 0", + "query": "from a_index | where cosh(stringField) > 0", "error": [ - "Argument of [mv_avg] must be [number], found value [stringField] type [string]" + "Argument of [cosh] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = mv_avg(numberField)", + "query": "from a_index | eval var = cosh(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_avg(numberField)", + "query": "from a_index | eval cosh(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_avg(to_integer(stringField))", + "query": "from a_index | eval var = cosh(to_integer(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_avg(stringField)", + "query": "from a_index | eval cosh(stringField)", "error": [ - "Argument of [mv_avg] must be [number], found value [stringField] type [string]" + "Argument of [cosh] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval mv_avg(numberField, extraArg)", + "query": "from a_index | eval cosh(numberField, extraArg)", "error": [ - "Error: [mv_avg] function expects exactly one argument, got 2." + "Error: [cosh] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = mv_avg(*)", + "query": "from a_index | eval var = cosh(*)", "error": [ - "Using wildcards (*) in mv_avg is not allowed" + "Using wildcards (*) in cosh is not allowed" ], "warning": [] }, { - "query": "from a_index | sort mv_avg(numberField)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_concat(\"a\", \"a\")", + "query": "from a_index | sort cosh(numberField)", "error": [], "warning": [] }, { - "query": "row mv_concat(\"a\", \"a\")", + "query": "row var = cosh(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = mv_concat(to_string(\"a\"), to_string(\"a\"))", - "error": [], + "query": "row var = cosh(true)", + "error": [ + "Argument of [cosh] must be [number], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = mv_concat(5, 5)", + "query": "from a_index | where cosh(booleanField) > 0", "error": [ - "Argument of [mv_concat] must be [string], found value [5] type [number]", - "Argument of [mv_concat] must be [string], found value [5] type [number]" + "Argument of [cosh] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where length(mv_concat(stringField, stringField)) > 0", + "query": "from a_index | eval var = cosh(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_concat(numberField, numberField)) > 0", + "query": "from a_index | eval cosh(booleanField)", "error": [ - "Argument of [mv_concat] must be [string], found value [numberField] type [number]", - "Argument of [mv_concat] must be [string], found value [numberField] type [number]" + "Argument of [cosh] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = mv_concat(stringField, stringField)", + "query": "row var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", now())", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_concat(stringField, stringField)", + "query": "row date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", now())", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_concat(to_string(stringField), to_string(stringField))", + "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_concat(numberField, numberField)", - "error": [ - "Argument of [mv_concat] must be [string], found value [numberField] type [number]", - "Argument of [mv_concat] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval mv_concat(stringField, stringField, extraArg)", - "error": [ - "Error: [mv_concat] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(stringField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort mv_concat(stringField, stringField)", - "error": [], + "query": "from a_index | eval date_extract(stringField, stringField)", + "error": [ + "Argument of [date_extract] must be [chrono_literal], found value [stringField] type [string]", + "Argument of [date_extract] must be [date], found value [stringField] type [string]" + ], "warning": [] }, { - "query": "row var = mv_count(\"a\")", - "error": [], + "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField, extraArg)", + "error": [ + "Error: [date_extract] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "row mv_count(\"a\")", + "query": "from a_index | sort date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(stringField)", - "error": [], + "query": "row var = date_extract(true, true)", + "error": [ + "Argument of [date_extract] must be [chrono_literal], found value [true] type [boolean]", + "Argument of [date_extract] must be [date], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval mv_count(stringField)", + "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_count(*)", + "query": "from a_index | eval date_extract(booleanField, booleanField)", "error": [ - "Using wildcards (*) in mv_count is not allowed" + "Argument of [date_extract] must be [chrono_literal], found value [booleanField] type [boolean]", + "Argument of [date_extract] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort mv_count(stringField)", + "query": "row var = date_format(\"a\", now())", "error": [], "warning": [] }, { - "query": "row var = mv_dedupe(\"a\")", + "query": "row date_format(\"a\", now())", "error": [], "warning": [] }, { - "query": "row mv_dedupe(\"a\")", + "query": "from a_index | eval var = date_format(stringField, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(stringField)", + "query": "from a_index | eval date_format(stringField, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_dedupe(stringField)", + "query": "from a_index | eval var = date_format(to_string(stringField), to_datetime(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_dedupe(*)", + "query": "from a_index | eval date_format(stringField, numberField)", "error": [ - "Using wildcards (*) in mv_dedupe is not allowed" + "Argument of [date_format] must be [date], found value [numberField] type [number]" ], "warning": [] }, { - "query": "from a_index | sort mv_dedupe(stringField)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_first(\"a\")", - "error": [], + "query": "from a_index | eval date_format(stringField, dateField, extraArg)", + "error": [ + "Error: [date_format] function expects no more than 2 arguments, got 3." + ], "warning": [] }, { - "query": "row mv_first(\"a\")", + "query": "from a_index | sort date_format(stringField, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(stringField)", - "error": [], + "query": "row var = date_format(true, true)", + "error": [ + "Argument of [date_format] must be [string], found value [true] type [boolean]", + "Argument of [date_format] must be [date], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval mv_first(stringField)", + "query": "from a_index | eval var = date_format(to_string(booleanField), to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_first(*)", + "query": "from a_index | eval date_format(booleanField, booleanField)", "error": [ - "Using wildcards (*) in mv_first is not allowed" + "Argument of [date_format] must be [string], found value [booleanField] type [boolean]", + "Argument of [date_format] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort mv_first(stringField)", - "error": [], - "warning": [] - }, - { - "query": "row var = mv_last(\"a\")", + "query": "row var = date_parse(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row mv_last(\"a\")", + "query": "row var = date_parse(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(stringField)", + "query": "row date_parse(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_last(stringField)", + "query": "row var = date_parse(to_string(\"a\"), to_string(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_last(*)", + "query": "row var = date_parse(5, 5)", "error": [ - "Using wildcards (*) in mv_last is not allowed" + "Argument of [date_parse] must be [string], found value [5] type [number]", + "Argument of [date_parse] must be [string], found value [5] type [number]" ], "warning": [] }, { - "query": "from a_index | sort mv_last(stringField)", + "query": "from a_index | eval var = date_parse(stringField)", "error": [], "warning": [] }, { - "query": "row var = mv_max(\"a\")", + "query": "from a_index | eval var = date_parse(stringField, stringField)", "error": [], "warning": [] }, { - "query": "row mv_max(\"a\")", + "query": "from a_index | eval date_parse(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_max(stringField)", + "query": "from a_index | eval var = date_parse(to_string(stringField), to_string(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_max(stringField)", - "error": [], + "query": "from a_index | eval date_parse(numberField, numberField)", + "error": [ + "Argument of [date_parse] must be [string], found value [numberField] type [number]", + "Argument of [date_parse] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { - "query": "from a_index | eval var = mv_max(*)", + "query": "from a_index | eval date_parse(stringField, stringField, extraArg)", "error": [ - "Using wildcards (*) in mv_max is not allowed" + "Error: [date_parse] function expects no more than 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | sort mv_max(stringField)", + "query": "from a_index | sort date_parse(stringField, stringField)", "error": [], "warning": [] }, { - "query": "row var = mv_median(5)", + "query": "row var = date_parse(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "row mv_median(5)", - "error": [], + "query": "row var = date_parse(true, true)", + "error": [ + "Argument of [date_parse] must be [string], found value [true] type [boolean]", + "Argument of [date_parse] must be [string], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row var = mv_median(to_integer(\"a\"))", + "query": "from a_index | eval var = date_parse(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = mv_median(\"a\")", + "query": "from a_index | eval date_parse(booleanField, booleanField)", "error": [ - "Argument of [mv_median] must be [number], found value [\"a\"] type [string]" + "Argument of [date_parse] must be [string], found value [booleanField] type [boolean]", + "Argument of [date_parse] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where mv_median(numberField) > 0", + "query": "row var = date_trunc(1 year, now())", "error": [], "warning": [] }, { - "query": "from a_index | where mv_median(stringField) > 0", - "error": [ - "Argument of [mv_median] must be [number], found value [stringField] type [string]" - ], + "query": "row date_trunc(1 year, now())", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_median(numberField)", + "query": "from a_index | eval var = date_trunc(1 year, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_median(numberField)", + "query": "from a_index | eval date_trunc(1 year, dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_median(to_integer(stringField))", + "query": "from a_index | eval var = date_trunc(1 year, to_datetime(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_median(stringField)", - "error": [ - "Argument of [mv_median] must be [number], found value [stringField] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | eval mv_median(numberField, extraArg)", + "query": "from a_index | eval date_trunc(stringField, stringField)", "error": [ - "Error: [mv_median] function expects exactly one argument, got 2." + "Argument of [date_trunc] must be [time_literal], found value [stringField] type [string]", + "Argument of [date_trunc] must be [date], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = mv_median(*)", + "query": "from a_index | eval date_trunc(1 year, dateField, extraArg)", "error": [ - "Using wildcards (*) in mv_median is not allowed" + "Error: [date_trunc] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | sort mv_median(numberField)", + "query": "from a_index | sort date_trunc(1 year, dateField)", "error": [], "warning": [] }, { - "query": "row var = mv_min(\"a\")", + "query": "row var = date_trunc(now(), now())", "error": [], "warning": [] }, { - "query": "row mv_min(\"a\")", + "query": "row date_trunc(now(), now())", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(stringField)", - "error": [], + "query": "row var = date_trunc(true, true)", + "error": [ + "Argument of [date_trunc] must be [time_literal], found value [true] type [boolean]", + "Argument of [date_trunc] must be [date], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval mv_min(stringField)", + "query": "from a_index | eval var = date_trunc(1 year, to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_min(*)", + "query": "from a_index | eval date_trunc(booleanField, booleanField)", "error": [ - "Using wildcards (*) in mv_min is not allowed" + "Argument of [date_trunc] must be [time_literal], found value [booleanField] type [boolean]", + "Argument of [date_trunc] must be [date], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort mv_min(stringField)", + "query": "from a_index | eval var = date_trunc(dateField, dateField)", "error": [], "warning": [] }, { - "query": "row var = mv_slice(\"a\", 5, 5)", + "query": "from a_index | eval date_trunc(dateField, dateField)", "error": [], "warning": [] }, { - "query": "row mv_slice(\"a\", 5, 5)", + "query": "from a_index | eval var = date_trunc(to_datetime(dateField), to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_slice(stringField, numberField, numberField)", + "query": "row var = e()", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_slice(stringField, numberField, numberField)", + "query": "row e()", "error": [], "warning": [] }, { - "query": "from a_index | sort mv_slice(stringField, numberField, numberField)", + "query": "from a_index | where e() > 0", "error": [], "warning": [] }, { - "query": "row var = mv_sort(\"a\", \"asc\")", + "query": "from a_index | eval var = e()", "error": [], "warning": [] }, { - "query": "row mv_sort(\"a\", \"asc\")", + "query": "from a_index | eval e()", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_sort(stringField, \"asc\")", - "error": [], + "query": "from a_index | eval e(extraArg)", + "error": [ + "Error: [e] function expects exactly 0 arguments, got 1." + ], "warning": [] }, { - "query": "from a_index | eval mv_sort(stringField, \"asc\")", + "query": "from a_index | sort e()", "error": [], "warning": [] }, { - "query": "from a_index | sort mv_sort(stringField, \"asc\")", + "query": "row var = ends_with(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row var = mv_sum(5)", + "query": "row ends_with(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "row mv_sum(5)", + "query": "row var = ends_with(to_string(\"a\"), to_string(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = mv_sum(to_integer(\"a\"))", + "query": "row var = ends_with(5, 5)", + "error": [ + "Argument of [ends_with] must be [string], found value [5] type [number]", + "Argument of [ends_with] must be [string], found value [5] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = ends_with(stringField, stringField)", "error": [], "warning": [] }, { - "query": "row var = mv_sum(\"a\")", - "error": [ - "Argument of [mv_sum] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval ends_with(stringField, stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | where mv_sum(numberField) > 0", + "query": "from a_index | eval var = ends_with(to_string(stringField), to_string(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | where mv_sum(stringField) > 0", + "query": "from a_index | eval ends_with(numberField, numberField)", "error": [ - "Argument of [mv_sum] must be [number], found value [stringField] type [string]" + "Argument of [ends_with] must be [string], found value [numberField] type [number]", + "Argument of [ends_with] must be [string], found value [numberField] type [number]" ], "warning": [] }, { - "query": "from a_index | eval var = mv_sum(numberField)", - "error": [], + "query": "from a_index | eval ends_with(stringField, stringField, extraArg)", + "error": [ + "Error: [ends_with] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "from a_index | eval mv_sum(numberField)", + "query": "from a_index | sort ends_with(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_sum(to_integer(stringField))", + "query": "row var = ends_with(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_sum(stringField)", + "query": "row var = ends_with(true, true)", "error": [ - "Argument of [mv_sum] must be [number], found value [stringField] type [string]" + "Argument of [ends_with] must be [string], found value [true] type [boolean]", + "Argument of [ends_with] must be [string], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval mv_sum(numberField, extraArg)", - "error": [ - "Error: [mv_sum] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = ends_with(to_string(booleanField), to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_sum(*)", + "query": "from a_index | eval ends_with(booleanField, booleanField)", "error": [ - "Using wildcards (*) in mv_sum is not allowed" + "Argument of [ends_with] must be [string], found value [booleanField] type [boolean]", + "Argument of [ends_with] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort mv_sum(numberField)", + "query": "row var = floor(5)", "error": [], "warning": [] }, { - "query": "row var = mv_zip(\"a\", \"a\", \"a\")", + "query": "row floor(5)", "error": [], "warning": [] }, { - "query": "row mv_zip(\"a\", \"a\", \"a\")", + "query": "row var = floor(to_integer(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = mv_zip(to_string(\"a\"), to_string(\"a\"), to_string(\"a\"))", + "query": "row var = floor(\"a\")", + "error": [ + "Argument of [floor] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where floor(numberField) > 0", "error": [], "warning": [] }, { - "query": "row var = mv_zip(5, 5, 5)", + "query": "from a_index | where floor(stringField) > 0", "error": [ - "Argument of [mv_zip] must be [string], found value [5] type [number]", - "Argument of [mv_zip] must be [string], found value [5] type [number]", - "Argument of [mv_zip] must be [string], found value [5] type [number]" + "Argument of [floor] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | where length(mv_zip(stringField, stringField, stringField)) > 0", + "query": "from a_index | eval var = floor(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(mv_zip(numberField, numberField, numberField)) > 0", + "query": "from a_index | eval floor(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = floor(to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval floor(stringField)", "error": [ - "Argument of [mv_zip] must be [string], found value [numberField] type [number]", - "Argument of [mv_zip] must be [string], found value [numberField] type [number]", - "Argument of [mv_zip] must be [string], found value [numberField] type [number]" + "Argument of [floor] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = mv_zip(stringField, stringField, stringField)", - "error": [], + "query": "from a_index | eval floor(numberField, extraArg)", + "error": [ + "Error: [floor] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "from a_index | eval mv_zip(stringField, stringField, stringField)", + "query": "from a_index | eval var = floor(*)", + "error": [ + "Using wildcards (*) in floor is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort floor(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = mv_zip(to_string(stringField), to_string(stringField), to_string(stringField))", + "query": "row var = floor(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval mv_zip(numberField, numberField, numberField)", + "query": "row var = floor(true)", "error": [ - "Argument of [mv_zip] must be [string], found value [numberField] type [number]", - "Argument of [mv_zip] must be [string], found value [numberField] type [number]", - "Argument of [mv_zip] must be [string], found value [numberField] type [number]" + "Argument of [floor] must be [number], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval mv_zip(stringField, stringField, stringField, extraArg)", + "query": "from a_index | where floor(booleanField) > 0", "error": [ - "Error: [mv_zip] function expects exactly 3 arguments, got 4." + "Argument of [floor] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | sort mv_zip(stringField, stringField, stringField)", + "query": "from a_index | eval var = floor(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = now()", - "error": [], + "query": "from a_index | eval floor(booleanField)", + "error": [ + "Argument of [floor] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row now()", + "query": "row var = greatest(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = now()", + "query": "row greatest(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval now()", + "query": "from a_index | eval var = greatest(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval now(extraArg)", - "error": [ - "Error: [now] function expects exactly 0 arguments, got 1." - ], + "query": "from a_index | eval greatest(stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort now()", + "query": "from a_index | sort greatest(stringField)", "error": [], "warning": [] }, { - "query": "row var = pi()", + "query": "row var = greatest(true)", "error": [], "warning": [] }, { - "query": "row pi()", + "query": "row greatest(true)", "error": [], "warning": [] }, { - "query": "from a_index | where pi() > 0", + "query": "row var = greatest(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = pi()", + "query": "row var = greatest(true, true)", "error": [], "warning": [] }, { - "query": "from a_index | eval pi()", + "query": "row greatest(true, true)", "error": [], "warning": [] }, { - "query": "from a_index | eval pi(extraArg)", - "error": [ - "Error: [pi] function expects exactly 0 arguments, got 1." - ], + "query": "row var = greatest(to_boolean(true), to_boolean(true))", + "error": [], "warning": [] }, { - "query": "from a_index | sort pi()", + "query": "row var = greatest(5, 5)", "error": [], "warning": [] }, { - "query": "row var = pow(5, 5)", + "query": "row greatest(5, 5)", "error": [], "warning": [] }, { - "query": "row pow(5, 5)", + "query": "row var = greatest(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = pow(to_integer(\"a\"), to_integer(\"a\"))", + "query": "row var = greatest(5)", "error": [], "warning": [] }, { - "query": "row var = pow(\"a\", \"a\")", - "error": [ - "Argument of [pow] must be [number], found value [\"a\"] type [string]", - "Argument of [pow] must be [number], found value [\"a\"] type [string]" - ], + "query": "row greatest(5)", + "error": [], "warning": [] }, { - "query": "from a_index | where pow(numberField, numberField) > 0", + "query": "row var = greatest(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | where pow(stringField, stringField) > 0", - "error": [ - "Argument of [pow] must be [number], found value [stringField] type [string]", - "Argument of [pow] must be [number], found value [stringField] type [string]" - ], + "query": "row var = greatest(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = pow(numberField, numberField)", + "query": "row greatest(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval pow(numberField, numberField)", + "query": "row var = greatest(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = pow(to_integer(stringField), to_integer(stringField))", + "query": "row var = greatest(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval pow(stringField, stringField)", - "error": [ - "Argument of [pow] must be [number], found value [stringField] type [string]", - "Argument of [pow] must be [number], found value [stringField] type [string]" - ], + "query": "row var = greatest(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval pow(numberField, numberField, extraArg)", - "error": [ - "Error: [pow] function expects exactly 2 arguments, got 3." - ], + "query": "row greatest(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | sort pow(numberField, numberField)", + "query": "row var = greatest(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "row var = replace(\"a\", \"a\", \"a\")", + "query": "row var = greatest(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row replace(\"a\", \"a\", \"a\")", + "query": "row greatest(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row var = replace(to_string(\"a\"), to_string(\"a\"), to_string(\"a\"))", + "query": "row var = greatest(to_version(\"a\"), to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = replace(5, 5, 5)", + "query": "row var = greatest(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", "error": [ - "Argument of [replace] must be [string], found value [5] type [number]", - "Argument of [replace] must be [string], found value [5] type [number]", - "Argument of [replace] must be [string], found value [5] type [number]" + "Argument of [greatest] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", + "Argument of [greatest] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | where length(replace(stringField, stringField, stringField)) > 0", + "query": "from a_index | where greatest(numberField, numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where length(replace(numberField, numberField, numberField)) > 0", + "query": "from a_index | where greatest(cartesianPointField, cartesianPointField) > 0", "error": [ - "Argument of [replace] must be [string], found value [numberField] type [number]", - "Argument of [replace] must be [string], found value [numberField] type [number]", - "Argument of [replace] must be [string], found value [numberField] type [number]" + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | eval var = replace(stringField, stringField, stringField)", + "query": "from a_index | where greatest(numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval replace(stringField, stringField, stringField)", - "error": [], + "query": "from a_index | where greatest(cartesianPointField) > 0", + "error": [ + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | eval var = replace(to_string(stringField), to_string(stringField), to_string(stringField))", + "query": "from a_index | where length(greatest(stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval replace(numberField, numberField, numberField)", + "query": "from a_index | where length(greatest(cartesianPointField)) > 0", "error": [ - "Argument of [replace] must be [string], found value [numberField] type [number]", - "Argument of [replace] must be [string], found value [numberField] type [number]", - "Argument of [replace] must be [string], found value [numberField] type [number]" + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | eval replace(stringField, stringField, stringField, extraArg)", - "error": [ - "Error: [replace] function expects exactly 3 arguments, got 4." - ], + "query": "from a_index | where length(greatest(stringField, stringField)) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | sort replace(stringField, stringField, stringField)", - "error": [], + "query": "from a_index | where length(greatest(cartesianPointField, cartesianPointField)) > 0", + "error": [ + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "row var = right(\"a\", 5)", + "query": "from a_index | eval var = greatest(booleanField)", "error": [], "warning": [] }, { - "query": "row right(\"a\", 5)", + "query": "from a_index | eval greatest(booleanField)", "error": [], "warning": [] }, { - "query": "row var = right(to_string(\"a\"), to_integer(\"a\"))", + "query": "from a_index | eval var = greatest(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = right(5, \"a\")", + "query": "from a_index | eval greatest(cartesianPointField)", "error": [ - "Argument of [right] must be [string], found value [5] type [number]", - "Argument of [right] must be [number], found value [\"a\"] type [string]" + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | where length(right(stringField, numberField)) > 0", + "query": "from a_index | eval var = greatest(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(right(numberField, stringField)) > 0", - "error": [ - "Argument of [right] must be [string], found value [numberField] type [number]", - "Argument of [right] must be [number], found value [stringField] type [string]" - ], - "warning": [] - }, - { - "query": "from a_index | eval var = right(stringField, numberField)", + "query": "from a_index | eval greatest(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval right(stringField, numberField)", + "query": "from a_index | eval var = greatest(to_boolean(booleanField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = right(to_string(stringField), to_integer(stringField))", - "error": [], + "query": "from a_index | eval greatest(cartesianPointField, cartesianPointField)", + "error": [ + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | eval right(numberField, stringField)", - "error": [ - "Argument of [right] must be [string], found value [numberField] type [number]", - "Argument of [right] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = greatest(numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval right(stringField, numberField, extraArg)", - "error": [ - "Error: [right] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | eval greatest(numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort right(stringField, numberField)", + "query": "from a_index | eval var = greatest(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = round(5, 5)", + "query": "from a_index | eval var = greatest(numberField)", "error": [], "warning": [] }, { - "query": "row round(5, 5)", + "query": "from a_index | eval greatest(numberField)", "error": [], "warning": [] }, { - "query": "row var = round(to_integer(\"a\"), to_integer(\"a\"))", + "query": "from a_index | eval var = greatest(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = round(\"a\", \"a\")", - "error": [ - "Argument of [round] must be [number], found value [\"a\"] type [string]", - "Argument of [round] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval var = greatest(ipField, ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | where round(numberField, numberField) > 0", + "query": "from a_index | eval greatest(ipField, ipField)", "error": [], "warning": [] }, { - "query": "from a_index | where round(stringField, stringField) > 0", - "error": [ - "Argument of [round] must be [number], found value [stringField] type [string]", - "Argument of [round] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = greatest(to_ip(ipField), to_ip(ipField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = round(numberField, numberField)", + "query": "from a_index | eval var = greatest(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval round(numberField, numberField)", + "query": "from a_index | eval var = greatest(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = round(to_integer(stringField), to_integer(stringField))", + "query": "from a_index | eval greatest(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval round(stringField, stringField)", - "error": [ - "Argument of [round] must be [number], found value [stringField] type [string]", - "Argument of [round] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = greatest(to_string(booleanField), to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval round(numberField, numberField, extraArg)", - "error": [ - "Error: [round] function expects no more than 2 arguments, got 3." - ], + "query": "from a_index | eval var = greatest(versionField, versionField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort round(numberField, numberField)", + "query": "from a_index | eval greatest(versionField, versionField)", "error": [], "warning": [] }, { - "query": "row var = rtrim(\"a\")", + "query": "from a_index | eval var = greatest(to_version(stringField), to_version(stringField))", "error": [], "warning": [] }, { - "query": "row rtrim(\"a\")", + "query": "from a_index | sort greatest(booleanField)", "error": [], "warning": [] }, { - "query": "row var = rtrim(to_string(\"a\"))", + "query": "row var = least(\"a\")", "error": [], "warning": [] }, { - "query": "row var = rtrim(5)", - "error": [ - "Argument of [rtrim] must be [string], found value [5] type [number]" - ], + "query": "row least(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | where length(rtrim(stringField)) > 0", + "query": "from a_index | eval var = least(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(rtrim(numberField)) > 0", - "error": [ - "Argument of [rtrim] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval least(stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = rtrim(stringField)", + "query": "from a_index | sort least(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval rtrim(stringField)", + "query": "row var = least(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = rtrim(to_string(stringField))", + "query": "row least(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval rtrim(numberField)", - "error": [ - "Argument of [rtrim] must be [string], found value [numberField] type [number]" - ], + "query": "row var = least(to_boolean(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval rtrim(stringField, extraArg)", - "error": [ - "Error: [rtrim] function expects exactly one argument, got 2." - ], + "query": "row var = least(true, true)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = rtrim(*)", - "error": [ - "Using wildcards (*) in rtrim is not allowed" - ], + "query": "row least(true, true)", + "error": [], "warning": [] }, { - "query": "from a_index | sort rtrim(stringField)", + "query": "row var = least(to_boolean(true), to_boolean(true))", "error": [], "warning": [] }, { - "query": "row var = signum(5)", + "query": "row var = least(5, 5)", "error": [], "warning": [] }, { - "query": "row signum(5)", + "query": "row least(5, 5)", "error": [], "warning": [] }, { - "query": "row var = signum(to_integer(\"a\"))", + "query": "row var = least(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = signum(\"a\")", - "error": [ - "Argument of [signum] must be [number], found value [\"a\"] type [string]" - ], + "query": "row var = least(5)", + "error": [], "warning": [] }, { - "query": "from a_index | where signum(numberField) > 0", + "query": "row least(5)", "error": [], "warning": [] }, { - "query": "from a_index | where signum(stringField) > 0", - "error": [ - "Argument of [signum] must be [number], found value [stringField] type [string]" - ], + "query": "row var = least(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = signum(numberField)", + "query": "row var = least(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval signum(numberField)", + "query": "row least(to_ip(\"127.0.0.1\"), to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = signum(to_integer(stringField))", + "query": "row var = least(to_ip(to_ip(\"127.0.0.1\")), to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval signum(stringField)", - "error": [ - "Argument of [signum] must be [number], found value [stringField] type [string]" - ], + "query": "row var = least(to_string(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval signum(numberField, extraArg)", - "error": [ - "Error: [signum] function expects exactly one argument, got 2." - ], + "query": "row var = least(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = signum(*)", - "error": [ - "Using wildcards (*) in signum is not allowed" - ], + "query": "row least(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | sort signum(numberField)", + "query": "row var = least(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "row var = sin(5)", + "query": "row var = least(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row sin(5)", + "query": "row least(to_version(\"1.0.0\"), to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row var = sin(to_integer(\"a\"))", + "query": "row var = least(to_version(\"a\"), to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = sin(\"a\")", + "query": "row var = least(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", "error": [ - "Argument of [sin] must be [number], found value [\"a\"] type [string]" + "Argument of [least] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", + "Argument of [least] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | where sin(numberField) > 0", + "query": "from a_index | where least(numberField, numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where sin(stringField) > 0", + "query": "from a_index | where least(cartesianPointField, cartesianPointField) > 0", "error": [ - "Argument of [sin] must be [number], found value [stringField] type [string]" + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | eval var = sin(numberField)", + "query": "from a_index | where least(numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval sin(numberField)", - "error": [], + "query": "from a_index | where least(cartesianPointField) > 0", + "error": [ + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | eval var = sin(to_integer(stringField))", + "query": "from a_index | where length(least(stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval sin(stringField)", + "query": "from a_index | where length(least(cartesianPointField)) > 0", "error": [ - "Argument of [sin] must be [number], found value [stringField] type [string]" + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | eval sin(numberField, extraArg)", - "error": [ - "Error: [sin] function expects exactly one argument, got 2." - ], + "query": "from a_index | where length(least(stringField, stringField)) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sin(*)", + "query": "from a_index | where length(least(cartesianPointField, cartesianPointField)) > 0", "error": [ - "Using wildcards (*) in sin is not allowed" + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | sort sin(numberField)", - "error": [], - "warning": [] - }, - { - "query": "row var = sinh(5)", + "query": "from a_index | eval var = least(booleanField)", "error": [], "warning": [] }, { - "query": "row sinh(5)", + "query": "from a_index | eval least(booleanField)", "error": [], "warning": [] }, { - "query": "row var = sinh(to_integer(\"a\"))", + "query": "from a_index | eval var = least(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = sinh(\"a\")", + "query": "from a_index | eval least(cartesianPointField)", "error": [ - "Argument of [sinh] must be [number], found value [\"a\"] type [string]" + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | where sinh(numberField) > 0", + "query": "from a_index | eval var = least(booleanField, booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | where sinh(stringField) > 0", - "error": [ - "Argument of [sinh] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval least(booleanField, booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sinh(numberField)", + "query": "from a_index | eval var = least(to_boolean(booleanField), to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval sinh(numberField)", - "error": [], + "query": "from a_index | eval least(cartesianPointField, cartesianPointField)", + "error": [ + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | eval var = sinh(to_integer(stringField))", + "query": "from a_index | eval var = least(numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval sinh(stringField)", - "error": [ - "Argument of [sinh] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval least(numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval sinh(numberField, extraArg)", - "error": [ - "Error: [sinh] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = least(to_integer(booleanField), to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sinh(*)", - "error": [ - "Using wildcards (*) in sinh is not allowed" - ], + "query": "from a_index | eval var = least(numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort sinh(numberField)", + "query": "from a_index | eval least(numberField)", "error": [], "warning": [] }, { - "query": "row var = split(\"a\", \"a\")", + "query": "from a_index | eval var = least(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row split(\"a\", \"a\")", + "query": "from a_index | eval var = least(ipField, ipField)", "error": [], "warning": [] }, { - "query": "row var = split(to_string(\"a\"), to_string(\"a\"))", + "query": "from a_index | eval least(ipField, ipField)", "error": [], "warning": [] }, { - "query": "row var = split(5, 5)", - "error": [ - "Argument of [split] must be [string], found value [5] type [number]", - "Argument of [split] must be [string], found value [5] type [number]" - ], + "query": "from a_index | eval var = least(to_ip(ipField), to_ip(ipField))", + "error": [], "warning": [] }, { - "query": "from a_index | where length(split(stringField, stringField)) > 0", + "query": "from a_index | eval var = least(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | where length(split(numberField, numberField)) > 0", - "error": [ - "Argument of [split] must be [string], found value [numberField] type [number]", - "Argument of [split] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval var = least(stringField, stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = split(stringField, stringField)", + "query": "from a_index | eval least(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval split(stringField, stringField)", + "query": "from a_index | eval var = least(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = split(to_string(stringField), to_string(stringField))", + "query": "from a_index | eval var = least(versionField, versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval split(numberField, numberField)", - "error": [ - "Argument of [split] must be [string], found value [numberField] type [number]", - "Argument of [split] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval least(versionField, versionField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval split(stringField, stringField, extraArg)", - "error": [ - "Error: [split] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | eval var = least(to_version(stringField), to_version(stringField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort split(stringField, stringField)", + "query": "from a_index | sort least(booleanField)", "error": [], "warning": [] }, { - "query": "row var = sqrt(5)", + "query": "row var = left(\"a\", 5)", "error": [], "warning": [] }, { - "query": "row sqrt(5)", + "query": "row left(\"a\", 5)", "error": [], "warning": [] }, { - "query": "row var = sqrt(to_integer(\"a\"))", + "query": "row var = left(to_string(\"a\"), to_integer(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = sqrt(\"a\")", + "query": "row var = left(5, \"a\")", "error": [ - "Argument of [sqrt] must be [number], found value [\"a\"] type [string]" + "Argument of [left] must be [string], found value [5] type [number]", + "Argument of [left] must be [number], found value [\"a\"] type [string]" ], "warning": [] }, { - "query": "from a_index | where sqrt(numberField) > 0", + "query": "from a_index | where length(left(stringField, numberField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where sqrt(stringField) > 0", + "query": "from a_index | where length(left(numberField, stringField)) > 0", "error": [ - "Argument of [sqrt] must be [number], found value [stringField] type [string]" + "Argument of [left] must be [string], found value [numberField] type [number]", + "Argument of [left] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = sqrt(numberField)", + "query": "from a_index | eval var = left(stringField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval sqrt(numberField)", + "query": "from a_index | eval left(stringField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = sqrt(to_integer(stringField))", + "query": "from a_index | eval var = left(to_string(stringField), to_integer(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval sqrt(stringField)", + "query": "from a_index | eval left(numberField, stringField)", "error": [ - "Argument of [sqrt] must be [number], found value [stringField] type [string]" + "Argument of [left] must be [string], found value [numberField] type [number]", + "Argument of [left] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval sqrt(numberField, extraArg)", + "query": "from a_index | eval left(stringField, numberField, extraArg)", "error": [ - "Error: [sqrt] function expects exactly one argument, got 2." + "Error: [left] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | eval var = sqrt(*)", - "error": [ - "Using wildcards (*) in sqrt is not allowed" - ], + "query": "from a_index | sort left(stringField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort sqrt(numberField)", + "query": "row var = left(to_string(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "row var = left(true, true)", + "error": [ + "Argument of [left] must be [string], found value [true] type [boolean]", + "Argument of [left] must be [number], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row st_contains(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | where length(left(booleanField, booleanField)) > 0", + "error": [ + "Argument of [left] must be [string], found value [booleanField] type [boolean]", + "Argument of [left] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = st_contains(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "query": "from a_index | eval var = left(to_string(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_contains(\"a\", \"a\")", + "query": "from a_index | eval left(booleanField, booleanField)", "error": [ - "Argument of [st_contains] must be [geo_point], found value [\"a\"] type [string]", - "Argument of [st_contains] must be [geo_point], found value [\"a\"] type [string]" + "Argument of [left] must be [string], found value [booleanField] type [boolean]", + "Argument of [left] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "row var = st_contains(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "row var = length(\"a\")", "error": [], "warning": [] }, { - "query": "row st_contains(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "row length(\"a\")", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "query": "row var = length(to_string(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "row var = length(5)", + "error": [ + "Argument of [length] must be [string], found value [5] type [number]" + ], "warning": [] }, { - "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | where length(stringField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", - "error": [], + "query": "from a_index | where length(numberField) > 0", + "error": [ + "Argument of [length] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { - "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = length(stringField)", "error": [], "warning": [] }, { - "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval length(stringField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = length(to_string(stringField))", "error": [], "warning": [] }, { - "query": "row st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval length(numberField)", + "error": [ + "Argument of [length] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { - "query": "row var = st_contains(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", - "error": [], + "query": "from a_index | eval length(stringField, extraArg)", + "error": [ + "Error: [length] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row var = st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval var = length(*)", + "error": [ + "Using wildcards (*) in length is not allowed" + ], "warning": [] }, { - "query": "row st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | sort length(stringField)", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row var = length(to_string(true))", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], + "query": "row var = length(true)", + "error": [ + "Argument of [length] must be [string], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | where length(booleanField) > 0", + "error": [ + "Argument of [length] must be [string], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = length(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval length(booleanField)", + "error": [ + "Argument of [length] must be [string], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row var = log(5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(geoPointField, geoPointField)", + "query": "row log(5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoPointField, geoPointField)", + "query": "row var = log(to_integer(\"a\"), to_integer(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_geopoint(stringField), to_geopoint(stringField))", - "error": [], + "query": "row var = log(\"a\", \"a\")", + "error": [ + "Argument of [log] must be [number], found value [\"a\"] type [string]", + "Argument of [log] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { - "query": "from a_index | eval st_contains(stringField, stringField)", - "error": [ - "Argument of [st_contains] must be [geo_point], found value [stringField] type [string]", - "Argument of [st_contains] must be [geo_point], found value [stringField] type [string]" - ], + "query": "from a_index | where log(numberField, numberField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoPointField, geoPointField, extraArg)", + "query": "from a_index | where log(stringField, stringField) > 0", "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." + "Argument of [log] must be [number], found value [stringField] type [string]", + "Argument of [log] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(geoPointField, geoShapeField)", + "query": "from a_index | eval var = log(numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoPointField, geoShapeField)", + "query": "from a_index | eval log(numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_geopoint(stringField), geoShapeField)", + "query": "from a_index | eval var = log(to_integer(stringField), to_integer(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoPointField, geoShapeField, extraArg)", + "query": "from a_index | eval log(stringField, stringField)", "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." + "Argument of [log] must be [number], found value [stringField] type [string]", + "Argument of [log] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(geoShapeField, geoPointField)", - "error": [], + "query": "from a_index | eval log(numberField, numberField, extraArg)", + "error": [ + "Error: [log] function expects no more than 2 arguments, got 3." + ], "warning": [] }, { - "query": "from a_index | eval st_contains(geoShapeField, geoPointField)", + "query": "from a_index | sort log(numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(geoShapeField, to_geopoint(stringField))", + "query": "row var = log(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoShapeField, geoPointField, extraArg)", - "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." - ], + "query": "row log(5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(geoShapeField, geoShapeField)", + "query": "row var = log(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoShapeField, geoShapeField)", + "query": "row var = log(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(geoShapeField, geoShapeField, extraArg)", + "query": "row var = log(true, true)", "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." + "Argument of [log] must be [number], found value [true] type [boolean]", + "Argument of [log] must be [number], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(cartesianPointField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField)", + "query": "from a_index | where log(numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", - "error": [], + "query": "from a_index | where log(booleanField) > 0", + "error": [ + "Argument of [log] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField, extraArg)", + "query": "from a_index | where log(booleanField, booleanField) > 0", "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." + "Argument of [log] must be [number], found value [booleanField] type [boolean]", + "Argument of [log] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(cartesianPointField, cartesianShapeField)", + "query": "from a_index | eval var = log(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianShapeField)", + "query": "from a_index | eval log(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_contains(to_cartesianpoint(stringField), cartesianShapeField)", + "query": "from a_index | eval var = log(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianPointField, cartesianShapeField, extraArg)", + "query": "from a_index | eval log(booleanField)", "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." + "Argument of [log] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(cartesianShapeField, cartesianPointField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_contains(cartesianShapeField, cartesianPointField)", - "error": [], + "query": "from a_index | eval var = log(*)", + "error": [ + "Using wildcards (*) in log is not allowed" + ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(cartesianShapeField, to_cartesianpoint(stringField))", + "query": "from a_index | eval var = log(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianShapeField, cartesianPointField, extraArg)", + "query": "from a_index | eval log(booleanField, booleanField)", "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." + "Argument of [log] must be [number], found value [booleanField] type [boolean]", + "Argument of [log] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = st_contains(cartesianShapeField, cartesianShapeField)", + "query": "from a_index | sort log(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianShapeField, cartesianShapeField)", + "query": "row var = log10(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_contains(cartesianShapeField, cartesianShapeField, extraArg)", - "error": [ - "Error: [st_contains] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | sort st_contains(geoPointField, geoPointField)", + "query": "row log10(5)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "row var = log10(to_integer(\"a\"))", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "row var = log10(\"a\")", + "error": [ + "Argument of [log10] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { - "query": "row var = st_disjoint(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "query": "from a_index | where log10(numberField) > 0", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(\"a\", \"a\")", + "query": "from a_index | where log10(stringField) > 0", "error": [ - "Argument of [st_disjoint] must be [geo_point], found value [\"a\"] type [string]", - "Argument of [st_disjoint] must be [geo_point], found value [\"a\"] type [string]" + "Argument of [log10] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "row var = st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = log10(numberField)", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval log10(numberField)", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = log10(to_integer(stringField))", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval log10(stringField)", + "error": [ + "Argument of [log10] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { - "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval log10(numberField, extraArg)", + "error": [ + "Error: [log10] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", - "error": [], + "query": "from a_index | eval var = log10(*)", + "error": [ + "Using wildcards (*) in log10 is not allowed" + ], "warning": [] }, { - "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | sort log10(numberField)", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "row var = log10(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], + "query": "row var = log10(true)", + "error": [ + "Argument of [log10] must be [number], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | where log10(booleanField) > 0", + "error": [ + "Argument of [log10] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = log10(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval log10(booleanField)", + "error": [ + "Argument of [log10] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row var = ltrim(\"a\")", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row ltrim(\"a\")", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row var = ltrim(to_string(\"a\"))", "error": [], "warning": [] }, { - "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", - "error": [], + "query": "row var = ltrim(5)", + "error": [ + "Argument of [ltrim] must be [string], found value [5] type [number]" + ], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | where length(ltrim(stringField)) > 0", "error": [], "warning": [] }, { - "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | where length(ltrim(numberField)) > 0", + "error": [ + "Argument of [ltrim] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { - "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = ltrim(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(geoPointField, geoPointField)", + "query": "from a_index | eval ltrim(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoPointField, geoPointField)", + "query": "from a_index | eval var = ltrim(to_string(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_geopoint(stringField), to_geopoint(stringField))", - "error": [], + "query": "from a_index | eval ltrim(numberField)", + "error": [ + "Argument of [ltrim] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { - "query": "from a_index | eval st_disjoint(stringField, stringField)", + "query": "from a_index | eval ltrim(stringField, extraArg)", "error": [ - "Argument of [st_disjoint] must be [geo_point], found value [stringField] type [string]", - "Argument of [st_disjoint] must be [geo_point], found value [stringField] type [string]" + "Error: [ltrim] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoPointField, geoPointField, extraArg)", + "query": "from a_index | eval var = ltrim(*)", "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + "Using wildcards (*) in ltrim is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(geoPointField, geoShapeField)", + "query": "from a_index | sort ltrim(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoPointField, geoShapeField)", + "query": "row var = ltrim(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_geopoint(stringField), geoShapeField)", - "error": [], + "query": "row var = ltrim(true)", + "error": [ + "Argument of [ltrim] must be [string], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoPointField, geoShapeField, extraArg)", + "query": "from a_index | where length(ltrim(booleanField)) > 0", "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + "Argument of [ltrim] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(geoShapeField, geoPointField)", + "query": "from a_index | eval var = ltrim(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoShapeField, geoPointField)", - "error": [], + "query": "from a_index | eval ltrim(booleanField)", + "error": [ + "Argument of [ltrim] must be [string], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(geoShapeField, to_geopoint(stringField))", + "query": "row var = mv_avg(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoShapeField, geoPointField, extraArg)", - "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." - ], + "query": "row mv_avg(5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(geoShapeField, geoShapeField)", + "query": "row var = mv_avg(to_integer(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoShapeField, geoShapeField)", + "query": "row var = mv_avg(\"a\")", + "error": [ + "Argument of [mv_avg] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where mv_avg(numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(geoShapeField, geoShapeField, extraArg)", + "query": "from a_index | where mv_avg(stringField) > 0", "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + "Argument of [mv_avg] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval var = mv_avg(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField)", + "query": "from a_index | eval mv_avg(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", + "query": "from a_index | eval var = mv_avg(to_integer(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField, extraArg)", + "query": "from a_index | eval mv_avg(stringField)", "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + "Argument of [mv_avg] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(cartesianPointField, cartesianShapeField)", - "error": [], + "query": "from a_index | eval mv_avg(numberField, extraArg)", + "error": [ + "Error: [mv_avg] function expects exactly one argument, got 2." + ], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField)", + "query": "from a_index | eval var = mv_avg(*)", + "error": [ + "Using wildcards (*) in mv_avg is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort mv_avg(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(stringField), cartesianShapeField)", + "query": "row var = mv_avg(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField, extraArg)", + "query": "row var = mv_avg(true)", "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + "Argument of [mv_avg] must be [number], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(cartesianShapeField, cartesianPointField)", - "error": [], + "query": "from a_index | where mv_avg(booleanField) > 0", + "error": [ + "Argument of [mv_avg] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField)", + "query": "from a_index | eval var = mv_avg(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(cartesianShapeField, to_cartesianpoint(stringField))", - "error": [], + "query": "from a_index | eval mv_avg(booleanField)", + "error": [ + "Argument of [mv_avg] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_concat(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_disjoint(cartesianShapeField, cartesianShapeField)", + "query": "row mv_concat(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField)", + "query": "row var = mv_concat(to_string(\"a\"), to_string(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField, extraArg)", + "query": "row var = mv_concat(5, 5)", "error": [ - "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + "Argument of [mv_concat] must be [string], found value [5] type [number]", + "Argument of [mv_concat] must be [string], found value [5] type [number]" ], "warning": [] }, { - "query": "from a_index | sort st_disjoint(geoPointField, geoPointField)", + "query": "from a_index | where length(mv_concat(stringField, stringField)) > 0", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | where length(mv_concat(numberField, numberField)) > 0", + "error": [ + "Argument of [mv_concat] must be [string], found value [numberField] type [number]", + "Argument of [mv_concat] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = mv_concat(stringField, stringField)", "error": [], "warning": [] }, { - "query": "row st_intersects(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_concat(stringField, stringField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "query": "from a_index | eval var = mv_concat(to_string(stringField), to_string(stringField))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(\"a\", \"a\")", + "query": "from a_index | eval mv_concat(numberField, numberField)", "error": [ - "Argument of [st_intersects] must be [geo_point], found value [\"a\"] type [string]", - "Argument of [st_intersects] must be [geo_point], found value [\"a\"] type [string]" + "Argument of [mv_concat] must be [string], found value [numberField] type [number]", + "Argument of [mv_concat] must be [string], found value [numberField] type [number]" ], "warning": [] }, { - "query": "row var = st_intersects(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval mv_concat(stringField, stringField, extraArg)", + "error": [ + "Error: [mv_concat] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { - "query": "row st_intersects(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | sort mv_concat(stringField, stringField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "query": "row var = mv_concat(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "row var = mv_concat(true, true)", + "error": [ + "Argument of [mv_concat] must be [string], found value [true] type [boolean]", + "Argument of [mv_concat] must be [string], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | where length(mv_concat(booleanField, booleanField)) > 0", + "error": [ + "Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]", + "Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", + "query": "from a_index | eval var = mv_concat(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", - "error": [], + "query": "from a_index | eval mv_concat(booleanField, booleanField)", + "error": [ + "Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]", + "Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "row var = mv_count(\"a\")", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row mv_count(\"a\")", "error": [], "warning": [] }, { - "query": "row st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(stringField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | eval mv_count(stringField)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(*)", + "error": [ + "Using wildcards (*) in mv_count is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort mv_count(stringField)", "error": [], "warning": [] }, { - "query": "row st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row var = mv_count(true)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row mv_count(true)", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row var = mv_count(to_boolean(true))", "error": [], "warning": [] }, { - "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row var = mv_count(to_cartesianpoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "query": "row mv_count(to_cartesianpoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row var = mv_count(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "row var = mv_count(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(geoPointField, geoPointField)", + "query": "row mv_count(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoPointField, geoPointField)", + "query": "row var = mv_count(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_geopoint(stringField), to_geopoint(stringField))", + "query": "row var = mv_count(now())", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(stringField, stringField)", - "error": [ - "Argument of [st_intersects] must be [geo_point], found value [stringField] type [string]", - "Argument of [st_intersects] must be [geo_point], found value [stringField] type [string]" - ], + "query": "row mv_count(now())", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoPointField, geoPointField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_count(to_datetime(now()))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(geoPointField, geoShapeField)", + "query": "row var = mv_count(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoPointField, geoShapeField)", + "query": "row mv_count(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_geopoint(stringField), geoShapeField)", + "query": "row var = mv_count(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoPointField, geoShapeField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_count(to_geopoint(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(geoShapeField, geoPointField)", + "query": "row mv_count(to_geopoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoShapeField, geoPointField)", + "query": "row var = mv_count(to_geopoint(to_geopoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(geoShapeField, to_geopoint(stringField))", + "query": "row var = mv_count(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoShapeField, geoPointField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "row mv_count(to_geoshape(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(geoShapeField, geoShapeField)", + "query": "row var = mv_count(to_geoshape(to_geopoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoShapeField, geoShapeField)", + "query": "row var = mv_count(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(geoShapeField, geoShapeField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "row mv_count(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(cartesianPointField, cartesianPointField)", + "query": "row var = mv_count(to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField)", + "query": "row var = mv_count(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", + "query": "row var = mv_count(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "row mv_count(to_version(\"1.0.0\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(cartesianPointField, cartesianShapeField)", + "query": "row var = mv_count(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianShapeField)", + "query": "from a_index | where mv_count(booleanField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(to_cartesianpoint(stringField), cartesianShapeField)", + "query": "from a_index | where mv_count(cartesianPointField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianPointField, cartesianShapeField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | where mv_count(cartesianShapeField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(cartesianShapeField, cartesianPointField)", + "query": "from a_index | where mv_count(dateField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianPointField)", + "query": "from a_index | where mv_count(numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(cartesianShapeField, to_cartesianpoint(stringField))", + "query": "from a_index | where mv_count(geoPointField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | where mv_count(geoShapeField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_intersects(cartesianShapeField, cartesianShapeField)", + "query": "from a_index | where mv_count(ipField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField)", + "query": "from a_index | where mv_count(stringField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField, extraArg)", - "error": [ - "Error: [st_intersects] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | where mv_count(versionField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | sort st_intersects(geoPointField, geoPointField)", + "query": "from a_index | eval var = mv_count(booleanField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_count(booleanField)", "error": [], "warning": [] }, { - "query": "row st_within(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "query": "from a_index | eval var = mv_count(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = st_within(\"a\", \"a\")", - "error": [ - "Argument of [st_within] must be [geo_point], found value [\"a\"] type [string]", - "Argument of [st_within] must be [geo_point], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval mv_count(cartesianPointField)", + "error": [], "warning": [] }, { - "query": "row var = st_within(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row st_within(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_count(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(dateField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", + "query": "from a_index | eval mv_count(dateField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row st_within(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(numberField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_count(numberField)", "error": [], "warning": [] }, { - "query": "row st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = mv_count(geoPointField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_count(geoPointField)", "error": [], "warning": [] }, { - "query": "row st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_count(geoShapeField)", "error": [], "warning": [] }, { - "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = mv_count(ipField)", "error": [], "warning": [] }, { - "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_count(ipField)", "error": [], "warning": [] }, { - "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_count(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(geoPointField, geoPointField)", + "query": "from a_index | eval var = mv_count(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoPointField, geoPointField)", + "query": "from a_index | eval var = mv_count(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_geopoint(stringField), to_geopoint(stringField))", + "query": "from a_index | eval mv_count(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(stringField, stringField)", - "error": [ - "Argument of [st_within] must be [geo_point], found value [stringField] type [string]", - "Argument of [st_within] must be [geo_point], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = mv_count(to_version(stringField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoPointField, geoPointField, extraArg)", + "query": "from a_index | eval mv_count(booleanField, extraArg)", "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." + "Error: [mv_count] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = st_within(geoPointField, geoShapeField)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | eval st_within(geoPointField, geoShapeField)", + "query": "from a_index | sort mv_count(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_geopoint(stringField), geoShapeField)", + "query": "row var = mv_dedupe(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoPointField, geoShapeField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], - "warning": [] - }, - { - "query": "from a_index | eval var = st_within(geoShapeField, geoPointField)", + "query": "row mv_dedupe(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoShapeField, geoPointField)", + "query": "from a_index | eval var = mv_dedupe(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(geoShapeField, to_geopoint(stringField))", + "query": "from a_index | eval mv_dedupe(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoShapeField, geoPointField, extraArg)", + "query": "from a_index | eval var = mv_dedupe(*)", "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." + "Using wildcards (*) in mv_dedupe is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = st_within(geoShapeField, geoShapeField)", + "query": "from a_index | sort mv_dedupe(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoShapeField, geoShapeField)", + "query": "row var = mv_dedupe(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(geoShapeField, geoShapeField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], + "query": "row mv_dedupe(true)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(cartesianPointField, cartesianPointField)", + "query": "row var = mv_dedupe(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField)", + "query": "row var = mv_dedupe(now())", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", + "query": "row mv_dedupe(now())", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_dedupe(to_datetime(now()))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(cartesianPointField, cartesianShapeField)", + "query": "row var = mv_dedupe(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianPointField, cartesianShapeField)", + "query": "row mv_dedupe(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(to_cartesianpoint(stringField), cartesianShapeField)", + "query": "row var = mv_dedupe(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianPointField, cartesianShapeField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_dedupe(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(cartesianShapeField, cartesianPointField)", + "query": "row mv_dedupe(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianShapeField, cartesianPointField)", + "query": "row var = mv_dedupe(to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(cartesianShapeField, to_cartesianpoint(stringField))", + "query": "row var = mv_dedupe(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianShapeField, cartesianPointField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], + "query": "row var = mv_dedupe(to_version(\"1.0.0\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_within(cartesianShapeField, cartesianShapeField)", + "query": "row mv_dedupe(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianShapeField, cartesianShapeField)", + "query": "row var = mv_dedupe(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_within(cartesianShapeField, cartesianShapeField, extraArg)", - "error": [ - "Error: [st_within] function expects exactly 2 arguments, got 3." - ], + "query": "from a_index | where mv_dedupe(numberField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | sort st_within(geoPointField, geoPointField)", + "query": "from a_index | where length(mv_dedupe(stringField)) > 0", "error": [], "warning": [] }, { - "query": "row var = st_x(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_dedupe(booleanField)", "error": [], "warning": [] }, { - "query": "row st_x(to_geopoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_dedupe(booleanField)", "error": [], "warning": [] }, { - "query": "row var = st_x(to_geopoint(\"a\"))", + "query": "from a_index | eval var = mv_dedupe(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = st_x(\"a\")", - "error": [ - "Argument of [st_x] must be [geo_point], found value [\"a\"] type [string]" - ], + "query": "from a_index | eval var = mv_dedupe(dateField)", + "error": [], "warning": [] }, { - "query": "row var = st_x(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval mv_dedupe(dateField)", "error": [], "warning": [] }, { - "query": "row st_x(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "from a_index | eval var = mv_dedupe(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row var = st_x(to_cartesianpoint(\"a\"))", + "query": "from a_index | eval var = mv_dedupe(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(geoPointField)", + "query": "from a_index | eval mv_dedupe(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(geoPointField)", + "query": "from a_index | eval var = mv_dedupe(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(to_geopoint(stringField))", + "query": "from a_index | eval var = mv_dedupe(ipField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(stringField)", - "error": [ - "Argument of [st_x] must be [geo_point], found value [stringField] type [string]" - ], + "query": "from a_index | eval mv_dedupe(ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(geoPointField, extraArg)", - "error": [ - "Error: [st_x] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = mv_dedupe(to_ip(ipField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(*)", - "error": [ - "Using wildcards (*) in st_x is not allowed" - ], + "query": "from a_index | eval var = mv_dedupe(to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(cartesianPointField)", + "query": "from a_index | eval var = mv_dedupe(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(cartesianPointField)", + "query": "from a_index | eval mv_dedupe(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_x(to_cartesianpoint(stringField))", + "query": "from a_index | eval var = mv_dedupe(to_version(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_x(cartesianPointField, extraArg)", + "query": "from a_index | eval mv_dedupe(booleanField, extraArg)", "error": [ - "Error: [st_x] function expects exactly one argument, got 2." + "Error: [mv_dedupe] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | sort st_x(geoPointField)", + "query": "from a_index | sort mv_dedupe(booleanField)", "error": [], "warning": [] }, { - "query": "row var = st_y(to_geopoint(\"POINT (30 10)\"))", + "query": "row mv_dedupe(to_cartesianpoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row st_y(to_geopoint(\"POINT (30 10)\"))", + "query": "row var = mv_dedupe(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "row var = st_y(to_geopoint(\"a\"))", + "query": "row var = mv_dedupe(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = st_y(\"a\")", - "error": [ - "Argument of [st_y] must be [geo_point], found value [\"a\"] type [string]" - ], + "query": "row mv_dedupe(to_cartesianshape(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "row var = st_y(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row var = mv_dedupe(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "row st_y(to_cartesianpoint(\"POINT (30 10)\"))", + "query": "row var = mv_dedupe(to_geopoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = st_y(to_cartesianpoint(\"a\"))", + "query": "row mv_dedupe(to_geopoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_y(geoPointField)", + "query": "row var = mv_dedupe(to_geopoint(to_geopoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(geoPointField)", + "query": "row var = mv_dedupe(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_y(to_geopoint(stringField))", + "query": "row mv_dedupe(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(stringField)", - "error": [ - "Argument of [st_y] must be [geo_point], found value [stringField] type [string]" - ], + "query": "row var = mv_dedupe(to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(geoPointField, extraArg)", - "error": [ - "Error: [st_y] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = mv_dedupe(cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_y(*)", - "error": [ - "Using wildcards (*) in st_y is not allowed" - ], + "query": "from a_index | eval var = mv_dedupe(to_cartesianpoint(cartesianPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_y(cartesianPointField)", + "query": "from a_index | eval var = mv_dedupe(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(cartesianPointField)", + "query": "from a_index | eval mv_dedupe(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_y(to_cartesianpoint(stringField))", + "query": "from a_index | eval var = mv_dedupe(to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval st_y(cartesianPointField, extraArg)", - "error": [ - "Error: [st_y] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = mv_dedupe(geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort st_y(geoPointField)", + "query": "from a_index | eval mv_dedupe(geoPointField)", "error": [], "warning": [] }, { - "query": "row var = starts_with(\"a\", \"a\")", + "query": "from a_index | eval var = mv_dedupe(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row starts_with(\"a\", \"a\")", + "query": "from a_index | eval var = mv_dedupe(geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = starts_with(to_string(\"a\"), to_string(\"a\"))", + "query": "from a_index | eval mv_dedupe(geoShapeField)", "error": [], "warning": [] }, { - "query": "row var = starts_with(5, 5)", + "query": "from a_index | eval var = mv_dedupe(to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval mv_dedupe(numberField, extraArg)", "error": [ - "Argument of [starts_with] must be [string], found value [5] type [number]", - "Argument of [starts_with] must be [string], found value [5] type [number]" + "Error: [mv_dedupe] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = starts_with(stringField, stringField)", + "query": "from a_index | sort mv_dedupe(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval starts_with(stringField, stringField)", + "query": "row var = mv_first(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = starts_with(to_string(stringField), to_string(stringField))", + "query": "row mv_first(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval starts_with(numberField, numberField)", - "error": [ - "Argument of [starts_with] must be [string], found value [numberField] type [number]", - "Argument of [starts_with] must be [string], found value [numberField] type [number]" - ], + "query": "from a_index | eval var = mv_first(stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval starts_with(stringField, stringField, extraArg)", + "query": "from a_index | eval mv_first(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = mv_first(*)", "error": [ - "Error: [starts_with] function expects exactly 2 arguments, got 3." + "Using wildcards (*) in mv_first is not allowed" ], "warning": [] }, { - "query": "from a_index | sort starts_with(stringField, stringField)", + "query": "from a_index | sort mv_first(stringField)", "error": [], "warning": [] }, { - "query": "row var = substring(\"a\", 5, 5)", + "query": "row var = mv_first(true)", "error": [], "warning": [] }, { - "query": "row substring(\"a\", 5, 5)", + "query": "row mv_first(true)", "error": [], "warning": [] }, { - "query": "row var = substring(to_string(\"a\"), to_integer(\"a\"), to_integer(\"a\"))", + "query": "row var = mv_first(to_boolean(true))", "error": [], "warning": [] }, { - "query": "row var = substring(5, \"a\", \"a\")", - "error": [ - "Argument of [substring] must be [string], found value [5] type [number]", - "Argument of [substring] must be [number], found value [\"a\"] type [string]", - "Argument of [substring] must be [number], found value [\"a\"] type [string]" - ], + "query": "row var = mv_first(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | where length(substring(stringField, numberField, numberField)) > 0", + "query": "row mv_first(to_cartesianpoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | where length(substring(numberField, stringField, stringField)) > 0", - "error": [ - "Argument of [substring] must be [string], found value [numberField] type [number]", - "Argument of [substring] must be [number], found value [stringField] type [string]", - "Argument of [substring] must be [number], found value [stringField] type [string]" - ], + "query": "row var = mv_first(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = substring(stringField, numberField, numberField)", + "query": "row var = mv_first(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval substring(stringField, numberField, numberField)", + "query": "row mv_first(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = substring(to_string(stringField), to_integer(stringField), to_integer(stringField))", + "query": "row var = mv_first(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval substring(numberField, stringField, stringField)", - "error": [ - "Argument of [substring] must be [string], found value [numberField] type [number]", - "Argument of [substring] must be [number], found value [stringField] type [string]", - "Argument of [substring] must be [number], found value [stringField] type [string]" - ], + "query": "row var = mv_first(now())", + "error": [], "warning": [] }, { - "query": "from a_index | eval substring(stringField, numberField, numberField, extraArg)", - "error": [ - "Error: [substring] function expects exactly 3 arguments, got 4." - ], + "query": "row mv_first(now())", + "error": [], "warning": [] }, { - "query": "from a_index | sort substring(stringField, numberField, numberField)", + "query": "row var = mv_first(to_datetime(now()))", "error": [], "warning": [] }, { - "query": "row var = tan(5)", + "query": "row var = mv_first(5)", "error": [], "warning": [] }, { - "query": "row tan(5)", + "query": "row mv_first(5)", "error": [], "warning": [] }, { - "query": "row var = tan(to_integer(\"a\"))", + "query": "row var = mv_first(to_integer(true))", "error": [], "warning": [] }, { - "query": "row var = tan(\"a\")", - "error": [ - "Argument of [tan] must be [number], found value [\"a\"] type [string]" - ], + "query": "row var = mv_first(to_geopoint(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | where tan(numberField) > 0", + "query": "row mv_first(to_geopoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | where tan(stringField) > 0", - "error": [ - "Argument of [tan] must be [number], found value [stringField] type [string]" - ], + "query": "row var = mv_first(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = tan(numberField)", + "query": "row var = mv_first(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval tan(numberField)", + "query": "row mv_first(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = tan(to_integer(stringField))", + "query": "row var = mv_first(to_geoshape(to_geopoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval tan(stringField)", - "error": [ - "Argument of [tan] must be [number], found value [stringField] type [string]" - ], + "query": "row var = mv_first(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval tan(numberField, extraArg)", - "error": [ - "Error: [tan] function expects exactly one argument, got 2." - ], + "query": "row mv_first(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = tan(*)", - "error": [ - "Using wildcards (*) in tan is not allowed" - ], + "query": "row var = mv_first(to_ip(to_ip(\"127.0.0.1\")))", + "error": [], "warning": [] }, { - "query": "from a_index | sort tan(numberField)", + "query": "row var = mv_first(to_string(true))", "error": [], "warning": [] }, { - "query": "row var = tanh(5)", + "query": "row var = mv_first(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row tanh(5)", + "query": "row mv_first(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "row var = tanh(to_integer(\"a\"))", + "query": "row var = mv_first(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = tanh(\"a\")", - "error": [ - "Argument of [tanh] must be [number], found value [\"a\"] type [string]" - ], + "query": "from a_index | where mv_first(numberField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | where tanh(numberField) > 0", + "query": "from a_index | where length(mv_first(stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where tanh(stringField) > 0", - "error": [ - "Argument of [tanh] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = mv_first(booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = tanh(numberField)", + "query": "from a_index | eval mv_first(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval tanh(numberField)", + "query": "from a_index | eval var = mv_first(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = tanh(to_integer(stringField))", + "query": "from a_index | eval var = mv_first(cartesianPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval tanh(stringField)", - "error": [ - "Argument of [tanh] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval mv_first(cartesianPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval tanh(numberField, extraArg)", - "error": [ - "Error: [tanh] function expects exactly one argument, got 2." - ], + "query": "from a_index | eval var = mv_first(to_cartesianpoint(cartesianPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = tanh(*)", - "error": [ - "Using wildcards (*) in tanh is not allowed" - ], + "query": "from a_index | eval var = mv_first(cartesianShapeField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort tanh(numberField)", + "query": "from a_index | eval mv_first(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "row var = tau()", + "query": "from a_index | eval var = mv_first(to_cartesianshape(cartesianPointField))", "error": [], "warning": [] }, { - "query": "row tau()", + "query": "from a_index | eval var = mv_first(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | where tau() > 0", + "query": "from a_index | eval mv_first(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = tau()", + "query": "from a_index | eval var = mv_first(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | eval tau()", + "query": "from a_index | eval var = mv_first(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval tau(extraArg)", - "error": [ - "Error: [tau] function expects exactly 0 arguments, got 1." - ], + "query": "from a_index | eval mv_first(numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort tau()", + "query": "from a_index | eval var = mv_first(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_boolean(\"a\")", + "query": "from a_index | eval var = mv_first(geoPointField)", "error": [], "warning": [] }, { - "query": "row to_boolean(\"a\")", + "query": "from a_index | eval mv_first(geoPointField)", "error": [], "warning": [] }, { - "query": "row var = to_bool(\"a\")", + "query": "from a_index | eval var = mv_first(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_boolean(stringField)", + "query": "from a_index | eval var = mv_first(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_boolean(stringField)", + "query": "from a_index | eval mv_first(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_bool(stringField)", + "query": "from a_index | eval var = mv_first(to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_boolean(*)", - "error": [ - "Using wildcards (*) in to_boolean is not allowed" - ], + "query": "from a_index | eval var = mv_first(ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_boolean(stringField)", + "query": "from a_index | eval mv_first(ipField)", "error": [], "warning": [] }, { - "query": "row var = to_cartesianpoint(\"a\")", + "query": "from a_index | eval var = mv_first(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "row to_cartesianpoint(\"a\")", + "query": "from a_index | eval var = mv_first(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianpoint(stringField)", + "query": "from a_index | eval var = mv_first(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianpoint(stringField)", + "query": "from a_index | eval mv_first(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianpoint(*)", + "query": "from a_index | eval var = mv_first(to_version(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval mv_first(booleanField, extraArg)", "error": [ - "Using wildcards (*) in to_cartesianpoint is not allowed" + "Error: [mv_first] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | sort to_cartesianpoint(stringField)", + "query": "from a_index | sort mv_first(booleanField)", "error": [], "warning": [] }, { - "query": "row var = to_cartesianshape(\"a\")", + "query": "row var = mv_last(\"a\")", "error": [], "warning": [] }, { - "query": "row to_cartesianshape(\"a\")", + "query": "row mv_last(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianshape(stringField)", + "query": "from a_index | eval var = mv_last(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_cartesianshape(stringField)", + "query": "from a_index | eval mv_last(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_cartesianshape(*)", + "query": "from a_index | eval var = mv_last(*)", "error": [ - "Using wildcards (*) in to_cartesianshape is not allowed" + "Using wildcards (*) in mv_last is not allowed" ], "warning": [] }, { - "query": "from a_index | sort to_cartesianshape(stringField)", + "query": "from a_index | sort mv_last(stringField)", "error": [], "warning": [] }, { - "query": "row var = to_datetime(\"a\")", + "query": "row var = mv_last(true)", "error": [], "warning": [] }, { - "query": "row to_datetime(\"a\")", + "query": "row mv_last(true)", "error": [], "warning": [] }, { - "query": "row var = to_dt(\"a\")", + "query": "row var = mv_last(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_datetime(stringField)", + "query": "row var = mv_last(to_cartesianpoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_datetime(stringField)", + "query": "row mv_last(to_cartesianpoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_dt(stringField)", + "query": "row var = mv_last(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_datetime(*)", - "error": [ - "Using wildcards (*) in to_datetime is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | sort to_datetime(stringField)", + "query": "row var = mv_last(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = to_degrees(5)", + "query": "row mv_last(to_cartesianshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row to_degrees(5)", + "query": "row var = mv_last(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "row var = to_degrees(to_integer(\"a\"))", + "query": "row var = mv_last(now())", "error": [], "warning": [] }, { - "query": "row var = to_degrees(\"a\")", - "error": [ - "Argument of [to_degrees] must be [number], found value [\"a\"] type [string]" - ], + "query": "row mv_last(now())", + "error": [], "warning": [] }, { - "query": "from a_index | where to_degrees(numberField) > 0", + "query": "row var = mv_last(to_datetime(now()))", "error": [], "warning": [] }, { - "query": "from a_index | where to_degrees(stringField) > 0", - "error": [ - "Argument of [to_degrees] must be [number], found value [stringField] type [string]" - ], + "query": "row var = mv_last(5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_degrees(numberField)", + "query": "row mv_last(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_degrees(numberField)", + "query": "row var = mv_last(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_degrees(to_integer(stringField))", + "query": "row var = mv_last(to_geopoint(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_degrees(stringField)", - "error": [ - "Argument of [to_degrees] must be [number], found value [stringField] type [string]" - ], + "query": "row mv_last(to_geopoint(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval to_degrees(numberField, extraArg)", - "error": [ - "Error: [to_degrees] function expects exactly one argument, got 2." - ], + "query": "row var = mv_last(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_degrees(*)", - "error": [ - "Using wildcards (*) in to_degrees is not allowed" - ], + "query": "row var = mv_last(to_geoshape(\"POINT (30 10)\"))", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_degrees(numberField)", + "query": "row mv_last(to_geoshape(\"POINT (30 10)\"))", "error": [], "warning": [] }, { - "query": "row var = to_double(\"a\")", + "query": "row var = mv_last(to_geoshape(to_geopoint(\"POINT (30 10)\")))", "error": [], "warning": [] }, { - "query": "row to_double(\"a\")", + "query": "row var = mv_last(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "row var = to_dbl(\"a\")", + "query": "row mv_last(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_double(stringField)", + "query": "row var = mv_last(to_ip(to_ip(\"127.0.0.1\")))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_double(stringField)", + "query": "row var = mv_last(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_dbl(stringField)", + "query": "row var = mv_last(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_double(*)", - "error": [ - "Using wildcards (*) in to_double is not allowed" - ], + "query": "row mv_last(to_version(\"1.0.0\"))", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_double(stringField)", + "query": "row var = mv_last(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = to_geopoint(\"a\")", + "query": "from a_index | where mv_last(numberField) > 0", "error": [], "warning": [] }, { - "query": "row to_geopoint(\"a\")", + "query": "from a_index | where length(mv_last(stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geopoint(stringField)", + "query": "from a_index | eval var = mv_last(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geopoint(stringField)", + "query": "from a_index | eval mv_last(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geopoint(*)", - "error": [ - "Using wildcards (*) in to_geopoint is not allowed" - ], + "query": "from a_index | eval var = mv_last(to_boolean(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_geopoint(stringField)", + "query": "from a_index | eval var = mv_last(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row var = to_geoshape(\"a\")", + "query": "from a_index | eval mv_last(cartesianPointField)", "error": [], "warning": [] }, { - "query": "row to_geoshape(\"a\")", + "query": "from a_index | eval var = mv_last(to_cartesianpoint(cartesianPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geoshape(stringField)", + "query": "from a_index | eval var = mv_last(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_geoshape(stringField)", + "query": "from a_index | eval mv_last(cartesianShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_geoshape(*)", - "error": [ - "Using wildcards (*) in to_geoshape is not allowed" - ], + "query": "from a_index | eval var = mv_last(to_cartesianshape(cartesianPointField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_geoshape(stringField)", + "query": "from a_index | eval var = mv_last(dateField)", "error": [], "warning": [] }, { - "query": "row var = to_integer(\"a\")", + "query": "from a_index | eval mv_last(dateField)", "error": [], "warning": [] }, { - "query": "row to_integer(\"a\")", + "query": "from a_index | eval var = mv_last(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "row var = to_int(\"a\")", + "query": "from a_index | eval var = mv_last(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_integer(stringField)", + "query": "from a_index | eval mv_last(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_integer(stringField)", + "query": "from a_index | eval var = mv_last(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_int(stringField)", + "query": "from a_index | eval var = mv_last(geoPointField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_integer(*)", - "error": [ - "Using wildcards (*) in to_integer is not allowed" - ], + "query": "from a_index | eval mv_last(geoPointField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_integer(stringField)", + "query": "from a_index | eval var = mv_last(to_geopoint(geoPointField))", "error": [], "warning": [] }, { - "query": "row var = to_ip(\"a\")", + "query": "from a_index | eval var = mv_last(geoShapeField)", "error": [], "warning": [] }, { - "query": "row to_ip(\"a\")", + "query": "from a_index | eval mv_last(geoShapeField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ip(stringField)", + "query": "from a_index | eval var = mv_last(to_geoshape(geoPointField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_ip(stringField)", + "query": "from a_index | eval var = mv_last(ipField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ip(*)", - "error": [ - "Using wildcards (*) in to_ip is not allowed" - ], + "query": "from a_index | eval mv_last(ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_ip(stringField)", + "query": "from a_index | eval var = mv_last(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "row var = to_long(\"a\")", + "query": "from a_index | eval var = mv_last(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "row to_long(\"a\")", + "query": "from a_index | eval var = mv_last(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(stringField)", + "query": "from a_index | eval mv_last(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_long(stringField)", + "query": "from a_index | eval var = mv_last(to_version(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_long(*)", + "query": "from a_index | eval mv_last(booleanField, extraArg)", "error": [ - "Using wildcards (*) in to_long is not allowed" + "Error: [mv_last] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | sort to_long(stringField)", + "query": "from a_index | sort mv_last(booleanField)", "error": [], "warning": [] }, { - "query": "row var = to_lower(\"a\")", + "query": "row var = mv_max(\"a\")", "error": [], "warning": [] }, { - "query": "row to_lower(\"a\")", + "query": "row mv_max(\"a\")", "error": [], "warning": [] }, { - "query": "row var = to_lower(to_string(\"a\"))", + "query": "from a_index | eval var = mv_max(stringField)", "error": [], "warning": [] }, { - "query": "row var = to_lower(5)", + "query": "from a_index | eval mv_max(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = mv_max(*)", "error": [ - "Argument of [to_lower] must be [string], found value [5] type [number]" + "Using wildcards (*) in mv_max is not allowed" ], "warning": [] }, { - "query": "from a_index | where length(to_lower(stringField)) > 0", + "query": "from a_index | sort mv_max(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | where length(to_lower(numberField)) > 0", - "error": [ - "Argument of [to_lower] must be [string], found value [numberField] type [number]" - ], + "query": "row var = mv_max(true)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_lower(stringField)", + "query": "row mv_max(true)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_lower(stringField)", + "query": "row var = mv_max(to_boolean(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_lower(to_string(stringField))", + "query": "row var = mv_max(now())", "error": [], "warning": [] }, { - "query": "from a_index | eval to_lower(numberField)", - "error": [ - "Argument of [to_lower] must be [string], found value [numberField] type [number]" - ], + "query": "row mv_max(now())", + "error": [], "warning": [] }, { - "query": "from a_index | eval to_lower(stringField, extraArg)", - "error": [ - "Error: [to_lower] function expects exactly one argument, got 2." - ], + "query": "row var = mv_max(to_datetime(now()))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_lower(*)", - "error": [ - "Using wildcards (*) in to_lower is not allowed" - ], + "query": "row var = mv_max(5)", + "error": [], "warning": [] }, { - "query": "from a_index | sort to_lower(stringField)", + "query": "row mv_max(5)", "error": [], "warning": [] }, { - "query": "row var = to_radians(5)", + "query": "row var = mv_max(to_integer(true))", "error": [], "warning": [] }, { - "query": "row to_radians(5)", + "query": "row var = mv_max(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "row var = to_radians(to_integer(\"a\"))", + "query": "row mv_max(to_ip(\"127.0.0.1\"))", "error": [], "warning": [] }, { - "query": "row var = to_radians(\"a\")", - "error": [ - "Argument of [to_radians] must be [number], found value [\"a\"] type [string]" - ], + "query": "row var = mv_max(to_ip(to_ip(\"127.0.0.1\")))", + "error": [], "warning": [] }, { - "query": "from a_index | where to_radians(numberField) > 0", + "query": "row var = mv_max(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | where to_radians(stringField) > 0", - "error": [ - "Argument of [to_radians] must be [number], found value [stringField] type [string]" - ], + "query": "row var = mv_max(to_version(\"1.0.0\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_radians(numberField)", + "query": "row mv_max(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_radians(numberField)", + "query": "row var = mv_max(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_radians(to_integer(stringField))", + "query": "row var = mv_max(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [mv_max] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where mv_max(numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | eval to_radians(stringField)", + "query": "from a_index | where mv_max(cartesianPointField) > 0", "error": [ - "Argument of [to_radians] must be [number], found value [stringField] type [string]" + "Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | eval to_radians(numberField, extraArg)", - "error": [ - "Error: [to_radians] function expects exactly one argument, got 2." - ], + "query": "from a_index | where length(mv_max(stringField)) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_radians(*)", + "query": "from a_index | where length(mv_max(cartesianPointField)) > 0", "error": [ - "Using wildcards (*) in to_radians is not allowed" + "Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]" ], "warning": [] }, { - "query": "from a_index | sort to_radians(numberField)", + "query": "from a_index | eval var = mv_max(booleanField)", "error": [], "warning": [] }, { - "query": "row var = to_string(\"a\")", + "query": "from a_index | eval mv_max(booleanField)", "error": [], "warning": [] }, { - "query": "row to_string(\"a\")", + "query": "from a_index | eval var = mv_max(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_str(\"a\")", + "query": "from a_index | eval mv_max(cartesianPointField)", + "error": [ + "Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = mv_max(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(stringField)", + "query": "from a_index | eval mv_max(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_string(stringField)", + "query": "from a_index | eval var = mv_max(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_str(stringField)", + "query": "from a_index | eval var = mv_max(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_string(*)", - "error": [ - "Using wildcards (*) in to_string is not allowed" - ], - "warning": [] - }, - { - "query": "from a_index | sort to_string(stringField)", + "query": "from a_index | eval mv_max(numberField)", "error": [], "warning": [] }, { - "query": "row var = to_unsigned_long(\"a\")", + "query": "from a_index | eval var = mv_max(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row to_unsigned_long(\"a\")", + "query": "from a_index | eval var = mv_max(ipField)", "error": [], "warning": [] }, { - "query": "row var = to_ul(\"a\")", + "query": "from a_index | eval mv_max(ipField)", "error": [], "warning": [] }, { - "query": "row var = to_ulong(\"a\")", + "query": "from a_index | eval var = mv_max(to_ip(ipField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(stringField)", + "query": "from a_index | eval var = mv_max(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_unsigned_long(stringField)", + "query": "from a_index | eval var = mv_max(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ul(stringField)", + "query": "from a_index | eval mv_max(versionField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ulong(stringField)", + "query": "from a_index | eval var = mv_max(to_version(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_unsigned_long(*)", + "query": "from a_index | eval mv_max(booleanField, extraArg)", "error": [ - "Using wildcards (*) in to_unsigned_long is not allowed" + "Error: [mv_max] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | sort to_unsigned_long(stringField)", + "query": "from a_index | sort mv_max(booleanField)", "error": [], "warning": [] }, { - "query": "row var = to_upper(\"a\")", + "query": "row var = mv_median(5)", "error": [], "warning": [] }, { - "query": "row to_upper(\"a\")", + "query": "row mv_median(5)", "error": [], "warning": [] }, { - "query": "row var = to_upper(to_string(\"a\"))", + "query": "row var = mv_median(to_integer(\"a\"))", "error": [], "warning": [] }, { - "query": "row var = to_upper(5)", + "query": "row var = mv_median(\"a\")", "error": [ - "Argument of [to_upper] must be [string], found value [5] type [number]" + "Argument of [mv_median] must be [number], found value [\"a\"] type [string]" ], "warning": [] }, { - "query": "from a_index | where length(to_upper(stringField)) > 0", + "query": "from a_index | where mv_median(numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | where length(to_upper(numberField)) > 0", + "query": "from a_index | where mv_median(stringField) > 0", "error": [ - "Argument of [to_upper] must be [string], found value [numberField] type [number]" + "Argument of [mv_median] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = to_upper(stringField)", + "query": "from a_index | eval var = mv_median(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval to_upper(stringField)", + "query": "from a_index | eval mv_median(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_upper(to_string(stringField))", + "query": "from a_index | eval var = mv_median(to_integer(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | eval to_upper(numberField)", + "query": "from a_index | eval mv_median(stringField)", "error": [ - "Argument of [to_upper] must be [string], found value [numberField] type [number]" + "Argument of [mv_median] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval to_upper(stringField, extraArg)", + "query": "from a_index | eval mv_median(numberField, extraArg)", "error": [ - "Error: [to_upper] function expects exactly one argument, got 2." + "Error: [mv_median] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = to_upper(*)", + "query": "from a_index | eval var = mv_median(*)", "error": [ - "Using wildcards (*) in to_upper is not allowed" + "Using wildcards (*) in mv_median is not allowed" ], "warning": [] }, { - "query": "from a_index | sort to_upper(stringField)", + "query": "from a_index | sort mv_median(numberField)", "error": [], "warning": [] }, { - "query": "row var = to_version(\"a\")", + "query": "row var = mv_median(to_integer(true))", "error": [], "warning": [] }, { - "query": "row to_version(\"a\")", + "query": "row var = mv_median(true)", + "error": [ + "Argument of [mv_median] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where mv_median(booleanField) > 0", + "error": [ + "Argument of [mv_median] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = mv_median(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "row var = to_ver(\"a\")", + "query": "from a_index | eval mv_median(booleanField)", + "error": [ + "Argument of [mv_median] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = mv_min(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_version(stringField)", + "query": "row mv_min(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | eval to_version(stringField)", + "query": "from a_index | eval var = mv_min(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_ver(stringField)", + "query": "from a_index | eval mv_min(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = to_version(*)", + "query": "from a_index | eval var = mv_min(*)", "error": [ - "Using wildcards (*) in to_version is not allowed" + "Using wildcards (*) in mv_min is not allowed" ], "warning": [] }, { - "query": "from a_index | sort to_version(stringField)", + "query": "from a_index | sort mv_min(stringField)", "error": [], "warning": [] }, { - "query": "row var = trim(\"a\")", + "query": "row var = mv_min(true)", "error": [], "warning": [] }, { - "query": "row trim(\"a\")", + "query": "row mv_min(true)", "error": [], "warning": [] }, { - "query": "row var = trim(to_string(\"a\"))", + "query": "row var = mv_min(to_boolean(true))", "error": [], "warning": [] }, { - "query": "row var = trim(5)", - "error": [ - "Argument of [trim] must be [string], found value [5] type [number]" - ], + "query": "row var = mv_min(now())", + "error": [], "warning": [] }, { - "query": "from a_index | where length(trim(stringField)) > 0", + "query": "row mv_min(now())", "error": [], "warning": [] }, { - "query": "from a_index | where length(trim(numberField)) > 0", - "error": [ - "Argument of [trim] must be [string], found value [numberField] type [number]" - ], + "query": "row var = mv_min(to_datetime(now()))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = trim(stringField)", + "query": "row var = mv_min(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval trim(stringField)", + "query": "row mv_min(5)", "error": [], "warning": [] }, { - "query": "from a_index | eval var = trim(to_string(stringField))", + "query": "row var = mv_min(to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | eval trim(numberField)", - "error": [ - "Argument of [trim] must be [string], found value [numberField] type [number]" - ], + "query": "row var = mv_min(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval trim(stringField, extraArg)", - "error": [ - "Error: [trim] function expects exactly one argument, got 2." - ], + "query": "row mv_min(to_ip(\"127.0.0.1\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = trim(*)", - "error": [ - "Using wildcards (*) in trim is not allowed" - ], + "query": "row var = mv_min(to_ip(to_ip(\"127.0.0.1\")))", + "error": [], "warning": [] }, { - "query": "from a_index | sort trim(stringField)", + "query": "row var = mv_min(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = avg(numberField)", + "query": "row var = mv_min(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField)", + "query": "row mv_min(to_version(\"1.0.0\"))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(avg(numberField))", + "query": "row var = mv_min(to_version(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(avg(numberField))", - "error": [], + "query": "row var = mv_min(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [mv_min] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | stats var = round(avg(numberField)) + avg(numberField)", + "query": "from a_index | where mv_min(numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats round(avg(numberField)) + avg(numberField)", - "error": [], + "query": "from a_index | where mv_min(cartesianPointField) > 0", + "error": [ + "Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField / 2)", + "query": "from a_index | where length(mv_min(stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = avg(numberField / 2)", - "error": [], + "query": "from a_index | where length(mv_min(cartesianPointField)) > 0", + "error": [ + "Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), avg(numberField / 2)", + "query": "from a_index | eval var = mv_min(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = avg(numberField / 2)", + "query": "from a_index | eval mv_min(booleanField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = avg(numberField)", + "query": "from a_index | eval var = mv_min(to_boolean(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), avg(numberField)", - "error": [], + "query": "from a_index | eval mv_min(cartesianPointField)", + "error": [ + "Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = avg(numberField)", + "query": "from a_index | eval var = mv_min(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField) by round(numberField / 2)", + "query": "from a_index | eval mv_min(dateField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = avg(numberField) by var1 = round(numberField / 2)", + "query": "from a_index | eval var = mv_min(to_datetime(dateField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), ipField", + "query": "from a_index | eval var = mv_min(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), ipField", + "query": "from a_index | eval mv_min(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = mv_min(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = mv_min(ipField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = avg(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | eval mv_min(ipField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats avg(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | eval var = mv_min(to_ip(ipField))", + "error": [], "warning": [] }, { - "query": "from a_index | stats avg(stringField)", - "error": [ - "Argument of [avg] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval var = mv_min(to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = avg(*)", - "error": [ - "Using wildcards (*) in avg is not allowed" - ], + "query": "from a_index | eval var = mv_min(versionField)", + "error": [], "warning": [] }, { - "query": "from a_index | sort avg(numberField)", - "error": [ - "SORT does not support function avg" - ], + "query": "from a_index | eval mv_min(versionField)", + "error": [], "warning": [] }, { - "query": "from a_index | where avg(numberField)", - "error": [ - "WHERE does not support function avg" - ], + "query": "from a_index | eval var = mv_min(to_version(stringField))", + "error": [], "warning": [] }, { - "query": "from a_index | where avg(numberField) > 0", + "query": "from a_index | eval mv_min(booleanField, extraArg)", "error": [ - "WHERE does not support function avg" + "Error: [mv_min] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = avg(numberField)", - "error": [ - "EVAL does not support function avg" - ], + "query": "from a_index | sort mv_min(booleanField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = avg(numberField) > 0", - "error": [ - "EVAL does not support function avg" - ], + "query": "row var = mv_slice(\"a\", 5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval avg(numberField)", - "error": [ - "EVAL does not support function avg" - ], + "query": "row mv_slice(\"a\", 5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | eval avg(numberField) > 0", - "error": [ - "EVAL does not support function avg" - ], + "query": "from a_index | eval var = mv_slice(stringField, numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = sum(numberField)", + "query": "from a_index | eval mv_slice(stringField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats sum(numberField)", + "query": "from a_index | sort mv_slice(stringField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(sum(numberField))", + "query": "row var = mv_slice(true, 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(sum(numberField))", + "query": "row mv_slice(true, 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(sum(numberField)) + sum(numberField)", + "query": "row var = mv_slice(to_boolean(true), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(sum(numberField)) + sum(numberField)", + "query": "row var = mv_slice(to_cartesianpoint(\"POINT (30 10)\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats sum(numberField / 2)", + "query": "row mv_slice(to_cartesianpoint(\"POINT (30 10)\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = sum(numberField / 2)", + "query": "row var = mv_slice(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), sum(numberField / 2)", + "query": "row var = mv_slice(to_cartesianshape(\"POINT (30 10)\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = sum(numberField / 2)", + "query": "row mv_slice(to_cartesianshape(\"POINT (30 10)\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = sum(numberField)", + "query": "row var = mv_slice(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), sum(numberField)", + "query": "row var = mv_slice(now(), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = sum(numberField)", + "query": "row mv_slice(now(), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats sum(numberField) by round(numberField / 2)", + "query": "row var = mv_slice(to_datetime(now()), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = sum(numberField) by var1 = round(numberField / 2)", + "query": "row var = mv_slice(5, 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), ipField", + "query": "row mv_slice(5, 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), ipField", + "query": "row var = mv_slice(to_integer(true), to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), numberField / 2", + "query": "row var = mv_slice(to_geopoint(\"POINT (30 10)\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "row mv_slice(to_geopoint(\"POINT (30 10)\"), 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = sum(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "row var = mv_slice(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | stats sum(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "row var = mv_slice(to_geoshape(\"POINT (30 10)\"), 5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | stats sum(stringField)", - "error": [ - "Argument of [sum] must be [number], found value [stringField] type [string]" - ], + "query": "row mv_slice(to_geoshape(\"POINT (30 10)\"), 5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = sum(*)", - "error": [ - "Using wildcards (*) in sum is not allowed" - ], + "query": "row var = mv_slice(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_integer(true), to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | sort sum(numberField)", - "error": [ - "SORT does not support function sum" - ], + "query": "row var = mv_slice(to_ip(\"127.0.0.1\"), 5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | where sum(numberField)", - "error": [ - "WHERE does not support function sum" - ], + "query": "row mv_slice(to_ip(\"127.0.0.1\"), 5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | where sum(numberField) > 0", - "error": [ - "WHERE does not support function sum" - ], + "query": "row var = mv_slice(to_ip(to_ip(\"127.0.0.1\")), to_integer(true), to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sum(numberField)", - "error": [ - "EVAL does not support function sum" - ], + "query": "row var = mv_slice(to_string(true), to_integer(true), to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = sum(numberField) > 0", + "query": "row var = mv_slice(to_version(\"1.0.0\"), 5, 5)", + "error": [], + "warning": [] + }, + { + "query": "row mv_slice(to_version(\"1.0.0\"), 5, 5)", + "error": [], + "warning": [] + }, + { + "query": "row var = mv_slice(to_version(\"a\"), to_integer(true), to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = mv_slice(to_version(\"1.0.0\"), true, true)", "error": [ - "EVAL does not support function sum" + "Argument of [mv_slice] must be [number], found value [true] type [boolean]", + "Argument of [mv_slice] must be [number], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval sum(numberField)", + "query": "from a_index | where mv_slice(numberField, numberField, numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where mv_slice(numberField, booleanField, booleanField) > 0", "error": [ - "EVAL does not support function sum" + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval sum(numberField) > 0", + "query": "from a_index | where length(mv_slice(stringField, numberField, numberField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(mv_slice(stringField, booleanField, booleanField)) > 0", "error": [ - "EVAL does not support function sum" + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats var = median(numberField)", + "query": "from a_index | eval var = mv_slice(booleanField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats median(numberField)", + "query": "from a_index | eval mv_slice(booleanField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(median(numberField))", + "query": "from a_index | eval var = mv_slice(to_boolean(booleanField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(median(numberField))", - "error": [], + "query": "from a_index | eval mv_slice(booleanField, booleanField, booleanField)", + "error": [ + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats var = round(median(numberField)) + median(numberField)", + "query": "from a_index | eval var = mv_slice(cartesianPointField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(median(numberField)) + median(numberField)", + "query": "from a_index | eval mv_slice(cartesianPointField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats median(numberField / 2)", + "query": "from a_index | eval var = mv_slice(to_cartesianpoint(cartesianPointField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median(numberField / 2)", - "error": [], + "query": "from a_index | eval mv_slice(cartesianPointField, booleanField, booleanField)", + "error": [ + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median(numberField / 2)", + "query": "from a_index | eval var = mv_slice(cartesianShapeField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median(numberField / 2)", + "query": "from a_index | eval mv_slice(cartesianShapeField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median(numberField)", + "query": "from a_index | eval var = mv_slice(to_cartesianshape(cartesianPointField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median(numberField)", - "error": [], + "query": "from a_index | eval mv_slice(cartesianShapeField, booleanField, booleanField)", + "error": [ + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median(numberField)", + "query": "from a_index | eval var = mv_slice(dateField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats median(numberField) by round(numberField / 2)", + "query": "from a_index | eval mv_slice(dateField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median(numberField) by var1 = round(numberField / 2)", + "query": "from a_index | eval var = mv_slice(to_datetime(dateField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), ipField", - "error": [], + "query": "from a_index | eval mv_slice(dateField, booleanField, booleanField)", + "error": [ + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), ipField", + "query": "from a_index | eval var = mv_slice(numberField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), numberField / 2", + "query": "from a_index | eval mv_slice(numberField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = mv_slice(to_integer(booleanField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = median(avg(numberField))", + "query": "from a_index | eval mv_slice(numberField, booleanField, booleanField)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats median(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | eval var = mv_slice(geoPointField, numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats median(stringField)", - "error": [ - "Argument of [median] must be [number], found value [stringField] type [string]" - ], + "query": "from a_index | eval mv_slice(geoPointField, numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = median(*)", - "error": [ - "Using wildcards (*) in median is not allowed" - ], + "query": "from a_index | eval var = mv_slice(to_geopoint(geoPointField), to_integer(booleanField), to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | sort median(numberField)", + "query": "from a_index | eval mv_slice(geoPointField, booleanField, booleanField)", "error": [ - "SORT does not support function median" + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where median(numberField)", - "error": [ - "WHERE does not support function median" - ], + "query": "from a_index | eval var = mv_slice(geoShapeField, numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | where median(numberField) > 0", - "error": [ - "WHERE does not support function median" - ], + "query": "from a_index | eval mv_slice(geoShapeField, numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = median(numberField)", - "error": [ - "EVAL does not support function median" - ], + "query": "from a_index | eval var = mv_slice(to_geoshape(geoPointField), to_integer(booleanField), to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = median(numberField) > 0", + "query": "from a_index | eval mv_slice(geoShapeField, booleanField, booleanField)", "error": [ - "EVAL does not support function median" + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval median(numberField)", - "error": [ - "EVAL does not support function median" - ], + "query": "from a_index | eval var = mv_slice(ipField, numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval median(numberField) > 0", - "error": [ - "EVAL does not support function median" - ], + "query": "from a_index | eval mv_slice(ipField, numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = median_absolute_deviation(numberField)", + "query": "from a_index | eval var = mv_slice(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(numberField)", - "error": [], + "query": "from a_index | eval mv_slice(ipField, booleanField, booleanField)", + "error": [ + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats var = round(median_absolute_deviation(numberField))", + "query": "from a_index | eval var = mv_slice(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(median_absolute_deviation(numberField))", - "error": [], + "query": "from a_index | eval mv_slice(stringField, booleanField, booleanField)", + "error": [ + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats var = round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)", + "query": "from a_index | eval var = mv_slice(versionField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)", + "query": "from a_index | eval mv_slice(versionField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(numberField / 2)", + "query": "from a_index | eval var = mv_slice(to_version(stringField), to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median_absolute_deviation(numberField / 2)", - "error": [], + "query": "from a_index | eval mv_slice(versionField, booleanField, booleanField)", + "error": [ + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]", + "Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField / 2)", - "error": [], + "query": "from a_index | eval mv_slice(booleanField, numberField, numberField, extraArg)", + "error": [ + "Error: [mv_slice] function expects no more than 3 arguments, got 4." + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField / 2)", + "query": "from a_index | sort mv_slice(booleanField, numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median_absolute_deviation(numberField)", + "query": "row var = mv_sort(\"a\", \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField)", + "query": "row mv_sort(\"a\", \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField)", + "query": "from a_index | eval var = mv_sort(stringField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(numberField) by round(numberField / 2)", + "query": "from a_index | eval mv_sort(stringField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2)", + "query": "from a_index | sort mv_sort(stringField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), ipField", + "query": "row var = mv_sort(true, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), ipField", + "query": "row mv_sort(true, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), numberField / 2", + "query": "row var = mv_sort(now(), \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "row mv_sort(now(), \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var = median_absolute_deviation(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "row var = mv_sort(5, \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "row mv_sort(5, \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats median_absolute_deviation(stringField)", - "error": [ - "Argument of [median_absolute_deviation] must be [number], found value [stringField] type [string]" - ], + "query": "row var = mv_sort(to_ip(\"127.0.0.1\"), \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = median_absolute_deviation(*)", - "error": [ - "Using wildcards (*) in median_absolute_deviation is not allowed" - ], + "query": "row mv_sort(to_ip(\"127.0.0.1\"), \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | sort median_absolute_deviation(numberField)", - "error": [ - "SORT does not support function median_absolute_deviation" - ], + "query": "row var = mv_sort(to_version(\"1.0.0\"), \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | where median_absolute_deviation(numberField)", - "error": [ - "WHERE does not support function median_absolute_deviation" - ], + "query": "row mv_sort(to_version(\"1.0.0\"), \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | where median_absolute_deviation(numberField) > 0", + "query": "row var = mv_sort(to_cartesianpoint(\"POINT (30 10)\"), true)", "error": [ - "WHERE does not support function median_absolute_deviation" + "Argument of [mv_sort] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]", + "Argument of [mv_sort] must be [string], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = median_absolute_deviation(numberField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], + "query": "from a_index | where mv_sort(numberField, \"asc\") > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = median_absolute_deviation(numberField) > 0", + "query": "from a_index | where mv_sort(cartesianPointField, booleanField) > 0", "error": [ - "EVAL does not support function median_absolute_deviation" + "Argument of [mv_sort] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [mv_sort] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval median_absolute_deviation(numberField)", - "error": [ - "EVAL does not support function median_absolute_deviation" - ], + "query": "from a_index | where length(mv_sort(stringField, \"asc\")) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval median_absolute_deviation(numberField) > 0", + "query": "from a_index | where length(mv_sort(cartesianPointField, booleanField)) > 0", "error": [ - "EVAL does not support function median_absolute_deviation" + "Argument of [mv_sort] must be [boolean], found value [cartesianPointField] type [cartesian_point]", + "Argument of [mv_sort] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats var = percentile(numberField, 5)", + "query": "from a_index | eval var = mv_sort(booleanField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats percentile(numberField, 5)", + "query": "from a_index | eval mv_sort(booleanField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(percentile(numberField, 5))", + "query": "from a_index | eval var = mv_sort(dateField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats round(percentile(numberField, 5))", + "query": "from a_index | eval mv_sort(dateField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(percentile(numberField, 5)) + percentile(numberField, 5)", + "query": "from a_index | eval var = mv_sort(numberField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats round(percentile(numberField, 5)) + percentile(numberField, 5)", + "query": "from a_index | eval mv_sort(numberField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats percentile(numberField, numberField)", - "error": [ - "Argument of [percentile] must be a constant, received [numberField]" - ], + "query": "from a_index | eval var = mv_sort(ipField, \"asc\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats percentile(numberField / 2, 5)", + "query": "from a_index | eval mv_sort(ipField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = percentile(numberField / 2, 5)", + "query": "from a_index | eval var = mv_sort(versionField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), percentile(numberField / 2, 5)", + "query": "from a_index | eval mv_sort(versionField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = percentile(numberField / 2, 5)", - "error": [], + "query": "from a_index | eval mv_sort(booleanField, \"asc\", extraArg)", + "error": [ + "Error: [mv_sort] function expects no more than 2 arguments, got 3." + ], "warning": [] }, { - "query": "from a_index | stats var0 = percentile(numberField, 5)", + "query": "from a_index | sort mv_sort(booleanField, \"asc\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), percentile(numberField, 5)", + "query": "row var = mv_sum(5)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5)", + "query": "row mv_sum(5)", "error": [], "warning": [] }, { - "query": "from a_index | stats percentile(numberField, 5) by round(numberField / 2)", + "query": "row var = mv_sum(to_integer(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = percentile(numberField, 5) by var1 = round(numberField / 2)", - "error": [], + "query": "row var = mv_sum(\"a\")", + "error": [ + "Argument of [mv_sum] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), ipField", + "query": "from a_index | where mv_sum(numberField) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), ipField", - "error": [], + "query": "from a_index | where mv_sum(stringField) > 0", + "error": [ + "Argument of [mv_sum] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = mv_sum(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), numberField / 2", + "query": "from a_index | eval mv_sum(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = percentile(avg(numberField), 5)", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "from a_index | eval var = mv_sum(to_integer(stringField))", + "error": [], "warning": [] }, { - "query": "from a_index | stats percentile(avg(numberField), 5)", + "query": "from a_index | eval mv_sum(stringField)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Argument of [mv_sum] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | stats percentile(stringField, 5)", + "query": "from a_index | eval mv_sum(numberField, extraArg)", "error": [ - "Argument of [percentile] must be [number], found value [stringField] type [string]" + "Error: [mv_sum] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | sort percentile(numberField, 5)", + "query": "from a_index | eval var = mv_sum(*)", "error": [ - "SORT does not support function percentile" + "Using wildcards (*) in mv_sum is not allowed" ], "warning": [] }, { - "query": "from a_index | where percentile(numberField, 5)", - "error": [ - "WHERE does not support function percentile" - ], + "query": "from a_index | sort mv_sum(numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | where percentile(numberField, 5) > 0", - "error": [ - "WHERE does not support function percentile" - ], + "query": "row var = mv_sum(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = percentile(numberField, 5)", + "query": "row var = mv_sum(true)", "error": [ - "EVAL does not support function percentile" + "Argument of [mv_sum] must be [number], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = percentile(numberField, 5) > 0", + "query": "from a_index | where mv_sum(booleanField) > 0", "error": [ - "EVAL does not support function percentile" + "Argument of [mv_sum] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval percentile(numberField, 5)", - "error": [ - "EVAL does not support function percentile" - ], + "query": "from a_index | eval var = mv_sum(to_integer(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval percentile(numberField, 5) > 0", + "query": "from a_index | eval mv_sum(booleanField)", "error": [ - "EVAL does not support function percentile" + "Argument of [mv_sum] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats var = max(numberField)", + "query": "row var = mv_zip(\"a\", \"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats max(numberField)", + "query": "row var = mv_zip(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(max(numberField))", + "query": "row mv_zip(\"a\", \"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats round(max(numberField))", + "query": "row mv_zip(\"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(max(numberField)) + max(numberField)", + "query": "row var = mv_zip(to_string(\"a\"), to_string(\"a\"), to_string(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(max(numberField)) + max(numberField)", - "error": [], + "query": "row var = mv_zip(5, 5, 5)", + "error": [ + "Argument of [mv_zip] must be [string], found value [5] type [number]", + "Argument of [mv_zip] must be [string], found value [5] type [number]", + "Argument of [mv_zip] must be [string], found value [5] type [number]" + ], "warning": [] }, { - "query": "from a_index | stats max(numberField / 2)", + "query": "from a_index | where length(mv_zip(stringField, stringField, stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = max(numberField / 2)", - "error": [], + "query": "from a_index | where length(mv_zip(numberField, numberField, numberField)) > 0", + "error": [ + "Argument of [mv_zip] must be [string], found value [numberField] type [number]", + "Argument of [mv_zip] must be [string], found value [numberField] type [number]", + "Argument of [mv_zip] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), max(numberField / 2)", + "query": "from a_index | eval var = mv_zip(stringField, stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = max(numberField / 2)", + "query": "from a_index | eval mv_zip(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = max(numberField)", + "query": "from a_index | eval mv_zip(stringField, stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), max(numberField)", + "query": "from a_index | eval var = mv_zip(to_string(stringField), to_string(stringField), to_string(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = max(numberField)", - "error": [], + "query": "from a_index | eval mv_zip(numberField, numberField, numberField)", + "error": [ + "Argument of [mv_zip] must be [string], found value [numberField] type [number]", + "Argument of [mv_zip] must be [string], found value [numberField] type [number]", + "Argument of [mv_zip] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { - "query": "from a_index | stats max(numberField) by round(numberField / 2)", - "error": [], + "query": "from a_index | eval mv_zip(stringField, stringField, stringField, extraArg)", + "error": [ + "Error: [mv_zip] function expects no more than 3 arguments, got 4." + ], "warning": [] }, { - "query": "from a_index | stats var0 = max(numberField) by var1 = round(numberField / 2)", + "query": "from a_index | sort mv_zip(stringField, stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), ipField", + "query": "row var = mv_zip(to_string(true), to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), ipField", - "error": [], + "query": "row var = mv_zip(true, true, true)", + "error": [ + "Argument of [mv_zip] must be [string], found value [true] type [boolean]", + "Argument of [mv_zip] must be [string], found value [true] type [boolean]", + "Argument of [mv_zip] must be [string], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), numberField / 2", - "error": [], + "query": "from a_index | where length(mv_zip(booleanField, booleanField, booleanField)) > 0", + "error": [ + "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]", + "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]", + "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = max(avg(numberField))", + "query": "from a_index | eval mv_zip(booleanField, booleanField, booleanField)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]", + "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]", + "Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats max(avg(numberField))", - "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" - ], + "query": "row var = now()", + "error": [], "warning": [] }, { - "query": "from a_index | stats max(stringField)", - "error": [ - "Argument of [max] must be [number], found value [stringField] type [string]" - ], + "query": "row now()", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = max(*)", + "query": "from a_index | eval var = now()", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval now()", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval now(extraArg)", "error": [ - "Using wildcards (*) in max is not allowed" + "Error: [now] function expects exactly 0 arguments, got 1." ], "warning": [] }, { - "query": "from a_index | stats var = max(dateField)", + "query": "from a_index | sort now()", "error": [], "warning": [] }, { - "query": "from a_index | stats max(dateField)", + "query": "row var = pi()", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(max(dateField))", + "query": "row pi()", "error": [], "warning": [] }, { - "query": "from a_index | stats round(max(dateField))", + "query": "from a_index | where pi() > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(max(dateField)) + max(dateField)", + "query": "from a_index | eval var = pi()", "error": [], "warning": [] }, { - "query": "from a_index | stats round(max(dateField)) + max(dateField)", + "query": "from a_index | eval pi()", "error": [], "warning": [] }, { - "query": "from a_index | sort max(numberField)", + "query": "from a_index | eval pi(extraArg)", "error": [ - "SORT does not support function max" + "Error: [pi] function expects exactly 0 arguments, got 1." ], "warning": [] }, { - "query": "from a_index | where max(numberField)", - "error": [ - "WHERE does not support function max" - ], + "query": "from a_index | sort pi()", + "error": [], "warning": [] }, { - "query": "from a_index | where max(numberField) > 0", - "error": [ - "WHERE does not support function max" - ], + "query": "row var = pow(5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | where max(dateField)", - "error": [ - "WHERE does not support function max" - ], + "query": "row pow(5, 5)", + "error": [], "warning": [] }, { - "query": "from a_index | where max(dateField) > 0", - "error": [ - "WHERE does not support function max" - ], + "query": "row var = pow(to_integer(\"a\"), to_integer(\"a\"))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = max(numberField)", + "query": "row var = pow(\"a\", \"a\")", "error": [ - "EVAL does not support function max" + "Argument of [pow] must be [number], found value [\"a\"] type [string]", + "Argument of [pow] must be [number], found value [\"a\"] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = max(numberField) > 0", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | where pow(numberField, numberField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval max(numberField)", + "query": "from a_index | where pow(stringField, stringField) > 0", "error": [ - "EVAL does not support function max" + "Argument of [pow] must be [number], found value [stringField] type [string]", + "Argument of [pow] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval max(numberField) > 0", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval var = pow(numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = max(dateField)", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval pow(numberField, numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = max(dateField) > 0", - "error": [ - "EVAL does not support function max" - ], + "query": "from a_index | eval var = pow(to_integer(stringField), to_integer(stringField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval max(dateField)", + "query": "from a_index | eval pow(stringField, stringField)", "error": [ - "EVAL does not support function max" + "Argument of [pow] must be [number], found value [stringField] type [string]", + "Argument of [pow] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval max(dateField) > 0", + "query": "from a_index | eval pow(numberField, numberField, extraArg)", "error": [ - "EVAL does not support function max" + "Error: [pow] function expects exactly 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | stats var = min(numberField)", + "query": "from a_index | sort pow(numberField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats min(numberField)", + "query": "row var = pow(to_integer(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(min(numberField))", - "error": [], + "query": "row var = pow(true, true)", + "error": [ + "Argument of [pow] must be [number], found value [true] type [boolean]", + "Argument of [pow] must be [number], found value [true] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats round(min(numberField))", - "error": [], + "query": "from a_index | where pow(booleanField, booleanField) > 0", + "error": [ + "Argument of [pow] must be [number], found value [booleanField] type [boolean]", + "Argument of [pow] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats var = round(min(numberField)) + min(numberField)", + "query": "from a_index | eval var = pow(to_integer(booleanField), to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats round(min(numberField)) + min(numberField)", - "error": [], + "query": "from a_index | eval pow(booleanField, booleanField)", + "error": [ + "Argument of [pow] must be [number], found value [booleanField] type [boolean]", + "Argument of [pow] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats min(numberField / 2)", + "query": "row var = replace(\"a\", \"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = min(numberField / 2)", + "query": "row replace(\"a\", \"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), min(numberField / 2)", + "query": "row var = replace(to_string(\"a\"), to_string(\"a\"), to_string(\"a\"))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = min(numberField / 2)", - "error": [], + "query": "row var = replace(5, 5, 5)", + "error": [ + "Argument of [replace] must be [string], found value [5] type [number]", + "Argument of [replace] must be [string], found value [5] type [number]", + "Argument of [replace] must be [string], found value [5] type [number]" + ], "warning": [] }, { - "query": "from a_index | stats var0 = min(numberField)", + "query": "from a_index | where length(replace(stringField, stringField, stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), min(numberField)", - "error": [], + "query": "from a_index | where length(replace(numberField, numberField, numberField)) > 0", + "error": [ + "Argument of [replace] must be [string], found value [numberField] type [number]", + "Argument of [replace] must be [string], found value [numberField] type [number]", + "Argument of [replace] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = min(numberField)", + "query": "from a_index | eval var = replace(stringField, stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats min(numberField) by round(numberField / 2)", + "query": "from a_index | eval replace(stringField, stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var0 = min(numberField) by var1 = round(numberField / 2)", + "query": "from a_index | eval var = replace(to_string(stringField), to_string(stringField), to_string(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), ipField", - "error": [], + "query": "from a_index | eval replace(numberField, numberField, numberField)", + "error": [ + "Argument of [replace] must be [string], found value [numberField] type [number]", + "Argument of [replace] must be [string], found value [numberField] type [number]", + "Argument of [replace] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), ipField", - "error": [], + "query": "from a_index | eval replace(stringField, stringField, stringField, extraArg)", + "error": [ + "Error: [replace] function expects exactly 3 arguments, got 4." + ], "warning": [] }, { - "query": "from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), numberField / 2", + "query": "from a_index | sort replace(stringField, stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), numberField / 2", + "query": "row var = replace(to_string(true), to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = min(avg(numberField))", + "query": "row var = replace(true, true, true)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Argument of [replace] must be [string], found value [true] type [boolean]", + "Argument of [replace] must be [string], found value [true] type [boolean]", + "Argument of [replace] must be [string], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats min(avg(numberField))", + "query": "from a_index | where length(replace(booleanField, booleanField, booleanField)) > 0", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Argument of [replace] must be [string], found value [booleanField] type [boolean]", + "Argument of [replace] must be [string], found value [booleanField] type [boolean]", + "Argument of [replace] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats min(stringField)", + "query": "from a_index | eval var = replace(to_string(booleanField), to_string(booleanField), to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval replace(booleanField, booleanField, booleanField)", "error": [ - "Argument of [min] must be [number], found value [stringField] type [string]" + "Argument of [replace] must be [string], found value [booleanField] type [boolean]", + "Argument of [replace] must be [string], found value [booleanField] type [boolean]", + "Argument of [replace] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats var = min(*)", + "query": "row var = right(\"a\", 5)", + "error": [], + "warning": [] + }, + { + "query": "row right(\"a\", 5)", + "error": [], + "warning": [] + }, + { + "query": "row var = right(to_string(\"a\"), to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = right(5, \"a\")", "error": [ - "Using wildcards (*) in min is not allowed" + "Argument of [right] must be [string], found value [5] type [number]", + "Argument of [right] must be [number], found value [\"a\"] type [string]" ], "warning": [] }, { - "query": "from a_index | stats var = min(dateField)", + "query": "from a_index | where length(right(stringField, numberField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats min(dateField)", + "query": "from a_index | where length(right(numberField, stringField)) > 0", + "error": [ + "Argument of [right] must be [string], found value [numberField] type [number]", + "Argument of [right] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = right(stringField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(min(dateField))", + "query": "from a_index | eval right(stringField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(min(dateField))", + "query": "from a_index | eval var = right(to_string(stringField), to_integer(stringField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(min(dateField)) + min(dateField)", + "query": "from a_index | eval right(numberField, stringField)", + "error": [ + "Argument of [right] must be [string], found value [numberField] type [number]", + "Argument of [right] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval right(stringField, numberField, extraArg)", + "error": [ + "Error: [right] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | sort right(stringField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats round(min(dateField)) + min(dateField)", + "query": "row var = right(to_string(true), to_integer(true))", "error": [], "warning": [] }, { - "query": "from a_index | sort min(numberField)", + "query": "row var = right(true, true)", "error": [ - "SORT does not support function min" + "Argument of [right] must be [string], found value [true] type [boolean]", + "Argument of [right] must be [number], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where min(numberField)", + "query": "from a_index | where length(right(booleanField, booleanField)) > 0", "error": [ - "WHERE does not support function min" + "Argument of [right] must be [string], found value [booleanField] type [boolean]", + "Argument of [right] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where min(numberField) > 0", + "query": "from a_index | eval var = right(to_string(booleanField), to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval right(booleanField, booleanField)", "error": [ - "WHERE does not support function min" + "Argument of [right] must be [string], found value [booleanField] type [boolean]", + "Argument of [right] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where min(dateField)", + "query": "row var = round(5, 5)", + "error": [], + "warning": [] + }, + { + "query": "row round(5, 5)", + "error": [], + "warning": [] + }, + { + "query": "row var = round(to_integer(\"a\"), to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = round(\"a\", \"a\")", "error": [ - "WHERE does not support function min" + "Argument of [round] must be [number], found value [\"a\"] type [string]", + "Argument of [round] must be [number], found value [\"a\"] type [string]" ], "warning": [] }, { - "query": "from a_index | where min(dateField) > 0", + "query": "from a_index | where round(numberField, numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where round(stringField, stringField) > 0", "error": [ - "WHERE does not support function min" + "Argument of [round] must be [number], found value [stringField] type [string]", + "Argument of [round] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = min(numberField)", + "query": "from a_index | eval var = round(numberField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval round(numberField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = round(to_integer(stringField), to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval round(stringField, stringField)", "error": [ - "EVAL does not support function min" + "Argument of [round] must be [number], found value [stringField] type [string]", + "Argument of [round] must be [number], found value [stringField] type [string]" ], "warning": [] }, { - "query": "from a_index | eval var = min(numberField) > 0", + "query": "from a_index | eval round(numberField, numberField, extraArg)", "error": [ - "EVAL does not support function min" + "Error: [round] function expects no more than 2 arguments, got 3." ], "warning": [] }, { - "query": "from a_index | eval min(numberField)", + "query": "from a_index | sort round(numberField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "row var = round(5)", + "error": [], + "warning": [] + }, + { + "query": "row round(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = round(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = round(to_integer(true), to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = round(true, true)", "error": [ - "EVAL does not support function min" + "Argument of [round] must be [number], found value [true] type [boolean]", + "Argument of [round] must be [number], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval min(numberField) > 0", + "query": "from a_index | where round(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where round(booleanField) > 0", "error": [ - "EVAL does not support function min" + "Argument of [round] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = min(dateField)", + "query": "from a_index | where round(booleanField, booleanField) > 0", "error": [ - "EVAL does not support function min" + "Argument of [round] must be [number], found value [booleanField] type [boolean]", + "Argument of [round] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = min(dateField) > 0", + "query": "from a_index | eval var = round(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval round(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = round(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval round(booleanField)", "error": [ - "EVAL does not support function min" + "Argument of [round] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval min(dateField)", + "query": "from a_index | eval var = round(*)", "error": [ - "EVAL does not support function min" + "Using wildcards (*) in round is not allowed" ], "warning": [] }, { - "query": "from a_index | eval min(dateField) > 0", + "query": "from a_index | eval var = round(to_integer(booleanField), to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval round(booleanField, booleanField)", "error": [ - "EVAL does not support function min" + "Argument of [round] must be [number], found value [booleanField] type [boolean]", + "Argument of [round] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats var = count(stringField)", + "query": "from a_index | sort round(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats count(stringField)", + "query": "row var = rtrim(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(count(stringField))", + "query": "row rtrim(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats round(count(stringField))", + "query": "row var = rtrim(to_string(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = rtrim(5)", + "error": [ + "Argument of [rtrim] must be [string], found value [5] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(rtrim(stringField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(rtrim(numberField)) > 0", + "error": [ + "Argument of [rtrim] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = rtrim(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval rtrim(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = rtrim(to_string(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval rtrim(numberField)", + "error": [ + "Argument of [rtrim] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval rtrim(stringField, extraArg)", + "error": [ + "Error: [rtrim] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = rtrim(*)", + "error": [ + "Using wildcards (*) in rtrim is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort rtrim(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = rtrim(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(count(stringField)) + count(stringField)", + "query": "row var = rtrim(true)", + "error": [ + "Argument of [rtrim] must be [string], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(rtrim(booleanField)) > 0", + "error": [ + "Argument of [rtrim] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = rtrim(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval rtrim(booleanField)", + "error": [ + "Argument of [rtrim] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = signum(5)", + "error": [], + "warning": [] + }, + { + "query": "row signum(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = signum(to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = signum(\"a\")", + "error": [ + "Argument of [signum] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where signum(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where signum(stringField) > 0", + "error": [ + "Argument of [signum] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = signum(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval signum(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = signum(to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval signum(stringField)", + "error": [ + "Argument of [signum] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval signum(numberField, extraArg)", + "error": [ + "Error: [signum] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = signum(*)", + "error": [ + "Using wildcards (*) in signum is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort signum(numberField)", + "error": [], + "warning": [] + }, + { + "query": "row var = signum(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = signum(true)", + "error": [ + "Argument of [signum] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where signum(booleanField) > 0", + "error": [ + "Argument of [signum] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = signum(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval signum(booleanField)", + "error": [ + "Argument of [signum] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = sin(5)", + "error": [], + "warning": [] + }, + { + "query": "row sin(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = sin(to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = sin(\"a\")", + "error": [ + "Argument of [sin] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where sin(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where sin(stringField) > 0", + "error": [ + "Argument of [sin] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sin(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sin(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = sin(to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sin(stringField)", + "error": [ + "Argument of [sin] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval sin(numberField, extraArg)", + "error": [ + "Error: [sin] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sin(*)", + "error": [ + "Using wildcards (*) in sin is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort sin(numberField)", + "error": [], + "warning": [] + }, + { + "query": "row var = sin(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = sin(true)", + "error": [ + "Argument of [sin] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where sin(booleanField) > 0", + "error": [ + "Argument of [sin] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sin(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sin(booleanField)", + "error": [ + "Argument of [sin] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = sinh(5)", + "error": [], + "warning": [] + }, + { + "query": "row sinh(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = sinh(to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = sinh(\"a\")", + "error": [ + "Argument of [sinh] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where sinh(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where sinh(stringField) > 0", + "error": [ + "Argument of [sinh] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sinh(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sinh(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = sinh(to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sinh(stringField)", + "error": [ + "Argument of [sinh] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval sinh(numberField, extraArg)", + "error": [ + "Error: [sinh] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sinh(*)", + "error": [ + "Using wildcards (*) in sinh is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort sinh(numberField)", + "error": [], + "warning": [] + }, + { + "query": "row var = sinh(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = sinh(true)", + "error": [ + "Argument of [sinh] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where sinh(booleanField) > 0", + "error": [ + "Argument of [sinh] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sinh(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sinh(booleanField)", + "error": [ + "Argument of [sinh] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = split(\"a\", \"a\")", + "error": [], + "warning": [] + }, + { + "query": "row split(\"a\", \"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = split(to_string(\"a\"), to_string(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = split(5, 5)", + "error": [ + "Argument of [split] must be [string], found value [5] type [number]", + "Argument of [split] must be [string], found value [5] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(split(stringField, stringField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(split(numberField, numberField)) > 0", + "error": [ + "Argument of [split] must be [string], found value [numberField] type [number]", + "Argument of [split] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = split(stringField, stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval split(stringField, stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = split(to_string(stringField), to_string(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval split(numberField, numberField)", + "error": [ + "Argument of [split] must be [string], found value [numberField] type [number]", + "Argument of [split] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval split(stringField, stringField, extraArg)", + "error": [ + "Error: [split] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | sort split(stringField, stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = split(to_string(true), to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = split(true, true)", + "error": [ + "Argument of [split] must be [string], found value [true] type [boolean]", + "Argument of [split] must be [string], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(split(booleanField, booleanField)) > 0", + "error": [ + "Argument of [split] must be [string], found value [booleanField] type [boolean]", + "Argument of [split] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = split(to_string(booleanField), to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval split(booleanField, booleanField)", + "error": [ + "Argument of [split] must be [string], found value [booleanField] type [boolean]", + "Argument of [split] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = sqrt(5)", + "error": [], + "warning": [] + }, + { + "query": "row sqrt(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = sqrt(to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = sqrt(\"a\")", + "error": [ + "Argument of [sqrt] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where sqrt(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where sqrt(stringField) > 0", + "error": [ + "Argument of [sqrt] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sqrt(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sqrt(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = sqrt(to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sqrt(stringField)", + "error": [ + "Argument of [sqrt] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval sqrt(numberField, extraArg)", + "error": [ + "Error: [sqrt] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sqrt(*)", + "error": [ + "Using wildcards (*) in sqrt is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort sqrt(numberField)", + "error": [], + "warning": [] + }, + { + "query": "row var = sqrt(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = sqrt(true)", + "error": [ + "Argument of [sqrt] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where sqrt(booleanField) > 0", + "error": [ + "Argument of [sqrt] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sqrt(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval sqrt(booleanField)", + "error": [ + "Argument of [sqrt] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = st_contains(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_contains(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(\"a\", \"a\")", + "error": [ + "Argument of [st_contains] must be [cartesian_point], found value [\"a\"] type [string]", + "Argument of [st_contains] must be [cartesian_point], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "row var = st_contains(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_contains(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_contains(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_contains(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_contains(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_geopoint(stringField), to_geopoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(stringField, stringField)", + "error": [ + "Argument of [st_contains] must be [cartesian_point], found value [stringField] type [string]", + "Argument of [st_contains] must be [cartesian_point], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(geoPointField, geoPointField, extraArg)", + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(geoPointField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(geoPointField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_geopoint(stringField), geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(geoPointField, geoShapeField, extraArg)", + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(geoShapeField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(geoShapeField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(geoShapeField, to_geopoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(geoShapeField, geoPointField, extraArg)", + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(geoShapeField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(geoShapeField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(geoShapeField, geoShapeField, extraArg)", + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(cartesianPointField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(cartesianPointField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_cartesianpoint(stringField), cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(cartesianPointField, cartesianShapeField, extraArg)", + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(cartesianShapeField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(cartesianShapeField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(cartesianShapeField, to_cartesianpoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(cartesianShapeField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(cartesianShapeField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(cartesianShapeField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(cartesianShapeField, cartesianShapeField, extraArg)", + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | sort st_contains(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_contains(true, true)", + "error": [ + "Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]", + "Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_contains(booleanField, booleanField)", + "error": [ + "Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]", + "Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort st_contains(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(\"a\", \"a\")", + "error": [ + "Argument of [st_disjoint] must be [cartesian_point], found value [\"a\"] type [string]", + "Argument of [st_disjoint] must be [cartesian_point], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_disjoint(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_disjoint(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_disjoint(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_disjoint(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_geopoint(stringField), to_geopoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(stringField, stringField)", + "error": [ + "Argument of [st_disjoint] must be [cartesian_point], found value [stringField] type [string]", + "Argument of [st_disjoint] must be [cartesian_point], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(geoPointField, geoPointField, extraArg)", + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(geoPointField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(geoPointField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_geopoint(stringField), geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(geoPointField, geoShapeField, extraArg)", + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(geoShapeField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(geoShapeField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(geoShapeField, to_geopoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(geoShapeField, geoPointField, extraArg)", + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(geoShapeField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(geoShapeField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(geoShapeField, geoShapeField, extraArg)", + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(cartesianPointField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(stringField), cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField, extraArg)", + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(cartesianShapeField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(cartesianShapeField, to_cartesianpoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(cartesianShapeField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField, extraArg)", + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | sort st_disjoint(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_disjoint(true, true)", + "error": [ + "Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]", + "Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_disjoint(booleanField, booleanField)", + "error": [ + "Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]", + "Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort st_disjoint(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_intersects(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(\"a\", \"a\")", + "error": [ + "Argument of [st_intersects] must be [cartesian_point], found value [\"a\"] type [string]", + "Argument of [st_intersects] must be [cartesian_point], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_intersects(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_intersects(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_intersects(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_intersects(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_geopoint(stringField), to_geopoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(stringField, stringField)", + "error": [ + "Argument of [st_intersects] must be [cartesian_point], found value [stringField] type [string]", + "Argument of [st_intersects] must be [cartesian_point], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(geoPointField, geoPointField, extraArg)", + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(geoPointField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(geoPointField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_geopoint(stringField), geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(geoPointField, geoShapeField, extraArg)", + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(geoShapeField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(geoShapeField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(geoShapeField, to_geopoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(geoShapeField, geoPointField, extraArg)", + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(geoShapeField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(geoShapeField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(geoShapeField, geoShapeField, extraArg)", + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(cartesianPointField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(cartesianPointField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_cartesianpoint(stringField), cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(cartesianPointField, cartesianShapeField, extraArg)", + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(cartesianShapeField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(cartesianShapeField, to_cartesianpoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(cartesianShapeField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField, extraArg)", + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | sort st_intersects(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_intersects(true, true)", + "error": [ + "Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]", + "Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_intersects(booleanField, booleanField)", + "error": [ + "Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]", + "Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort st_intersects(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_within(to_geopoint(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_geopoint(\"a\"), to_geopoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(\"a\", \"a\")", + "error": [ + "Argument of [st_within] must be [cartesian_point], found value [\"a\"] type [string]", + "Argument of [st_within] must be [cartesian_point], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "row var = st_within(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_within(to_geopoint(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_geopoint(\"a\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geopoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_within(to_geoshape(\"POINT (30 10)\"), to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianpoint(\"a\"), to_cartesianpoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_within(to_cartesianpoint(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianpoint(\"a\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianpoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_within(to_cartesianshape(\"POINT (30 10)\"), to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_geopoint(stringField), to_geopoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(stringField, stringField)", + "error": [ + "Argument of [st_within] must be [cartesian_point], found value [stringField] type [string]", + "Argument of [st_within] must be [cartesian_point], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_within(geoPointField, geoPointField, extraArg)", + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(geoPointField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(geoPointField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_geopoint(stringField), geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(geoPointField, geoShapeField, extraArg)", + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(geoShapeField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(geoShapeField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(geoShapeField, to_geopoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(geoShapeField, geoPointField, extraArg)", + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(geoShapeField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(geoShapeField, geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(geoShapeField, geoShapeField, extraArg)", + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_cartesianpoint(stringField), to_cartesianpoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(cartesianPointField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(cartesianPointField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_cartesianpoint(stringField), cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(cartesianPointField, cartesianShapeField, extraArg)", + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(cartesianShapeField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(cartesianShapeField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(cartesianShapeField, to_cartesianpoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(cartesianShapeField, cartesianPointField, extraArg)", + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(cartesianShapeField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(cartesianShapeField, cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(cartesianShapeField, cartesianShapeField, extraArg)", + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | sort st_within(geoPointField, geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")), to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_geopoint(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(to_geoshape(to_geopoint(\"POINT (30 10)\")), to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_within(true, true)", + "error": [ + "Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]", + "Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_within(booleanField, booleanField)", + "error": [ + "Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]", + "Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_geopoint(geoPointField), to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_geopoint(geoPointField), to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_geoshape(geoPointField), to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_within(to_geoshape(geoPointField), to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort st_within(cartesianPointField, cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_x(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_x(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_x(to_geopoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_x(\"a\")", + "error": [ + "Argument of [st_x] must be [cartesian_point], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "row var = st_x(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_x(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_x(to_cartesianpoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_x(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_x(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_x(to_geopoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_x(stringField)", + "error": [ + "Argument of [st_x] must be [cartesian_point], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_x(geoPointField, extraArg)", + "error": [ + "Error: [st_x] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_x(*)", + "error": [ + "Using wildcards (*) in st_x is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_x(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_x(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_x(to_cartesianpoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_x(cartesianPointField, extraArg)", + "error": [ + "Error: [st_x] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort st_x(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_x(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_x(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_x(true)", + "error": [ + "Argument of [st_x] must be [cartesian_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_x(to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_x(booleanField)", + "error": [ + "Argument of [st_x] must be [cartesian_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_x(to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort st_x(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_y(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_y(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_y(to_geopoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_y(\"a\")", + "error": [ + "Argument of [st_y] must be [cartesian_point], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "row var = st_y(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row st_y(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_y(to_cartesianpoint(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_y(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_y(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_y(to_geopoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_y(stringField)", + "error": [ + "Argument of [st_y] must be [cartesian_point], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_y(geoPointField, extraArg)", + "error": [ + "Error: [st_y] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_y(*)", + "error": [ + "Using wildcards (*) in st_y is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_y(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_y(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = st_y(to_cartesianpoint(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_y(cartesianPointField, extraArg)", + "error": [ + "Error: [st_y] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort st_y(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = st_y(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_y(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = st_y(true)", + "error": [ + "Argument of [st_y] must be [cartesian_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_y(to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval st_y(booleanField)", + "error": [ + "Argument of [st_y] must be [cartesian_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_y(to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort st_y(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = starts_with(\"a\", \"a\")", + "error": [], + "warning": [] + }, + { + "query": "row starts_with(\"a\", \"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = starts_with(to_string(\"a\"), to_string(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = starts_with(5, 5)", + "error": [ + "Argument of [starts_with] must be [string], found value [5] type [number]", + "Argument of [starts_with] must be [string], found value [5] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = starts_with(stringField, stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval starts_with(stringField, stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = starts_with(to_string(stringField), to_string(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval starts_with(numberField, numberField)", + "error": [ + "Argument of [starts_with] must be [string], found value [numberField] type [number]", + "Argument of [starts_with] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval starts_with(stringField, stringField, extraArg)", + "error": [ + "Error: [starts_with] function expects exactly 2 arguments, got 3." + ], + "warning": [] + }, + { + "query": "from a_index | sort starts_with(stringField, stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = starts_with(to_string(true), to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = starts_with(true, true)", + "error": [ + "Argument of [starts_with] must be [string], found value [true] type [boolean]", + "Argument of [starts_with] must be [string], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = starts_with(to_string(booleanField), to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval starts_with(booleanField, booleanField)", + "error": [ + "Argument of [starts_with] must be [string], found value [booleanField] type [boolean]", + "Argument of [starts_with] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = substring(\"a\", 5, 5)", + "error": [], + "warning": [] + }, + { + "query": "row var = substring(\"a\", 5)", + "error": [], + "warning": [] + }, + { + "query": "row substring(\"a\", 5, 5)", + "error": [], + "warning": [] + }, + { + "query": "row substring(\"a\", 5)", + "error": [], + "warning": [] + }, + { + "query": "row var = substring(to_string(\"a\"), to_integer(\"a\"), to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = substring(5, \"a\", \"a\")", + "error": [ + "Argument of [substring] must be [string], found value [5] type [number]", + "Argument of [substring] must be [number], found value [\"a\"] type [string]", + "Argument of [substring] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(substring(stringField, numberField, numberField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(substring(numberField, stringField, stringField)) > 0", + "error": [ + "Argument of [substring] must be [string], found value [numberField] type [number]", + "Argument of [substring] must be [number], found value [stringField] type [string]", + "Argument of [substring] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = substring(stringField, numberField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval substring(stringField, numberField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = substring(to_string(stringField), to_integer(stringField), to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval substring(numberField, stringField, stringField)", + "error": [ + "Argument of [substring] must be [string], found value [numberField] type [number]", + "Argument of [substring] must be [number], found value [stringField] type [string]", + "Argument of [substring] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval substring(stringField, numberField, numberField, extraArg)", + "error": [ + "Error: [substring] function expects no more than 3 arguments, got 4." + ], + "warning": [] + }, + { + "query": "from a_index | sort substring(stringField, numberField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort substring(stringField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "row var = substring(to_string(true), to_integer(true), to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = substring(true, true, true)", + "error": [ + "Argument of [substring] must be [string], found value [true] type [boolean]", + "Argument of [substring] must be [number], found value [true] type [boolean]", + "Argument of [substring] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(substring(booleanField, booleanField, booleanField)) > 0", + "error": [ + "Argument of [substring] must be [string], found value [booleanField] type [boolean]", + "Argument of [substring] must be [number], found value [booleanField] type [boolean]", + "Argument of [substring] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = substring(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval substring(booleanField, booleanField, booleanField)", + "error": [ + "Argument of [substring] must be [string], found value [booleanField] type [boolean]", + "Argument of [substring] must be [number], found value [booleanField] type [boolean]", + "Argument of [substring] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = tan(5)", + "error": [], + "warning": [] + }, + { + "query": "row tan(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = tan(to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = tan(\"a\")", + "error": [ + "Argument of [tan] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where tan(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where tan(stringField) > 0", + "error": [ + "Argument of [tan] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = tan(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval tan(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = tan(to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval tan(stringField)", + "error": [ + "Argument of [tan] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval tan(numberField, extraArg)", + "error": [ + "Error: [tan] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = tan(*)", + "error": [ + "Using wildcards (*) in tan is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort tan(numberField)", + "error": [], + "warning": [] + }, + { + "query": "row var = tan(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = tan(true)", + "error": [ + "Argument of [tan] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where tan(booleanField) > 0", + "error": [ + "Argument of [tan] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = tan(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval tan(booleanField)", + "error": [ + "Argument of [tan] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = tanh(5)", + "error": [], + "warning": [] + }, + { + "query": "row tanh(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = tanh(to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = tanh(\"a\")", + "error": [ + "Argument of [tanh] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where tanh(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where tanh(stringField) > 0", + "error": [ + "Argument of [tanh] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = tanh(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval tanh(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = tanh(to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval tanh(stringField)", + "error": [ + "Argument of [tanh] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval tanh(numberField, extraArg)", + "error": [ + "Error: [tanh] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = tanh(*)", + "error": [ + "Using wildcards (*) in tanh is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort tanh(numberField)", + "error": [], + "warning": [] + }, + { + "query": "row var = tanh(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = tanh(true)", + "error": [ + "Argument of [tanh] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where tanh(booleanField) > 0", + "error": [ + "Argument of [tanh] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = tanh(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval tanh(booleanField)", + "error": [ + "Argument of [tanh] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = tau()", + "error": [], + "warning": [] + }, + { + "query": "row tau()", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where tau() > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = tau()", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval tau()", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval tau(extraArg)", + "error": [ + "Error: [tau] function expects exactly 0 arguments, got 1." + ], + "warning": [] + }, + { + "query": "from a_index | sort tau()", + "error": [], + "warning": [] + }, + { + "query": "row var = to_boolean(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_boolean(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_bool(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_boolean(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_boolean(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_bool(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_boolean(*)", + "error": [ + "Using wildcards (*) in to_boolean is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_boolean(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_boolean(true)", + "error": [], + "warning": [] + }, + { + "query": "row to_boolean(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_bool(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_boolean(to_boolean(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_boolean(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_boolean(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_bool(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_boolean(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_boolean(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_boolean(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [to_boolean] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_boolean(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_boolean(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_bool(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_boolean(to_boolean(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_boolean(cartesianPointField)", + "error": [ + "Argument of [to_boolean] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_boolean(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_boolean(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_bool(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_boolean(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_boolean(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_boolean(booleanField, extraArg)", + "error": [ + "Error: [to_boolean] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_boolean(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianpoint(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_cartesianpoint(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianpoint(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_cartesianpoint(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianpoint(*)", + "error": [ + "Using wildcards (*) in to_cartesianpoint is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_cartesianpoint(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianpoint(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianpoint(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianpoint(true)", + "error": [ + "Argument of [to_cartesianpoint] must be [cartesian_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianpoint(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_cartesianpoint(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianpoint(to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_cartesianpoint(booleanField)", + "error": [ + "Argument of [to_cartesianpoint] must be [cartesian_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianpoint(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_cartesianpoint(cartesianPointField, extraArg)", + "error": [ + "Error: [to_cartesianpoint] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_cartesianpoint(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianshape(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_cartesianshape(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianshape(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_cartesianshape(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianshape(*)", + "error": [ + "Using wildcards (*) in to_cartesianshape is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_cartesianshape(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianshape(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianshape(to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_cartesianshape(to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianshape(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianshape(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_cartesianshape(true)", + "error": [ + "Argument of [to_cartesianshape] must be [cartesian_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianshape(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_cartesianshape(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianshape(to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_cartesianshape(booleanField)", + "error": [ + "Argument of [to_cartesianshape] must be [cartesian_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianshape(cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_cartesianshape(cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianshape(to_cartesianshape(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_cartesianshape(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_cartesianshape(cartesianPointField, extraArg)", + "error": [ + "Error: [to_cartesianshape] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_cartesianshape(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_datetime(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_datetime(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_dt(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_datetime(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_datetime(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_dt(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_datetime(*)", + "error": [ + "Using wildcards (*) in to_datetime is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_datetime(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_datetime(now())", + "error": [], + "warning": [] + }, + { + "query": "row to_datetime(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_dt(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_datetime(to_datetime(now()))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_datetime(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_datetime(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_dt(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_datetime(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_datetime(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_datetime(true)", + "error": [ + "Argument of [to_datetime] must be [date], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_datetime(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_datetime(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_dt(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_datetime(to_datetime(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_datetime(booleanField)", + "error": [ + "Argument of [to_datetime] must be [date], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_datetime(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_datetime(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_dt(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_datetime(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_datetime(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_datetime(dateField, extraArg)", + "error": [ + "Error: [to_datetime] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_datetime(dateField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_degrees(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_degrees(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_degrees(to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_degrees(\"a\")", + "error": [ + "Argument of [to_degrees] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_degrees(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_degrees(stringField) > 0", + "error": [ + "Argument of [to_degrees] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_degrees(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_degrees(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_degrees(to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_degrees(stringField)", + "error": [ + "Argument of [to_degrees] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval to_degrees(numberField, extraArg)", + "error": [ + "Error: [to_degrees] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_degrees(*)", + "error": [ + "Using wildcards (*) in to_degrees is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_degrees(numberField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_degrees(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_degrees(true)", + "error": [ + "Argument of [to_degrees] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_degrees(booleanField) > 0", + "error": [ + "Argument of [to_degrees] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_degrees(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_degrees(booleanField)", + "error": [ + "Argument of [to_degrees] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = to_double(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_double(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_dbl(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_double(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_double(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_dbl(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_double(*)", + "error": [ + "Using wildcards (*) in to_double is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_double(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_double(true)", + "error": [], + "warning": [] + }, + { + "query": "row to_double(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_dbl(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_double(to_boolean(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_double(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_double(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_dbl(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_double(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_double(now())", + "error": [], + "warning": [] + }, + { + "query": "row to_double(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_dbl(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_double(to_datetime(now()))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_double(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_double(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [to_double] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_double(booleanField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_double(cartesianPointField) > 0", + "error": [ + "Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_double(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_double(dateField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_double(stringField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_double(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_double(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_dbl(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_double(to_boolean(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_double(cartesianPointField)", + "error": [ + "Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_double(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_double(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_dbl(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_double(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_double(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_double(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_dbl(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_double(to_datetime(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_double(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_double(booleanField, extraArg)", + "error": [ + "Error: [to_double] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_double(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geopoint(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_geopoint(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geopoint(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_geopoint(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geopoint(*)", + "error": [ + "Using wildcards (*) in to_geopoint is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_geopoint(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geopoint(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_geopoint(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geopoint(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geopoint(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geopoint(true)", + "error": [ + "Argument of [to_geopoint] must be [geo_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geopoint(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_geopoint(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geopoint(to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_geopoint(booleanField)", + "error": [ + "Argument of [to_geopoint] must be [geo_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geopoint(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_geopoint(geoPointField, extraArg)", + "error": [ + "Error: [to_geopoint] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_geopoint(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geoshape(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_geoshape(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geoshape(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_geoshape(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geoshape(*)", + "error": [ + "Using wildcards (*) in to_geoshape is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_geoshape(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geoshape(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_geoshape(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geoshape(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geoshape(to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_geoshape(to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geoshape(to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geoshape(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_geoshape(true)", + "error": [ + "Argument of [to_geoshape] must be [geo_point], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geoshape(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_geoshape(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geoshape(to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_geoshape(booleanField)", + "error": [ + "Argument of [to_geoshape] must be [geo_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geoshape(geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_geoshape(geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geoshape(to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_geoshape(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_geoshape(geoPointField, extraArg)", + "error": [ + "Error: [to_geoshape] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_geoshape(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_integer(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_int(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_integer(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_int(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(*)", + "error": [ + "Using wildcards (*) in to_integer is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_integer(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(true)", + "error": [], + "warning": [] + }, + { + "query": "row to_integer(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_int(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_boolean(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_integer(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_int(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(now())", + "error": [], + "warning": [] + }, + { + "query": "row to_integer(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_int(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_datetime(now()))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_integer(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [to_integer] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_integer(booleanField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_integer(cartesianPointField) > 0", + "error": [ + "Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_integer(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_integer(dateField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_integer(stringField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_integer(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_int(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(to_boolean(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_integer(cartesianPointField)", + "error": [ + "Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_integer(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_int(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_integer(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_int(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(to_datetime(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_integer(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_integer(booleanField, extraArg)", + "error": [ + "Error: [to_integer] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_integer(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ip(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_ip(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ip(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_ip(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ip(*)", + "error": [ + "Using wildcards (*) in to_ip is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_ip(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ip(to_ip(\"127.0.0.1\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_ip(to_ip(\"127.0.0.1\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ip(to_ip(to_ip(\"127.0.0.1\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ip(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ip(true)", + "error": [ + "Argument of [to_ip] must be [ip], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ip(ipField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_ip(ipField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ip(to_ip(ipField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_ip(booleanField)", + "error": [ + "Argument of [to_ip] must be [ip], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ip(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_ip(ipField, extraArg)", + "error": [ + "Error: [to_ip] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_ip(ipField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_long(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(*)", + "error": [ + "Using wildcards (*) in to_long is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_long(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(true)", + "error": [], + "warning": [] + }, + { + "query": "row to_long(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(to_boolean(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_long(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(now())", + "error": [], + "warning": [] + }, + { + "query": "row to_long(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(to_datetime(now()))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_long(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [to_long] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_long(booleanField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(cartesianPointField) > 0", + "error": [ + "Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_long(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(dateField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_long(stringField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(to_boolean(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(cartesianPointField)", + "error": [ + "Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(to_datetime(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_long(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_long(booleanField, extraArg)", + "error": [ + "Error: [to_long] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_lower(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_lower(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_lower(to_string(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_lower(5)", + "error": [ + "Argument of [to_lower] must be [string], found value [5] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(to_lower(stringField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_lower(numberField)) > 0", + "error": [ + "Argument of [to_lower] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_lower(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_lower(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_lower(to_string(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_lower(numberField)", + "error": [ + "Argument of [to_lower] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval to_lower(stringField, extraArg)", + "error": [ + "Error: [to_lower] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_lower(*)", + "error": [ + "Using wildcards (*) in to_lower is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_lower(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_lower(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_lower(true)", + "error": [ + "Argument of [to_lower] must be [string], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(to_lower(booleanField)) > 0", + "error": [ + "Argument of [to_lower] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_lower(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_lower(booleanField)", + "error": [ + "Argument of [to_lower] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = to_radians(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_radians(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_radians(to_integer(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_radians(\"a\")", + "error": [ + "Argument of [to_radians] must be [number], found value [\"a\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_radians(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_radians(stringField) > 0", + "error": [ + "Argument of [to_radians] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(to_integer(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(stringField)", + "error": [ + "Argument of [to_radians] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(numberField, extraArg)", + "error": [ + "Error: [to_radians] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(*)", + "error": [ + "Using wildcards (*) in to_radians is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_radians(numberField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_radians(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_radians(true)", + "error": [ + "Argument of [to_radians] must be [number], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_radians(booleanField) > 0", + "error": [ + "Argument of [to_radians] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_radians(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_radians(booleanField)", + "error": [ + "Argument of [to_radians] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = to_string(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_string(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_str(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_str(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(*)", + "error": [ + "Using wildcards (*) in to_string is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_string(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(true)", + "error": [], + "warning": [] + }, + { + "query": "row to_string(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_str(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_boolean(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_string(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_str(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_cartesianpoint(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_string(to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_str(to_cartesianshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_cartesianshape(to_cartesianpoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(now())", + "error": [], + "warning": [] + }, + { + "query": "row to_string(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_str(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_datetime(now()))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_string(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_str(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_string(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_str(to_geopoint(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_geopoint(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_string(to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_str(to_geoshape(\"POINT (30 10)\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_geoshape(to_geopoint(\"POINT (30 10)\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_ip(\"127.0.0.1\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_string(to_ip(\"127.0.0.1\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_str(to_ip(\"127.0.0.1\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_ip(to_ip(\"127.0.0.1\")))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_version(\"1.0.0\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_string(to_version(\"1.0.0\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_str(to_version(\"1.0.0\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_string(to_version(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_string(booleanField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_string(cartesianPointField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_string(cartesianShapeField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_string(dateField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_string(numberField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_string(geoPointField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_string(geoShapeField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_string(ipField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_string(stringField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_string(versionField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_str(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(to_boolean(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_str(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(to_cartesianpoint(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_str(cartesianShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(to_cartesianshape(cartesianPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_str(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(to_datetime(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_str(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_str(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(to_geopoint(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_str(geoShapeField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(to_geoshape(geoPointField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(ipField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(ipField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_str(ipField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(to_ip(ipField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(versionField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(versionField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_str(versionField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_string(to_version(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_string(booleanField, extraArg)", + "error": [ + "Error: [to_string] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_string(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_unsigned_long(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ul(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ulong(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(*)", + "error": [ + "Using wildcards (*) in to_unsigned_long is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_unsigned_long(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(true)", + "error": [], + "warning": [] + }, + { + "query": "row to_unsigned_long(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ul(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ulong(true)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_boolean(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(now())", + "error": [], + "warning": [] + }, + { + "query": "row to_unsigned_long(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ul(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ulong(now())", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_datetime(now()))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(5)", + "error": [], + "warning": [] + }, + { + "query": "row to_unsigned_long(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ul(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ulong(5)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_integer(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_unsigned_long(to_cartesianpoint(\"POINT (30 10)\"))", + "error": [ + "Argument of [to_unsigned_long] must be [boolean], found value [to_cartesianpoint(\"POINT (30 10)\")] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(booleanField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(cartesianPointField) > 0", + "error": [ + "Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(dateField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(numberField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where to_unsigned_long(stringField) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(to_boolean(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(cartesianPointField)", + "error": [ + "Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(to_datetime(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ul(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ulong(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_unsigned_long(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_unsigned_long(booleanField, extraArg)", + "error": [ + "Error: [to_unsigned_long] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | sort to_unsigned_long(booleanField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_upper(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_upper(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_upper(to_string(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_upper(5)", + "error": [ + "Argument of [to_upper] must be [string], found value [5] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(to_upper(stringField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(to_upper(numberField)) > 0", + "error": [ + "Argument of [to_upper] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_upper(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_upper(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_upper(to_string(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_upper(numberField)", + "error": [ + "Argument of [to_upper] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval to_upper(stringField, extraArg)", + "error": [ + "Error: [to_upper] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_upper(*)", + "error": [ + "Using wildcards (*) in to_upper is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_upper(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_upper(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_upper(true)", + "error": [ + "Argument of [to_upper] must be [string], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(to_upper(booleanField)) > 0", + "error": [ + "Argument of [to_upper] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_upper(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_upper(booleanField)", + "error": [ + "Argument of [to_upper] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "row var = to_version(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row to_version(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ver(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_version(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_version(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ver(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_version(*)", + "error": [ + "Using wildcards (*) in to_version is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort to_version(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = to_version(to_version(\"1.0.0\"))", + "error": [], + "warning": [] + }, + { + "query": "row to_version(to_version(\"1.0.0\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_ver(to_version(\"1.0.0\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = to_version(true)", + "error": [ + "Argument of [to_version] must be [string], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = to_version(versionField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_version(versionField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = to_ver(versionField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval to_version(stringField, extraArg)", + "error": [ + "Error: [to_version] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "row var = trim(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row trim(\"a\")", + "error": [], + "warning": [] + }, + { + "query": "row var = trim(to_string(\"a\"))", + "error": [], + "warning": [] + }, + { + "query": "row var = trim(5)", + "error": [ + "Argument of [trim] must be [string], found value [5] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(trim(stringField)) > 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where length(trim(numberField)) > 0", + "error": [ + "Argument of [trim] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = trim(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval trim(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval var = trim(to_string(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval trim(numberField)", + "error": [ + "Argument of [trim] must be [string], found value [numberField] type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | eval trim(stringField, extraArg)", + "error": [ + "Error: [trim] function expects exactly one argument, got 2." + ], + "warning": [] + }, + { + "query": "from a_index | eval var = trim(*)", + "error": [ + "Using wildcards (*) in trim is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort trim(stringField)", + "error": [], + "warning": [] + }, + { + "query": "row var = trim(to_string(true))", + "error": [], + "warning": [] + }, + { + "query": "row var = trim(true)", + "error": [ + "Argument of [trim] must be [string], found value [true] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | where length(trim(booleanField)) > 0", + "error": [ + "Argument of [trim] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = trim(to_string(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval trim(booleanField)", + "error": [ + "Argument of [trim] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(avg(numberField)) + avg(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(avg(numberField)) + avg(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField) by round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = avg(numberField) by var1 = round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(stringField)", + "error": [ + "Argument of [avg] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = avg(*)", + "error": [ + "Using wildcards (*) in avg is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort avg(numberField)", + "error": [ + "SORT does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(numberField)", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | where avg(numberField) > 0", + "error": [ + "WHERE does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(numberField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = avg(numberField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(numberField)", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | eval avg(numberField) > 0", + "error": [ + "EVAL does not support function avg" + ], + "warning": [] + }, + { + "query": "from a_index | stats avg(booleanField)", + "error": [ + "Argument of [avg] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(sum(numberField)) + sum(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(sum(numberField)) + sum(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats sum(numberField) by round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = sum(numberField) by var1 = round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats sum(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats sum(stringField)", + "error": [ + "Argument of [sum] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = sum(*)", + "error": [ + "Using wildcards (*) in sum is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort sum(numberField)", + "error": [ + "SORT does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(numberField)", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | where sum(numberField) > 0", + "error": [ + "WHERE does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(numberField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = sum(numberField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(numberField)", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | eval sum(numberField) > 0", + "error": [ + "EVAL does not support function sum" + ], + "warning": [] + }, + { + "query": "from a_index | stats sum(booleanField)", + "error": [ + "Argument of [sum] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = median(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median(numberField)) + median(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median(numberField)) + median(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), median(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), median(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median(numberField) by round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median(numberField) by var1 = round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats median(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats median(stringField)", + "error": [ + "Argument of [median] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = median(*)", + "error": [ + "Using wildcards (*) in median is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort median(numberField)", + "error": [ + "SORT does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(numberField)", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | where median(numberField) > 0", + "error": [ + "WHERE does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(numberField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median(numberField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(numberField)", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | eval median(numberField) > 0", + "error": [ + "EVAL does not support function median" + ], + "warning": [] + }, + { + "query": "from a_index | stats median(booleanField)", + "error": [ + "Argument of [median] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField) by round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(stringField)", + "error": [ + "Argument of [median_absolute_deviation] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = median_absolute_deviation(*)", + "error": [ + "Using wildcards (*) in median_absolute_deviation is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | sort median_absolute_deviation(numberField)", + "error": [ + "SORT does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(numberField)", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | where median_absolute_deviation(numberField) > 0", + "error": [ + "WHERE does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(numberField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = median_absolute_deviation(numberField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(numberField)", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | eval median_absolute_deviation(numberField) > 0", + "error": [ + "EVAL does not support function median_absolute_deviation" + ], + "warning": [] + }, + { + "query": "from a_index | stats median_absolute_deviation(booleanField)", + "error": [ + "Argument of [median_absolute_deviation] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(numberField, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats percentile(numberField, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(numberField, 5))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(numberField, 5))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(percentile(numberField, 5)) + percentile(numberField, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(percentile(numberField, 5)) + percentile(numberField, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats percentile(numberField, numberField)", + "error": [ + "Argument of [percentile] must be a constant, received [numberField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(numberField / 2, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(numberField / 2, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField / 2, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField / 2, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(numberField, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats percentile(numberField, 5) by round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = percentile(numberField, 5) by var1 = round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = percentile(avg(numberField), 5)", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(avg(numberField), 5)", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(stringField, 5)", + "error": [ + "Argument of [percentile] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | sort percentile(numberField, 5)", + "error": [ + "SORT does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(numberField, 5)", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | where percentile(numberField, 5) > 0", + "error": [ + "WHERE does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(numberField, 5)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = percentile(numberField, 5) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(numberField, 5)", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | eval percentile(numberField, 5) > 0", + "error": [ + "EVAL does not support function percentile" + ], + "warning": [] + }, + { + "query": "from a_index | stats percentile(booleanField, 5)", + "error": [ + "Argument of [percentile] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = max(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(max(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(max(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(max(numberField)) + max(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(max(numberField)) + max(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = max(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), max(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = max(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), max(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(numberField) by round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = max(numberField) by var1 = round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = max(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats max(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats max(stringField)", + "error": [ + "Argument of [max] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = max(*)", + "error": [ + "Using wildcards (*) in max is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = max(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats max(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(max(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(max(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(max(dateField)) + max(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(max(dateField)) + max(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort max(numberField)", + "error": [ + "SORT does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(numberField)", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(numberField) > 0", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(dateField)", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | where max(dateField) > 0", + "error": [ + "WHERE does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(numberField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(numberField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(numberField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(numberField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(dateField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = max(dateField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(dateField)", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | eval max(dateField) > 0", + "error": [ + "EVAL does not support function max" + ], + "warning": [] + }, + { + "query": "from a_index | stats max(booleanField)", + "error": [ + "Argument of [max] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = min(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(min(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(min(numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(min(numberField)) + min(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(min(numberField)) + min(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = min(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), min(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = min(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), min(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(numberField) by round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var0 = min(numberField) by var1 = round(numberField / 2)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = min(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats min(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats min(stringField)", + "error": [ + "Argument of [min] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = min(*)", + "error": [ + "Using wildcards (*) in min is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = min(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats min(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(min(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(min(dateField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(min(dateField)) + min(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(min(dateField)) + min(dateField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort min(numberField)", + "error": [ + "SORT does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(numberField)", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(numberField) > 0", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(dateField)", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | where min(dateField) > 0", + "error": [ + "WHERE does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(numberField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(numberField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(numberField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(numberField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(dateField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = min(dateField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(dateField)", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | eval min(dateField) > 0", + "error": [ + "EVAL does not support function min" + ], + "warning": [] + }, + { + "query": "from a_index | stats min(booleanField)", + "error": [ + "Argument of [min] must be [number], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = count(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats count(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(count(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(count(stringField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(count(stringField)) + count(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(count(stringField)) + count(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort count(stringField)", + "error": [ + "SORT does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | where count(stringField)", + "error": [ + "WHERE does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | where count(stringField) > 0", + "error": [ + "WHERE does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = count(stringField)", + "error": [ + "EVAL does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = count(stringField) > 0", + "error": [ + "EVAL does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | eval count(stringField)", + "error": [ + "EVAL does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | eval count(stringField) > 0", + "error": [ + "EVAL does not support function count" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = count_distinct(stringField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats count_distinct(stringField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(count_distinct(stringField, numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(count_distinct(stringField, numberField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = round(count_distinct(stringField, numberField)) + count_distinct(stringField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats round(count_distinct(stringField, numberField)) + count_distinct(stringField, numberField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort count_distinct(stringField, numberField)", + "error": [ + "SORT does not support function count_distinct" + ], + "warning": [] + }, + { + "query": "from a_index | where count_distinct(stringField, numberField)", + "error": [ + "WHERE does not support function count_distinct" + ], + "warning": [] + }, + { + "query": "from a_index | where count_distinct(stringField, numberField) > 0", + "error": [ + "WHERE does not support function count_distinct" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = count_distinct(stringField, numberField)", + "error": [ + "EVAL does not support function count_distinct" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = count_distinct(stringField, numberField) > 0", + "error": [ + "EVAL does not support function count_distinct" + ], + "warning": [] + }, + { + "query": "from a_index | eval count_distinct(stringField, numberField)", + "error": [ + "EVAL does not support function count_distinct" + ], + "warning": [] + }, + { + "query": "from a_index | eval count_distinct(stringField, numberField) > 0", + "error": [ + "EVAL does not support function count_distinct" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = st_centroid_agg(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats st_centroid_agg(cartesianPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats var = st_centroid_agg(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats st_centroid_agg(avg(numberField))", + "error": [ + "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + ], + "warning": [] + }, + { + "query": "from a_index | stats st_centroid_agg(stringField)", + "error": [ + "Argument of [st_centroid_agg] must be [cartesian_point], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = st_centroid_agg(*)", + "error": [ + "Using wildcards (*) in st_centroid_agg is not allowed" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = st_centroid_agg(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats st_centroid_agg(geoPointField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort st_centroid_agg(cartesianPointField)", + "error": [ + "SORT does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | where st_centroid_agg(cartesianPointField)", + "error": [ + "WHERE does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | where st_centroid_agg(cartesianPointField) > 0", + "error": [ + "WHERE does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | where st_centroid_agg(geoPointField)", + "error": [ + "WHERE does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | where st_centroid_agg(geoPointField) > 0", + "error": [ + "WHERE does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_centroid_agg(cartesianPointField)", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_centroid_agg(cartesianPointField) > 0", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_centroid_agg(cartesianPointField)", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_centroid_agg(cartesianPointField) > 0", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_centroid_agg(geoPointField)", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = st_centroid_agg(geoPointField) > 0", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_centroid_agg(geoPointField)", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | eval st_centroid_agg(geoPointField) > 0", + "error": [ + "EVAL does not support function st_centroid_agg" + ], + "warning": [] + }, + { + "query": "from a_index | stats st_centroid_agg(booleanField)", + "error": [ + "Argument of [st_centroid_agg] must be [cartesian_point], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | stats var = values(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats values(stringField)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | sort values(stringField)", + "error": [ + "SORT does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | where values(stringField)", + "error": [ + "WHERE does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | where values(stringField) > 0", + "error": [ + "WHERE does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = values(stringField)", + "error": [ + "EVAL does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | eval var = values(stringField) > 0", + "error": [ + "EVAL does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | eval values(stringField)", + "error": [ + "EVAL does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | eval values(stringField) > 0", + "error": [ + "EVAL does not support function values" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(dateField, 1 year)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats by bin(dateField, 1 year)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(numberField, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(numberField, numberField)", + "error": [ + "Argument of [bucket] must be a constant, received [numberField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bin(numberField, 5)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(dateField, 5, \"a\", \"a\")", + "error": [], + "warning": [] + }, + { + "query": "from a_index | stats by bucket(dateField, numberField, stringField, stringField)", + "error": [ + "Argument of [bucket] must be a constant, received [numberField]", + "Argument of [bucket] must be a constant, received [stringField]", + "Argument of [bucket] must be a constant, received [stringField]" + ], + "warning": [] + }, + { + "query": "from a_index | stats by bin(dateField, 5, \"a\", \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats round(count(stringField)) + count(stringField)", + "query": "from a_index | stats by bucket(dateField, 5, now(), now())", "error": [], "warning": [] }, { - "query": "from a_index | sort count(stringField)", + "query": "from a_index | stats by bucket(dateField, numberField, dateField, dateField)", "error": [ - "SORT does not support function count" + "Argument of [bucket] must be a constant, received [numberField]", + "Argument of [bucket] must be a constant, received [dateField]", + "Argument of [bucket] must be a constant, received [dateField]" ], "warning": [] }, { - "query": "from a_index | where count(stringField)", - "error": [ - "WHERE does not support function count" - ], + "query": "from a_index | stats by bin(dateField, 5, now(), now())", + "error": [], "warning": [] }, { - "query": "from a_index | where count(stringField) > 0", - "error": [ - "WHERE does not support function count" - ], + "query": "from a_index | stats by bucket(dateField, 5, \"a\", now())", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = count(stringField)", + "query": "from a_index | stats by bucket(dateField, numberField, stringField, dateField)", "error": [ - "EVAL does not support function count" + "Argument of [bucket] must be a constant, received [numberField]", + "Argument of [bucket] must be a constant, received [stringField]", + "Argument of [bucket] must be a constant, received [dateField]" ], "warning": [] }, { - "query": "from a_index | eval var = count(stringField) > 0", - "error": [ - "EVAL does not support function count" - ], + "query": "from a_index | stats by bin(dateField, 5, \"a\", now())", + "error": [], "warning": [] }, { - "query": "from a_index | eval count(stringField)", - "error": [ - "EVAL does not support function count" - ], + "query": "from a_index | stats by bucket(dateField, 5, now(), \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval count(stringField) > 0", + "query": "from a_index | stats by bucket(dateField, numberField, dateField, stringField)", "error": [ - "EVAL does not support function count" + "Argument of [bucket] must be a constant, received [numberField]", + "Argument of [bucket] must be a constant, received [dateField]", + "Argument of [bucket] must be a constant, received [stringField]" ], "warning": [] }, { - "query": "from a_index | stats var = count_distinct(stringField, numberField)", + "query": "from a_index | stats by bin(dateField, 5, now(), \"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats count_distinct(stringField, numberField)", + "query": "from a_index | stats by bucket(numberField, 5, 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(count_distinct(stringField, numberField))", - "error": [], + "query": "from a_index | stats by bucket(numberField, numberField, numberField, numberField)", + "error": [ + "Argument of [bucket] must be a constant, received [numberField]", + "Argument of [bucket] must be a constant, received [numberField]", + "Argument of [bucket] must be a constant, received [numberField]" + ], "warning": [] }, { - "query": "from a_index | stats round(count_distinct(stringField, numberField))", + "query": "from a_index | stats by bin(numberField, 5, 5, 5)", "error": [], "warning": [] }, { - "query": "from a_index | stats var = round(count_distinct(stringField, numberField)) + count_distinct(stringField, numberField)", - "error": [], + "query": "from a_index | sort bucket(dateField, 1 year)", + "error": [ + "SORT does not support function bucket" + ], "warning": [] }, { - "query": "from a_index | stats round(count_distinct(stringField, numberField)) + count_distinct(stringField, numberField)", + "query": "row var = cbrt(5)", "error": [], "warning": [] }, { - "query": "from a_index | sort count_distinct(stringField, numberField)", - "error": [ - "SORT does not support function count_distinct" - ], - "warning": [] - }, - { - "query": "from a_index | where count_distinct(stringField, numberField)", - "error": [ - "WHERE does not support function count_distinct" - ], + "query": "row cbrt(5)", + "error": [], "warning": [] }, { - "query": "from a_index | where count_distinct(stringField, numberField) > 0", - "error": [ - "WHERE does not support function count_distinct" - ], + "query": "row var = cbrt(to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = count_distinct(stringField, numberField)", + "query": "row var = cbrt(true)", "error": [ - "EVAL does not support function count_distinct" + "Argument of [cbrt] must be [number], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = count_distinct(stringField, numberField) > 0", - "error": [ - "EVAL does not support function count_distinct" - ], + "query": "from a_index | where cbrt(numberField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval count_distinct(stringField, numberField)", + "query": "from a_index | where cbrt(booleanField) > 0", "error": [ - "EVAL does not support function count_distinct" + "Argument of [cbrt] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval count_distinct(stringField, numberField) > 0", - "error": [ - "EVAL does not support function count_distinct" - ], + "query": "from a_index | eval var = cbrt(numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = st_centroid_agg(cartesianPointField)", + "query": "from a_index | eval cbrt(numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats st_centroid_agg(cartesianPointField)", + "query": "from a_index | eval var = cbrt(to_integer(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats var = st_centroid_agg(avg(numberField))", + "query": "from a_index | eval cbrt(booleanField)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Argument of [cbrt] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats st_centroid_agg(avg(numberField))", + "query": "from a_index | eval var = cbrt(*)", "error": [ - "Aggregate function's parameters must be an attribute, literal or a non-aggregation function; found [avg(numberField)] of type [number]" + "Using wildcards (*) in cbrt is not allowed" ], "warning": [] }, { - "query": "from a_index | stats st_centroid_agg(stringField)", + "query": "from a_index | eval cbrt(numberField, extraArg)", "error": [ - "Argument of [st_centroid_agg] must be [cartesian_point], found value [stringField] type [string]" + "Error: [cbrt] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | stats var = st_centroid_agg(*)", - "error": [ - "Using wildcards (*) in st_centroid_agg is not allowed" - ], + "query": "from a_index | sort cbrt(numberField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = st_centroid_agg(geoPointField)", + "query": "row var = from_base64(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats st_centroid_agg(geoPointField)", + "query": "row from_base64(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | sort st_centroid_agg(cartesianPointField)", - "error": [ - "SORT does not support function st_centroid_agg" - ], + "query": "row var = from_base64(to_string(true))", + "error": [], "warning": [] }, { - "query": "from a_index | where st_centroid_agg(cartesianPointField)", + "query": "row var = from_base64(true)", "error": [ - "WHERE does not support function st_centroid_agg" + "Argument of [from_base64] must be [string], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where st_centroid_agg(cartesianPointField) > 0", - "error": [ - "WHERE does not support function st_centroid_agg" - ], + "query": "from a_index | where length(from_base64(stringField)) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | where st_centroid_agg(geoPointField)", + "query": "from a_index | where length(from_base64(booleanField)) > 0", "error": [ - "WHERE does not support function st_centroid_agg" + "Argument of [from_base64] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | where st_centroid_agg(geoPointField) > 0", - "error": [ - "WHERE does not support function st_centroid_agg" - ], + "query": "from a_index | eval var = from_base64(stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_centroid_agg(cartesianPointField)", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "from a_index | eval from_base64(stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = st_centroid_agg(cartesianPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "from a_index | eval var = from_base64(to_string(booleanField))", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_centroid_agg(cartesianPointField)", + "query": "from a_index | eval from_base64(booleanField)", "error": [ - "EVAL does not support function st_centroid_agg" + "Argument of [from_base64] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval st_centroid_agg(cartesianPointField) > 0", + "query": "from a_index | eval var = from_base64(*)", "error": [ - "EVAL does not support function st_centroid_agg" + "Using wildcards (*) in from_base64 is not allowed" ], "warning": [] }, { - "query": "from a_index | eval var = st_centroid_agg(geoPointField)", + "query": "from a_index | eval from_base64(stringField, extraArg)", "error": [ - "EVAL does not support function st_centroid_agg" + "Error: [from_base64] function expects exactly one argument, got 2." ], "warning": [] }, { - "query": "from a_index | eval var = st_centroid_agg(geoPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "from a_index | sort from_base64(stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_centroid_agg(geoPointField)", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "row var = locate(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | eval st_centroid_agg(geoPointField) > 0", - "error": [ - "EVAL does not support function st_centroid_agg" - ], + "query": "row locate(\"a\", \"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats var = values(stringField)", + "query": "row var = locate(to_string(true), to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats values(stringField)", + "query": "row var = locate(\"a\", \"a\", 5)", "error": [], "warning": [] }, { - "query": "from a_index | sort values(stringField)", - "error": [ - "SORT does not support function values" - ], + "query": "row locate(\"a\", \"a\", 5)", + "error": [], "warning": [] }, { - "query": "from a_index | where values(stringField)", - "error": [ - "WHERE does not support function values" - ], + "query": "row var = locate(to_string(true), to_string(true), to_integer(true))", + "error": [], "warning": [] }, { - "query": "from a_index | where values(stringField) > 0", + "query": "row var = locate(true, true, true)", "error": [ - "WHERE does not support function values" + "Argument of [locate] must be [string], found value [true] type [boolean]", + "Argument of [locate] must be [string], found value [true] type [boolean]", + "Argument of [locate] must be [number], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval var = values(stringField)", - "error": [ - "EVAL does not support function values" - ], + "query": "from a_index | where locate(stringField, stringField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval var = values(stringField) > 0", + "query": "from a_index | where locate(booleanField, booleanField) > 0", "error": [ - "EVAL does not support function values" + "Argument of [locate] must be [string], found value [booleanField] type [boolean]", + "Argument of [locate] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | eval values(stringField)", - "error": [ - "EVAL does not support function values" - ], + "query": "from a_index | where locate(stringField, stringField, numberField) > 0", + "error": [], "warning": [] }, { - "query": "from a_index | eval values(stringField) > 0", + "query": "from a_index | where locate(booleanField, booleanField, booleanField) > 0", "error": [ - "EVAL does not support function values" + "Argument of [locate] must be [string], found value [booleanField] type [boolean]", + "Argument of [locate] must be [string], found value [booleanField] type [boolean]", + "Argument of [locate] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, 1 year)", + "query": "from a_index | eval var = locate(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats by bin(dateField, 1 year)", + "query": "from a_index | eval locate(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(numberField, 5)", + "query": "from a_index | eval var = locate(to_string(booleanField), to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(numberField, numberField)", + "query": "from a_index | eval locate(booleanField, booleanField)", "error": [ - "Argument of [bucket] must be a constant, received [numberField]" + "Argument of [locate] must be [string], found value [booleanField] type [boolean]", + "Argument of [locate] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats by bin(numberField, 5)", + "query": "from a_index | eval var = locate(stringField, stringField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, 5, \"a\", \"a\")", + "query": "from a_index | eval locate(stringField, stringField, numberField)", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, numberField, stringField, stringField)", + "query": "from a_index | eval var = locate(to_string(booleanField), to_string(booleanField), to_integer(booleanField))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval locate(booleanField, booleanField, booleanField)", "error": [ - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [stringField]", - "Argument of [bucket] must be a constant, received [stringField]" + "Argument of [locate] must be [string], found value [booleanField] type [boolean]", + "Argument of [locate] must be [string], found value [booleanField] type [boolean]", + "Argument of [locate] must be [number], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats by bin(dateField, 5, \"a\", \"a\")", - "error": [], + "query": "from a_index | eval locate(stringField, stringField, numberField, extraArg)", + "error": [ + "Error: [locate] function expects no more than 3 arguments, got 4." + ], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, 5, now(), now())", + "query": "from a_index | sort locate(stringField, stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, numberField, dateField, dateField)", - "error": [ - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [dateField]", - "Argument of [bucket] must be a constant, received [dateField]" - ], + "query": "row var = to_base64(\"a\")", + "error": [], "warning": [] }, { - "query": "from a_index | stats by bin(dateField, 5, now(), now())", + "query": "row to_base64(\"a\")", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, 5, \"a\", now())", + "query": "row var = to_base64(to_string(true))", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, numberField, stringField, dateField)", + "query": "row var = to_base64(true)", "error": [ - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [stringField]", - "Argument of [bucket] must be a constant, received [dateField]" + "Argument of [to_base64] must be [string], found value [true] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats by bin(dateField, 5, \"a\", now())", + "query": "from a_index | where length(to_base64(stringField)) > 0", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, 5, now(), \"a\")", - "error": [], + "query": "from a_index | where length(to_base64(booleanField)) > 0", + "error": [ + "Argument of [to_base64] must be [string], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | stats by bucket(dateField, numberField, dateField, stringField)", - "error": [ - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [dateField]", - "Argument of [bucket] must be a constant, received [stringField]" - ], + "query": "from a_index | eval var = to_base64(stringField)", + "error": [], "warning": [] }, { - "query": "from a_index | stats by bin(dateField, 5, now(), \"a\")", + "query": "from a_index | eval to_base64(stringField)", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(numberField, 5, 5, 5)", + "query": "from a_index | eval var = to_base64(to_string(booleanField))", "error": [], "warning": [] }, { - "query": "from a_index | stats by bucket(numberField, numberField, numberField, numberField)", + "query": "from a_index | eval to_base64(booleanField)", "error": [ - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [numberField]", - "Argument of [bucket] must be a constant, received [numberField]" + "Argument of [to_base64] must be [string], found value [booleanField] type [boolean]" ], "warning": [] }, { - "query": "from a_index | stats by bin(numberField, 5, 5, 5)", - "error": [], + "query": "from a_index | eval var = to_base64(*)", + "error": [ + "Using wildcards (*) in to_base64 is not allowed" + ], "warning": [] }, { - "query": "from a_index | sort bucket(dateField, 1 year)", + "query": "from a_index | eval to_base64(stringField, extraArg)", "error": [ - "SORT does not support function bucket" + "Error: [to_base64] function expects exactly one argument, got 2." ], "warning": [] + }, + { + "query": "from a_index | sort to_base64(stringField)", + "error": [], + "warning": [] } ] } \ No newline at end of file diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/helpers.ts b/packages/kbn-esql-validation-autocomplete/src/validation/helpers.ts index 9abb3ea3dc2aa..1b75dcd965550 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/helpers.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/helpers.ts @@ -7,6 +7,7 @@ */ import type { ESQLAst, ESQLAstItem, ESQLMessage, ESQLSingleAstItem } from '@kbn/esql-ast'; +import { FunctionDefinition } from '../definitions/types'; import { getAllArrayTypes, getAllArrayValues } from '../shared/helpers'; import { getMessageFromId } from './errors'; import type { ESQLPolicy, ReferenceMaps } from './types'; @@ -38,6 +39,21 @@ export function buildQueryForFieldsForStringSources(queryString: string, ast: ES return customQuery; } +/** + * Returns the maximum and minimum number of parameters allowed by a function + * + * Used for too-many, too-few arguments validation + */ +export function getMaxMinNumberOfParams(definition: FunctionDefinition) { + let min = Infinity; + let max = 0; + definition.signatures.forEach(({ params, minParams }) => { + min = Math.min(min, params.filter(({ optional }) => !optional).length); + max = Math.max(max, minParams ? Infinity : params.length); + }); + return { min, max }; +} + /** * We only want to report one message when any number of the elements in an array argument is of the wrong type */ diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts b/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts index 01d0695af4a6c..c05e6e2f28787 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts @@ -9,9 +9,9 @@ import { join } from 'path'; import { writeFile, readFile } from 'fs/promises'; import { ignoreErrorsMap, validateQuery } from './validation'; -import { evalFunctionsDefinitions } from '../definitions/functions'; +import { evalFunctionDefinitions } from '../definitions/functions'; import { getFunctionSignatures } from '../definitions/helpers'; -import { FunctionDefinition } from '../definitions/types'; +import { FunctionDefinition, SupportedFieldType, supportedFieldTypes } from '../definitions/types'; import { chronoLiterals, timeLiterals } from '../definitions/literals'; import { statsAggregationFunctionDefinitions } from '../definitions/aggs'; import capitalize from 'lodash/capitalize'; @@ -21,20 +21,8 @@ import { nonNullable } from '../shared/helpers'; import { METADATA_FIELDS } from '../shared/constants'; import { FUNCTION_DESCRIBE_BLOCK_NAME } from './function_describe_block_name'; -const fieldTypes = [ - 'number', - 'date', - 'boolean', - 'version', - 'ip', - 'string', - 'cartesian_point', - 'cartesian_shape', - 'geo_point', - 'geo_shape', -]; const fields = [ - ...fieldTypes.map((type) => ({ name: `${camelCase(type)}Field`, type })), + ...supportedFieldTypes.map((type) => ({ name: `${camelCase(type)}Field`, type })), { name: 'any#Char$Field', type: 'number' }, { name: 'kubernetes.something.something', type: 'number' }, { name: '@timestamp', type: 'date' }, @@ -97,13 +85,13 @@ function getCallbackMocks() { }; } -const toInteger = evalFunctionsDefinitions.find(({ name }) => name === 'to_integer')!; -const toStringSignature = evalFunctionsDefinitions.find(({ name }) => name === 'to_string')!; -const toDateSignature = evalFunctionsDefinitions.find(({ name }) => name === 'to_datetime')!; -const toBooleanSignature = evalFunctionsDefinitions.find(({ name }) => name === 'to_boolean')!; -const toIpSignature = evalFunctionsDefinitions.find(({ name }) => name === 'to_ip')!; -const toGeoPointSignature = evalFunctionsDefinitions.find(({ name }) => name === 'to_geopoint')!; -const toCartesianPointSignature = evalFunctionsDefinitions.find( +const toInteger = evalFunctionDefinitions.find(({ name }) => name === 'to_integer')!; +const toStringSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_string')!; +const toDateSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_datetime')!; +const toBooleanSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_boolean')!; +const toIpSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_ip')!; +const toGeoPointSignature = evalFunctionDefinitions.find(({ name }) => name === 'to_geopoint')!; +const toCartesianPointSignature = evalFunctionDefinitions.find( ({ name }) => name === 'to_cartesianpoint' )!; @@ -129,6 +117,9 @@ function getLiteralType(typeString: 'chrono_literal' | 'time_literal') { } return `1 ${literals[typeString]}`; } + +export const fieldNameFromType = (type: SupportedFieldType) => `${camelCase(type)}Field`; + function getFieldName( typeString: string, { useNestedFunction, isStats }: { useNestedFunction: boolean; isStats: boolean } @@ -179,7 +170,7 @@ function getFieldMapping( }; return params.map(({ name: _name, type, constantOnly, literalOptions, ...rest }) => { const typeString: string = type; - if (fieldTypes.includes(typeString)) { + if (supportedFieldTypes.includes(typeString as SupportedFieldType)) { if (useLiterals && literalOptions) { return { name: `"${literalOptions[0]}"`, @@ -1024,15 +1015,15 @@ describe('validation logic', () => { [] ); - for (const field of fieldTypes) { - testErrorsAndWarnings(`from a_index | where ${camelCase(field)}Field IS NULL`, []); - testErrorsAndWarnings(`from a_index | where ${camelCase(field)}Field IS null`, []); - testErrorsAndWarnings(`from a_index | where ${camelCase(field)}Field is null`, []); - testErrorsAndWarnings(`from a_index | where ${camelCase(field)}Field is NULL`, []); - testErrorsAndWarnings(`from a_index | where ${camelCase(field)}Field IS NOT NULL`, []); - testErrorsAndWarnings(`from a_index | where ${camelCase(field)}Field IS NOT null`, []); - testErrorsAndWarnings(`from a_index | where ${camelCase(field)}Field IS not NULL`, []); - testErrorsAndWarnings(`from a_index | where ${camelCase(field)}Field Is nOt NuLL`, []); + for (const field of supportedFieldTypes) { + testErrorsAndWarnings(`from a_index | where ${fieldNameFromType(field)} IS NULL`, []); + testErrorsAndWarnings(`from a_index | where ${fieldNameFromType(field)} IS null`, []); + testErrorsAndWarnings(`from a_index | where ${fieldNameFromType(field)} is null`, []); + testErrorsAndWarnings(`from a_index | where ${fieldNameFromType(field)} is NULL`, []); + testErrorsAndWarnings(`from a_index | where ${fieldNameFromType(field)} IS NOT NULL`, []); + testErrorsAndWarnings(`from a_index | where ${fieldNameFromType(field)} IS NOT null`, []); + testErrorsAndWarnings(`from a_index | where ${fieldNameFromType(field)} IS not NULL`, []); + testErrorsAndWarnings(`from a_index | where ${fieldNameFromType(field)} Is nOt NuLL`, []); } // this is a scenario that was failing because "or" didn't accept "null" @@ -1087,14 +1078,14 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval a=["a", "b"]', []); testErrorsAndWarnings('from a_index | eval a=null', []); - for (const field of fieldTypes) { - testErrorsAndWarnings(`from a_index | eval ${camelCase(field)}Field IS NULL`, []); - testErrorsAndWarnings(`from a_index | eval ${camelCase(field)}Field IS null`, []); - testErrorsAndWarnings(`from a_index | eval ${camelCase(field)}Field is null`, []); - testErrorsAndWarnings(`from a_index | eval ${camelCase(field)}Field is NULL`, []); - testErrorsAndWarnings(`from a_index | eval ${camelCase(field)}Field IS NOT NULL`, []); - testErrorsAndWarnings(`from a_index | eval ${camelCase(field)}Field IS NOT null`, []); - testErrorsAndWarnings(`from a_index | eval ${camelCase(field)}Field IS not NULL`, []); + for (const field of supportedFieldTypes) { + testErrorsAndWarnings(`from a_index | eval ${fieldNameFromType(field)} IS NULL`, []); + testErrorsAndWarnings(`from a_index | eval ${fieldNameFromType(field)} IS null`, []); + testErrorsAndWarnings(`from a_index | eval ${fieldNameFromType(field)} is null`, []); + testErrorsAndWarnings(`from a_index | eval ${fieldNameFromType(field)} is NULL`, []); + testErrorsAndWarnings(`from a_index | eval ${fieldNameFromType(field)} IS NOT NULL`, []); + testErrorsAndWarnings(`from a_index | eval ${fieldNameFromType(field)} IS NOT null`, []); + testErrorsAndWarnings(`from a_index | eval ${fieldNameFromType(field)} IS not NULL`, []); } for (const nesting of NESTED_DEPTHS) { @@ -2060,6 +2051,20 @@ describe('validation logic', () => { ); testErrorsAndWarnings('from a_index | sort date_diff("year", dateField, dateField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = date_diff("year", to_datetime(dateField), to_datetime(dateField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval date_diff(booleanField, booleanField, booleanField)', + [ + 'Argument of [date_diff] must be [string], found value [booleanField] type [boolean]', + 'Argument of [date_diff] must be [date], found value [booleanField] type [boolean]', + 'Argument of [date_diff] must be [date], found value [booleanField] type [boolean]', + ] + ); }); describe('abs', () => { @@ -2094,6 +2099,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort abs(numberField)', []); + testErrorsAndWarnings('row var = abs(to_integer(true))', []); + + testErrorsAndWarnings('row var = abs(true)', [ + 'Argument of [abs] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where abs(booleanField) > 0', [ + 'Argument of [abs] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = abs(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval abs(booleanField)', [ + 'Argument of [abs] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('acos', () => { @@ -2128,6 +2148,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort acos(numberField)', []); + testErrorsAndWarnings('row var = acos(to_integer(true))', []); + + testErrorsAndWarnings('row var = acos(true)', [ + 'Argument of [acos] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where acos(booleanField) > 0', [ + 'Argument of [acos] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = acos(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval acos(booleanField)', [ + 'Argument of [acos] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('asin', () => { @@ -2162,6 +2197,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort asin(numberField)', []); + testErrorsAndWarnings('row var = asin(to_integer(true))', []); + + testErrorsAndWarnings('row var = asin(true)', [ + 'Argument of [asin] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where asin(booleanField) > 0', [ + 'Argument of [asin] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = asin(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval asin(booleanField)', [ + 'Argument of [asin] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('atan', () => { @@ -2196,6 +2246,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort atan(numberField)', []); + testErrorsAndWarnings('row var = atan(to_integer(true))', []); + + testErrorsAndWarnings('row var = atan(true)', [ + 'Argument of [atan] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where atan(booleanField) > 0', [ + 'Argument of [atan] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = atan(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval atan(booleanField)', [ + 'Argument of [atan] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('atan2', () => { @@ -2233,6 +2298,27 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort atan2(numberField, numberField)', []); + testErrorsAndWarnings('row var = atan2(to_integer(true), to_integer(true))', []); + + testErrorsAndWarnings('row var = atan2(true, true)', [ + 'Argument of [atan2] must be [number], found value [true] type [boolean]', + 'Argument of [atan2] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where atan2(booleanField, booleanField) > 0', [ + 'Argument of [atan2] must be [number], found value [booleanField] type [boolean]', + 'Argument of [atan2] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = atan2(to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval atan2(booleanField, booleanField)', [ + 'Argument of [atan2] must be [number], found value [booleanField] type [boolean]', + 'Argument of [atan2] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('case', () => { @@ -2241,6 +2327,10 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval var = case(booleanField, stringField)', []); testErrorsAndWarnings('from a_index | eval case(booleanField, stringField)', []); testErrorsAndWarnings('from a_index | sort case(booleanField, stringField)', []); + + testErrorsAndWarnings('row var = case(to_cartesianpoint("POINT (30 10)"), true)', [ + 'Argument of [case] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); }); describe('ceil', () => { @@ -2275,6 +2365,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort ceil(numberField)', []); + testErrorsAndWarnings('row var = ceil(to_integer(true))', []); + + testErrorsAndWarnings('row var = ceil(true)', [ + 'Argument of [ceil] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where ceil(booleanField) > 0', [ + 'Argument of [ceil] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = ceil(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval ceil(booleanField)', [ + 'Argument of [ceil] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('cidr_match', () => { @@ -2301,6 +2406,25 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort cidr_match(ipField, stringField)', []); + testErrorsAndWarnings( + 'row var = cidr_match(to_ip(to_ip("127.0.0.1")), to_string(true))', + [] + ); + + testErrorsAndWarnings('row var = cidr_match(true, true)', [ + 'Argument of [cidr_match] must be [ip], found value [true] type [boolean]', + 'Argument of [cidr_match] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = cidr_match(to_ip(ipField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval cidr_match(booleanField, booleanField)', [ + 'Argument of [cidr_match] must be [ip], found value [booleanField] type [boolean]', + 'Argument of [cidr_match] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('coalesce', () => { @@ -2309,6 +2433,277 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval var = coalesce(stringField)', []); testErrorsAndWarnings('from a_index | eval coalesce(stringField)', []); testErrorsAndWarnings('from a_index | sort coalesce(stringField)', []); + testErrorsAndWarnings('row var = coalesce(true)', []); + testErrorsAndWarnings('row coalesce(true)', []); + testErrorsAndWarnings('row var = coalesce(to_boolean(true))', []); + testErrorsAndWarnings('row var = coalesce(true, true)', []); + testErrorsAndWarnings('row coalesce(true, true)', []); + testErrorsAndWarnings('row var = coalesce(to_boolean(true), to_boolean(true))', []); + testErrorsAndWarnings('row var = coalesce(5)', []); + testErrorsAndWarnings('row coalesce(5)', []); + testErrorsAndWarnings('row var = coalesce(to_integer(true))', []); + testErrorsAndWarnings('row var = coalesce(5, 5)', []); + testErrorsAndWarnings('row coalesce(5, 5)', []); + testErrorsAndWarnings('row var = coalesce(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = coalesce(to_string(true))', []); + testErrorsAndWarnings('row var = coalesce("a", "a")', []); + testErrorsAndWarnings('row coalesce("a", "a")', []); + testErrorsAndWarnings('row var = coalesce(to_string(true), to_string(true))', []); + + testErrorsAndWarnings('from a_index | where coalesce(numberField) > 0', []); + + testErrorsAndWarnings('from a_index | where coalesce(numberField, numberField) > 0', []); + + testErrorsAndWarnings('from a_index | where length(coalesce(stringField)) > 0', []); + + testErrorsAndWarnings( + 'from a_index | where length(coalesce(stringField, stringField)) > 0', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(booleanField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval var = coalesce(booleanField, booleanField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(booleanField, booleanField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_boolean(booleanField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(numberField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(numberField, numberField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(numberField, numberField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(stringField, stringField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(stringField, stringField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | sort coalesce(booleanField)', []); + testErrorsAndWarnings('row var = coalesce(5, true)', []); + testErrorsAndWarnings('row coalesce(5, true)', []); + testErrorsAndWarnings('row var = coalesce(to_integer(true), to_boolean(true))', []); + testErrorsAndWarnings('row var = coalesce(now())', []); + testErrorsAndWarnings('row coalesce(now())', []); + testErrorsAndWarnings('row var = coalesce(to_datetime(now()))', []); + testErrorsAndWarnings('row var = coalesce(now(), true)', []); + testErrorsAndWarnings('row coalesce(now(), true)', []); + testErrorsAndWarnings('row var = coalesce(to_datetime(now()), to_boolean(true))', []); + testErrorsAndWarnings('row var = coalesce("a", true)', []); + testErrorsAndWarnings('row coalesce("a", true)', []); + testErrorsAndWarnings('row var = coalesce(to_string(true), to_boolean(true))', []); + testErrorsAndWarnings('row var = coalesce(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row coalesce(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = coalesce(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = coalesce(to_ip("127.0.0.1"), true)', []); + testErrorsAndWarnings('row coalesce(to_ip("127.0.0.1"), true)', []); + testErrorsAndWarnings( + 'row var = coalesce(to_ip(to_ip("127.0.0.1")), to_boolean(true))', + [] + ); + testErrorsAndWarnings('row var = coalesce(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row coalesce(to_cartesianpoint("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = coalesce(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = coalesce(to_cartesianpoint("POINT (30 10)"), true)', []); + testErrorsAndWarnings('row coalesce(to_cartesianpoint("POINT (30 10)"), true)', []); + + testErrorsAndWarnings( + 'row var = coalesce(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_boolean(true))', + [] + ); + + testErrorsAndWarnings('row var = coalesce(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row coalesce(to_cartesianshape("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = coalesce(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = coalesce(to_cartesianshape("POINT (30 10)"), true)', []); + testErrorsAndWarnings('row coalesce(to_cartesianshape("POINT (30 10)"), true)', []); + + testErrorsAndWarnings( + 'row var = coalesce(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_boolean(true))', + [] + ); + + testErrorsAndWarnings('row var = coalesce(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row coalesce(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = coalesce(to_geopoint(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = coalesce(to_geopoint("POINT (30 10)"), true)', []); + testErrorsAndWarnings('row coalesce(to_geopoint("POINT (30 10)"), true)', []); + + testErrorsAndWarnings( + 'row var = coalesce(to_geopoint(to_geopoint("POINT (30 10)")), to_boolean(true))', + [] + ); + + testErrorsAndWarnings('row var = coalesce(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row coalesce(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = coalesce(to_geoshape(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = coalesce(to_geoshape("POINT (30 10)"), true)', []); + testErrorsAndWarnings('row coalesce(to_geoshape("POINT (30 10)"), true)', []); + + testErrorsAndWarnings( + 'row var = coalesce(to_geoshape(to_geopoint("POINT (30 10)")), to_boolean(true))', + [] + ); + + testErrorsAndWarnings('row var = coalesce(to_version("1.0.0"))', []); + testErrorsAndWarnings('row coalesce(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = coalesce(to_version("a"))', []); + testErrorsAndWarnings('row var = coalesce(to_version("1.0.0"), true)', []); + testErrorsAndWarnings('row coalesce(to_version("1.0.0"), true)', []); + testErrorsAndWarnings('row var = coalesce(to_version("a"), to_boolean(true))', []); + testErrorsAndWarnings('from a_index | where coalesce(numberField, booleanField) > 0', []); + testErrorsAndWarnings( + 'from a_index | where length(coalesce(stringField, booleanField)) > 0', + [] + ); + testErrorsAndWarnings('from a_index | eval var = coalesce(numberField, booleanField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(numberField, booleanField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_integer(booleanField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(dateField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(dateField, booleanField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(dateField, booleanField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_datetime(dateField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(stringField, booleanField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(stringField, booleanField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_string(booleanField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(ipField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(ipField, booleanField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(ipField, booleanField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_ip(ipField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(cartesianPointField, booleanField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval coalesce(cartesianPointField, booleanField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_cartesianpoint(cartesianPointField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(cartesianShapeField, booleanField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval coalesce(cartesianShapeField, booleanField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_cartesianshape(cartesianPointField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(to_geopoint(geoPointField))', []); + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(geoPointField, booleanField)', + [] + ); + testErrorsAndWarnings('from a_index | eval coalesce(geoPointField, booleanField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_geopoint(geoPointField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(to_geoshape(geoPointField))', []); + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(geoShapeField, booleanField)', + [] + ); + testErrorsAndWarnings('from a_index | eval coalesce(geoShapeField, booleanField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_geoshape(geoPointField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = coalesce(versionField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(to_version(stringField))', []); + testErrorsAndWarnings('from a_index | eval var = coalesce(versionField, booleanField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(versionField, booleanField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = coalesce(to_version(stringField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | sort coalesce(numberField)', []); + testErrorsAndWarnings('from a_index | eval coalesce(cartesianPointField)', []); }); describe('concat', () => { @@ -2318,6 +2713,7 @@ describe('validation logic', () => { testErrorsAndWarnings('row var = concat(5, 5)', [ 'Argument of [concat] must be [string], found value [5] type [number]', + 'Argument of [concat] must be [string], found value [5] type [number]', ]); testErrorsAndWarnings( @@ -2327,6 +2723,7 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | where length(concat(numberField, numberField)) > 0', [ 'Argument of [concat] must be [string], found value [numberField] type [number]', + 'Argument of [concat] must be [string], found value [numberField] type [number]', ]); testErrorsAndWarnings('from a_index | eval var = concat(stringField, stringField)', []); @@ -2339,9 +2736,34 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval concat(numberField, numberField)', [ 'Argument of [concat] must be [string], found value [numberField] type [number]', + 'Argument of [concat] must be [string], found value [numberField] type [number]', ]); testErrorsAndWarnings('from a_index | sort concat(stringField, stringField)', []); + testErrorsAndWarnings('row var = concat(to_string(true), to_string(true))', []); + + testErrorsAndWarnings('row var = concat(true, true)', [ + 'Argument of [concat] must be [string], found value [true] type [boolean]', + 'Argument of [concat] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | where length(concat(booleanField, booleanField)) > 0', + [ + 'Argument of [concat] must be [string], found value [booleanField] type [boolean]', + 'Argument of [concat] must be [string], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = concat(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval concat(booleanField, booleanField)', [ + 'Argument of [concat] must be [string], found value [booleanField] type [boolean]', + 'Argument of [concat] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('cos', () => { @@ -2376,6 +2798,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort cos(numberField)', []); + testErrorsAndWarnings('row var = cos(to_integer(true))', []); + + testErrorsAndWarnings('row var = cos(true)', [ + 'Argument of [cos] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where cos(booleanField) > 0', [ + 'Argument of [cos] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = cos(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval cos(booleanField)', [ + 'Argument of [cos] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('cosh', () => { @@ -2410,6 +2847,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort cosh(numberField)', []); + testErrorsAndWarnings('row var = cosh(to_integer(true))', []); + + testErrorsAndWarnings('row var = cosh(true)', [ + 'Argument of [cosh] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where cosh(booleanField) > 0', [ + 'Argument of [cosh] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = cosh(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval cosh(booleanField)', [ + 'Argument of [cosh] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('date_extract', () => { @@ -2445,33 +2897,63 @@ describe('validation logic', () => { 'from a_index | sort date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", dateField)', [] ); + + testErrorsAndWarnings('row var = date_extract(true, true)', [ + 'Argument of [date_extract] must be [chrono_literal], found value [true] type [boolean]', + 'Argument of [date_extract] must be [date], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = date_extract("ALIGNED_DAY_OF_WEEK_IN_MONTH", to_datetime(dateField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval date_extract(booleanField, booleanField)', [ + 'Argument of [date_extract] must be [chrono_literal], found value [booleanField] type [boolean]', + 'Argument of [date_extract] must be [date], found value [booleanField] type [boolean]', + ]); }); describe('date_format', () => { - testErrorsAndWarnings('row var = date_format(now(), "a")', []); - testErrorsAndWarnings('row date_format(now(), "a")', []); - testErrorsAndWarnings('from a_index | eval var = date_format(dateField, stringField)', []); - testErrorsAndWarnings('from a_index | eval date_format(dateField, stringField)', []); + testErrorsAndWarnings('row var = date_format("a", now())', []); + testErrorsAndWarnings('row date_format("a", now())', []); + testErrorsAndWarnings('from a_index | eval var = date_format(stringField, dateField)', []); + testErrorsAndWarnings('from a_index | eval date_format(stringField, dateField)', []); testErrorsAndWarnings( - 'from a_index | eval var = date_format(to_datetime(stringField), to_string(stringField))', + 'from a_index | eval var = date_format(to_string(stringField), to_datetime(stringField))', [] ); testErrorsAndWarnings('from a_index | eval date_format(stringField, numberField)', [ - 'Argument of [date_format] must be [date], found value [stringField] type [string]', - 'Argument of [date_format] must be [string], found value [numberField] type [number]', + 'Argument of [date_format] must be [date], found value [numberField] type [number]', ]); - testErrorsAndWarnings('from a_index | eval date_format(dateField, stringField, extraArg)', [ + testErrorsAndWarnings('from a_index | eval date_format(stringField, dateField, extraArg)', [ 'Error: [date_format] function expects no more than 2 arguments, got 3.', ]); - testErrorsAndWarnings('from a_index | sort date_format(dateField, stringField)', []); + testErrorsAndWarnings('from a_index | sort date_format(stringField, dateField)', []); + + testErrorsAndWarnings('row var = date_format(true, true)', [ + 'Argument of [date_format] must be [string], found value [true] type [boolean]', + 'Argument of [date_format] must be [date], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = date_format(to_string(booleanField), to_datetime(dateField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval date_format(booleanField, booleanField)', [ + 'Argument of [date_format] must be [string], found value [booleanField] type [boolean]', + 'Argument of [date_format] must be [date], found value [booleanField] type [boolean]', + ]); }); describe('date_parse', () => { testErrorsAndWarnings('row var = date_parse("a", "a")', []); + testErrorsAndWarnings('row var = date_parse("a")', []); testErrorsAndWarnings('row date_parse("a", "a")', []); testErrorsAndWarnings('row var = date_parse(to_string("a"), to_string("a"))', []); @@ -2480,6 +2962,7 @@ describe('validation logic', () => { 'Argument of [date_parse] must be [string], found value [5] type [number]', ]); + testErrorsAndWarnings('from a_index | eval var = date_parse(stringField)', []); testErrorsAndWarnings('from a_index | eval var = date_parse(stringField, stringField)', []); testErrorsAndWarnings('from a_index | eval date_parse(stringField, stringField)', []); @@ -2495,16 +2978,32 @@ describe('validation logic', () => { testErrorsAndWarnings( 'from a_index | eval date_parse(stringField, stringField, extraArg)', - ['Error: [date_parse] function expects exactly 2 arguments, got 3.'] + ['Error: [date_parse] function expects no more than 2 arguments, got 3.'] ); testErrorsAndWarnings('from a_index | sort date_parse(stringField, stringField)', []); - }); + testErrorsAndWarnings('row var = date_parse(to_string(true), to_string(true))', []); - describe('date_trunc', () => { - testErrorsAndWarnings('row var = date_trunc(1 year, now())', []); - testErrorsAndWarnings('row date_trunc(1 year, now())', []); - testErrorsAndWarnings('from a_index | eval var = date_trunc(1 year, dateField)', []); + testErrorsAndWarnings('row var = date_parse(true, true)', [ + 'Argument of [date_parse] must be [string], found value [true] type [boolean]', + 'Argument of [date_parse] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = date_parse(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval date_parse(booleanField, booleanField)', [ + 'Argument of [date_parse] must be [string], found value [booleanField] type [boolean]', + 'Argument of [date_parse] must be [string], found value [booleanField] type [boolean]', + ]); + }); + + describe('date_trunc', () => { + testErrorsAndWarnings('row var = date_trunc(1 year, now())', []); + testErrorsAndWarnings('row date_trunc(1 year, now())', []); + testErrorsAndWarnings('from a_index | eval var = date_trunc(1 year, dateField)', []); testErrorsAndWarnings('from a_index | eval date_trunc(1 year, dateField)', []); testErrorsAndWarnings( @@ -2522,6 +3021,31 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort date_trunc(1 year, dateField)', []); + testErrorsAndWarnings('row var = date_trunc(now(), now())', []); + testErrorsAndWarnings('row date_trunc(now(), now())', []); + + testErrorsAndWarnings('row var = date_trunc(true, true)', [ + 'Argument of [date_trunc] must be [time_literal], found value [true] type [boolean]', + 'Argument of [date_trunc] must be [date], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = date_trunc(1 year, to_datetime(dateField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval date_trunc(booleanField, booleanField)', [ + 'Argument of [date_trunc] must be [time_literal], found value [booleanField] type [boolean]', + 'Argument of [date_trunc] must be [date], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = date_trunc(dateField, dateField)', []); + testErrorsAndWarnings('from a_index | eval date_trunc(dateField, dateField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = date_trunc(to_datetime(dateField), to_datetime(dateField))', + [] + ); }); describe('e', () => { @@ -2566,6 +3090,22 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort ends_with(stringField, stringField)', []); + testErrorsAndWarnings('row var = ends_with(to_string(true), to_string(true))', []); + + testErrorsAndWarnings('row var = ends_with(true, true)', [ + 'Argument of [ends_with] must be [string], found value [true] type [boolean]', + 'Argument of [ends_with] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = ends_with(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval ends_with(booleanField, booleanField)', [ + 'Argument of [ends_with] must be [string], found value [booleanField] type [boolean]', + 'Argument of [ends_with] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('floor', () => { @@ -2600,6 +3140,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort floor(numberField)', []); + testErrorsAndWarnings('row var = floor(to_integer(true))', []); + + testErrorsAndWarnings('row var = floor(true)', [ + 'Argument of [floor] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where floor(booleanField) > 0', [ + 'Argument of [floor] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = floor(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval floor(booleanField)', [ + 'Argument of [floor] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('greatest', () => { @@ -2608,6 +3163,136 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval var = greatest(stringField)', []); testErrorsAndWarnings('from a_index | eval greatest(stringField)', []); testErrorsAndWarnings('from a_index | sort greatest(stringField)', []); + testErrorsAndWarnings('row var = greatest(true)', []); + testErrorsAndWarnings('row greatest(true)', []); + testErrorsAndWarnings('row var = greatest(to_boolean(true))', []); + testErrorsAndWarnings('row var = greatest(true, true)', []); + testErrorsAndWarnings('row greatest(true, true)', []); + testErrorsAndWarnings('row var = greatest(to_boolean(true), to_boolean(true))', []); + testErrorsAndWarnings('row var = greatest(5, 5)', []); + testErrorsAndWarnings('row greatest(5, 5)', []); + testErrorsAndWarnings('row var = greatest(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = greatest(5)', []); + testErrorsAndWarnings('row greatest(5)', []); + testErrorsAndWarnings('row var = greatest(to_integer(true))', []); + testErrorsAndWarnings('row var = greatest(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row greatest(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); + + testErrorsAndWarnings( + 'row var = greatest(to_ip(to_ip("127.0.0.1")), to_ip(to_ip("127.0.0.1")))', + [] + ); + + testErrorsAndWarnings('row var = greatest(to_string(true))', []); + testErrorsAndWarnings('row var = greatest("a", "a")', []); + testErrorsAndWarnings('row greatest("a", "a")', []); + testErrorsAndWarnings('row var = greatest(to_string(true), to_string(true))', []); + testErrorsAndWarnings('row var = greatest(to_version("1.0.0"), to_version("1.0.0"))', []); + testErrorsAndWarnings('row greatest(to_version("1.0.0"), to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = greatest(to_version("a"), to_version("a"))', []); + + testErrorsAndWarnings( + 'row var = greatest(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + [ + 'Argument of [greatest] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + 'Argument of [greatest] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ] + ); + + testErrorsAndWarnings('from a_index | where greatest(numberField, numberField) > 0', []); + + testErrorsAndWarnings( + 'from a_index | where greatest(cartesianPointField, cartesianPointField) > 0', + [ + 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ] + ); + + testErrorsAndWarnings('from a_index | where greatest(numberField) > 0', []); + + testErrorsAndWarnings('from a_index | where greatest(cartesianPointField) > 0', [ + 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where length(greatest(stringField)) > 0', []); + + testErrorsAndWarnings('from a_index | where length(greatest(cartesianPointField)) > 0', [ + 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings( + 'from a_index | where length(greatest(stringField, stringField)) > 0', + [] + ); + + testErrorsAndWarnings( + 'from a_index | where length(greatest(cartesianPointField, cartesianPointField)) > 0', + [ + 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ] + ); + + testErrorsAndWarnings('from a_index | eval var = greatest(booleanField)', []); + testErrorsAndWarnings('from a_index | eval greatest(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = greatest(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval greatest(cartesianPointField)', [ + 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = greatest(booleanField, booleanField)', []); + testErrorsAndWarnings('from a_index | eval greatest(booleanField, booleanField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = greatest(to_boolean(booleanField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval greatest(cartesianPointField, cartesianPointField)', + [ + 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + 'Argument of [greatest] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ] + ); + + testErrorsAndWarnings('from a_index | eval var = greatest(numberField, numberField)', []); + testErrorsAndWarnings('from a_index | eval greatest(numberField, numberField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = greatest(to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = greatest(numberField)', []); + testErrorsAndWarnings('from a_index | eval greatest(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = greatest(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = greatest(ipField, ipField)', []); + testErrorsAndWarnings('from a_index | eval greatest(ipField, ipField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = greatest(to_ip(ipField), to_ip(ipField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = greatest(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = greatest(stringField, stringField)', []); + testErrorsAndWarnings('from a_index | eval greatest(stringField, stringField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = greatest(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = greatest(versionField, versionField)', []); + testErrorsAndWarnings('from a_index | eval greatest(versionField, versionField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = greatest(to_version(stringField), to_version(stringField))', + [] + ); + + testErrorsAndWarnings('from a_index | sort greatest(booleanField)', []); }); describe('least', () => { @@ -2616,6 +3301,136 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval var = least(stringField)', []); testErrorsAndWarnings('from a_index | eval least(stringField)', []); testErrorsAndWarnings('from a_index | sort least(stringField)', []); + testErrorsAndWarnings('row var = least(true)', []); + testErrorsAndWarnings('row least(true)', []); + testErrorsAndWarnings('row var = least(to_boolean(true))', []); + testErrorsAndWarnings('row var = least(true, true)', []); + testErrorsAndWarnings('row least(true, true)', []); + testErrorsAndWarnings('row var = least(to_boolean(true), to_boolean(true))', []); + testErrorsAndWarnings('row var = least(5, 5)', []); + testErrorsAndWarnings('row least(5, 5)', []); + testErrorsAndWarnings('row var = least(to_integer(true), to_integer(true))', []); + testErrorsAndWarnings('row var = least(5)', []); + testErrorsAndWarnings('row least(5)', []); + testErrorsAndWarnings('row var = least(to_integer(true))', []); + testErrorsAndWarnings('row var = least(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row least(to_ip("127.0.0.1"), to_ip("127.0.0.1"))', []); + + testErrorsAndWarnings( + 'row var = least(to_ip(to_ip("127.0.0.1")), to_ip(to_ip("127.0.0.1")))', + [] + ); + + testErrorsAndWarnings('row var = least(to_string(true))', []); + testErrorsAndWarnings('row var = least("a", "a")', []); + testErrorsAndWarnings('row least("a", "a")', []); + testErrorsAndWarnings('row var = least(to_string(true), to_string(true))', []); + testErrorsAndWarnings('row var = least(to_version("1.0.0"), to_version("1.0.0"))', []); + testErrorsAndWarnings('row least(to_version("1.0.0"), to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = least(to_version("a"), to_version("a"))', []); + + testErrorsAndWarnings( + 'row var = least(to_cartesianpoint("POINT (30 10)"), to_cartesianpoint("POINT (30 10)"))', + [ + 'Argument of [least] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + 'Argument of [least] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ] + ); + + testErrorsAndWarnings('from a_index | where least(numberField, numberField) > 0', []); + + testErrorsAndWarnings( + 'from a_index | where least(cartesianPointField, cartesianPointField) > 0', + [ + 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ] + ); + + testErrorsAndWarnings('from a_index | where least(numberField) > 0', []); + + testErrorsAndWarnings('from a_index | where least(cartesianPointField) > 0', [ + 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where length(least(stringField)) > 0', []); + + testErrorsAndWarnings('from a_index | where length(least(cartesianPointField)) > 0', [ + 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings( + 'from a_index | where length(least(stringField, stringField)) > 0', + [] + ); + + testErrorsAndWarnings( + 'from a_index | where length(least(cartesianPointField, cartesianPointField)) > 0', + [ + 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ] + ); + + testErrorsAndWarnings('from a_index | eval var = least(booleanField)', []); + testErrorsAndWarnings('from a_index | eval least(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = least(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval least(cartesianPointField)', [ + 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = least(booleanField, booleanField)', []); + testErrorsAndWarnings('from a_index | eval least(booleanField, booleanField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = least(to_boolean(booleanField), to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval least(cartesianPointField, cartesianPointField)', + [ + 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + 'Argument of [least] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ] + ); + + testErrorsAndWarnings('from a_index | eval var = least(numberField, numberField)', []); + testErrorsAndWarnings('from a_index | eval least(numberField, numberField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = least(to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = least(numberField)', []); + testErrorsAndWarnings('from a_index | eval least(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = least(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = least(ipField, ipField)', []); + testErrorsAndWarnings('from a_index | eval least(ipField, ipField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = least(to_ip(ipField), to_ip(ipField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = least(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = least(stringField, stringField)', []); + testErrorsAndWarnings('from a_index | eval least(stringField, stringField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = least(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = least(versionField, versionField)', []); + testErrorsAndWarnings('from a_index | eval least(versionField, versionField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = least(to_version(stringField), to_version(stringField))', + [] + ); + + testErrorsAndWarnings('from a_index | sort least(booleanField)', []); }); describe('left', () => { @@ -2656,6 +3471,27 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort left(stringField, numberField)', []); + testErrorsAndWarnings('row var = left(to_string(true), to_integer(true))', []); + + testErrorsAndWarnings('row var = left(true, true)', [ + 'Argument of [left] must be [string], found value [true] type [boolean]', + 'Argument of [left] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where length(left(booleanField, booleanField)) > 0', [ + 'Argument of [left] must be [string], found value [booleanField] type [boolean]', + 'Argument of [left] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = left(to_string(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval left(booleanField, booleanField)', [ + 'Argument of [left] must be [string], found value [booleanField] type [boolean]', + 'Argument of [left] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('length', () => { @@ -2690,6 +3526,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort length(stringField)', []); + testErrorsAndWarnings('row var = length(to_string(true))', []); + + testErrorsAndWarnings('row var = length(true)', [ + 'Argument of [length] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where length(booleanField) > 0', [ + 'Argument of [length] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = length(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval length(booleanField)', [ + 'Argument of [length] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('log', () => { @@ -2727,6 +3578,50 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort log(numberField, numberField)', []); + testErrorsAndWarnings('row var = log(5)', []); + testErrorsAndWarnings('row log(5)', []); + testErrorsAndWarnings('row var = log(to_integer(true))', []); + testErrorsAndWarnings('row var = log(to_integer(true), to_integer(true))', []); + + testErrorsAndWarnings('row var = log(true, true)', [ + 'Argument of [log] must be [number], found value [true] type [boolean]', + 'Argument of [log] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where log(numberField) > 0', []); + + testErrorsAndWarnings('from a_index | where log(booleanField) > 0', [ + 'Argument of [log] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where log(booleanField, booleanField) > 0', [ + 'Argument of [log] must be [number], found value [booleanField] type [boolean]', + 'Argument of [log] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = log(numberField)', []); + testErrorsAndWarnings('from a_index | eval log(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = log(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval log(booleanField)', [ + 'Argument of [log] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = log(*)', [ + 'Using wildcards (*) in log is not allowed', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = log(to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval log(booleanField, booleanField)', [ + 'Argument of [log] must be [number], found value [booleanField] type [boolean]', + 'Argument of [log] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | sort log(numberField)', []); }); describe('log10', () => { @@ -2761,6 +3656,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort log10(numberField)', []); + testErrorsAndWarnings('row var = log10(to_integer(true))', []); + + testErrorsAndWarnings('row var = log10(true)', [ + 'Argument of [log10] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where log10(booleanField) > 0', [ + 'Argument of [log10] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = log10(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval log10(booleanField)', [ + 'Argument of [log10] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('ltrim', () => { @@ -2795,6 +3705,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort ltrim(stringField)', []); + testErrorsAndWarnings('row var = ltrim(to_string(true))', []); + + testErrorsAndWarnings('row var = ltrim(true)', [ + 'Argument of [ltrim] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where length(ltrim(booleanField)) > 0', [ + 'Argument of [ltrim] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = ltrim(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval ltrim(booleanField)', [ + 'Argument of [ltrim] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('mv_avg', () => { @@ -2829,6 +3754,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort mv_avg(numberField)', []); + testErrorsAndWarnings('row var = mv_avg(to_integer(true))', []); + + testErrorsAndWarnings('row var = mv_avg(true)', [ + 'Argument of [mv_avg] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where mv_avg(booleanField) > 0', [ + 'Argument of [mv_avg] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_avg(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_avg(booleanField)', [ + 'Argument of [mv_avg] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('mv_concat', () => { @@ -2872,6 +3812,30 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort mv_concat(stringField, stringField)', []); + testErrorsAndWarnings('row var = mv_concat(to_string(true), to_string(true))', []); + + testErrorsAndWarnings('row var = mv_concat(true, true)', [ + 'Argument of [mv_concat] must be [string], found value [true] type [boolean]', + 'Argument of [mv_concat] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | where length(mv_concat(booleanField, booleanField)) > 0', + [ + 'Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]', + 'Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_concat(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval mv_concat(booleanField, booleanField)', [ + 'Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]', + 'Argument of [mv_concat] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('mv_count', () => { @@ -2885,23 +3849,213 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort mv_count(stringField)', []); - }); + testErrorsAndWarnings('row var = mv_count(true)', []); + testErrorsAndWarnings('row mv_count(true)', []); + testErrorsAndWarnings('row var = mv_count(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_count(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_count(to_cartesianpoint("POINT (30 10)"))', []); - describe('mv_dedupe', () => { - testErrorsAndWarnings('row var = mv_dedupe("a")', []); - testErrorsAndWarnings('row mv_dedupe("a")', []); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(stringField)', []); - testErrorsAndWarnings('from a_index | eval mv_dedupe(stringField)', []); + testErrorsAndWarnings( + 'row var = mv_count(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); - testErrorsAndWarnings('from a_index | eval var = mv_dedupe(*)', [ - 'Using wildcards (*) in mv_dedupe is not allowed', - ]); + testErrorsAndWarnings('row var = mv_count(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_count(to_cartesianshape("POINT (30 10)"))', []); - testErrorsAndWarnings('from a_index | sort mv_dedupe(stringField)', []); - }); + testErrorsAndWarnings( + 'row var = mv_count(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); - describe('mv_first', () => { - testErrorsAndWarnings('row var = mv_first("a")', []); + testErrorsAndWarnings('row var = mv_count(now())', []); + testErrorsAndWarnings('row mv_count(now())', []); + testErrorsAndWarnings('row var = mv_count(to_datetime(now()))', []); + testErrorsAndWarnings('row var = mv_count(5)', []); + testErrorsAndWarnings('row mv_count(5)', []); + testErrorsAndWarnings('row var = mv_count(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_count(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_count(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_count(to_geopoint(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = mv_count(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_count(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_count(to_geoshape(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = mv_count(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_count(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_count(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_count(to_string(true))', []); + testErrorsAndWarnings('row var = mv_count(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_count(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_count(to_version("a"))', []); + testErrorsAndWarnings('from a_index | where mv_count(booleanField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(cartesianPointField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(cartesianShapeField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(dateField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(geoPointField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(geoShapeField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(ipField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(stringField) > 0', []); + testErrorsAndWarnings('from a_index | where mv_count(versionField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_boolean(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_count(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_count(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_count(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_count(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(numberField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_geopoint(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_geoshape(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_count(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_count(to_version(stringField))', []); + + testErrorsAndWarnings('from a_index | eval mv_count(booleanField, extraArg)', [ + 'Error: [mv_count] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_count(booleanField)', []); + }); + + describe('mv_dedupe', () => { + testErrorsAndWarnings('row var = mv_dedupe("a")', []); + testErrorsAndWarnings('row mv_dedupe("a")', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(stringField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(stringField)', []); + + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(*)', [ + 'Using wildcards (*) in mv_dedupe is not allowed', + ]); + + testErrorsAndWarnings('from a_index | sort mv_dedupe(stringField)', []); + testErrorsAndWarnings('row var = mv_dedupe(true)', []); + testErrorsAndWarnings('row mv_dedupe(true)', []); + testErrorsAndWarnings('row var = mv_dedupe(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_dedupe(now())', []); + testErrorsAndWarnings('row mv_dedupe(now())', []); + testErrorsAndWarnings('row var = mv_dedupe(to_datetime(now()))', []); + testErrorsAndWarnings('row var = mv_dedupe(5)', []); + testErrorsAndWarnings('row mv_dedupe(5)', []); + testErrorsAndWarnings('row var = mv_dedupe(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_dedupe(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_string(true))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_dedupe(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_version("a"))', []); + + testErrorsAndWarnings('from a_index | where mv_dedupe(numberField) > 0', []); + + testErrorsAndWarnings('from a_index | where length(mv_dedupe(stringField)) > 0', []); + + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(numberField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(to_version(stringField))', []); + + testErrorsAndWarnings('from a_index | eval mv_dedupe(booleanField, extraArg)', [ + 'Error: [mv_dedupe] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_dedupe(booleanField)', []); + testErrorsAndWarnings('row mv_dedupe(to_cartesianpoint("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = mv_dedupe(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = mv_dedupe(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_dedupe(to_cartesianshape("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = mv_dedupe(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = mv_dedupe(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_dedupe(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_geopoint(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_dedupe(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_dedupe(to_geoshape(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_dedupe(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_dedupe(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(geoPointField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_dedupe(to_geopoint(geoPointField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = mv_dedupe(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_dedupe(geoShapeField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = mv_dedupe(to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval mv_dedupe(numberField, extraArg)', [ + 'Error: [mv_dedupe] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_dedupe(numberField)', []); + }); + + describe('mv_first', () => { + testErrorsAndWarnings('row var = mv_first("a")', []); testErrorsAndWarnings('row mv_first("a")', []); testErrorsAndWarnings('from a_index | eval var = mv_first(stringField)', []); testErrorsAndWarnings('from a_index | eval mv_first(stringField)', []); @@ -2911,6 +4065,90 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort mv_first(stringField)', []); + testErrorsAndWarnings('row var = mv_first(true)', []); + testErrorsAndWarnings('row mv_first(true)', []); + testErrorsAndWarnings('row var = mv_first(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_first(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_first(to_cartesianpoint("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = mv_first(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = mv_first(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_first(to_cartesianshape("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = mv_first(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = mv_first(now())', []); + testErrorsAndWarnings('row mv_first(now())', []); + testErrorsAndWarnings('row var = mv_first(to_datetime(now()))', []); + testErrorsAndWarnings('row var = mv_first(5)', []); + testErrorsAndWarnings('row mv_first(5)', []); + testErrorsAndWarnings('row var = mv_first(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_first(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_first(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_first(to_geopoint(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = mv_first(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_first(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_first(to_geoshape(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = mv_first(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_first(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_first(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_first(to_string(true))', []); + testErrorsAndWarnings('row var = mv_first(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_first(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_first(to_version("a"))', []); + testErrorsAndWarnings('from a_index | where mv_first(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where length(mv_first(stringField)) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_boolean(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_first(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_first(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_first(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_first(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(numberField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_geopoint(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_geoshape(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_first(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_first(to_version(stringField))', []); + + testErrorsAndWarnings('from a_index | eval mv_first(booleanField, extraArg)', [ + 'Error: [mv_first] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_first(booleanField)', []); }); describe('mv_last', () => { @@ -2924,6 +4162,90 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort mv_last(stringField)', []); + testErrorsAndWarnings('row var = mv_last(true)', []); + testErrorsAndWarnings('row mv_last(true)', []); + testErrorsAndWarnings('row var = mv_last(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_last(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_last(to_cartesianpoint("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = mv_last(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = mv_last(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_last(to_cartesianshape("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = mv_last(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = mv_last(now())', []); + testErrorsAndWarnings('row mv_last(now())', []); + testErrorsAndWarnings('row var = mv_last(to_datetime(now()))', []); + testErrorsAndWarnings('row var = mv_last(5)', []); + testErrorsAndWarnings('row mv_last(5)', []); + testErrorsAndWarnings('row var = mv_last(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_last(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_last(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_last(to_geopoint(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = mv_last(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row mv_last(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = mv_last(to_geoshape(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = mv_last(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_last(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_last(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_last(to_string(true))', []); + testErrorsAndWarnings('row var = mv_last(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_last(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_last(to_version("a"))', []); + testErrorsAndWarnings('from a_index | where mv_last(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where length(mv_last(stringField)) > 0', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_boolean(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_last(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_last(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_last(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_last(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(numberField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_geopoint(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_geoshape(geoPointField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_last(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_last(to_version(stringField))', []); + + testErrorsAndWarnings('from a_index | eval mv_last(booleanField, extraArg)', [ + 'Error: [mv_last] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_last(booleanField)', []); }); describe('mv_max', () => { @@ -2937,6 +4259,66 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort mv_max(stringField)', []); + testErrorsAndWarnings('row var = mv_max(true)', []); + testErrorsAndWarnings('row mv_max(true)', []); + testErrorsAndWarnings('row var = mv_max(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_max(now())', []); + testErrorsAndWarnings('row mv_max(now())', []); + testErrorsAndWarnings('row var = mv_max(to_datetime(now()))', []); + testErrorsAndWarnings('row var = mv_max(5)', []); + testErrorsAndWarnings('row mv_max(5)', []); + testErrorsAndWarnings('row var = mv_max(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_max(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_max(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_max(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_max(to_string(true))', []); + testErrorsAndWarnings('row var = mv_max(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_max(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_max(to_version("a"))', []); + + testErrorsAndWarnings('row var = mv_max(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [mv_max] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where mv_max(numberField) > 0', []); + + testErrorsAndWarnings('from a_index | where mv_max(cartesianPointField) > 0', [ + 'Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where length(mv_max(stringField)) > 0', []); + + testErrorsAndWarnings('from a_index | where length(mv_max(cartesianPointField)) > 0', [ + 'Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_max(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_max(cartesianPointField)', [ + 'Argument of [mv_max] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_max(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(numberField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_max(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_max(to_version(stringField))', []); + + testErrorsAndWarnings('from a_index | eval mv_max(booleanField, extraArg)', [ + 'Error: [mv_max] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_max(booleanField)', []); }); describe('mv_median', () => { @@ -2971,6 +4353,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort mv_median(numberField)', []); + testErrorsAndWarnings('row var = mv_median(to_integer(true))', []); + + testErrorsAndWarnings('row var = mv_median(true)', [ + 'Argument of [mv_median] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where mv_median(booleanField) > 0', [ + 'Argument of [mv_median] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_median(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_median(booleanField)', [ + 'Argument of [mv_median] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('mv_min', () => { @@ -2984,23 +4381,417 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort mv_min(stringField)', []); + testErrorsAndWarnings('row var = mv_min(true)', []); + testErrorsAndWarnings('row mv_min(true)', []); + testErrorsAndWarnings('row var = mv_min(to_boolean(true))', []); + testErrorsAndWarnings('row var = mv_min(now())', []); + testErrorsAndWarnings('row mv_min(now())', []); + testErrorsAndWarnings('row var = mv_min(to_datetime(now()))', []); + testErrorsAndWarnings('row var = mv_min(5)', []); + testErrorsAndWarnings('row mv_min(5)', []); + testErrorsAndWarnings('row var = mv_min(to_integer(true))', []); + testErrorsAndWarnings('row var = mv_min(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row mv_min(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = mv_min(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = mv_min(to_string(true))', []); + testErrorsAndWarnings('row var = mv_min(to_version("1.0.0"))', []); + testErrorsAndWarnings('row mv_min(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = mv_min(to_version("a"))', []); + + testErrorsAndWarnings('row var = mv_min(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [mv_min] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where mv_min(numberField) > 0', []); + + testErrorsAndWarnings('from a_index | where mv_min(cartesianPointField) > 0', [ + 'Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where length(mv_min(stringField)) > 0', []); + + testErrorsAndWarnings('from a_index | where length(mv_min(cartesianPointField)) > 0', [ + 'Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_min(booleanField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_min(cartesianPointField)', [ + 'Argument of [mv_min] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_min(dateField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(numberField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(ipField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(versionField)', []); + testErrorsAndWarnings('from a_index | eval mv_min(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = mv_min(to_version(stringField))', []); + + testErrorsAndWarnings('from a_index | eval mv_min(booleanField, extraArg)', [ + 'Error: [mv_min] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_min(booleanField)', []); }); - describe('mv_slice', () => { - testErrorsAndWarnings('row var = mv_slice("a", 5, 5)', []); - testErrorsAndWarnings('row mv_slice("a", 5, 5)', []); + describe('mv_slice', () => { + testErrorsAndWarnings('row var = mv_slice("a", 5, 5)', []); + testErrorsAndWarnings('row mv_slice("a", 5, 5)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(stringField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(stringField, numberField, numberField)', + [] + ); + testErrorsAndWarnings( + 'from a_index | sort mv_slice(stringField, numberField, numberField)', + [] + ); + testErrorsAndWarnings('row var = mv_slice(true, 5, 5)', []); + testErrorsAndWarnings('row mv_slice(true, 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_boolean(true), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(to_cartesianpoint("POINT (30 10)"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_cartesianpoint("POINT (30 10)"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(to_cartesianshape("POINT (30 10)"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_cartesianshape("POINT (30 10)"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(now(), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(now(), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_datetime(now()), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(5, 5, 5)', []); + testErrorsAndWarnings('row mv_slice(5, 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_integer(true), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(to_geopoint("POINT (30 10)"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_geopoint("POINT (30 10)"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_geopoint(to_geopoint("POINT (30 10)")), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(to_geoshape("POINT (30 10)"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_geoshape("POINT (30 10)"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_geoshape(to_geopoint("POINT (30 10)")), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(to_ip("127.0.0.1"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_ip("127.0.0.1"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_ip(to_ip("127.0.0.1")), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings( + 'row var = mv_slice(to_string(true), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(to_version("1.0.0"), 5, 5)', []); + testErrorsAndWarnings('row mv_slice(to_version("1.0.0"), 5, 5)', []); + + testErrorsAndWarnings( + 'row var = mv_slice(to_version("a"), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_slice(to_version("1.0.0"), true, true)', [ + 'Argument of [mv_slice] must be [number], found value [true] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | where mv_slice(numberField, numberField, numberField) > 0', + [] + ); + + testErrorsAndWarnings( + 'from a_index | where mv_slice(numberField, booleanField, booleanField) > 0', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | where length(mv_slice(stringField, numberField, numberField)) > 0', + [] + ); + + testErrorsAndWarnings( + 'from a_index | where length(mv_slice(stringField, booleanField, booleanField)) > 0', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(booleanField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(booleanField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_boolean(booleanField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(booleanField, booleanField, booleanField)', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(cartesianPointField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(cartesianPointField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_cartesianpoint(cartesianPointField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(cartesianPointField, booleanField, booleanField)', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(cartesianShapeField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(cartesianShapeField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_cartesianshape(cartesianPointField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(cartesianShapeField, booleanField, booleanField)', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(dateField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(dateField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_datetime(dateField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(dateField, booleanField, booleanField)', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(numberField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(numberField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_integer(booleanField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(numberField, booleanField, booleanField)', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(geoPointField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(geoPointField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_geopoint(geoPointField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(geoPointField, booleanField, booleanField)', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(geoShapeField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(geoShapeField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_geoshape(geoPointField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(geoShapeField, booleanField, booleanField)', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(ipField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(ipField, numberField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_ip(ipField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval mv_slice(ipField, booleanField, booleanField)', [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(stringField, booleanField, booleanField)', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_slice(versionField, numberField, numberField)', + [] + ); testErrorsAndWarnings( - 'from a_index | eval var = mv_slice(stringField, numberField, numberField)', + 'from a_index | eval mv_slice(versionField, numberField, numberField)', [] ); testErrorsAndWarnings( - 'from a_index | eval mv_slice(stringField, numberField, numberField)', + 'from a_index | eval var = mv_slice(to_version(stringField), to_integer(booleanField), to_integer(booleanField))', [] ); + testErrorsAndWarnings( - 'from a_index | sort mv_slice(stringField, numberField, numberField)', + 'from a_index | eval mv_slice(versionField, booleanField, booleanField)', + [ + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + 'Argument of [mv_slice] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_slice(booleanField, numberField, numberField, extraArg)', + ['Error: [mv_slice] function expects no more than 3 arguments, got 4.'] + ); + + testErrorsAndWarnings( + 'from a_index | sort mv_slice(booleanField, numberField, numberField)', [] ); }); @@ -3011,6 +4802,58 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval var = mv_sort(stringField, "asc")', []); testErrorsAndWarnings('from a_index | eval mv_sort(stringField, "asc")', []); testErrorsAndWarnings('from a_index | sort mv_sort(stringField, "asc")', []); + testErrorsAndWarnings('row var = mv_sort(true, "asc")', []); + testErrorsAndWarnings('row mv_sort(true, "asc")', []); + testErrorsAndWarnings('row var = mv_sort(now(), "asc")', []); + testErrorsAndWarnings('row mv_sort(now(), "asc")', []); + testErrorsAndWarnings('row var = mv_sort(5, "asc")', []); + testErrorsAndWarnings('row mv_sort(5, "asc")', []); + testErrorsAndWarnings('row var = mv_sort(to_ip("127.0.0.1"), "asc")', []); + testErrorsAndWarnings('row mv_sort(to_ip("127.0.0.1"), "asc")', []); + testErrorsAndWarnings('row var = mv_sort(to_version("1.0.0"), "asc")', []); + testErrorsAndWarnings('row mv_sort(to_version("1.0.0"), "asc")', []); + + testErrorsAndWarnings('row var = mv_sort(to_cartesianpoint("POINT (30 10)"), true)', [ + 'Argument of [mv_sort] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + 'Argument of [mv_sort] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where mv_sort(numberField, "asc") > 0', []); + + testErrorsAndWarnings( + 'from a_index | where mv_sort(cartesianPointField, booleanField) > 0', + [ + 'Argument of [mv_sort] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + 'Argument of [mv_sort] must be [string], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings('from a_index | where length(mv_sort(stringField, "asc")) > 0', []); + + testErrorsAndWarnings( + 'from a_index | where length(mv_sort(cartesianPointField, booleanField)) > 0', + [ + 'Argument of [mv_sort] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + 'Argument of [mv_sort] must be [string], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings('from a_index | eval var = mv_sort(booleanField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(booleanField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(dateField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(dateField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(numberField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(numberField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(ipField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(ipField, "asc")', []); + testErrorsAndWarnings('from a_index | eval var = mv_sort(versionField, "asc")', []); + testErrorsAndWarnings('from a_index | eval mv_sort(versionField, "asc")', []); + + testErrorsAndWarnings('from a_index | eval mv_sort(booleanField, "asc", extraArg)', [ + 'Error: [mv_sort] function expects no more than 2 arguments, got 3.', + ]); + + testErrorsAndWarnings('from a_index | sort mv_sort(booleanField, "asc")', []); }); describe('mv_sum', () => { @@ -3045,11 +4888,28 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort mv_sum(numberField)', []); + testErrorsAndWarnings('row var = mv_sum(to_integer(true))', []); + + testErrorsAndWarnings('row var = mv_sum(true)', [ + 'Argument of [mv_sum] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where mv_sum(booleanField) > 0', [ + 'Argument of [mv_sum] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = mv_sum(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval mv_sum(booleanField)', [ + 'Argument of [mv_sum] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('mv_zip', () => { testErrorsAndWarnings('row var = mv_zip("a", "a", "a")', []); + testErrorsAndWarnings('row var = mv_zip("a", "a")', []); testErrorsAndWarnings('row mv_zip("a", "a", "a")', []); + testErrorsAndWarnings('row mv_zip("a", "a")', []); testErrorsAndWarnings( 'row var = mv_zip(to_string("a"), to_string("a"), to_string("a"))', @@ -3081,6 +4941,8 @@ describe('validation logic', () => { [] ); + testErrorsAndWarnings('from a_index | eval mv_zip(stringField, stringField)', []); + testErrorsAndWarnings( 'from a_index | eval mv_zip(stringField, stringField, stringField)', [] @@ -3099,13 +4961,46 @@ describe('validation logic', () => { testErrorsAndWarnings( 'from a_index | eval mv_zip(stringField, stringField, stringField, extraArg)', - ['Error: [mv_zip] function expects exactly 3 arguments, got 4.'] + ['Error: [mv_zip] function expects no more than 3 arguments, got 4.'] ); testErrorsAndWarnings( 'from a_index | sort mv_zip(stringField, stringField, stringField)', [] ); + testErrorsAndWarnings( + 'row var = mv_zip(to_string(true), to_string(true), to_string(true))', + [] + ); + + testErrorsAndWarnings('row var = mv_zip(true, true, true)', [ + 'Argument of [mv_zip] must be [string], found value [true] type [boolean]', + 'Argument of [mv_zip] must be [string], found value [true] type [boolean]', + 'Argument of [mv_zip] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | where length(mv_zip(booleanField, booleanField, booleanField)) > 0', + [ + 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', + 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', + 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = mv_zip(to_string(booleanField), to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval mv_zip(booleanField, booleanField, booleanField)', + [ + 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', + 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', + 'Argument of [mv_zip] must be [string], found value [booleanField] type [boolean]', + ] + ); }); describe('now', () => { @@ -3170,6 +5065,27 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort pow(numberField, numberField)', []); + testErrorsAndWarnings('row var = pow(to_integer(true), to_integer(true))', []); + + testErrorsAndWarnings('row var = pow(true, true)', [ + 'Argument of [pow] must be [number], found value [true] type [boolean]', + 'Argument of [pow] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where pow(booleanField, booleanField) > 0', [ + 'Argument of [pow] must be [number], found value [booleanField] type [boolean]', + 'Argument of [pow] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = pow(to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval pow(booleanField, booleanField)', [ + 'Argument of [pow] must be [number], found value [booleanField] type [boolean]', + 'Argument of [pow] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('replace', () => { @@ -3234,6 +5150,39 @@ describe('validation logic', () => { 'from a_index | sort replace(stringField, stringField, stringField)', [] ); + testErrorsAndWarnings( + 'row var = replace(to_string(true), to_string(true), to_string(true))', + [] + ); + + testErrorsAndWarnings('row var = replace(true, true, true)', [ + 'Argument of [replace] must be [string], found value [true] type [boolean]', + 'Argument of [replace] must be [string], found value [true] type [boolean]', + 'Argument of [replace] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | where length(replace(booleanField, booleanField, booleanField)) > 0', + [ + 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', + 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', + 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = replace(to_string(booleanField), to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval replace(booleanField, booleanField, booleanField)', + [ + 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', + 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', + 'Argument of [replace] must be [string], found value [booleanField] type [boolean]', + ] + ); }); describe('right', () => { @@ -3274,6 +5223,30 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort right(stringField, numberField)', []); + testErrorsAndWarnings('row var = right(to_string(true), to_integer(true))', []); + + testErrorsAndWarnings('row var = right(true, true)', [ + 'Argument of [right] must be [string], found value [true] type [boolean]', + 'Argument of [right] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | where length(right(booleanField, booleanField)) > 0', + [ + 'Argument of [right] must be [string], found value [booleanField] type [boolean]', + 'Argument of [right] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = right(to_string(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval right(booleanField, booleanField)', [ + 'Argument of [right] must be [string], found value [booleanField] type [boolean]', + 'Argument of [right] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('round', () => { @@ -3311,6 +5284,50 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort round(numberField, numberField)', []); + testErrorsAndWarnings('row var = round(5)', []); + testErrorsAndWarnings('row round(5)', []); + testErrorsAndWarnings('row var = round(to_integer(true))', []); + testErrorsAndWarnings('row var = round(to_integer(true), to_integer(true))', []); + + testErrorsAndWarnings('row var = round(true, true)', [ + 'Argument of [round] must be [number], found value [true] type [boolean]', + 'Argument of [round] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where round(numberField) > 0', []); + + testErrorsAndWarnings('from a_index | where round(booleanField) > 0', [ + 'Argument of [round] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where round(booleanField, booleanField) > 0', [ + 'Argument of [round] must be [number], found value [booleanField] type [boolean]', + 'Argument of [round] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = round(numberField)', []); + testErrorsAndWarnings('from a_index | eval round(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = round(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval round(booleanField)', [ + 'Argument of [round] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = round(*)', [ + 'Using wildcards (*) in round is not allowed', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = round(to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval round(booleanField, booleanField)', [ + 'Argument of [round] must be [number], found value [booleanField] type [boolean]', + 'Argument of [round] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | sort round(numberField)', []); }); describe('rtrim', () => { @@ -3345,6 +5362,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort rtrim(stringField)', []); + testErrorsAndWarnings('row var = rtrim(to_string(true))', []); + + testErrorsAndWarnings('row var = rtrim(true)', [ + 'Argument of [rtrim] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where length(rtrim(booleanField)) > 0', [ + 'Argument of [rtrim] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = rtrim(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval rtrim(booleanField)', [ + 'Argument of [rtrim] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('signum', () => { @@ -3379,6 +5411,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort signum(numberField)', []); + testErrorsAndWarnings('row var = signum(to_integer(true))', []); + + testErrorsAndWarnings('row var = signum(true)', [ + 'Argument of [signum] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where signum(booleanField) > 0', [ + 'Argument of [signum] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = signum(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval signum(booleanField)', [ + 'Argument of [signum] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('sin', () => { @@ -3413,6 +5460,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort sin(numberField)', []); + testErrorsAndWarnings('row var = sin(to_integer(true))', []); + + testErrorsAndWarnings('row var = sin(true)', [ + 'Argument of [sin] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where sin(booleanField) > 0', [ + 'Argument of [sin] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = sin(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval sin(booleanField)', [ + 'Argument of [sin] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('sinh', () => { @@ -3447,6 +5509,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort sinh(numberField)', []); + testErrorsAndWarnings('row var = sinh(to_integer(true))', []); + + testErrorsAndWarnings('row var = sinh(true)', [ + 'Argument of [sinh] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where sinh(booleanField) > 0', [ + 'Argument of [sinh] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = sinh(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval sinh(booleanField)', [ + 'Argument of [sinh] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('split', () => { @@ -3487,6 +5564,30 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort split(stringField, stringField)', []); + testErrorsAndWarnings('row var = split(to_string(true), to_string(true))', []); + + testErrorsAndWarnings('row var = split(true, true)', [ + 'Argument of [split] must be [string], found value [true] type [boolean]', + 'Argument of [split] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | where length(split(booleanField, booleanField)) > 0', + [ + 'Argument of [split] must be [string], found value [booleanField] type [boolean]', + 'Argument of [split] must be [string], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = split(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval split(booleanField, booleanField)', [ + 'Argument of [split] must be [string], found value [booleanField] type [boolean]', + 'Argument of [split] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('sqrt', () => { @@ -3521,6 +5622,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort sqrt(numberField)', []); + testErrorsAndWarnings('row var = sqrt(to_integer(true))', []); + + testErrorsAndWarnings('row var = sqrt(true)', [ + 'Argument of [sqrt] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where sqrt(booleanField) > 0', [ + 'Argument of [sqrt] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = sqrt(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval sqrt(booleanField)', [ + 'Argument of [sqrt] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('st_contains', () => { @@ -3537,8 +5653,8 @@ describe('validation logic', () => { testErrorsAndWarnings('row var = st_contains(to_geopoint("a"), to_geopoint("a"))', []); testErrorsAndWarnings('row var = st_contains("a", "a")', [ - 'Argument of [st_contains] must be [geo_point], found value ["a"] type [string]', - 'Argument of [st_contains] must be [geo_point], found value ["a"] type [string]', + 'Argument of [st_contains] must be [cartesian_point], found value ["a"] type [string]', + 'Argument of [st_contains] must be [cartesian_point], found value ["a"] type [string]', ]); testErrorsAndWarnings( @@ -3648,8 +5764,8 @@ describe('validation logic', () => { ); testErrorsAndWarnings('from a_index | eval st_contains(stringField, stringField)', [ - 'Argument of [st_contains] must be [geo_point], found value [stringField] type [string]', - 'Argument of [st_contains] must be [geo_point], found value [stringField] type [string]', + 'Argument of [st_contains] must be [cartesian_point], found value [stringField] type [string]', + 'Argument of [st_contains] must be [cartesian_point], found value [stringField] type [string]', ]); testErrorsAndWarnings( @@ -3701,81 +5817,176 @@ describe('validation logic', () => { ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(cartesianPointField, cartesianPointField)', + 'from a_index | eval var = st_contains(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(to_cartesianpoint(stringField), to_cartesianpoint(stringField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianPointField, cartesianPointField, extraArg)', + ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(to_cartesianpoint(stringField), cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianPointField, cartesianShapeField, extraArg)', + ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(cartesianShapeField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianShapeField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(cartesianShapeField, to_cartesianpoint(stringField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianShapeField, cartesianPointField, extraArg)', + ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_contains(cartesianShapeField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianShapeField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_contains(cartesianShapeField, cartesianShapeField, extraArg)', + ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings('from a_index | sort st_contains(geoPointField, geoPointField)', []); + + testErrorsAndWarnings( + 'row var = st_contains(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_contains(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianPointField, cartesianPointField)', + 'row var = st_contains(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_cartesianpoint(stringField), to_cartesianpoint(stringField))', + 'row var = st_contains(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianPointField, cartesianPointField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'row var = st_contains(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(cartesianPointField, cartesianShapeField)', + 'row var = st_contains(to_geopoint(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianPointField, cartesianShapeField)', + 'row var = st_contains(to_geoshape(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(to_cartesianpoint(stringField), cartesianShapeField)', + 'row var = st_contains(to_geoshape(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', [] ); + testErrorsAndWarnings('row var = st_contains(true, true)', [ + 'Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]', + 'Argument of [st_contains] must be [cartesian_point], found value [true] type [boolean]', + ]); + testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianPointField, cartesianShapeField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] ); + testErrorsAndWarnings('from a_index | eval st_contains(booleanField, booleanField)', [ + 'Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]', + 'Argument of [st_contains] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + testErrorsAndWarnings( - 'from a_index | eval var = st_contains(cartesianShapeField, cartesianPointField)', + 'from a_index | eval var = st_contains(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianShapeField, cartesianPointField)', + 'from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(cartesianShapeField, to_cartesianpoint(stringField))', + 'from a_index | eval var = st_contains(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianShapeField, cartesianPointField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geopoint(geoPointField))', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_contains(cartesianShapeField, cartesianShapeField)', + 'from a_index | eval var = st_contains(to_geopoint(geoPointField), to_geoshape(geoPointField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianShapeField, cartesianShapeField)', + 'from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geopoint(geoPointField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_contains(cartesianShapeField, cartesianShapeField, extraArg)', - ['Error: [st_contains] function expects exactly 2 arguments, got 3.'] + 'from a_index | eval var = st_contains(to_geoshape(geoPointField), to_geoshape(geoPointField))', + [] ); - testErrorsAndWarnings('from a_index | sort st_contains(geoPointField, geoPointField)', []); + testErrorsAndWarnings( + 'from a_index | sort st_contains(cartesianPointField, cartesianPointField)', + [] + ); }); describe('st_disjoint', () => { @@ -3792,8 +6003,8 @@ describe('validation logic', () => { testErrorsAndWarnings('row var = st_disjoint(to_geopoint("a"), to_geopoint("a"))', []); testErrorsAndWarnings('row var = st_disjoint("a", "a")', [ - 'Argument of [st_disjoint] must be [geo_point], found value ["a"] type [string]', - 'Argument of [st_disjoint] must be [geo_point], found value ["a"] type [string]', + 'Argument of [st_disjoint] must be [cartesian_point], found value ["a"] type [string]', + 'Argument of [st_disjoint] must be [cartesian_point], found value ["a"] type [string]', ]); testErrorsAndWarnings( @@ -3903,8 +6114,8 @@ describe('validation logic', () => { ); testErrorsAndWarnings('from a_index | eval st_disjoint(stringField, stringField)', [ - 'Argument of [st_disjoint] must be [geo_point], found value [stringField] type [string]', - 'Argument of [st_disjoint] must be [geo_point], found value [stringField] type [string]', + 'Argument of [st_disjoint] must be [cartesian_point], found value [stringField] type [string]', + 'Argument of [st_disjoint] must be [cartesian_point], found value [stringField] type [string]', ]); testErrorsAndWarnings( @@ -4031,6 +6242,101 @@ describe('validation logic', () => { ); testErrorsAndWarnings('from a_index | sort st_disjoint(geoPointField, geoPointField)', []); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_geopoint(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_geoshape(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_disjoint(to_geoshape(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = st_disjoint(true, true)', [ + 'Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]', + 'Argument of [st_disjoint] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_disjoint(booleanField, booleanField)', [ + 'Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]', + 'Argument of [st_disjoint] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_geopoint(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_disjoint(to_geoshape(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | sort st_disjoint(cartesianPointField, cartesianPointField)', + [] + ); }); describe('st_intersects', () => { @@ -4047,8 +6353,8 @@ describe('validation logic', () => { testErrorsAndWarnings('row var = st_intersects(to_geopoint("a"), to_geopoint("a"))', []); testErrorsAndWarnings('row var = st_intersects("a", "a")', [ - 'Argument of [st_intersects] must be [geo_point], found value ["a"] type [string]', - 'Argument of [st_intersects] must be [geo_point], found value ["a"] type [string]', + 'Argument of [st_intersects] must be [cartesian_point], found value ["a"] type [string]', + 'Argument of [st_intersects] must be [cartesian_point], found value ["a"] type [string]', ]); testErrorsAndWarnings( @@ -4162,8 +6468,8 @@ describe('validation logic', () => { ); testErrorsAndWarnings('from a_index | eval st_intersects(stringField, stringField)', [ - 'Argument of [st_intersects] must be [geo_point], found value [stringField] type [string]', - 'Argument of [st_intersects] must be [geo_point], found value [stringField] type [string]', + 'Argument of [st_intersects] must be [cartesian_point], found value [stringField] type [string]', + 'Argument of [st_intersects] must be [cartesian_point], found value [stringField] type [string]', ]); testErrorsAndWarnings( @@ -4305,6 +6611,101 @@ describe('validation logic', () => { 'from a_index | sort st_intersects(geoPointField, geoPointField)', [] ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_geopoint(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_geoshape(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = st_intersects(to_geoshape(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = st_intersects(true, true)', [ + 'Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]', + 'Argument of [st_intersects] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_intersects(booleanField, booleanField)', [ + 'Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]', + 'Argument of [st_intersects] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_geopoint(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_intersects(to_geoshape(geoPointField), to_geoshape(geoPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | sort st_intersects(cartesianPointField, cartesianPointField)', + [] + ); }); describe('st_within', () => { @@ -4321,8 +6722,8 @@ describe('validation logic', () => { testErrorsAndWarnings('row var = st_within(to_geopoint("a"), to_geopoint("a"))', []); testErrorsAndWarnings('row var = st_within("a", "a")', [ - 'Argument of [st_within] must be [geo_point], found value ["a"] type [string]', - 'Argument of [st_within] must be [geo_point], found value ["a"] type [string]', + 'Argument of [st_within] must be [cartesian_point], found value ["a"] type [string]', + 'Argument of [st_within] must be [cartesian_point], found value ["a"] type [string]', ]); testErrorsAndWarnings( @@ -4432,134 +6833,229 @@ describe('validation logic', () => { ); testErrorsAndWarnings('from a_index | eval st_within(stringField, stringField)', [ - 'Argument of [st_within] must be [geo_point], found value [stringField] type [string]', - 'Argument of [st_within] must be [geo_point], found value [stringField] type [string]', + 'Argument of [st_within] must be [cartesian_point], found value [stringField] type [string]', + 'Argument of [st_within] must be [cartesian_point], found value [stringField] type [string]', ]); testErrorsAndWarnings( - 'from a_index | eval st_within(geoPointField, geoPointField, extraArg)', + 'from a_index | eval st_within(geoPointField, geoPointField, extraArg)', + ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(geoPointField, geoShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_within(geoPointField, geoShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_geopoint(stringField), geoShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(geoPointField, geoShapeField, extraArg)', + ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(geoShapeField, geoPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_within(geoShapeField, geoPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(geoShapeField, to_geopoint(stringField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(geoShapeField, geoPointField, extraArg)', + ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(geoShapeField, geoShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval st_within(geoShapeField, geoShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval st_within(geoShapeField, geoShapeField, extraArg)', + ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(cartesianPointField, cartesianPointField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_cartesianpoint(stringField), to_cartesianpoint(stringField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(cartesianPointField, cartesianPointField, extraArg)', + ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(cartesianPointField, cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = st_within(to_cartesianpoint(stringField), cartesianShapeField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(cartesianPointField, cartesianShapeField, extraArg)', ['Error: [st_within] function expects exactly 2 arguments, got 3.'] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(geoPointField, geoShapeField)', + 'from a_index | eval var = st_within(cartesianShapeField, cartesianPointField)', [] ); - testErrorsAndWarnings('from a_index | eval st_within(geoPointField, geoShapeField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_geopoint(stringField), geoShapeField)', + 'from a_index | eval st_within(cartesianShapeField, cartesianPointField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(geoPointField, geoShapeField, extraArg)', + 'from a_index | eval var = st_within(cartesianShapeField, to_cartesianpoint(stringField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval st_within(cartesianShapeField, cartesianPointField, extraArg)', ['Error: [st_within] function expects exactly 2 arguments, got 3.'] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(geoShapeField, geoPointField)', + 'from a_index | eval var = st_within(cartesianShapeField, cartesianShapeField)', [] ); - testErrorsAndWarnings('from a_index | eval st_within(geoShapeField, geoPointField)', []); testErrorsAndWarnings( - 'from a_index | eval var = st_within(geoShapeField, to_geopoint(stringField))', + 'from a_index | eval st_within(cartesianShapeField, cartesianShapeField)', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(geoShapeField, geoPointField, extraArg)', + 'from a_index | eval st_within(cartesianShapeField, cartesianShapeField, extraArg)', ['Error: [st_within] function expects exactly 2 arguments, got 3.'] ); + testErrorsAndWarnings('from a_index | sort st_within(geoPointField, geoPointField)', []); + testErrorsAndWarnings( - 'from a_index | eval var = st_within(geoShapeField, geoShapeField)', + 'row var = st_within(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', [] ); - testErrorsAndWarnings('from a_index | eval st_within(geoShapeField, geoShapeField)', []); testErrorsAndWarnings( - 'from a_index | eval st_within(geoShapeField, geoShapeField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'row var = st_within(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(cartesianPointField, cartesianPointField)', + 'row var = st_within(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianPointField, cartesianPointField)', + 'row var = st_within(to_cartesianshape(to_cartesianpoint("POINT (30 10)")), to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_cartesianpoint(stringField), to_cartesianpoint(stringField))', + 'row var = st_within(to_geopoint(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianPointField, cartesianPointField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'row var = st_within(to_geopoint(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(cartesianPointField, cartesianShapeField)', + 'row var = st_within(to_geoshape(to_geopoint("POINT (30 10)")), to_geopoint(to_geopoint("POINT (30 10)")))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianPointField, cartesianShapeField)', + 'row var = st_within(to_geoshape(to_geopoint("POINT (30 10)")), to_geoshape(to_geopoint("POINT (30 10)")))', [] ); + testErrorsAndWarnings('row var = st_within(true, true)', [ + 'Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]', + 'Argument of [st_within] must be [cartesian_point], found value [true] type [boolean]', + ]); + testErrorsAndWarnings( - 'from a_index | eval var = st_within(to_cartesianpoint(stringField), cartesianShapeField)', + 'from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianpoint(cartesianPointField))', [] ); + testErrorsAndWarnings('from a_index | eval st_within(booleanField, booleanField)', [ + 'Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]', + 'Argument of [st_within] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianPointField, cartesianShapeField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | eval var = st_within(to_cartesianpoint(cartesianPointField), to_cartesianshape(cartesianPointField))', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(cartesianShapeField, cartesianPointField)', + 'from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianpoint(cartesianPointField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianShapeField, cartesianPointField)', + 'from a_index | eval var = st_within(to_cartesianshape(cartesianPointField), to_cartesianshape(cartesianPointField))', [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(cartesianShapeField, to_cartesianpoint(stringField))', + 'from a_index | eval var = st_within(to_geopoint(geoPointField), to_geopoint(geoPointField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianShapeField, cartesianPointField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | eval var = st_within(to_geopoint(geoPointField), to_geoshape(geoPointField))', + [] ); testErrorsAndWarnings( - 'from a_index | eval var = st_within(cartesianShapeField, cartesianShapeField)', + 'from a_index | eval var = st_within(to_geoshape(geoPointField), to_geopoint(geoPointField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianShapeField, cartesianShapeField)', + 'from a_index | eval var = st_within(to_geoshape(geoPointField), to_geoshape(geoPointField))', [] ); testErrorsAndWarnings( - 'from a_index | eval st_within(cartesianShapeField, cartesianShapeField, extraArg)', - ['Error: [st_within] function expects exactly 2 arguments, got 3.'] + 'from a_index | sort st_within(cartesianPointField, cartesianPointField)', + [] ); - - testErrorsAndWarnings('from a_index | sort st_within(geoPointField, geoPointField)', []); }); describe('st_x', () => { @@ -4568,7 +7064,7 @@ describe('validation logic', () => { testErrorsAndWarnings('row var = st_x(to_geopoint("a"))', []); testErrorsAndWarnings('row var = st_x("a")', [ - 'Argument of [st_x] must be [geo_point], found value ["a"] type [string]', + 'Argument of [st_x] must be [cartesian_point], found value ["a"] type [string]', ]); testErrorsAndWarnings('row var = st_x(to_cartesianpoint("POINT (30 10)"))', []); @@ -4579,7 +7075,7 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval var = st_x(to_geopoint(stringField))', []); testErrorsAndWarnings('from a_index | eval st_x(stringField)', [ - 'Argument of [st_x] must be [geo_point], found value [stringField] type [string]', + 'Argument of [st_x] must be [cartesian_point], found value [stringField] type [string]', ]); testErrorsAndWarnings('from a_index | eval st_x(geoPointField, extraArg)', [ @@ -4599,6 +7095,29 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort st_x(geoPointField)', []); + + testErrorsAndWarnings( + 'row var = st_x(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = st_x(to_geopoint(to_geopoint("POINT (30 10)")))', []); + + testErrorsAndWarnings('row var = st_x(true)', [ + 'Argument of [st_x] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_x(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_x(booleanField)', [ + 'Argument of [st_x] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = st_x(to_geopoint(geoPointField))', []); + testErrorsAndWarnings('from a_index | sort st_x(cartesianPointField)', []); }); describe('st_y', () => { @@ -4607,7 +7126,7 @@ describe('validation logic', () => { testErrorsAndWarnings('row var = st_y(to_geopoint("a"))', []); testErrorsAndWarnings('row var = st_y("a")', [ - 'Argument of [st_y] must be [geo_point], found value ["a"] type [string]', + 'Argument of [st_y] must be [cartesian_point], found value ["a"] type [string]', ]); testErrorsAndWarnings('row var = st_y(to_cartesianpoint("POINT (30 10)"))', []); @@ -4618,7 +7137,7 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval var = st_y(to_geopoint(stringField))', []); testErrorsAndWarnings('from a_index | eval st_y(stringField)', [ - 'Argument of [st_y] must be [geo_point], found value [stringField] type [string]', + 'Argument of [st_y] must be [cartesian_point], found value [stringField] type [string]', ]); testErrorsAndWarnings('from a_index | eval st_y(geoPointField, extraArg)', [ @@ -4638,6 +7157,29 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort st_y(geoPointField)', []); + + testErrorsAndWarnings( + 'row var = st_y(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = st_y(to_geopoint(to_geopoint("POINT (30 10)")))', []); + + testErrorsAndWarnings('row var = st_y(true)', [ + 'Argument of [st_y] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = st_y(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval st_y(booleanField)', [ + 'Argument of [st_y] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = st_y(to_geopoint(geoPointField))', []); + testErrorsAndWarnings('from a_index | sort st_y(cartesianPointField)', []); }); describe('starts_with', () => { @@ -4672,11 +7214,29 @@ describe('validation logic', () => { ); testErrorsAndWarnings('from a_index | sort starts_with(stringField, stringField)', []); + testErrorsAndWarnings('row var = starts_with(to_string(true), to_string(true))', []); + + testErrorsAndWarnings('row var = starts_with(true, true)', [ + 'Argument of [starts_with] must be [string], found value [true] type [boolean]', + 'Argument of [starts_with] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = starts_with(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval starts_with(booleanField, booleanField)', [ + 'Argument of [starts_with] must be [string], found value [booleanField] type [boolean]', + 'Argument of [starts_with] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('substring', () => { testErrorsAndWarnings('row var = substring("a", 5, 5)', []); + testErrorsAndWarnings('row var = substring("a", 5)', []); testErrorsAndWarnings('row substring("a", 5, 5)', []); + testErrorsAndWarnings('row substring("a", 5)', []); testErrorsAndWarnings( 'row var = substring(to_string("a"), to_integer("a"), to_integer("a"))', @@ -4729,13 +7289,48 @@ describe('validation logic', () => { testErrorsAndWarnings( 'from a_index | eval substring(stringField, numberField, numberField, extraArg)', - ['Error: [substring] function expects exactly 3 arguments, got 4.'] + ['Error: [substring] function expects no more than 3 arguments, got 4.'] ); testErrorsAndWarnings( 'from a_index | sort substring(stringField, numberField, numberField)', [] ); + testErrorsAndWarnings('from a_index | sort substring(stringField, numberField)', []); + + testErrorsAndWarnings( + 'row var = substring(to_string(true), to_integer(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = substring(true, true, true)', [ + 'Argument of [substring] must be [string], found value [true] type [boolean]', + 'Argument of [substring] must be [number], found value [true] type [boolean]', + 'Argument of [substring] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | where length(substring(booleanField, booleanField, booleanField)) > 0', + [ + 'Argument of [substring] must be [string], found value [booleanField] type [boolean]', + 'Argument of [substring] must be [number], found value [booleanField] type [boolean]', + 'Argument of [substring] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = substring(to_string(booleanField), to_integer(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval substring(booleanField, booleanField, booleanField)', + [ + 'Argument of [substring] must be [string], found value [booleanField] type [boolean]', + 'Argument of [substring] must be [number], found value [booleanField] type [boolean]', + 'Argument of [substring] must be [number], found value [booleanField] type [boolean]', + ] + ); }); describe('tan', () => { @@ -4770,6 +7365,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort tan(numberField)', []); + testErrorsAndWarnings('row var = tan(to_integer(true))', []); + + testErrorsAndWarnings('row var = tan(true)', [ + 'Argument of [tan] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where tan(booleanField) > 0', [ + 'Argument of [tan] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = tan(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval tan(booleanField)', [ + 'Argument of [tan] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('tanh', () => { @@ -4804,6 +7414,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort tanh(numberField)', []); + testErrorsAndWarnings('row var = tanh(to_integer(true))', []); + + testErrorsAndWarnings('row var = tanh(true)', [ + 'Argument of [tanh] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where tanh(booleanField) > 0', [ + 'Argument of [tanh] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = tanh(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval tanh(booleanField)', [ + 'Argument of [tanh] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('tau', () => { @@ -4833,6 +7458,40 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_boolean(stringField)', []); + testErrorsAndWarnings('row var = to_boolean(true)', []); + testErrorsAndWarnings('row to_boolean(true)', []); + testErrorsAndWarnings('row var = to_bool(true)', []); + testErrorsAndWarnings('row var = to_boolean(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_boolean(5)', []); + testErrorsAndWarnings('row to_boolean(5)', []); + testErrorsAndWarnings('row var = to_bool(5)', []); + testErrorsAndWarnings('row var = to_boolean(to_integer(true))', []); + testErrorsAndWarnings('row var = to_boolean(to_string(true))', []); + + testErrorsAndWarnings('row var = to_boolean(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [to_boolean] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_boolean(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_boolean(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_bool(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_boolean(cartesianPointField)', [ + 'Argument of [to_boolean] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_boolean(numberField)', []); + testErrorsAndWarnings('from a_index | eval to_boolean(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_bool(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_boolean(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_boolean(booleanField, extraArg)', [ + 'Error: [to_boolean] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_boolean(booleanField)', []); }); describe('to_cartesianpoint', () => { @@ -4846,6 +7505,49 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_cartesianpoint(stringField)', []); + testErrorsAndWarnings( + 'row var = to_cartesianpoint(to_cartesianpoint("POINT (30 10)"))', + [] + ); + testErrorsAndWarnings('row to_cartesianpoint(to_cartesianpoint("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = to_cartesianpoint(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = to_cartesianpoint(to_string(true))', []); + + testErrorsAndWarnings('row var = to_cartesianpoint(true)', [ + 'Argument of [to_cartesianpoint] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianpoint(cartesianPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval to_cartesianpoint(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianpoint(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval to_cartesianpoint(booleanField)', [ + 'Argument of [to_cartesianpoint] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianpoint(to_string(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval to_cartesianpoint(cartesianPointField, extraArg)', + ['Error: [to_cartesianpoint] function expects exactly one argument, got 2.'] + ); + + testErrorsAndWarnings('from a_index | sort to_cartesianpoint(cartesianPointField)', []); }); describe('to_cartesianshape', () => { @@ -4859,6 +7561,71 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_cartesianshape(stringField)', []); + testErrorsAndWarnings( + 'row var = to_cartesianshape(to_cartesianpoint("POINT (30 10)"))', + [] + ); + testErrorsAndWarnings('row to_cartesianshape(to_cartesianpoint("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = to_cartesianshape(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings( + 'row var = to_cartesianshape(to_cartesianshape("POINT (30 10)"))', + [] + ); + testErrorsAndWarnings('row to_cartesianshape(to_cartesianshape("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = to_cartesianshape(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = to_cartesianshape(to_string(true))', []); + + testErrorsAndWarnings('row var = to_cartesianshape(true)', [ + 'Argument of [to_cartesianshape] must be [cartesian_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianshape(cartesianPointField)', + [] + ); + testErrorsAndWarnings('from a_index | eval to_cartesianshape(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianshape(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval to_cartesianshape(booleanField)', [ + 'Argument of [to_cartesianshape] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianshape(cartesianShapeField)', + [] + ); + testErrorsAndWarnings('from a_index | eval to_cartesianshape(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianshape(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = to_cartesianshape(to_string(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval to_cartesianshape(cartesianPointField, extraArg)', + ['Error: [to_cartesianshape] function expects exactly one argument, got 2.'] + ); + + testErrorsAndWarnings('from a_index | sort to_cartesianshape(cartesianPointField)', []); }); describe('to_datetime', () => { @@ -4874,6 +7641,43 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_datetime(stringField)', []); + testErrorsAndWarnings('row var = to_datetime(now())', []); + testErrorsAndWarnings('row to_datetime(now())', []); + testErrorsAndWarnings('row var = to_dt(now())', []); + testErrorsAndWarnings('row var = to_datetime(to_datetime(now()))', []); + testErrorsAndWarnings('row var = to_datetime(5)', []); + testErrorsAndWarnings('row to_datetime(5)', []); + testErrorsAndWarnings('row var = to_dt(5)', []); + testErrorsAndWarnings('row var = to_datetime(to_integer(true))', []); + testErrorsAndWarnings('row var = to_datetime(to_string(true))', []); + + testErrorsAndWarnings('row var = to_datetime(true)', [ + 'Argument of [to_datetime] must be [date], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_datetime(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_datetime(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dt(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_datetime(to_datetime(dateField))', []); + + testErrorsAndWarnings('from a_index | eval to_datetime(booleanField)', [ + 'Argument of [to_datetime] must be [date], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_datetime(numberField)', []); + testErrorsAndWarnings('from a_index | eval to_datetime(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dt(numberField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_datetime(to_integer(booleanField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = to_datetime(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_datetime(dateField, extraArg)', [ + 'Error: [to_datetime] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_datetime(dateField)', []); }); describe('to_degrees', () => { @@ -4908,6 +7712,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_degrees(numberField)', []); + testErrorsAndWarnings('row var = to_degrees(to_integer(true))', []); + + testErrorsAndWarnings('row var = to_degrees(true)', [ + 'Argument of [to_degrees] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where to_degrees(booleanField) > 0', [ + 'Argument of [to_degrees] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_degrees(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_degrees(booleanField)', [ + 'Argument of [to_degrees] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('to_double', () => { @@ -4923,6 +7742,57 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_double(stringField)', []); + testErrorsAndWarnings('row var = to_double(true)', []); + testErrorsAndWarnings('row to_double(true)', []); + testErrorsAndWarnings('row var = to_dbl(true)', []); + testErrorsAndWarnings('row var = to_double(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_double(5)', []); + testErrorsAndWarnings('row to_double(5)', []); + testErrorsAndWarnings('row var = to_dbl(5)', []); + testErrorsAndWarnings('row var = to_double(to_integer(true))', []); + testErrorsAndWarnings('row var = to_double(now())', []); + testErrorsAndWarnings('row to_double(now())', []); + testErrorsAndWarnings('row var = to_dbl(now())', []); + testErrorsAndWarnings('row var = to_double(to_datetime(now()))', []); + testErrorsAndWarnings('row var = to_double(to_string(true))', []); + + testErrorsAndWarnings('row var = to_double(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [to_double] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where to_double(booleanField) > 0', []); + + testErrorsAndWarnings('from a_index | where to_double(cartesianPointField) > 0', [ + 'Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where to_double(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(dateField) > 0', []); + testErrorsAndWarnings('from a_index | where to_double(stringField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_double(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_double(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_double(cartesianPointField)', [ + 'Argument of [to_double] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_double(numberField)', []); + testErrorsAndWarnings('from a_index | eval to_double(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_double(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_double(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_dbl(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_double(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = to_double(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_double(booleanField, extraArg)', [ + 'Error: [to_double] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_double(booleanField)', []); }); describe('to_geopoint', () => { @@ -4935,7 +7805,37 @@ describe('validation logic', () => { 'Using wildcards (*) in to_geopoint is not allowed', ]); - testErrorsAndWarnings('from a_index | sort to_geopoint(stringField)', []); + testErrorsAndWarnings('from a_index | sort to_geopoint(stringField)', []); + testErrorsAndWarnings('row var = to_geopoint(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row to_geopoint(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings( + 'row var = to_geopoint(to_geopoint(to_geopoint("POINT (30 10)")))', + [] + ); + testErrorsAndWarnings('row var = to_geopoint(to_string(true))', []); + + testErrorsAndWarnings('row var = to_geopoint(true)', [ + 'Argument of [to_geopoint] must be [geo_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_geopoint(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval to_geopoint(geoPointField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_geopoint(to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval to_geopoint(booleanField)', [ + 'Argument of [to_geopoint] must be [geo_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_geopoint(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_geopoint(geoPointField, extraArg)', [ + 'Error: [to_geopoint] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_geopoint(geoPointField)', []); }); describe('to_geoshape', () => { @@ -4949,6 +7849,48 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_geoshape(stringField)', []); + testErrorsAndWarnings('row var = to_geoshape(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row to_geoshape(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings( + 'row var = to_geoshape(to_geopoint(to_geopoint("POINT (30 10)")))', + [] + ); + testErrorsAndWarnings('row var = to_geoshape(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row to_geoshape(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings( + 'row var = to_geoshape(to_geoshape(to_geopoint("POINT (30 10)")))', + [] + ); + testErrorsAndWarnings('row var = to_geoshape(to_string(true))', []); + + testErrorsAndWarnings('row var = to_geoshape(true)', [ + 'Argument of [to_geoshape] must be [geo_point], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_geoshape(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval to_geoshape(geoPointField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_geoshape(to_geopoint(geoPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval to_geoshape(booleanField)', [ + 'Argument of [to_geoshape] must be [geo_point], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_geoshape(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval to_geoshape(geoShapeField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_geoshape(to_geoshape(geoPointField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = to_geoshape(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_geoshape(geoPointField, extraArg)', [ + 'Error: [to_geoshape] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_geoshape(geoPointField)', []); }); describe('to_integer', () => { @@ -4964,6 +7906,57 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_integer(stringField)', []); + testErrorsAndWarnings('row var = to_integer(true)', []); + testErrorsAndWarnings('row to_integer(true)', []); + testErrorsAndWarnings('row var = to_int(true)', []); + testErrorsAndWarnings('row var = to_integer(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_integer(5)', []); + testErrorsAndWarnings('row to_integer(5)', []); + testErrorsAndWarnings('row var = to_int(5)', []); + testErrorsAndWarnings('row var = to_integer(to_integer(true))', []); + testErrorsAndWarnings('row var = to_integer(now())', []); + testErrorsAndWarnings('row to_integer(now())', []); + testErrorsAndWarnings('row var = to_int(now())', []); + testErrorsAndWarnings('row var = to_integer(to_datetime(now()))', []); + testErrorsAndWarnings('row var = to_integer(to_string(true))', []); + + testErrorsAndWarnings('row var = to_integer(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [to_integer] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where to_integer(booleanField) > 0', []); + + testErrorsAndWarnings('from a_index | where to_integer(cartesianPointField) > 0', [ + 'Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where to_integer(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(dateField) > 0', []); + testErrorsAndWarnings('from a_index | where to_integer(stringField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_integer(cartesianPointField)', [ + 'Argument of [to_integer] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_integer(numberField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_integer(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_int(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = to_integer(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_integer(booleanField, extraArg)', [ + 'Error: [to_integer] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_integer(booleanField)', []); }); describe('to_ip', () => { @@ -4977,6 +7970,30 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_ip(stringField)', []); + testErrorsAndWarnings('row var = to_ip(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row to_ip(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = to_ip(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = to_ip(to_string(true))', []); + + testErrorsAndWarnings('row var = to_ip(true)', [ + 'Argument of [to_ip] must be [ip], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_ip(ipField)', []); + testErrorsAndWarnings('from a_index | eval to_ip(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ip(to_ip(ipField))', []); + + testErrorsAndWarnings('from a_index | eval to_ip(booleanField)', [ + 'Argument of [to_ip] must be [ip], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_ip(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_ip(ipField, extraArg)', [ + 'Error: [to_ip] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_ip(ipField)', []); }); describe('to_long', () => { @@ -4990,6 +8007,51 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_long(stringField)', []); + testErrorsAndWarnings('row var = to_long(true)', []); + testErrorsAndWarnings('row to_long(true)', []); + testErrorsAndWarnings('row var = to_long(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_long(5)', []); + testErrorsAndWarnings('row to_long(5)', []); + testErrorsAndWarnings('row var = to_long(to_integer(true))', []); + testErrorsAndWarnings('row var = to_long(now())', []); + testErrorsAndWarnings('row to_long(now())', []); + testErrorsAndWarnings('row var = to_long(to_datetime(now()))', []); + testErrorsAndWarnings('row var = to_long(to_string(true))', []); + + testErrorsAndWarnings('row var = to_long(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [to_long] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where to_long(booleanField) > 0', []); + + testErrorsAndWarnings('from a_index | where to_long(cartesianPointField) > 0', [ + 'Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where to_long(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where to_long(dateField) > 0', []); + testErrorsAndWarnings('from a_index | where to_long(stringField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_long(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_long(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(to_boolean(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_long(cartesianPointField)', [ + 'Argument of [to_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_long(numberField)', []); + testErrorsAndWarnings('from a_index | eval to_long(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_long(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_long(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_long(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = to_long(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_long(booleanField, extraArg)', [ + 'Error: [to_long] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_long(booleanField)', []); }); describe('to_lower', () => { @@ -5024,6 +8086,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_lower(stringField)', []); + testErrorsAndWarnings('row var = to_lower(to_string(true))', []); + + testErrorsAndWarnings('row var = to_lower(true)', [ + 'Argument of [to_lower] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where length(to_lower(booleanField)) > 0', [ + 'Argument of [to_lower] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_lower(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_lower(booleanField)', [ + 'Argument of [to_lower] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('to_radians', () => { @@ -5058,6 +8135,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_radians(numberField)', []); + testErrorsAndWarnings('row var = to_radians(to_integer(true))', []); + + testErrorsAndWarnings('row var = to_radians(true)', [ + 'Argument of [to_radians] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where to_radians(booleanField) > 0', [ + 'Argument of [to_radians] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_radians(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_radians(booleanField)', [ + 'Argument of [to_radians] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('to_string', () => { @@ -5073,6 +8165,128 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_string(stringField)', []); + testErrorsAndWarnings('row var = to_string(true)', []); + testErrorsAndWarnings('row to_string(true)', []); + testErrorsAndWarnings('row var = to_str(true)', []); + testErrorsAndWarnings('row var = to_string(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_string(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row to_string(to_cartesianpoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_str(to_cartesianpoint("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = to_string(to_cartesianpoint(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = to_string(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row to_string(to_cartesianshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_str(to_cartesianshape("POINT (30 10)"))', []); + + testErrorsAndWarnings( + 'row var = to_string(to_cartesianshape(to_cartesianpoint("POINT (30 10)")))', + [] + ); + + testErrorsAndWarnings('row var = to_string(now())', []); + testErrorsAndWarnings('row to_string(now())', []); + testErrorsAndWarnings('row var = to_str(now())', []); + testErrorsAndWarnings('row var = to_string(to_datetime(now()))', []); + testErrorsAndWarnings('row var = to_string(5)', []); + testErrorsAndWarnings('row to_string(5)', []); + testErrorsAndWarnings('row var = to_str(5)', []); + testErrorsAndWarnings('row var = to_string(to_integer(true))', []); + testErrorsAndWarnings('row var = to_string(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row to_string(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_str(to_geopoint("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_string(to_geopoint(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = to_string(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row to_string(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_str(to_geoshape("POINT (30 10)"))', []); + testErrorsAndWarnings('row var = to_string(to_geoshape(to_geopoint("POINT (30 10)")))', []); + testErrorsAndWarnings('row var = to_string(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row to_string(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = to_str(to_ip("127.0.0.1"))', []); + testErrorsAndWarnings('row var = to_string(to_ip(to_ip("127.0.0.1")))', []); + testErrorsAndWarnings('row var = to_string(to_string(true))', []); + testErrorsAndWarnings('row var = to_string(to_version("1.0.0"))', []); + testErrorsAndWarnings('row to_string(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = to_str(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = to_string(to_version("a"))', []); + testErrorsAndWarnings('from a_index | where length(to_string(booleanField)) > 0', []); + testErrorsAndWarnings( + 'from a_index | where length(to_string(cartesianPointField)) > 0', + [] + ); + testErrorsAndWarnings( + 'from a_index | where length(to_string(cartesianShapeField)) > 0', + [] + ); + testErrorsAndWarnings('from a_index | where length(to_string(dateField)) > 0', []); + testErrorsAndWarnings('from a_index | where length(to_string(numberField)) > 0', []); + testErrorsAndWarnings('from a_index | where length(to_string(geoPointField)) > 0', []); + testErrorsAndWarnings('from a_index | where length(to_string(geoShapeField)) > 0', []); + testErrorsAndWarnings('from a_index | where length(to_string(ipField)) > 0', []); + testErrorsAndWarnings('from a_index | where length(to_string(stringField)) > 0', []); + testErrorsAndWarnings('from a_index | where length(to_string(versionField)) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_string(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_string(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_boolean(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval to_string(cartesianPointField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(cartesianPointField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = to_string(to_cartesianpoint(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = to_string(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval to_string(cartesianShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(cartesianShapeField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = to_string(to_cartesianshape(cartesianPointField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval var = to_string(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_string(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_datetime(dateField))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(numberField)', []); + testErrorsAndWarnings('from a_index | eval to_string(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_integer(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval to_string(geoPointField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(geoPointField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_string(to_geopoint(geoPointField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = to_string(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval to_string(geoShapeField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(geoShapeField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_string(to_geoshape(geoPointField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = to_string(ipField)', []); + testErrorsAndWarnings('from a_index | eval to_string(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(ipField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_ip(ipField))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_string(booleanField))', []); + testErrorsAndWarnings('from a_index | eval var = to_string(versionField)', []); + testErrorsAndWarnings('from a_index | eval to_string(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = to_str(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = to_string(to_version(stringField))', []); + + testErrorsAndWarnings('from a_index | eval to_string(booleanField, extraArg)', [ + 'Error: [to_string] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_string(booleanField)', []); }); describe('to_unsigned_long', () => { @@ -5090,6 +8304,75 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_unsigned_long(stringField)', []); + testErrorsAndWarnings('row var = to_unsigned_long(true)', []); + testErrorsAndWarnings('row to_unsigned_long(true)', []); + testErrorsAndWarnings('row var = to_ul(true)', []); + testErrorsAndWarnings('row var = to_ulong(true)', []); + testErrorsAndWarnings('row var = to_unsigned_long(to_boolean(true))', []); + testErrorsAndWarnings('row var = to_unsigned_long(now())', []); + testErrorsAndWarnings('row to_unsigned_long(now())', []); + testErrorsAndWarnings('row var = to_ul(now())', []); + testErrorsAndWarnings('row var = to_ulong(now())', []); + testErrorsAndWarnings('row var = to_unsigned_long(to_datetime(now()))', []); + testErrorsAndWarnings('row var = to_unsigned_long(5)', []); + testErrorsAndWarnings('row to_unsigned_long(5)', []); + testErrorsAndWarnings('row var = to_ul(5)', []); + testErrorsAndWarnings('row var = to_ulong(5)', []); + testErrorsAndWarnings('row var = to_unsigned_long(to_integer(true))', []); + testErrorsAndWarnings('row var = to_unsigned_long(to_string(true))', []); + + testErrorsAndWarnings('row var = to_unsigned_long(to_cartesianpoint("POINT (30 10)"))', [ + 'Argument of [to_unsigned_long] must be [boolean], found value [to_cartesianpoint("POINT (30 10)")] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where to_unsigned_long(booleanField) > 0', []); + + testErrorsAndWarnings('from a_index | where to_unsigned_long(cartesianPointField) > 0', [ + 'Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | where to_unsigned_long(dateField) > 0', []); + testErrorsAndWarnings('from a_index | where to_unsigned_long(numberField) > 0', []); + testErrorsAndWarnings('from a_index | where to_unsigned_long(stringField) > 0', []); + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(booleanField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(booleanField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(booleanField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_unsigned_long(to_boolean(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval to_unsigned_long(cartesianPointField)', [ + 'Argument of [to_unsigned_long] must be [boolean], found value [cartesianPointField] type [cartesian_point]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(dateField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(dateField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(dateField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_unsigned_long(to_datetime(dateField))', + [] + ); + testErrorsAndWarnings('from a_index | eval var = to_unsigned_long(numberField)', []); + testErrorsAndWarnings('from a_index | eval to_unsigned_long(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ul(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ulong(numberField)', []); + testErrorsAndWarnings( + 'from a_index | eval var = to_unsigned_long(to_integer(booleanField))', + [] + ); + testErrorsAndWarnings( + 'from a_index | eval var = to_unsigned_long(to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval to_unsigned_long(booleanField, extraArg)', [ + 'Error: [to_unsigned_long] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_unsigned_long(booleanField)', []); }); describe('to_upper', () => { @@ -5124,6 +8407,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_upper(stringField)', []); + testErrorsAndWarnings('row var = to_upper(to_string(true))', []); + + testErrorsAndWarnings('row var = to_upper(true)', [ + 'Argument of [to_upper] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where length(to_upper(booleanField)) > 0', [ + 'Argument of [to_upper] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_upper(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_upper(booleanField)', [ + 'Argument of [to_upper] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('to_version', () => { @@ -5139,6 +8437,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort to_version(stringField)', []); + testErrorsAndWarnings('row var = to_version(to_version("1.0.0"))', []); + testErrorsAndWarnings('row to_version(to_version("1.0.0"))', []); + testErrorsAndWarnings('row var = to_ver(to_version("1.0.0"))', []); + + testErrorsAndWarnings('row var = to_version(true)', [ + 'Argument of [to_version] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_version(versionField)', []); + testErrorsAndWarnings('from a_index | eval to_version(versionField)', []); + testErrorsAndWarnings('from a_index | eval var = to_ver(versionField)', []); + + testErrorsAndWarnings('from a_index | eval to_version(stringField, extraArg)', [ + 'Error: [to_version] function expects exactly one argument, got 2.', + ]); }); describe('trim', () => { @@ -5173,6 +8486,21 @@ describe('validation logic', () => { ]); testErrorsAndWarnings('from a_index | sort trim(stringField)', []); + testErrorsAndWarnings('row var = trim(to_string(true))', []); + + testErrorsAndWarnings('row var = trim(true)', [ + 'Argument of [trim] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where length(trim(booleanField)) > 0', [ + 'Argument of [trim] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = trim(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval trim(booleanField)', [ + 'Argument of [trim] must be [string], found value [booleanField] type [boolean]', + ]); }); describe('avg', () => { @@ -5273,6 +8601,10 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval avg(numberField) > 0', [ 'EVAL does not support function avg', ]); + + testErrorsAndWarnings('from a_index | stats avg(booleanField)', [ + 'Argument of [avg] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('sum', () => { @@ -5373,6 +8705,10 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval sum(numberField) > 0', [ 'EVAL does not support function sum', ]); + + testErrorsAndWarnings('from a_index | stats sum(booleanField)', [ + 'Argument of [sum] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('median', () => { @@ -5479,6 +8815,10 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval median(numberField) > 0', [ 'EVAL does not support function median', ]); + + testErrorsAndWarnings('from a_index | stats median(booleanField)', [ + 'Argument of [median] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('median_absolute_deviation', () => { @@ -5620,6 +8960,10 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval median_absolute_deviation(numberField) > 0', [ 'EVAL does not support function median_absolute_deviation', ]); + + testErrorsAndWarnings('from a_index | stats median_absolute_deviation(booleanField)', [ + 'Argument of [median_absolute_deviation] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('percentile', () => { @@ -5735,6 +9079,10 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval percentile(numberField, 5) > 0', [ 'EVAL does not support function percentile', ]); + + testErrorsAndWarnings('from a_index | stats percentile(booleanField, 5)', [ + 'Argument of [percentile] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('max', () => { @@ -5869,6 +9217,10 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval max(dateField) > 0', [ 'EVAL does not support function max', ]); + + testErrorsAndWarnings('from a_index | stats max(booleanField)', [ + 'Argument of [max] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('min', () => { @@ -6003,6 +9355,10 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval min(dateField) > 0', [ 'EVAL does not support function min', ]); + + testErrorsAndWarnings('from a_index | stats min(booleanField)', [ + 'Argument of [min] must be [number], found value [booleanField] type [boolean]', + ]); }); describe('count', () => { @@ -6186,6 +9542,10 @@ describe('validation logic', () => { testErrorsAndWarnings('from a_index | eval st_centroid_agg(geoPointField) > 0', [ 'EVAL does not support function st_centroid_agg', ]); + + testErrorsAndWarnings('from a_index | stats st_centroid_agg(booleanField)', [ + 'Argument of [st_centroid_agg] must be [cartesian_point], found value [booleanField] type [boolean]', + ]); }); describe('values', () => { @@ -6296,6 +9656,191 @@ describe('validation logic', () => { 'SORT does not support function bucket', ]); }); + + describe('cbrt', () => { + testErrorsAndWarnings('row var = cbrt(5)', []); + testErrorsAndWarnings('row cbrt(5)', []); + testErrorsAndWarnings('row var = cbrt(to_integer(true))', []); + + testErrorsAndWarnings('row var = cbrt(true)', [ + 'Argument of [cbrt] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where cbrt(numberField) > 0', []); + + testErrorsAndWarnings('from a_index | where cbrt(booleanField) > 0', [ + 'Argument of [cbrt] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = cbrt(numberField)', []); + testErrorsAndWarnings('from a_index | eval cbrt(numberField)', []); + testErrorsAndWarnings('from a_index | eval var = cbrt(to_integer(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval cbrt(booleanField)', [ + 'Argument of [cbrt] must be [number], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = cbrt(*)', [ + 'Using wildcards (*) in cbrt is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval cbrt(numberField, extraArg)', [ + 'Error: [cbrt] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort cbrt(numberField)', []); + }); + + describe('from_base64', () => { + testErrorsAndWarnings('row var = from_base64("a")', []); + testErrorsAndWarnings('row from_base64("a")', []); + testErrorsAndWarnings('row var = from_base64(to_string(true))', []); + + testErrorsAndWarnings('row var = from_base64(true)', [ + 'Argument of [from_base64] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where length(from_base64(stringField)) > 0', []); + + testErrorsAndWarnings('from a_index | where length(from_base64(booleanField)) > 0', [ + 'Argument of [from_base64] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = from_base64(stringField)', []); + testErrorsAndWarnings('from a_index | eval from_base64(stringField)', []); + testErrorsAndWarnings('from a_index | eval var = from_base64(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval from_base64(booleanField)', [ + 'Argument of [from_base64] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = from_base64(*)', [ + 'Using wildcards (*) in from_base64 is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval from_base64(stringField, extraArg)', [ + 'Error: [from_base64] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort from_base64(stringField)', []); + }); + + describe('locate', () => { + testErrorsAndWarnings('row var = locate("a", "a")', []); + testErrorsAndWarnings('row locate("a", "a")', []); + testErrorsAndWarnings('row var = locate(to_string(true), to_string(true))', []); + testErrorsAndWarnings('row var = locate("a", "a", 5)', []); + testErrorsAndWarnings('row locate("a", "a", 5)', []); + testErrorsAndWarnings( + 'row var = locate(to_string(true), to_string(true), to_integer(true))', + [] + ); + + testErrorsAndWarnings('row var = locate(true, true, true)', [ + 'Argument of [locate] must be [string], found value [true] type [boolean]', + 'Argument of [locate] must be [string], found value [true] type [boolean]', + 'Argument of [locate] must be [number], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where locate(stringField, stringField) > 0', []); + + testErrorsAndWarnings('from a_index | where locate(booleanField, booleanField) > 0', [ + 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', + 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | where locate(stringField, stringField, numberField) > 0', + [] + ); + + testErrorsAndWarnings( + 'from a_index | where locate(booleanField, booleanField, booleanField) > 0', + [ + 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', + 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', + 'Argument of [locate] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings('from a_index | eval var = locate(stringField, stringField)', []); + testErrorsAndWarnings('from a_index | eval locate(stringField, stringField)', []); + + testErrorsAndWarnings( + 'from a_index | eval var = locate(to_string(booleanField), to_string(booleanField))', + [] + ); + + testErrorsAndWarnings('from a_index | eval locate(booleanField, booleanField)', [ + 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', + 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings( + 'from a_index | eval var = locate(stringField, stringField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval locate(stringField, stringField, numberField)', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval var = locate(to_string(booleanField), to_string(booleanField), to_integer(booleanField))', + [] + ); + + testErrorsAndWarnings( + 'from a_index | eval locate(booleanField, booleanField, booleanField)', + [ + 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', + 'Argument of [locate] must be [string], found value [booleanField] type [boolean]', + 'Argument of [locate] must be [number], found value [booleanField] type [boolean]', + ] + ); + + testErrorsAndWarnings( + 'from a_index | eval locate(stringField, stringField, numberField, extraArg)', + ['Error: [locate] function expects no more than 3 arguments, got 4.'] + ); + + testErrorsAndWarnings('from a_index | sort locate(stringField, stringField)', []); + }); + + describe('to_base64', () => { + testErrorsAndWarnings('row var = to_base64("a")', []); + testErrorsAndWarnings('row to_base64("a")', []); + testErrorsAndWarnings('row var = to_base64(to_string(true))', []); + + testErrorsAndWarnings('row var = to_base64(true)', [ + 'Argument of [to_base64] must be [string], found value [true] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | where length(to_base64(stringField)) > 0', []); + + testErrorsAndWarnings('from a_index | where length(to_base64(booleanField)) > 0', [ + 'Argument of [to_base64] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_base64(stringField)', []); + testErrorsAndWarnings('from a_index | eval to_base64(stringField)', []); + testErrorsAndWarnings('from a_index | eval var = to_base64(to_string(booleanField))', []); + + testErrorsAndWarnings('from a_index | eval to_base64(booleanField)', [ + 'Argument of [to_base64] must be [string], found value [booleanField] type [boolean]', + ]); + + testErrorsAndWarnings('from a_index | eval var = to_base64(*)', [ + 'Using wildcards (*) in to_base64 is not allowed', + ]); + + testErrorsAndWarnings('from a_index | eval to_base64(stringField, extraArg)', [ + 'Error: [to_base64] function expects exactly one argument, got 2.', + ]); + + testErrorsAndWarnings('from a_index | sort to_base64(stringField)', []); + }); }); }); diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts b/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts index 5bef4d5faa604..1bc4121d729a2 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/validation.ts @@ -70,7 +70,8 @@ import { retrievePoliciesFields, retrieveFieldsFromStringSources, } from './resources'; -import { collapseWrongArgumentTypeMessages } from './helpers'; +import { collapseWrongArgumentTypeMessages, getMaxMinNumberOfParams } from './helpers'; +import { getParamAtPosition } from '../autocomplete/helper'; import { METADATA_FIELDS } from '../shared/constants'; function validateFunctionLiteralArg( @@ -346,35 +347,28 @@ function validateFunction( } const matchingSignatures = extractCompatibleSignaturesForFunction(fnDefinition, astFunction); if (!matchingSignatures.length) { - const refSignature = fnDefinition.signatures[0]; - const numArgs = - refSignature.minParams ?? refSignature.params.filter(({ optional }) => !optional).length; - if ( - !refSignature.minParams && - refSignature.params.filter(({ optional }) => !optional).length === refSignature.params.length - ) { + const { max, min } = getMaxMinNumberOfParams(fnDefinition); + if (max === min) { messages.push( getMessageFromId({ messageId: 'wrongArgumentNumber', values: { fn: astFunction.name, - numArgs: - refSignature.minParams ?? - refSignature.params.filter(({ optional }) => !optional).length, + numArgs: max, passedArgs: astFunction.args.length, }, locations: astFunction.location, }) ); - } else if (Math.max(astFunction.args.length - refSignature.params.length, 0) > 0) { + } else if (astFunction.args.length > max) { messages.push( getMessageFromId({ messageId: 'wrongArgumentNumberTooMany', values: { fn: astFunction.name, - numArgs: refSignature.params.length, + numArgs: max, passedArgs: astFunction.args.length, - extraArgs: Math.max(astFunction.args.length - refSignature.params.length, 0), + extraArgs: astFunction.args.length - max, }, locations: astFunction.location, }) @@ -385,9 +379,9 @@ function validateFunction( messageId: 'wrongArgumentNumberTooFew', values: { fn: astFunction.name, - numArgs, + numArgs: min, passedArgs: astFunction.args.length, - missingArgs: Math.max(numArgs - astFunction.args.length, 0), + missingArgs: min - astFunction.args.length, }, locations: astFunction.location, }) @@ -461,9 +455,9 @@ function validateFunction( const failingSignatures: ESQLMessage[][] = []; for (const signature of matchingSignatures) { const failingSignature: ESQLMessage[] = []; - signature.params.forEach((argDef, index) => { - const outerArg = astFunction.args[index]!; - if (!outerArg && argDef.optional) { + astFunction.args.forEach((outerArg, index) => { + const argDef = getParamAtPosition(signature, index); + if ((!outerArg && argDef?.optional) || !argDef) { // that's ok, just skip it // the else case is already catched with the argument counts check // few lines above diff --git a/packages/kbn-esql-validation-autocomplete/tsconfig.json b/packages/kbn-esql-validation-autocomplete/tsconfig.json index 59bed1b2893f0..3c87e005c394f 100644 --- a/packages/kbn-esql-validation-autocomplete/tsconfig.json +++ b/packages/kbn-esql-validation-autocomplete/tsconfig.json @@ -14,6 +14,7 @@ "kbn_references": [ "@kbn/i18n", "@kbn/esql-ast", + "@kbn/utility-types", ], "exclude": [ "target/**/*", diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json index a194bc656b28b..3fddf1ca6ae2d 100644 --- a/x-pack/plugins/translations/translations/fr-FR.json +++ b/x-pack/plugins/translations/translations/fr-FR.json @@ -5062,27 +5062,15 @@ "kbn-esql-validation-autocomplete.esql.definition.orDoc": "ou", "kbn-esql-validation-autocomplete.esql.definition.rlikeDoc": "Filtrer les données en fonction des expressions régulières des chaînes", "kbn-esql-validation-autocomplete.esql.definition.subtractDoc": "Subtract (-)", - "kbn-esql-validation-autocomplete.esql.definitions.absDoc": "Renvoie la valeur absolue.", - "kbn-esql-validation-autocomplete.esql.definitions.acosDoc": "Fonction trigonométrique cosinus inverse", "kbn-esql-validation-autocomplete.esql.definitions.appendSeparatorDoc": "Le ou les caractères qui séparent les champs ajoutés. A pour valeur par défaut une chaîne vide (\"\").", "kbn-esql-validation-autocomplete.esql.definitions.asDoc": "En tant que", - "kbn-esql-validation-autocomplete.esql.definitions.asinDoc": "Fonction trigonométrique sinus inverse", - "kbn-esql-validation-autocomplete.esql.definitions.atan2Doc": "L'angle entre l'axe positif des x et le rayon allant de l'origine au point (x , y) dans le plan cartésien", - "kbn-esql-validation-autocomplete.esql.definitions.atanDoc": "Fonction trigonométrique tangente inverse", "kbn-esql-validation-autocomplete.esql.definitions.autoBucketDoc": "Groupement automatique des dates en fonction d'une plage et d'un compartiment cible donnés.", "kbn-esql-validation-autocomplete.esql.definitions.avgDoc": "Renvoie la moyenne des valeurs dans un champ", "kbn-esql-validation-autocomplete.esql.definitions.byDoc": "Par", - "kbn-esql-validation-autocomplete.esql.definitions.caseDoc": "Accepte les paires de conditions et de valeurs. La fonction renvoie la valeur correspondant à la première condition évaluée à `true` (vraie). Si le nombre d'arguments est impair, le dernier argument est la valeur par défaut qui est renvoyée si aucune condition ne correspond.", "kbn-esql-validation-autocomplete.esql.definitions.ccqAnyDoc": "L'enrichissement a lieu sur n'importe quel cluster", "kbn-esql-validation-autocomplete.esql.definitions.ccqCoordinatorDoc": "L'enrichissement a lieu sur le cluster de coordination qui reçoit une requête ES|QL", "kbn-esql-validation-autocomplete.esql.definitions.ccqModeDoc": "Mode de requête inter-clusters", "kbn-esql-validation-autocomplete.esql.definitions.ccqRemoteDoc": "L'enrichissement a lieu sur le cluster qui héberge l'index cible.", - "kbn-esql-validation-autocomplete.esql.definitions.ceilDoc": "Arrondir un nombre à l'entier supérieur.", - "kbn-esql-validation-autocomplete.esql.definitions.cidrMatchDoc": "La fonction utilise un premier paramètre de type adresse IP, puis un ou plusieurs paramètres évalués en fonction d'une spécification CIDR.", - "kbn-esql-validation-autocomplete.esql.definitions.coalesceDoc": "Renvoie la première valeur non nulle.", - "kbn-esql-validation-autocomplete.esql.definitions.concatDoc": "Concatène deux ou plusieurs chaînes.", - "kbn-esql-validation-autocomplete.esql.definitions.cosDoc": "Fonction trigonométrique cosinus", - "kbn-esql-validation-autocomplete.esql.definitions.coshDoc": "Fonction hyperbolique cosinus", "kbn-esql-validation-autocomplete.esql.definitions.countDistinctDoc": "Renvoie le décompte des valeurs distinctes dans un champ.", "kbn-esql-validation-autocomplete.esql.definitions.countDoc": "Renvoie le décompte des valeurs dans un champ.", "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.day": "Jour", @@ -5101,87 +5089,29 @@ "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.weeks": "Semaines (pluriel)", "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.year": "An", "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.years": "Ans (pluriel)", - "kbn-esql-validation-autocomplete.esql.definitions.dateExtractDoc": "Extrait des parties d'une date, telles que l'année, le mois, le jour, l'heure. Les types de champs pris en charge sont ceux fournis par la fonction \"java.time.temporal.ChronoField\"", - "kbn-esql-validation-autocomplete.esql.definitions.dateFormatDoc": "Renvoie une représentation sous forme de chaîne d'une date dans le format fourni. Si aucun format n'est indiqué, le format \"yyyy-MM-dd'T'HH:mm:ss.SSSZ\" est utilisé.", - "kbn-esql-validation-autocomplete.esql.definitions.dateParseDoc": "Analyser les dates à partir de chaînes.", - "kbn-esql-validation-autocomplete.esql.definitions.dateTruncDoc": "Arrondit une date à l'intervalle le plus proche. Les intervalles peuvent être exprimés à l'aide de la syntaxe littérale timespan.", "kbn-esql-validation-autocomplete.esql.definitions.dissectDoc": "Extrait de multiples valeurs de chaîne à partir d'une entrée de chaîne unique, suivant un modèle", "kbn-esql-validation-autocomplete.esql.definitions.dropDoc": "Supprime les colonnes", - "kbn-esql-validation-autocomplete.esql.definitions.eDoc": "Nombre d'Euler.", - "kbn-esql-validation-autocomplete.esql.definitions.endsWithDoc": "Renvoie une valeur booléenne qui indique si une chaîne de mots-clés se termine par une autre chaîne :", "kbn-esql-validation-autocomplete.esql.definitions.enrichDoc": "Enrichissez le tableau à l'aide d'un autre tableau. Avant de pouvoir utiliser l'enrichissement, vous devez créer et exécuter une politique d'enrichissement.", "kbn-esql-validation-autocomplete.esql.definitions.evalDoc": "Calcule une expression et place la valeur résultante dans un champ de résultats de recherche.", - "kbn-esql-validation-autocomplete.esql.definitions.floorDoc": "Arrondir un nombre à l'entier inférieur.", "kbn-esql-validation-autocomplete.esql.definitions.fromDoc": "Récupère les données à partir d'un ou plusieurs flux de données, index ou alias. Dans une requête ou une sous-requête, vous devez utiliser d'abord la commande from, et cette dernière ne nécessite pas de barre verticale au début. Par exemple, pour récupérer des données d'un index :", - "kbn-esql-validation-autocomplete.esql.definitions.greatestDoc": "Renvoie la valeur maximale de plusieurs colonnes.", "kbn-esql-validation-autocomplete.esql.definitions.grokDoc": "Extrait de multiples valeurs de chaîne à partir d'une entrée de chaîne unique, suivant un modèle", "kbn-esql-validation-autocomplete.esql.definitions.keepDoc": "Réarrange les champs dans le tableau d'entrée en appliquant les clauses \"KEEP\" dans les champs", - "kbn-esql-validation-autocomplete.esql.definitions.leastDoc": "Renvoie la valeur minimale de plusieurs colonnes.", - "kbn-esql-validation-autocomplete.esql.definitions.leftDoc": "Renvoyer la sous-chaîne qui extrait la longueur des caractères de la chaîne en partant de la gauche.", - "kbn-esql-validation-autocomplete.esql.definitions.lengthDoc": "Renvoie la longueur des caractères d'une chaîne.", "kbn-esql-validation-autocomplete.esql.definitions.limitDoc": "Renvoie les premiers résultats de recherche, dans l'ordre de recherche, en fonction de la \"limite\" spécifiée.", - "kbn-esql-validation-autocomplete.esql.definitions.log10Doc": "Renvoie le log de base 10.", - "kbn-esql-validation-autocomplete.esql.definitions.logDoc": "La fonction scalaire log(based, value) renvoie le logarithme d'une valeur pour une base spécifique, comme défini dans l'argument", - "kbn-esql-validation-autocomplete.esql.definitions.ltrimDoc": "Retire les espaces au début des chaînes.", "kbn-esql-validation-autocomplete.esql.definitions.maxDoc": "Renvoie la valeur maximale dans un champ.", "kbn-esql-validation-autocomplete.esql.definitions.medianDeviationDoc": "Renvoie la médiane de chaque écart de point de données par rapport à la médiane de l'ensemble de l'échantillon.", "kbn-esql-validation-autocomplete.esql.definitions.medianDoc": "Renvoie le 50e centile.", "kbn-esql-validation-autocomplete.esql.definitions.metadataDoc": "Métadonnées", "kbn-esql-validation-autocomplete.esql.definitions.minDoc": "Renvoie la valeur minimale dans un champ.", - "kbn-esql-validation-autocomplete.esql.definitions.mvAvgDoc": "Convertit un champ multivalué en un champ à valeur unique comprenant la moyenne de toutes les valeurs.", - "kbn-esql-validation-autocomplete.esql.definitions.mvConcatDoc": "Convertit un champ de type chaîne multivalué en un champ à valeur unique comprenant la concaténation de toutes les valeurs, séparées par un délimiteur", - "kbn-esql-validation-autocomplete.esql.definitions.mvCountDoc": "Convertit un champ multivalué en un champ à valeur unique comprenant le total du nombre de valeurs", - "kbn-esql-validation-autocomplete.esql.definitions.mvDedupeDoc": "Supprime les doublons d'un champ multivalué", "kbn-esql-validation-autocomplete.esql.definitions.mvExpandDoc": "Développe des champs comportant des valeurs multiples en indiquant une valeur par ligne et en dupliquant les autres champs", - "kbn-esql-validation-autocomplete.esql.definitions.mvFirstDoc": "Réduit un champ multivalué en un champ à valeur unique comprenant la première valeur.", - "kbn-esql-validation-autocomplete.esql.definitions.mvLastDoc": "Réduit un champ multivalué en un champ à valeur unique comprenant la dernière valeur.", - "kbn-esql-validation-autocomplete.esql.definitions.mvMaxDoc": "Convertit un champ multivalué en un champ à valeur unique comprenant la valeur maximale.", - "kbn-esql-validation-autocomplete.esql.definitions.mvMedianDoc": "Convertit un champ multivalué en un champ à valeur unique comprenant la valeur médiane.", - "kbn-esql-validation-autocomplete.esql.definitions.mvMinDoc": "Convertit un champ multivalué en un champ à valeur unique comprenant la valeur minimale.", - "kbn-esql-validation-autocomplete.esql.definitions.mvSumDoc": "Convertit un champ multivalué en un champ à valeur unique comprenant la somme de toutes les valeurs.", - "kbn-esql-validation-autocomplete.esql.definitions.nowDoc": "Renvoie la date et l'heure actuelles.", "kbn-esql-validation-autocomplete.esql.definitions.onDoc": "Activé", "kbn-esql-validation-autocomplete.esql.definitions.percentiletDoc": "Renvoie le n-ième centile d'un champ.", - "kbn-esql-validation-autocomplete.esql.definitions.piDoc": "Le rapport entre la circonférence et le diamètre d'un cercle.", - "kbn-esql-validation-autocomplete.esql.definitions.powDoc": "Renvoie la valeur d'une base (premier argument) élevée à une puissance (deuxième argument).", "kbn-esql-validation-autocomplete.esql.definitions.renameDoc": "Attribue un nouveau nom à une ancienne colonne", - "kbn-esql-validation-autocomplete.esql.definitions.replaceDoc": "La fonction remplace dans la chaîne (1er argument) toutes les correspondances avec l'expression régulière (2e argument) par la chaîne de remplacement (3e argument). Si l'un des arguments est NULL, le résultat est NULL.", - "kbn-esql-validation-autocomplete.esql.definitions.rightDoc": "Renvoyer la sous-chaîne qui extrait la longueur des caractères de la chaîne en partant de la droite.", - "kbn-esql-validation-autocomplete.esql.definitions.roundDoc": "Renvoie un nombre arrondi à la décimale, spécifié par la valeur entière la plus proche. La valeur par défaut est arrondie à un entier.", "kbn-esql-validation-autocomplete.esql.definitions.rowDoc": "Renvoie une ligne contenant une ou plusieurs colonnes avec les valeurs que vous spécifiez. Cette commande peut s'avérer utile pour les tests.", - "kbn-esql-validation-autocomplete.esql.definitions.rtrimDoc": "Supprime les espaces à la fin des chaînes.", "kbn-esql-validation-autocomplete.esql.definitions.showDoc": "Renvoie des informations sur le déploiement et ses capacités", - "kbn-esql-validation-autocomplete.esql.definitions.sinDoc": "Fonction trigonométrique sinus.", - "kbn-esql-validation-autocomplete.esql.definitions.sinhDoc": "Fonction hyperbolique sinus.", "kbn-esql-validation-autocomplete.esql.definitions.sortDoc": "Trie tous les résultats en fonction des champs spécifiés. Par défaut, les valeurs null sont considérées comme supérieures à toutes les autres valeurs. Avec l'ordre de tri croissant, les valeurs null sont classées en dernier. Avec l'ordre de tri décroissant, elles sont classées en premier. Pour modifier cet ordre, utilisez NULLS FIRST ou NULLS LAST", - "kbn-esql-validation-autocomplete.esql.definitions.splitDoc": "Divise une chaîne de valeur unique en plusieurs chaînes.", - "kbn-esql-validation-autocomplete.esql.definitions.sqrtDoc": "Renvoie la racine carrée d'un nombre. ", - "kbn-esql-validation-autocomplete.esql.definitions.startsWithDoc": "Renvoie un booléen qui indique si une chaîne de mot-clés débute par une autre chaîne.", "kbn-esql-validation-autocomplete.esql.definitions.statsDoc": "Calcule les statistiques agrégées, telles que la moyenne, le décompte et la somme, sur l'ensemble des résultats de recherche entrants. Comme pour l'agrégation SQL, si la commande stats est utilisée sans clause BY, une seule ligne est renvoyée, qui est l'agrégation de tout l'ensemble des résultats de recherche entrants. Lorsque vous utilisez une clause BY, une ligne est renvoyée pour chaque valeur distincte dans le champ spécifié dans la clause BY. La commande stats renvoie uniquement les champs dans l'agrégation, et vous pouvez utiliser un large éventail de fonctions statistiques avec la commande stats. Lorsque vous effectuez plusieurs agrégations, séparez chacune d'entre elle par une virgule.", "kbn-esql-validation-autocomplete.esql.definitions.stCentroidDoc": "Renvoie le décompte des valeurs distinctes dans un champ.", - "kbn-esql-validation-autocomplete.esql.definitions.substringDoc": "Renvoie la sous-chaîne d'une chaîne, délimitée en fonction d'une position de départ et d'une longueur facultative.", "kbn-esql-validation-autocomplete.esql.definitions.sumDoc": "Renvoie la somme des valeurs dans un champ.", - "kbn-esql-validation-autocomplete.esql.definitions.tanDoc": "Fonction trigonométrique tangente.", - "kbn-esql-validation-autocomplete.esql.definitions.tanhDoc": "Fonction hyperbolique tangente.", - "kbn-esql-validation-autocomplete.esql.definitions.tauDoc": "Le rapport entre la circonférence et le rayon d'un cercle.", - "kbn-esql-validation-autocomplete.esql.definitions.toBooleanDoc": "Convertit en booléen.", - "kbn-esql-validation-autocomplete.esql.definitions.toCartesianPointDoc": "Convertit la valeur d'une entrée en une valeur \"point\".", - "kbn-esql-validation-autocomplete.esql.definitions.toCartesianshapeDoc": "Convertit la valeur d'une entrée en une valeur cartesian_shape.", - "kbn-esql-validation-autocomplete.esql.definitions.toDateTimeDoc": "Convertit en date.", - "kbn-esql-validation-autocomplete.esql.definitions.toDegreesDoc": "Convertit en degrés", - "kbn-esql-validation-autocomplete.esql.definitions.toDoubleDoc": "Convertit en double.", - "kbn-esql-validation-autocomplete.esql.definitions.toGeopointDoc": "Convertit en une valeur geo_point.", - "kbn-esql-validation-autocomplete.esql.definitions.toGeoshapeDoc": "Convertit la valeur d'une entrée en une valeur geo_shape.", - "kbn-esql-validation-autocomplete.esql.definitions.toIntegerDoc": "Convertit en nombre entier.", - "kbn-esql-validation-autocomplete.esql.definitions.toIpDoc": "Convertit en ip.", - "kbn-esql-validation-autocomplete.esql.definitions.toLongDoc": "Convertit en long.", - "kbn-esql-validation-autocomplete.esql.definitions.toLowerDoc": "Renvoie une nouvelle chaîne représentant la chaîne d'entrée convertie en minuscules.", - "kbn-esql-validation-autocomplete.esql.definitions.toRadiansDoc": "Convertit en radians", - "kbn-esql-validation-autocomplete.esql.definitions.toStringDoc": "Convertit en chaîne.", - "kbn-esql-validation-autocomplete.esql.definitions.toUnsignedLongDoc": "Convertit en long non signé.", - "kbn-esql-validation-autocomplete.esql.definitions.toUpperDoc": "Renvoie une nouvelle chaîne représentant la chaîne d'entrée convertie en majuscules.", - "kbn-esql-validation-autocomplete.esql.definitions.toVersionDoc": "Convertit en version.", - "kbn-esql-validation-autocomplete.esql.definitions.trimDoc": "Supprime les espaces de début et de fin d'une chaîne.", "kbn-esql-validation-autocomplete.esql.definitions.whereDoc": "Utilise \"predicate-expressions\" pour filtrer les résultats de recherche. Une expression predicate, lorsqu'elle est évaluée, renvoie TRUE ou FALSE. La commande where renvoie uniquement les résultats qui donnent la valeur TRUE. Par exemple, pour filtrer les résultats pour une valeur de champ spécifique", "kbn-esql-validation-autocomplete.esql.definitions.withDoc": "Avec", "kbn-esql-validation-autocomplete.esql.quickfix.replaceWithQuote": "Remplacer les guillemets par le signe \" (double)", diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json index 252712bbd8b0e..61111df3e6107 100644 --- a/x-pack/plugins/translations/translations/ja-JP.json +++ b/x-pack/plugins/translations/translations/ja-JP.json @@ -5054,27 +5054,15 @@ "kbn-esql-validation-autocomplete.esql.definition.orDoc": "または", "kbn-esql-validation-autocomplete.esql.definition.rlikeDoc": "文字列の正規表現に基づいてデータをフィルター", "kbn-esql-validation-autocomplete.esql.definition.subtractDoc": "減算（-）", - "kbn-esql-validation-autocomplete.esql.definitions.absDoc": "絶対値を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.acosDoc": "逆余弦三角関数", "kbn-esql-validation-autocomplete.esql.definitions.appendSeparatorDoc": "追加されたフィールドを区切る文字。デフォルトは空の文字列（\"\"）です。", "kbn-esql-validation-autocomplete.esql.definitions.asDoc": "として", - "kbn-esql-validation-autocomplete.esql.definitions.asinDoc": "逆正弦三角関数", - "kbn-esql-validation-autocomplete.esql.definitions.atan2Doc": "直交平面上の原点から点（x , y）に向かう光線と正のx軸のなす角", - "kbn-esql-validation-autocomplete.esql.definitions.atanDoc": "逆正接三角関数", "kbn-esql-validation-autocomplete.esql.definitions.autoBucketDoc": "指定された範囲とバケット目標に基づいて、日付を自動的にバケット化します。", "kbn-esql-validation-autocomplete.esql.definitions.avgDoc": "フィールドの値の平均を返します", "kbn-esql-validation-autocomplete.esql.definitions.byDoc": "グループ基準", - "kbn-esql-validation-autocomplete.esql.definitions.caseDoc": "条件と値のペアを指定できます。この関数は、最初にtrueと評価された条件に属する値を返します。引数の数が奇数の場合、最後の引数は条件に一致しない場合に返されるデフォルト値になります。", "kbn-esql-validation-autocomplete.esql.definitions.ccqAnyDoc": "エンリッチは任意のクラスターで発生します", "kbn-esql-validation-autocomplete.esql.definitions.ccqCoordinatorDoc": "エンリッチは、ES|QLを受信する調整クラスターで実行されます", "kbn-esql-validation-autocomplete.esql.definitions.ccqModeDoc": "クラスター横断クエリモード", "kbn-esql-validation-autocomplete.esql.definitions.ccqRemoteDoc": "エンリッチはターゲットインデックスをホスティングするクラスターで発生します。", - "kbn-esql-validation-autocomplete.esql.definitions.ceilDoc": "最も近い整数に数値を切り上げます。", - "kbn-esql-validation-autocomplete.esql.definitions.cidrMatchDoc": "この関数は、IP型の最初のパラメーターを取り、その後にCIDR指定に対して評価された1つ以上のパラメーターを取ります。", - "kbn-esql-validation-autocomplete.esql.definitions.coalesceDoc": "最初のNULL以外の値を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.concatDoc": "2つ以上の文字列を連結します。", - "kbn-esql-validation-autocomplete.esql.definitions.cosDoc": "余弦三角関数", - "kbn-esql-validation-autocomplete.esql.definitions.coshDoc": "余弦双曲線関数", "kbn-esql-validation-autocomplete.esql.definitions.countDistinctDoc": "フィールド内の異なる値の数を返します。", "kbn-esql-validation-autocomplete.esql.definitions.countDoc": "フィールドの値の数を返します。", "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.day": "日", @@ -5093,87 +5081,29 @@ "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.weeks": "週（複数）", "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.year": "年", "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.years": "年（複数）", - "kbn-esql-validation-autocomplete.esql.definitions.dateExtractDoc": "年、月、日、時間など、日付の一部を抽出します。サポートされているフィールド型はjava.time.temporal.ChronoFieldで提供されている型です。", - "kbn-esql-validation-autocomplete.esql.definitions.dateFormatDoc": "指定した書式の日付の文字列表現を返します。書式が指定されていない場合は、yyyy-MM-dd'T'HH:mm:ss.SSSZの書式が使用されます。", - "kbn-esql-validation-autocomplete.esql.definitions.dateParseDoc": "文字列から日付を解析します。", - "kbn-esql-validation-autocomplete.esql.definitions.dateTruncDoc": "最も近い区間まで日付を切り捨てます。区間はtimespanリテラル構文を使って表現できます。", "kbn-esql-validation-autocomplete.esql.definitions.dissectDoc": "単一の文字列入力から、パターンに基づいて複数の文字列値を抽出", "kbn-esql-validation-autocomplete.esql.definitions.dropDoc": "列を削除", - "kbn-esql-validation-autocomplete.esql.definitions.eDoc": "Eulerの数値。", - "kbn-esql-validation-autocomplete.esql.definitions.endsWithDoc": "キーワード文字列が他の文字列で終わるかどうかを示すブール値を返します。", "kbn-esql-validation-autocomplete.esql.definitions.enrichDoc": "別のテーブルでテーブルをエンリッチします。エンリッチを使用する前に、エンリッチポリシーを作成して実行する必要があります。", "kbn-esql-validation-autocomplete.esql.definitions.evalDoc": "式を計算し、結果の値を検索結果フィールドに入力します。", - "kbn-esql-validation-autocomplete.esql.definitions.floorDoc": "最も近い整数に数値を切り捨てます。", "kbn-esql-validation-autocomplete.esql.definitions.fromDoc": "1つ以上のデータストリーム、インデックス、またはエイリアスからデータを取得します。クエリまたはサブクエリでは、最初にコマンドから使用する必要があります。先頭のパイプは不要です。たとえば、インデックスからデータを取得します。", - "kbn-esql-validation-autocomplete.esql.definitions.greatestDoc": "多数の列から最大値を返します。", "kbn-esql-validation-autocomplete.esql.definitions.grokDoc": "単一の文字列入力から、パターンに基づいて複数の文字列値を抽出", "kbn-esql-validation-autocomplete.esql.definitions.keepDoc": "フィールドでkeep句を適用して、入力テーブルのフィールドを並べ替えます", - "kbn-esql-validation-autocomplete.esql.definitions.leastDoc": "多数の列から最小値を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.leftDoc": "stringから左から順にlength文字を抜き出したサブ文字列を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.lengthDoc": "文字列の文字数を返します。", "kbn-esql-validation-autocomplete.esql.definitions.limitDoc": "指定された「制限」に基づき、検索順序で、最初の検索結果を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.log10Doc": "底が10の対数を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.logDoc": "スカラー関数対数（底、値）は、引数で指定されている特定の底の値の対数を返します", - "kbn-esql-validation-autocomplete.esql.definitions.ltrimDoc": "文字列から先頭の空白を取り除きます。", "kbn-esql-validation-autocomplete.esql.definitions.maxDoc": "フィールドの最大値を返します。", "kbn-esql-validation-autocomplete.esql.definitions.medianDeviationDoc": "サンプル全体の中央値からの各データポイントの偏差の中央値を返します。", "kbn-esql-validation-autocomplete.esql.definitions.medianDoc": "50%パーセンタイルを返します。", "kbn-esql-validation-autocomplete.esql.definitions.metadataDoc": "メタデータ", "kbn-esql-validation-autocomplete.esql.definitions.minDoc": "フィールドの最小値を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.mvAvgDoc": "複数値フィールドを、すべての値の平均を含む単一値フィールドに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.mvConcatDoc": "複数値文字列フィールドを、区切り文字で区切られたすべての値を連結した単一値フィールドに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.mvCountDoc": "複数値フィールドを、値の数をカウントする単一値フィールドに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.mvDedupeDoc": "複数値フィールドから重複を削除します。", "kbn-esql-validation-autocomplete.esql.definitions.mvExpandDoc": "複数値フィールドを値ごとに1行に展開し、他のフィールドを複製します", - "kbn-esql-validation-autocomplete.esql.definitions.mvFirstDoc": "複数値フィールドを、最初の値を含む単一値フィールドに縮小します。", - "kbn-esql-validation-autocomplete.esql.definitions.mvLastDoc": "複数値フィールドを、最後の値を含む単一値フィールドに縮小します。", - "kbn-esql-validation-autocomplete.esql.definitions.mvMaxDoc": "複数値フィールドを、最大値を含む単一値フィールドに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.mvMedianDoc": "複数値フィールドを、中央値を含む単一値フィールドに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.mvMinDoc": "複数値フィールドを、最小値を含む単一値フィールドに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.mvSumDoc": "複数値フィールドを、すべての値の合計を含む単一値フィールドに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.nowDoc": "現在の日付と時刻を返します。", "kbn-esql-validation-autocomplete.esql.definitions.onDoc": "オン", "kbn-esql-validation-autocomplete.esql.definitions.percentiletDoc": "フィールドのnパーセンタイルを返します。", - "kbn-esql-validation-autocomplete.esql.definitions.piDoc": "円の円周と直径の比率。", - "kbn-esql-validation-autocomplete.esql.definitions.powDoc": "底（第1引数）を累乗（第2引数）した値を返します。", "kbn-esql-validation-autocomplete.esql.definitions.renameDoc": "古い列の名前を新しい列に変更", - "kbn-esql-validation-autocomplete.esql.definitions.replaceDoc": "この関数は、文字列（第1引数）で、正規表現（第2引数）の任意の一致に置換文字列（第3引数）を代入します。いずれかの引数がNULLの場合、結果はNULLになります。", - "kbn-esql-validation-autocomplete.esql.definitions.rightDoc": "stringのうち右から数えてlength文字までのサブ文字列を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.roundDoc": "最も近い整数値で指定された数字まで端数処理された数値を返します。デフォルトは整数になるように四捨五入されます。", "kbn-esql-validation-autocomplete.esql.definitions.rowDoc": "指定した値の列を1つ以上含む行を作成します。これはテストの場合に便利です。", - "kbn-esql-validation-autocomplete.esql.definitions.rtrimDoc": "文字列から末尾の空白を取り除きます。", "kbn-esql-validation-autocomplete.esql.definitions.showDoc": "デプロイとその能力に関する情報を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.sinDoc": "正弦三角関数。", - "kbn-esql-validation-autocomplete.esql.definitions.sinhDoc": "正弦双曲線関数。", "kbn-esql-validation-autocomplete.esql.definitions.sortDoc": "すべての結果を指定されたフィールドで並べ替えます。デフォルトでは、null値は他のどの値よりも大きい値として扱われます。昇順のソートではnull値は最後にソートされ、降順のソートではnull値は最初にソートされます。NULLS FIRSTまたはNULLS LASTを指定することで変更できます。", - "kbn-esql-validation-autocomplete.esql.definitions.splitDoc": "単一の値の文字列を複数の文字列に分割します。", - "kbn-esql-validation-autocomplete.esql.definitions.sqrtDoc": "数値の平方根を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.startsWithDoc": "キーワード文字列が他の文字列で始まるかどうかを示すブール値を返します。", "kbn-esql-validation-autocomplete.esql.definitions.statsDoc": "受信検索結果セットで、平均、カウント、合計などの集約統計情報を計算します。SQL集約と同様に、statsコマンドをBY句なしで使用した場合は、1行のみが返されます。これは、受信検索結果セット全体に対する集約です。BY句を使用すると、BY句で指定したフィールドの1つの値ごとに1行が返されます。statsコマンドは集約のフィールドのみを返します。statsコマンドではさまざまな統計関数を使用できます。複数の集約を実行するときには、各集約をカンマで区切ります。", "kbn-esql-validation-autocomplete.esql.definitions.stCentroidDoc": "フィールド内の異なる値の数を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.substringDoc": "文字列のサブ文字列を、開始位置とオプションの長さで指定して返します。", "kbn-esql-validation-autocomplete.esql.definitions.sumDoc": "フィールドの値の合計を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.tanDoc": "正接三角関数。", - "kbn-esql-validation-autocomplete.esql.definitions.tanhDoc": "正接双曲線関数。", - "kbn-esql-validation-autocomplete.esql.definitions.tauDoc": "円の円周と半径の比率。", - "kbn-esql-validation-autocomplete.esql.definitions.toBooleanDoc": "ブール値に変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toCartesianPointDoc": "入力値をpoint値に変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toCartesianshapeDoc": "入力値をcartesian_shape値に変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toDateTimeDoc": "日付に変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toDegreesDoc": "度に変換します", - "kbn-esql-validation-autocomplete.esql.definitions.toDoubleDoc": "doubleに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toGeopointDoc": "geo_pointに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toGeoshapeDoc": "入力値をgeo_shape値に変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toIntegerDoc": "整数に変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toIpDoc": "IPに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toLongDoc": "longに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toLowerDoc": "小文字に変換された入力文字列を表す新しい文字列を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.toRadiansDoc": "ラジアンに変換します", - "kbn-esql-validation-autocomplete.esql.definitions.toStringDoc": "文字列に変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toUnsignedLongDoc": "符号なしlongに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.toUpperDoc": "大文字に変換された入力文字列を表す新しい文字列を返します。", - "kbn-esql-validation-autocomplete.esql.definitions.toVersionDoc": "バージョンに変換します。", - "kbn-esql-validation-autocomplete.esql.definitions.trimDoc": "文字列から先頭と末尾の空白を削除します。", "kbn-esql-validation-autocomplete.esql.definitions.whereDoc": "「predicate-expressions」を使用して、検索結果をフィルターします。予測式は評価時にTRUEまたはFALSEを返します。whereコマンドはTRUEに評価される結果のみを返します。たとえば、特定のフィールド値の結果をフィルターします", "kbn-esql-validation-autocomplete.esql.definitions.withDoc": "を使用して", "kbn-esql-validation-autocomplete.esql.quickfix.replaceWithQuote": "引用符を\"（二重引用符）に変更", diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json index 117cbce80da6c..828a4b28e299f 100644 --- a/x-pack/plugins/translations/translations/zh-CN.json +++ b/x-pack/plugins/translations/translations/zh-CN.json @@ -5065,27 +5065,15 @@ "kbn-esql-validation-autocomplete.esql.definition.orDoc": "或", "kbn-esql-validation-autocomplete.esql.definition.rlikeDoc": "根据字符串正则表达式筛选数据", "kbn-esql-validation-autocomplete.esql.definition.subtractDoc": "减 (-)", - "kbn-esql-validation-autocomplete.esql.definitions.absDoc": "返回绝对值。", - "kbn-esql-validation-autocomplete.esql.definitions.acosDoc": "反余弦三角函数", "kbn-esql-validation-autocomplete.esql.definitions.appendSeparatorDoc": "分隔已追加字段的字符。默认为空字符串 (\"\")。", "kbn-esql-validation-autocomplete.esql.definitions.asDoc": "作为", - "kbn-esql-validation-autocomplete.esql.definitions.asinDoc": "反正弦三角函数", - "kbn-esql-validation-autocomplete.esql.definitions.atan2Doc": "笛卡儿平面中正 x 轴与从原点到点 (x , y) 构成的射线之间的角度", - "kbn-esql-validation-autocomplete.esql.definitions.atanDoc": "反正切三角函数", "kbn-esql-validation-autocomplete.esql.definitions.autoBucketDoc": "根据给定范围和存储桶目标自动收集存储桶日期。", "kbn-esql-validation-autocomplete.esql.definitions.avgDoc": "返回字段中的值的平均值", "kbn-esql-validation-autocomplete.esql.definitions.byDoc": "依据", - "kbn-esql-validation-autocomplete.esql.definitions.caseDoc": "接受成对的条件和值。此函数返回属于第一个评估为 `true` 的条件的值。如果参数数量为奇数，则最后一个参数为在无条件匹配时返回的默认值。", "kbn-esql-validation-autocomplete.esql.definitions.ccqAnyDoc": "扩充在任何集群上发生", "kbn-esql-validation-autocomplete.esql.definitions.ccqCoordinatorDoc": "扩充在接收 ES|QL 的协调集群上发生", "kbn-esql-validation-autocomplete.esql.definitions.ccqModeDoc": "跨集群查询模式", "kbn-esql-validation-autocomplete.esql.definitions.ccqRemoteDoc": "扩充在托管目标索引的集群上发生。", - "kbn-esql-validation-autocomplete.esql.definitions.ceilDoc": "将数字四舍五入为最近的整数。", - "kbn-esql-validation-autocomplete.esql.definitions.cidrMatchDoc": "此函数接受的第一个参数应为 IP 类型，后接一个或多个评估为 CIDR 规范的参数。", - "kbn-esql-validation-autocomplete.esql.definitions.coalesceDoc": "返回第一个非 null 值。", - "kbn-esql-validation-autocomplete.esql.definitions.concatDoc": "串联两个或多个字符串。", - "kbn-esql-validation-autocomplete.esql.definitions.cosDoc": "余弦三角函数", - "kbn-esql-validation-autocomplete.esql.definitions.coshDoc": "余弦双曲函数", "kbn-esql-validation-autocomplete.esql.definitions.countDistinctDoc": "返回字段中不同值的计数。", "kbn-esql-validation-autocomplete.esql.definitions.countDoc": "返回字段中的值的计数。", "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.day": "天", @@ -5104,87 +5092,29 @@ "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.weeks": "周（复数）", "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.year": "年", "kbn-esql-validation-autocomplete.esql.definitions.dateDurationDefinition.years": "年（复数）", - "kbn-esql-validation-autocomplete.esql.definitions.dateExtractDoc": "提取日期的某些部分，如年、月、日、小时。支持的字段类型为 java.time.temporal.ChronoField 提供的那些类型", - "kbn-esql-validation-autocomplete.esql.definitions.dateFormatDoc": "以提供的格式返回日期的字符串表示形式。如果未指定格式，则使用“yyyy-MM-dd'T'HH:mm:ss.SSSZ”格式。", - "kbn-esql-validation-autocomplete.esql.definitions.dateParseDoc": "解析字符串中的日期。", - "kbn-esql-validation-autocomplete.esql.definitions.dateTruncDoc": "将日期向下舍入到最近的时间间隔。时间间隔可以用时间跨度文本语法表示。", "kbn-esql-validation-autocomplete.esql.definitions.dissectDoc": "根据模式从单个字符串输入中提取多个字符串值", "kbn-esql-validation-autocomplete.esql.definitions.dropDoc": "丢弃列", - "kbn-esql-validation-autocomplete.esql.definitions.eDoc": "Euler 函数的编号。", - "kbn-esql-validation-autocomplete.esql.definitions.endsWithDoc": "返回布尔值，指示关键字字符串是否以另一个字符串结尾：", "kbn-esql-validation-autocomplete.esql.definitions.enrichDoc": "用其他表来扩充表。在使用扩充之前，您需要创建并执行扩充策略。", "kbn-esql-validation-autocomplete.esql.definitions.evalDoc": "计算表达式并将生成的值置入搜索结果字段。", - "kbn-esql-validation-autocomplete.esql.definitions.floorDoc": "将数字向下舍入到最近的整数。", "kbn-esql-validation-autocomplete.esql.definitions.fromDoc": "从一个或多个数据流、索引或别名中检索数据。在查询或子查询中，必须先使用 from 命令，并且它不需要前导管道符。例如，要从索引中检索数据：", - "kbn-esql-validation-autocomplete.esql.definitions.greatestDoc": "返回许多列中的最大值。", "kbn-esql-validation-autocomplete.esql.definitions.grokDoc": "根据模式从单个字符串输入中提取多个字符串值", "kbn-esql-validation-autocomplete.esql.definitions.keepDoc": "通过在字段中应用 keep 子句重新安排输入表中的字段", - "kbn-esql-validation-autocomplete.esql.definitions.leastDoc": "返回许多列中的最小值。", - "kbn-esql-validation-autocomplete.esql.definitions.leftDoc": "返回从字符串中提取长度字符的子字符串，从左侧开始。", - "kbn-esql-validation-autocomplete.esql.definitions.lengthDoc": "返回字符串的字符长度。", "kbn-esql-validation-autocomplete.esql.definitions.limitDoc": "根据指定的“限制”按搜索顺序返回第一个搜索结果。", - "kbn-esql-validation-autocomplete.esql.definitions.log10Doc": "返回对数底数 10。", - "kbn-esql-validation-autocomplete.esql.definitions.logDoc": "如参数中所指定，标量函数 log(based, value) 返回特定底数的值的对数", - "kbn-esql-validation-autocomplete.esql.definitions.ltrimDoc": "从字符串中移除前导空格。", "kbn-esql-validation-autocomplete.esql.definitions.maxDoc": "返回字段中的最大值。", "kbn-esql-validation-autocomplete.esql.definitions.medianDeviationDoc": "返回每个数据点的中位数与整个样例的中位数的偏差。", "kbn-esql-validation-autocomplete.esql.definitions.medianDoc": "返回 50% 百分位数。", "kbn-esql-validation-autocomplete.esql.definitions.metadataDoc": "元数据", "kbn-esql-validation-autocomplete.esql.definitions.minDoc": "返回字段中的最小值。", - "kbn-esql-validation-autocomplete.esql.definitions.mvAvgDoc": "将多值字段转换为包含所有值的平均值的单值字段。", - "kbn-esql-validation-autocomplete.esql.definitions.mvConcatDoc": "将多值字符串字段转换为单值字段，其中包含由分隔符分隔的所有值的串联形式", - "kbn-esql-validation-autocomplete.esql.definitions.mvCountDoc": "将多值字段转换为包含值计数的单值字段", - "kbn-esql-validation-autocomplete.esql.definitions.mvDedupeDoc": "移除多值字段中的重复项", "kbn-esql-validation-autocomplete.esql.definitions.mvExpandDoc": "将多值字段扩展成每个值一行，从而复制其他字段", - "kbn-esql-validation-autocomplete.esql.definitions.mvFirstDoc": "将多值字段缩减为包含第一个值的单值字段。", - "kbn-esql-validation-autocomplete.esql.definitions.mvLastDoc": "将多值字段缩减为包含最后一个值的单值字段。", - "kbn-esql-validation-autocomplete.esql.definitions.mvMaxDoc": "将多值字段转换为包含最大值的单值字段。", - "kbn-esql-validation-autocomplete.esql.definitions.mvMedianDoc": "将多值字段转换为包含中位数值的单值字段。", - "kbn-esql-validation-autocomplete.esql.definitions.mvMinDoc": "将多值字段转换为包含最小值的单值字段。", - "kbn-esql-validation-autocomplete.esql.definitions.mvSumDoc": "将多值字段转换为包含所有值的总和的单值字段。", - "kbn-esql-validation-autocomplete.esql.definitions.nowDoc": "返回当前日期和时间。", "kbn-esql-validation-autocomplete.esql.definitions.onDoc": "开启", "kbn-esql-validation-autocomplete.esql.definitions.percentiletDoc": "返回字段的第 n 个百分位。", - "kbn-esql-validation-autocomplete.esql.definitions.piDoc": "圆的周长与其直径的比率。", - "kbn-esql-validation-autocomplete.esql.definitions.powDoc": "返回提升为幂（第二个参数）的底数（第一个参数）的值。", "kbn-esql-validation-autocomplete.esql.definitions.renameDoc": "将旧列重命名为新列", - "kbn-esql-validation-autocomplete.esql.definitions.replaceDoc": "此函数将字符串（第 1 个参数）中正则表达式（第 2 个参数）的任何匹配项替换为替代字符串（第 3 个参数）。如果任何参数为 NULL，则结果为 NULL。", - "kbn-esql-validation-autocomplete.esql.definitions.rightDoc": "返回从字符串中提取长度字符的子字符串，从右侧开始。", - "kbn-esql-validation-autocomplete.esql.definitions.roundDoc": "返回四舍五入到小数（由最近的整数值指定）的数字。默认做法是四舍五入到整数。", "kbn-esql-validation-autocomplete.esql.definitions.rowDoc": "生成一个行，其中包含一个或多个含有您指定的值的列。这可以用于测试。", - "kbn-esql-validation-autocomplete.esql.definitions.rtrimDoc": "从字符串中移除尾随空格。", "kbn-esql-validation-autocomplete.esql.definitions.showDoc": "返回有关部署及其功能的信息", - "kbn-esql-validation-autocomplete.esql.definitions.sinDoc": "正弦三角函数。", - "kbn-esql-validation-autocomplete.esql.definitions.sinhDoc": "正弦双曲函数。", "kbn-esql-validation-autocomplete.esql.definitions.sortDoc": "按指定字段对所有结果排序。默认情况下，会将 null 值视为大于任何其他值。使用升序排序顺序时，会最后对 null 值排序，而使用降序排序顺序时，会首先对 null 值排序。您可以通过提供 NULLS FIRST 或 NULLS LAST 来更改该排序", - "kbn-esql-validation-autocomplete.esql.definitions.splitDoc": "将单值字符串拆分成多个字符串。", - "kbn-esql-validation-autocomplete.esql.definitions.sqrtDoc": "返回数字的平方根。", - "kbn-esql-validation-autocomplete.esql.definitions.startsWithDoc": "返回指示关键字字符串是否以另一个字符串开头的布尔值。", "kbn-esql-validation-autocomplete.esql.definitions.statsDoc": "对传入的搜索结果集计算汇总统计信息，如平均值、计数和总和。与 SQL 聚合类似，如果使用不含 BY 子句的 stats 命令，则只返回一行内容，即聚合传入的整个搜索结果集。使用 BY 子句时，将为在 BY 子句中指定的字段中的每个不同值返回一行内容。stats 命令仅返回聚合中的字段，并且您可以将一系列统计函数与 stats 命令搭配在一起使用。执行多个聚合时，请用逗号分隔每个聚合。", "kbn-esql-validation-autocomplete.esql.definitions.stCentroidDoc": "返回字段中不同值的计数。", - "kbn-esql-validation-autocomplete.esql.definitions.substringDoc": "返回字符串的子字符串，用起始位置和可选长度指定。", "kbn-esql-validation-autocomplete.esql.definitions.sumDoc": "返回字段中的值的总和。", - "kbn-esql-validation-autocomplete.esql.definitions.tanDoc": "正切三角函数。", - "kbn-esql-validation-autocomplete.esql.definitions.tanhDoc": "正切双曲函数。", - "kbn-esql-validation-autocomplete.esql.definitions.tauDoc": "圆的圆周长与其半径的比率。", - "kbn-esql-validation-autocomplete.esql.definitions.toBooleanDoc": "转换为布尔值。", - "kbn-esql-validation-autocomplete.esql.definitions.toCartesianPointDoc": "将输入值转换为 `point` 值。", - "kbn-esql-validation-autocomplete.esql.definitions.toCartesianshapeDoc": "将输入值转换为 cartesian_shape 值。", - "kbn-esql-validation-autocomplete.esql.definitions.toDateTimeDoc": "转换为日期。", - "kbn-esql-validation-autocomplete.esql.definitions.toDegreesDoc": "转换为度", - "kbn-esql-validation-autocomplete.esql.definitions.toDoubleDoc": "转换为双精度值。", - "kbn-esql-validation-autocomplete.esql.definitions.toGeopointDoc": "转换为 geo_point。", - "kbn-esql-validation-autocomplete.esql.definitions.toGeoshapeDoc": "将输入值转换为 geo_shape 值。", - "kbn-esql-validation-autocomplete.esql.definitions.toIntegerDoc": "转换为整数。", - "kbn-esql-validation-autocomplete.esql.definitions.toIpDoc": "转换为 IP。", - "kbn-esql-validation-autocomplete.esql.definitions.toLongDoc": "转换为长整型。", - "kbn-esql-validation-autocomplete.esql.definitions.toLowerDoc": "返回一个新字符串，表示已将输入字符串转为小写。", - "kbn-esql-validation-autocomplete.esql.definitions.toRadiansDoc": "转换为弧度", - "kbn-esql-validation-autocomplete.esql.definitions.toStringDoc": "转换为字符串。", - "kbn-esql-validation-autocomplete.esql.definitions.toUnsignedLongDoc": "转换为无符号长整型。", - "kbn-esql-validation-autocomplete.esql.definitions.toUpperDoc": "返回一个新字符串，表示已将输入字符串转为大写。", - "kbn-esql-validation-autocomplete.esql.definitions.toVersionDoc": "转换为版本。", - "kbn-esql-validation-autocomplete.esql.definitions.trimDoc": "从字符串中移除前导和尾随空格。", "kbn-esql-validation-autocomplete.esql.definitions.whereDoc": "使用“predicate-expressions”可筛选搜索结果。进行计算时，谓词表达式将返回 TRUE 或 FALSE。where 命令仅返回计算结果为 TRUE 的结果。例如，筛选特定字段值的结果", "kbn-esql-validation-autocomplete.esql.definitions.withDoc": "具有", "kbn-esql-validation-autocomplete.esql.quickfix.replaceWithQuote": "将引号更改为 \"（双引号）",