[FEATURE] [IMPROVEMENT] PPL Error needs improvement

[Jon-AtAWS]

Is your feature request related to a problem?

I am writing PPL to query an index and just display some fields. If I run

source=moviegeek-logs-*

I see fields like trace_id, method, span_id, index

I can run source=moviegeek-logs-* | fields trace_id, span_id, method and get the expected table.

If I add index: source=moviegeek-logs-* | fields trace_id, span_id, method, index I get the following error in the output panel:

Events: Bad Request, this query is not runnable.

1. Is there something special about the "index" field?
2. A better error message here would be invaluable.

What solution would you like?

Better error messaging around syntax and other problems

What alternatives have you considered?

None

Do you have any additional context?

None

[rafael-gumiero]

Every time I need to understand why it's failing, I need to do it directly via API. This makes it cumbersome to use the Workbench.

Example:
POST /_opendistro/_ppl { "query": """ source=opensearch_dashboards_sample_data_logs | fields host, clientip, response, bytes | where response='503' or response='404' """ }

[Yury-Fridlyand]

Meta fields are not available for querying at the moment. I think your issue is very similar to opensearch-project/sql#639, opensearch-project/sql#432 and opensearch-project/sql#339.

[dai-chen]

There was issue and PR for the second question regarding error message: opendistro-for-elasticsearch/sql#872

But later the changes were reverted for some reason: opensearch-project/sql@5cea8b4

[Jon-AtAWS]

@Yury-Fridlyand "index" in this case was a field on the document, not the meta field.

[rmarops]

I get this issue in query workbench with a simple where condition on a custom metric
source=prometheus.os_index_storage | where size > 200000

i added in the size label above as a duplicate of @value in case there was an issue specific to @value

query works when "| where size > 200000" is removed