diff --git a/packages/kbn-monaco/src/esql/lib/ast/validation/.gitignore b/packages/kbn-monaco/src/esql/lib/ast/validation/.gitignore new file mode 100644 index 0000000000000..2dda2f8187a82 --- /dev/null +++ b/packages/kbn-monaco/src/esql/lib/ast/validation/.gitignore @@ -0,0 +1 @@ +esql_validation_missmatches.json \ No newline at end of file diff --git a/packages/kbn-monaco/src/esql/lib/ast/validation/esql_validation_meta_tests.json b/packages/kbn-monaco/src/esql/lib/ast/validation/esql_validation_meta_tests.json new file mode 100644 index 0000000000000..b279d8b17899e --- /dev/null +++ b/packages/kbn-monaco/src/esql/lib/ast/validation/esql_validation_meta_tests.json @@ -0,0 +1,8362 @@ +{ + "indexes": [ + "a_index", + "index", + "other_index", + ".secret_index", + "my-index", + "unsupported_index" + ], + "fields": [ + { + "name": "numberField", + "type": "number" + }, + { + "name": "dateField", + "type": "date" + }, + { + "name": "booleanField", + "type": "boolean" + }, + { + "name": "ipField", + "type": "ip" + }, + { + "name": "stringField", + "type": "string" + }, + { + "name": "cartesianPointField", + "type": "cartesian_point" + }, + { + "name": "geoPointField", + "type": "geo_point" + }, + { + "name": "any#Char$Field", + "type": "number" + }, + { + "name": "kubernetes.something.something", + "type": "number" + }, + { + "name": "@timestamp", + "type": "date" + }, + { + "name": "otherStringField", + "type": "keyword" + } + ], + "enrichFields": [ + { + "name": "otherField", + "type": "string" + }, + { + "name": "yetAnotherField", + "type": "number" + }, + { + "name": "otherStringField", + "type": "keyword" + } + ], + "policies": [ + { + "name": "policy", + "sourceIndices": [ + "enrich_index" + ], + "matchField": "otherStringField", + "enrichFields": [ + "otherField", + "yetAnotherField" + ] + }, + { + "name": "policy$", + "sourceIndices": [ + "enrich_index" + ], + "matchField": "otherStringField", + "enrichFields": [ + "otherField", + "yetAnotherField" + ] + } + ], + "unsupported_field": [ + { + "name": "unsupported_field", + "type": "unsupported" + } + ], + "testCases": [ + { + "query": "eval", + "error": true + }, + { + "query": "stats", + "error": true + }, + { + "query": "rename", + "error": true + }, + { + "query": "limit", + "error": true + }, + { + "query": "keep", + "error": true + }, + { + "query": "drop", + "error": true + }, + { + "query": "mv_expand", + "error": true + }, + { + "query": "dissect", + "error": true + }, + { + "query": "grok", + "error": true + }, + { + "query": "f", + "error": true + }, + { + "query": "from ", + "error": true + }, + { + "query": "from index,", + "error": true + }, + { + "query": "from assignment = 1", + "error": true + }, + { + "query": "from index", + "error": false + }, + { + "query": "FROM index", + "error": false + }, + { + "query": "FrOm index", + "error": false + }, + { + "query": "from `index`", + "error": false + }, + { + "query": "from index, other_index", + "error": false + }, + { + "query": "from index, missingIndex", + "error": true + }, + { + "query": "from fn()", + "error": true + }, + { + "query": "from average()", + "error": true + }, + { + "query": "from index [METADATA _id]", + "error": false + }, + { + "query": "from index [metadata _id]", + "error": false + }, + { + "query": "from index [METADATA _id, _source]", + "error": false + }, + { + "query": "from index [METADATA _id, _source2]", + "error": true + }, + { + "query": "from index [metadata _id, _source] [METADATA _id2]", + "error": true + }, + { + "query": "from remote-ccs:indexes [METADATA _id]", + "error": false + }, + { + "query": "from *:indexes [METADATA _id]", + "error": false + }, + { + "query": "from index METADATA _id", + "error": false + }, + { + "query": "from index metadata _id", + "error": false + }, + { + "query": "from index METADATA _id, _source", + "error": false + }, + { + "query": "from index METADATA _id, _source2", + "error": true + }, + { + "query": "from index metadata _id, _source METADATA _id2", + "error": true + }, + { + "query": "from remote-ccs:indexes METADATA _id", + "error": false + }, + { + "query": "from *:indexes METADATA _id", + "error": false + }, + { + "query": "from index (metadata _id)", + "error": true + }, + { + "query": "from ind*, other*", + "error": false + }, + { + "query": "from index*", + "error": false + }, + { + "query": "from *ex", + "error": false + }, + { + "query": "from in*ex", + "error": false + }, + { + "query": "from ind*ex", + "error": false + }, + { + "query": "from indexes*", + "error": true + }, + { + "query": "from remote-*:indexes*", + "error": false + }, + { + "query": "from remote-*:indexes", + "error": false + }, + { + "query": "from remote-ccs:indexes", + "error": false + }, + { + "query": "from a_index, remote-ccs:indexes", + "error": false + }, + { + "query": "from .secret_index", + "error": false + }, + { + "query": "from my-index", + "error": false + }, + { + "query": "from numberField", + "error": true + }, + { + "query": "from policy", + "error": true + }, + { + "query": "row", + "error": true + }, + { + "query": "row missing_column", + "error": true + }, + { + "query": "row fn()", + "error": true + }, + { + "query": "row missing_column, missing_column2", + "error": true + }, + { + "query": "row a=1", + "error": false + }, + { + "query": "row a=1, missing_column", + "error": true + }, + { + "query": "row a=1, b = average()", + "error": true + }, + { + "query": "row a = [1, 2, 3]", + "error": false + }, + { + "query": "row a = [true, false]", + "error": false + }, + { + "query": "row a = [\"a\", \"b\"]", + "error": false + }, + { + "query": "row a = null", + "error": false + }, + { + "query": "row a = (1)", + "error": false + }, + { + "query": "row a = (1, 2, 3)", + "error": true + }, + { + "query": "row a=NOT true", + "error": false + }, + { + "query": "row NOT true", + "error": false + }, + { + "query": "row a=NOT false", + "error": false + }, + { + "query": "row NOT false", + "error": false + }, + { + "query": "row var = 1 in ", + "error": true + }, + { + "query": "row var = 1 in (", + "error": true + }, + { + "query": "row var = 1 not in ", + "error": true + }, + { + "query": "row var = 1 in (1, 2, 3)", + "error": false + }, + { + "query": "row var = 5 in (1, 2, 3)", + "error": false + }, + { + "query": "row var = 5 not in (1, 2, 3)", + "error": false + }, + { + "query": "row var = 1 in (1, 2, 3, round(5))", + "error": false + }, + { + "query": "row var = \"a\" in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "row var = \"a\" in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "row var = \"a\" not in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "row var = 1 in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "row var = 5 in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "row var = 5 not in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "row var = 5 not in (1, 2, 3, \"a\")", + "error": true + }, + { + "query": "row var = abs(5)", + "error": false + }, + { + "query": "row abs(5)", + "error": false + }, + { + "query": "row var = abs(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = abs(\"a\")", + "error": true + }, + { + "query": "row var = acos(5)", + "error": false + }, + { + "query": "row acos(5)", + "error": false + }, + { + "query": "row var = acos(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = acos(\"a\")", + "error": true + }, + { + "query": "row var = asin(5)", + "error": false + }, + { + "query": "row asin(5)", + "error": false + }, + { + "query": "row var = asin(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = asin(\"a\")", + "error": true + }, + { + "query": "row var = atan(5)", + "error": false + }, + { + "query": "row atan(5)", + "error": false + }, + { + "query": "row var = atan(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = atan(\"a\")", + "error": true + }, + { + "query": "row var = atan2(5, 5)", + "error": false + }, + { + "query": "row atan2(5, 5)", + "error": false + }, + { + "query": "row var = atan2(to_integer(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = atan2(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = auto_bucket(now(), 5, \"a\", \"a\")", + "error": false + }, + { + "query": "row auto_bucket(now(), 5, \"a\", \"a\")", + "error": false + }, + { + "query": "row var = auto_bucket(now(), 5, 5, 5)", + "error": false + }, + { + "query": "row auto_bucket(now(), 5, 5, 5)", + "error": false + }, + { + "query": "row var = case(true, \"a\")", + "error": false + }, + { + "query": "row case(true, \"a\")", + "error": false + }, + { + "query": "row var = ceil(5)", + "error": false + }, + { + "query": "row ceil(5)", + "error": false + }, + { + "query": "row var = ceil(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = ceil(\"a\")", + "error": true + }, + { + "query": "row var = cidr_match(to_ip(\"127.0.0.1\"), \"a\")", + "error": false + }, + { + "query": "row cidr_match(to_ip(\"127.0.0.1\"), \"a\")", + "error": false + }, + { + "query": "row var = cidr_match(to_ip(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = cidr_match(\"a\", 5)", + "error": true + }, + { + "query": "row var = coalesce(\"a\")", + "error": false + }, + { + "query": "row coalesce(\"a\")", + "error": false + }, + { + "query": "row var = concat(\"a\")", + "error": false + }, + { + "query": "row concat(\"a\")", + "error": false + }, + { + "query": "row var = concat(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = concat(5)", + "error": true + }, + { + "query": "row var = cos(5)", + "error": false + }, + { + "query": "row cos(5)", + "error": false + }, + { + "query": "row var = cos(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = cos(\"a\")", + "error": true + }, + { + "query": "row var = cosh(5)", + "error": false + }, + { + "query": "row cosh(5)", + "error": false + }, + { + "query": "row var = cosh(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = cosh(\"a\")", + "error": true + }, + { + "query": "row var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", now())", + "error": false + }, + { + "query": "row date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", now())", + "error": false + }, + { + "query": "row var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(\"a\"))", + "error": false + }, + { + "query": "row var = date_extract(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = date_format(now(), \"a\")", + "error": false + }, + { + "query": "row date_format(now(), \"a\")", + "error": false + }, + { + "query": "row var = date_format(to_datetime(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = date_format(\"a\", 5)", + "error": true + }, + { + "query": "row var = date_parse(\"a\", \"a\")", + "error": false + }, + { + "query": "row date_parse(\"a\", \"a\")", + "error": false + }, + { + "query": "row var = date_parse(to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = date_parse(5, 5)", + "error": true + }, + { + "query": "row var = date_trunc(1 year, now())", + "error": false + }, + { + "query": "row date_trunc(1 year, now())", + "error": false + }, + { + "query": "row var = date_trunc(1 year, to_datetime(\"a\"))", + "error": false + }, + { + "query": "row var = date_trunc(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = e()", + "error": false + }, + { + "query": "row e()", + "error": false + }, + { + "query": "row var = e()", + "error": false + }, + { + "query": "row var = e()", + "error": false + }, + { + "query": "row var = ends_with(\"a\", \"a\")", + "error": false + }, + { + "query": "row ends_with(\"a\", \"a\")", + "error": false + }, + { + "query": "row var = ends_with(to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = ends_with(5, 5)", + "error": true + }, + { + "query": "row var = floor(5)", + "error": false + }, + { + "query": "row floor(5)", + "error": false + }, + { + "query": "row var = floor(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = floor(\"a\")", + "error": true + }, + { + "query": "row var = greatest(\"a\")", + "error": false + }, + { + "query": "row greatest(\"a\")", + "error": false + }, + { + "query": "row var = least(\"a\")", + "error": false + }, + { + "query": "row least(\"a\")", + "error": false + }, + { + "query": "row var = left(\"a\", 5)", + "error": false + }, + { + "query": "row left(\"a\", 5)", + "error": false + }, + { + "query": "row var = left(to_string(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = left(5, \"a\")", + "error": true + }, + { + "query": "row var = length(\"a\")", + "error": false + }, + { + "query": "row length(\"a\")", + "error": false + }, + { + "query": "row var = length(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = length(5)", + "error": true + }, + { + "query": "row var = log(5, 5)", + "error": false + }, + { + "query": "row log(5, 5)", + "error": false + }, + { + "query": "row var = log(to_integer(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = log(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = log10(5)", + "error": false + }, + { + "query": "row log10(5)", + "error": false + }, + { + "query": "row var = log10(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = log10(\"a\")", + "error": true + }, + { + "query": "row var = ltrim(\"a\")", + "error": false + }, + { + "query": "row ltrim(\"a\")", + "error": false + }, + { + "query": "row var = ltrim(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = ltrim(5)", + "error": true + }, + { + "query": "row var = mv_avg(5)", + "error": false + }, + { + "query": "row mv_avg(5)", + "error": false + }, + { + "query": "row var = mv_avg(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = mv_avg(\"a\")", + "error": true + }, + { + "query": "row var = mv_concat(\"a\", \"a\")", + "error": false + }, + { + "query": "row mv_concat(\"a\", \"a\")", + "error": false + }, + { + "query": "row var = mv_concat(to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = mv_concat(5, 5)", + "error": true + }, + { + "query": "row var = mv_count(\"a\")", + "error": false + }, + { + "query": "row mv_count(\"a\")", + "error": false + }, + { + "query": "row var = mv_dedupe(\"a\")", + "error": false + }, + { + "query": "row mv_dedupe(\"a\")", + "error": false + }, + { + "query": "row var = mv_first(\"a\")", + "error": false + }, + { + "query": "row mv_first(\"a\")", + "error": false + }, + { + "query": "row var = mv_last(\"a\")", + "error": false + }, + { + "query": "row mv_last(\"a\")", + "error": false + }, + { + "query": "row var = mv_max(\"a\")", + "error": false + }, + { + "query": "row mv_max(\"a\")", + "error": false + }, + { + "query": "row var = mv_median(5)", + "error": false + }, + { + "query": "row mv_median(5)", + "error": false + }, + { + "query": "row var = mv_median(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = mv_median(\"a\")", + "error": true + }, + { + "query": "row var = mv_min(\"a\")", + "error": false + }, + { + "query": "row mv_min(\"a\")", + "error": false + }, + { + "query": "row var = mv_sum(5)", + "error": false + }, + { + "query": "row mv_sum(5)", + "error": false + }, + { + "query": "row var = mv_sum(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = mv_sum(\"a\")", + "error": true + }, + { + "query": "row var = now()", + "error": false + }, + { + "query": "row now()", + "error": false + }, + { + "query": "row var = now()", + "error": false + }, + { + "query": "row var = now()", + "error": false + }, + { + "query": "row var = pi()", + "error": false + }, + { + "query": "row pi()", + "error": false + }, + { + "query": "row var = pi()", + "error": false + }, + { + "query": "row var = pi()", + "error": false + }, + { + "query": "row var = pow(5, 5)", + "error": false + }, + { + "query": "row pow(5, 5)", + "error": false + }, + { + "query": "row var = pow(to_integer(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = pow(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = replace(\"a\", \"a\", \"a\")", + "error": false + }, + { + "query": "row replace(\"a\", \"a\", \"a\")", + "error": false + }, + { + "query": "row var = replace(to_string(\"a\"), to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = replace(5, 5, 5)", + "error": true + }, + { + "query": "row var = right(\"a\", 5)", + "error": false + }, + { + "query": "row right(\"a\", 5)", + "error": false + }, + { + "query": "row var = right(to_string(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = right(5, \"a\")", + "error": true + }, + { + "query": "row var = round(5, 5)", + "error": false + }, + { + "query": "row round(5, 5)", + "error": false + }, + { + "query": "row var = round(to_integer(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = round(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = rtrim(\"a\")", + "error": false + }, + { + "query": "row rtrim(\"a\")", + "error": false + }, + { + "query": "row var = rtrim(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = rtrim(5)", + "error": true + }, + { + "query": "row var = sin(5)", + "error": false + }, + { + "query": "row sin(5)", + "error": false + }, + { + "query": "row var = sin(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = sin(\"a\")", + "error": true + }, + { + "query": "row var = sinh(5)", + "error": false + }, + { + "query": "row sinh(5)", + "error": false + }, + { + "query": "row var = sinh(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = sinh(\"a\")", + "error": true + }, + { + "query": "row var = split(\"a\", \"a\")", + "error": false + }, + { + "query": "row split(\"a\", \"a\")", + "error": false + }, + { + "query": "row var = split(to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = split(5, 5)", + "error": true + }, + { + "query": "row var = sqrt(5)", + "error": false + }, + { + "query": "row sqrt(5)", + "error": false + }, + { + "query": "row var = sqrt(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = sqrt(\"a\")", + "error": true + }, + { + "query": "row var = starts_with(\"a\", \"a\")", + "error": false + }, + { + "query": "row starts_with(\"a\", \"a\")", + "error": false + }, + { + "query": "row var = starts_with(to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = starts_with(5, 5)", + "error": true + }, + { + "query": "row var = substring(\"a\", 5, 5)", + "error": false + }, + { + "query": "row substring(\"a\", 5, 5)", + "error": false + }, + { + "query": "row var = substring(to_string(\"a\"), to_integer(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = substring(5, \"a\", \"a\")", + "error": true + }, + { + "query": "row var = tan(5)", + "error": false + }, + { + "query": "row tan(5)", + "error": false + }, + { + "query": "row var = tan(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = tan(\"a\")", + "error": true + }, + { + "query": "row var = tanh(5)", + "error": false + }, + { + "query": "row tanh(5)", + "error": false + }, + { + "query": "row var = tanh(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = tanh(\"a\")", + "error": true + }, + { + "query": "row var = tau()", + "error": false + }, + { + "query": "row tau()", + "error": false + }, + { + "query": "row var = tau()", + "error": false + }, + { + "query": "row var = tau()", + "error": false + }, + { + "query": "row var = to_boolean(\"a\")", + "error": false + }, + { + "query": "row to_boolean(\"a\")", + "error": false + }, + { + "query": "row var = to_bool(\"a\")", + "error": false + }, + { + "query": "row var = to_cartesianpoint(\"a\")", + "error": false + }, + { + "query": "row to_cartesianpoint(\"a\")", + "error": false + }, + { + "query": "row var = to_cartesianshape(\"a\")", + "error": false + }, + { + "query": "row to_cartesianshape(\"a\")", + "error": false + }, + { + "query": "row var = to_datetime(\"a\")", + "error": false + }, + { + "query": "row to_datetime(\"a\")", + "error": false + }, + { + "query": "row var = to_dt(\"a\")", + "error": false + }, + { + "query": "row var = to_degrees(5)", + "error": false + }, + { + "query": "row to_degrees(5)", + "error": false + }, + { + "query": "row var = to_degrees(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = to_degrees(\"a\")", + "error": true + }, + { + "query": "row var = to_double(\"a\")", + "error": false + }, + { + "query": "row to_double(\"a\")", + "error": false + }, + { + "query": "row var = to_dbl(\"a\")", + "error": false + }, + { + "query": "row var = to_geopoint(\"a\")", + "error": false + }, + { + "query": "row to_geopoint(\"a\")", + "error": false + }, + { + "query": "row var = to_geoshape(\"a\")", + "error": false + }, + { + "query": "row to_geoshape(\"a\")", + "error": false + }, + { + "query": "row var = to_integer(\"a\")", + "error": false + }, + { + "query": "row to_integer(\"a\")", + "error": false + }, + { + "query": "row var = to_int(\"a\")", + "error": false + }, + { + "query": "row var = to_ip(\"a\")", + "error": false + }, + { + "query": "row to_ip(\"a\")", + "error": false + }, + { + "query": "row var = to_long(\"a\")", + "error": false + }, + { + "query": "row to_long(\"a\")", + "error": false + }, + { + "query": "row var = to_lower(\"a\")", + "error": false + }, + { + "query": "row to_lower(\"a\")", + "error": false + }, + { + "query": "row var = to_lower(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = to_lower(5)", + "error": true + }, + { + "query": "row var = to_radians(5)", + "error": false + }, + { + "query": "row to_radians(5)", + "error": false + }, + { + "query": "row var = to_radians(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = to_radians(\"a\")", + "error": true + }, + { + "query": "row var = to_string(\"a\")", + "error": false + }, + { + "query": "row to_string(\"a\")", + "error": false + }, + { + "query": "row var = to_str(\"a\")", + "error": false + }, + { + "query": "row var = to_unsigned_long(\"a\")", + "error": false + }, + { + "query": "row to_unsigned_long(\"a\")", + "error": false + }, + { + "query": "row var = to_ul(\"a\")", + "error": false + }, + { + "query": "row var = to_ulong(\"a\")", + "error": false + }, + { + "query": "row var = to_upper(\"a\")", + "error": false + }, + { + "query": "row to_upper(\"a\")", + "error": false + }, + { + "query": "row var = to_upper(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = to_upper(5)", + "error": true + }, + { + "query": "row var = to_version(\"a\")", + "error": false + }, + { + "query": "row to_version(\"a\")", + "error": false + }, + { + "query": "row var = to_ver(\"a\")", + "error": false + }, + { + "query": "row var = to_version(\"a\")", + "error": false + }, + { + "query": "row to_version(\"a\")", + "error": false + }, + { + "query": "row var = to_ver(\"a\")", + "error": false + }, + { + "query": "row var = trim(\"a\")", + "error": false + }, + { + "query": "row trim(\"a\")", + "error": false + }, + { + "query": "row var = trim(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = trim(5)", + "error": true + }, + { + "query": "row var = 5 > 0", + "error": false + }, + { + "query": "row var = NOT 5 > 0", + "error": false + }, + { + "query": "row var = (numberField > 0)", + "error": true + }, + { + "query": "row var = (NOT (5 > 0))", + "error": false + }, + { + "query": "row var = \"a\" > 0", + "error": true + }, + { + "query": "row var = 5 >= 0", + "error": false + }, + { + "query": "row var = NOT 5 >= 0", + "error": false + }, + { + "query": "row var = (numberField >= 0)", + "error": true + }, + { + "query": "row var = (NOT (5 >= 0))", + "error": false + }, + { + "query": "row var = \"a\" >= 0", + "error": true + }, + { + "query": "row var = 5 < 0", + "error": false + }, + { + "query": "row var = NOT 5 < 0", + "error": false + }, + { + "query": "row var = (numberField < 0)", + "error": true + }, + { + "query": "row var = (NOT (5 < 0))", + "error": false + }, + { + "query": "row var = \"a\" < 0", + "error": true + }, + { + "query": "row var = 5 <= 0", + "error": false + }, + { + "query": "row var = NOT 5 <= 0", + "error": false + }, + { + "query": "row var = (numberField <= 0)", + "error": true + }, + { + "query": "row var = (NOT (5 <= 0))", + "error": false + }, + { + "query": "row var = \"a\" <= 0", + "error": true + }, + { + "query": "row var = 5 == 0", + "error": false + }, + { + "query": "row var = NOT 5 == 0", + "error": false + }, + { + "query": "row var = (numberField == 0)", + "error": true + }, + { + "query": "row var = (NOT (5 == 0))", + "error": false + }, + { + "query": "row var = \"a\" == 0", + "error": true + }, + { + "query": "row var = 1 + 1", + "error": false + }, + { + "query": "row var = (5 + 1)", + "error": false + }, + { + "query": "row var = 1 - 1", + "error": false + }, + { + "query": "row var = (5 - 1)", + "error": false + }, + { + "query": "row var = 1 * 1", + "error": false + }, + { + "query": "row var = (5 * 1)", + "error": false + }, + { + "query": "row var = 1 / 1", + "error": false + }, + { + "query": "row var = (5 / 1)", + "error": false + }, + { + "query": "row var = 1 % 1", + "error": false + }, + { + "query": "row var = (5 % 1)", + "error": false + }, + { + "query": "row var = \"a\" like \"?a\"", + "error": false + }, + { + "query": "row var = \"a\" NOT like \"?a\"", + "error": false + }, + { + "query": "row var = NOT \"a\" like \"?a\"", + "error": false + }, + { + "query": "row var = NOT \"a\" NOT like \"?a\"", + "error": false + }, + { + "query": "row var = 5 like \"?a\"", + "error": true + }, + { + "query": "row var = 5 NOT like \"?a\"", + "error": true + }, + { + "query": "row var = NOT 5 like \"?a\"", + "error": true + }, + { + "query": "row var = NOT 5 NOT like \"?a\"", + "error": true + }, + { + "query": "row var = \"a\" rlike \"?a\"", + "error": false + }, + { + "query": "row var = \"a\" NOT rlike \"?a\"", + "error": false + }, + { + "query": "row var = NOT \"a\" rlike \"?a\"", + "error": false + }, + { + "query": "row var = NOT \"a\" NOT rlike \"?a\"", + "error": false + }, + { + "query": "row var = 5 rlike \"?a\"", + "error": true + }, + { + "query": "row var = 5 NOT rlike \"?a\"", + "error": true + }, + { + "query": "row var = NOT 5 rlike \"?a\"", + "error": true + }, + { + "query": "row var = NOT 5 NOT rlike \"?a\"", + "error": true + }, + { + "query": "row 1 anno", + "error": true + }, + { + "query": "row var = 1 anno", + "error": true + }, + { + "query": "row now() + 1 anno", + "error": true + }, + { + "query": "row 1 year", + "error": true + }, + { + "query": "row 1 year", + "error": true + }, + { + "query": "row var = now() - 1 year", + "error": false + }, + { + "query": "row var = now() - 1 YEAR", + "error": false + }, + { + "query": "row var = now() - 1 Year", + "error": false + }, + { + "query": "row var = now() + 1 year", + "error": false + }, + { + "query": "row 1 year + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 year", + "error": true + }, + { + "query": "row var = now() / 1 year", + "error": true + }, + { + "query": "row var = now() % 1 year", + "error": true + }, + { + "query": "row 1 years", + "error": true + }, + { + "query": "row 1 years", + "error": true + }, + { + "query": "row var = now() - 1 years", + "error": false + }, + { + "query": "row var = now() - 1 YEARS", + "error": false + }, + { + "query": "row var = now() - 1 Years", + "error": false + }, + { + "query": "row var = now() + 1 years", + "error": false + }, + { + "query": "row 1 years + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 years", + "error": true + }, + { + "query": "row var = now() / 1 years", + "error": true + }, + { + "query": "row var = now() % 1 years", + "error": true + }, + { + "query": "row 1 month", + "error": true + }, + { + "query": "row 1 month", + "error": true + }, + { + "query": "row var = now() - 1 month", + "error": false + }, + { + "query": "row var = now() - 1 MONTH", + "error": false + }, + { + "query": "row var = now() - 1 Month", + "error": false + }, + { + "query": "row var = now() + 1 month", + "error": false + }, + { + "query": "row 1 month + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 month", + "error": true + }, + { + "query": "row var = now() / 1 month", + "error": true + }, + { + "query": "row var = now() % 1 month", + "error": true + }, + { + "query": "row 1 months", + "error": true + }, + { + "query": "row 1 months", + "error": true + }, + { + "query": "row var = now() - 1 months", + "error": false + }, + { + "query": "row var = now() - 1 MONTHS", + "error": false + }, + { + "query": "row var = now() - 1 Months", + "error": false + }, + { + "query": "row var = now() + 1 months", + "error": false + }, + { + "query": "row 1 months + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 months", + "error": true + }, + { + "query": "row var = now() / 1 months", + "error": true + }, + { + "query": "row var = now() % 1 months", + "error": true + }, + { + "query": "row 1 week", + "error": true + }, + { + "query": "row 1 week", + "error": true + }, + { + "query": "row var = now() - 1 week", + "error": false + }, + { + "query": "row var = now() - 1 WEEK", + "error": false + }, + { + "query": "row var = now() - 1 Week", + "error": false + }, + { + "query": "row var = now() + 1 week", + "error": false + }, + { + "query": "row 1 week + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 week", + "error": true + }, + { + "query": "row var = now() / 1 week", + "error": true + }, + { + "query": "row var = now() % 1 week", + "error": true + }, + { + "query": "row 1 weeks", + "error": true + }, + { + "query": "row 1 weeks", + "error": true + }, + { + "query": "row var = now() - 1 weeks", + "error": false + }, + { + "query": "row var = now() - 1 WEEKS", + "error": false + }, + { + "query": "row var = now() - 1 Weeks", + "error": false + }, + { + "query": "row var = now() + 1 weeks", + "error": false + }, + { + "query": "row 1 weeks + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 weeks", + "error": true + }, + { + "query": "row var = now() / 1 weeks", + "error": true + }, + { + "query": "row var = now() % 1 weeks", + "error": true + }, + { + "query": "row 1 day", + "error": true + }, + { + "query": "row 1 day", + "error": true + }, + { + "query": "row var = now() - 1 day", + "error": false + }, + { + "query": "row var = now() - 1 DAY", + "error": false + }, + { + "query": "row var = now() - 1 Day", + "error": false + }, + { + "query": "row var = now() + 1 day", + "error": false + }, + { + "query": "row 1 day + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 day", + "error": true + }, + { + "query": "row var = now() / 1 day", + "error": true + }, + { + "query": "row var = now() % 1 day", + "error": true + }, + { + "query": "row 1 days", + "error": true + }, + { + "query": "row 1 days", + "error": true + }, + { + "query": "row var = now() - 1 days", + "error": false + }, + { + "query": "row var = now() - 1 DAYS", + "error": false + }, + { + "query": "row var = now() - 1 Days", + "error": false + }, + { + "query": "row var = now() + 1 days", + "error": false + }, + { + "query": "row 1 days + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 days", + "error": true + }, + { + "query": "row var = now() / 1 days", + "error": true + }, + { + "query": "row var = now() % 1 days", + "error": true + }, + { + "query": "row 1 hour", + "error": true + }, + { + "query": "row 1 hour", + "error": true + }, + { + "query": "row var = now() - 1 hour", + "error": false + }, + { + "query": "row var = now() - 1 HOUR", + "error": false + }, + { + "query": "row var = now() - 1 Hour", + "error": false + }, + { + "query": "row var = now() + 1 hour", + "error": false + }, + { + "query": "row 1 hour + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 hour", + "error": true + }, + { + "query": "row var = now() / 1 hour", + "error": true + }, + { + "query": "row var = now() % 1 hour", + "error": true + }, + { + "query": "row 1 hours", + "error": true + }, + { + "query": "row 1 hours", + "error": true + }, + { + "query": "row var = now() - 1 hours", + "error": false + }, + { + "query": "row var = now() - 1 HOURS", + "error": false + }, + { + "query": "row var = now() - 1 Hours", + "error": false + }, + { + "query": "row var = now() + 1 hours", + "error": false + }, + { + "query": "row 1 hours + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 hours", + "error": true + }, + { + "query": "row var = now() / 1 hours", + "error": true + }, + { + "query": "row var = now() % 1 hours", + "error": true + }, + { + "query": "row 1 minute", + "error": true + }, + { + "query": "row 1 minute", + "error": true + }, + { + "query": "row var = now() - 1 minute", + "error": false + }, + { + "query": "row var = now() - 1 MINUTE", + "error": false + }, + { + "query": "row var = now() - 1 Minute", + "error": false + }, + { + "query": "row var = now() + 1 minute", + "error": false + }, + { + "query": "row 1 minute + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 minute", + "error": true + }, + { + "query": "row var = now() / 1 minute", + "error": true + }, + { + "query": "row var = now() % 1 minute", + "error": true + }, + { + "query": "row 1 minutes", + "error": true + }, + { + "query": "row 1 minutes", + "error": true + }, + { + "query": "row var = now() - 1 minutes", + "error": false + }, + { + "query": "row var = now() - 1 MINUTES", + "error": false + }, + { + "query": "row var = now() - 1 Minutes", + "error": false + }, + { + "query": "row var = now() + 1 minutes", + "error": false + }, + { + "query": "row 1 minutes + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 minutes", + "error": true + }, + { + "query": "row var = now() / 1 minutes", + "error": true + }, + { + "query": "row var = now() % 1 minutes", + "error": true + }, + { + "query": "row 1 second", + "error": true + }, + { + "query": "row 1 second", + "error": true + }, + { + "query": "row var = now() - 1 second", + "error": false + }, + { + "query": "row var = now() - 1 SECOND", + "error": false + }, + { + "query": "row var = now() - 1 Second", + "error": false + }, + { + "query": "row var = now() + 1 second", + "error": false + }, + { + "query": "row 1 second + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 second", + "error": true + }, + { + "query": "row var = now() / 1 second", + "error": true + }, + { + "query": "row var = now() % 1 second", + "error": true + }, + { + "query": "row 1 seconds", + "error": true + }, + { + "query": "row 1 seconds", + "error": true + }, + { + "query": "row var = now() - 1 seconds", + "error": false + }, + { + "query": "row var = now() - 1 SECONDS", + "error": false + }, + { + "query": "row var = now() - 1 Seconds", + "error": false + }, + { + "query": "row var = now() + 1 seconds", + "error": false + }, + { + "query": "row 1 seconds + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 seconds", + "error": true + }, + { + "query": "row var = now() / 1 seconds", + "error": true + }, + { + "query": "row var = now() % 1 seconds", + "error": true + }, + { + "query": "row 1 millisecond", + "error": true + }, + { + "query": "row 1 millisecond", + "error": true + }, + { + "query": "row var = now() - 1 millisecond", + "error": false + }, + { + "query": "row var = now() - 1 MILLISECOND", + "error": false + }, + { + "query": "row var = now() - 1 Millisecond", + "error": false + }, + { + "query": "row var = now() + 1 millisecond", + "error": false + }, + { + "query": "row 1 millisecond + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 millisecond", + "error": true + }, + { + "query": "row var = now() / 1 millisecond", + "error": true + }, + { + "query": "row var = now() % 1 millisecond", + "error": true + }, + { + "query": "row 1 milliseconds", + "error": true + }, + { + "query": "row 1 milliseconds", + "error": true + }, + { + "query": "row var = now() - 1 milliseconds", + "error": false + }, + { + "query": "row var = now() - 1 MILLISECONDS", + "error": false + }, + { + "query": "row var = now() - 1 Milliseconds", + "error": false + }, + { + "query": "row var = now() + 1 milliseconds", + "error": false + }, + { + "query": "row 1 milliseconds + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 milliseconds", + "error": true + }, + { + "query": "row var = now() / 1 milliseconds", + "error": true + }, + { + "query": "row var = now() % 1 milliseconds", + "error": true + }, + { + "query": "show", + "error": true + }, + { + "query": "show functions", + "error": false + }, + { + "query": "show info", + "error": false + }, + { + "query": "show functions()", + "error": true + }, + { + "query": "show functions blah", + "error": true + }, + { + "query": "show numberField", + "error": true + }, + { + "query": "from index | limit ", + "error": true + }, + { + "query": "from index | limit 4 ", + "error": false + }, + { + "query": "from index | limit 4.5", + "error": true + }, + { + "query": "from index | limit a", + "error": true + }, + { + "query": "from index | limit numberField", + "error": true + }, + { + "query": "from index | limit stringField", + "error": true + }, + { + "query": "from index | limit 4", + "error": false + }, + { + "query": "from index | keep ", + "error": true + }, + { + "query": "from index | keep stringField, numberField, dateField", + "error": false + }, + { + "query": "from index | keep `stringField`, `numberField`, `dateField`", + "error": false + }, + { + "query": "from index | keep 4.5", + "error": true + }, + { + "query": "from index | keep `4.5`", + "error": true + }, + { + "query": "from index | keep missingField, numberField, dateField", + "error": true + }, + { + "query": "from index | keep `any#Char$Field`", + "error": false + }, + { + "query": "from index | project ", + "error": true + }, + { + "query": "from index | project stringField, numberField, dateField", + "error": true + }, + { + "query": "from index | PROJECT stringField, numberField, dateField", + "error": true + }, + { + "query": "from index | project missingField, numberField, dateField", + "error": true + }, + { + "query": "from index | keep s*", + "error": false + }, + { + "query": "from index | keep *Field", + "error": false + }, + { + "query": "from index | keep s*Field", + "error": false + }, + { + "query": "from index | keep string*Field", + "error": false + }, + { + "query": "from index | keep s*, n*", + "error": false + }, + { + "query": "from index | keep m*", + "error": true + }, + { + "query": "from index | keep *m", + "error": true + }, + { + "query": "from index | keep d*m", + "error": true + }, + { + "query": "from unsupported_index | keep unsupported_field", + "error": false + }, + { + "query": "FROM index | STATS ROUND(AVG(numberField * 1.5)), COUNT(*), MIN(numberField * 10) | KEEP `MIN(numberField * 10)`", + "error": false + }, + { + "query": "FROM index | STATS COUNT(*), MIN(numberField * 10), MAX(numberField)| KEEP `COUNT(*)`", + "error": false + }, + { + "query": "from index | drop ", + "error": true + }, + { + "query": "from index | drop stringField, numberField, dateField", + "error": false + }, + { + "query": "from index | drop 4.5", + "error": true + }, + { + "query": "from index | drop missingField, numberField, dateField", + "error": true + }, + { + "query": "from index | drop `any#Char$Field`", + "error": false + }, + { + "query": "from index | drop s*", + "error": false + }, + { + "query": "from index | drop *Field", + "error": false + }, + { + "query": "from index | drop s*Field", + "error": false + }, + { + "query": "from index | drop string*Field", + "error": false + }, + { + "query": "from index | drop s*, n*", + "error": false + }, + { + "query": "from index | drop m*", + "error": true + }, + { + "query": "from index | drop *m", + "error": true + }, + { + "query": "from index | drop d*m", + "error": true + }, + { + "query": "from index | drop *", + "error": true + }, + { + "query": "from index | drop stringField, *", + "error": true + }, + { + "query": "from index | drop @timestamp", + "error": false + }, + { + "query": "from index | drop stringField, @timestamp", + "error": false + }, + { + "query": "FROM index | STATS ROUND(AVG(numberField * 1.5)), COUNT(*), MIN(numberField * 10) | DROP `MIN(numberField * 10)`", + "error": false + }, + { + "query": "FROM index | STATS COUNT(*), MIN(numberField * 10), MAX(numberField)| DROP `COUNT(*)`", + "error": false + }, + { + "query": "from a_index | mv_expand ", + "error": true + }, + { + "query": "from a_index | mv_expand stringField", + "error": false + }, + { + "query": "from a_index | mv_expand numberField", + "error": false + }, + { + "query": "from a_index | mv_expand dateField", + "error": false + }, + { + "query": "from a_index | mv_expand booleanField", + "error": false + }, + { + "query": "from a_index | mv_expand ipField", + "error": false + }, + { + "query": "from a_index | mv_expand numberField, b", + "error": true + }, + { + "query": "row a = \"a\" | mv_expand a", + "error": false + }, + { + "query": "row a = [1, 2, 3] | mv_expand a", + "error": false + }, + { + "query": "row a = [true, false] | mv_expand a", + "error": false + }, + { + "query": "row a = [\"a\", \"b\"] | mv_expand a", + "error": false + }, + { + "query": "from a_index | rename", + "error": true + }, + { + "query": "from a_index | rename stringField", + "error": true + }, + { + "query": "from a_index | rename a", + "error": true + }, + { + "query": "from a_index | rename stringField as", + "error": true + }, + { + "query": "from a_index | rename missingField as", + "error": true + }, + { + "query": "from a_index | rename stringField as b", + "error": false + }, + { + "query": "from a_index | rename stringField AS b", + "error": false + }, + { + "query": "from a_index | rename stringField As b", + "error": false + }, + { + "query": "from a_index | rename stringField As b, b AS c", + "error": false + }, + { + "query": "from a_index | rename fn() as a", + "error": true + }, + { + "query": "from a_index | eval numberField + 1 | rename `numberField + 1` as a", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) | rename `avg(numberField)` as avg0", + "error": false + }, + { + "query": "from a_index |eval numberField + 1 | rename `numberField + 1` as ", + "error": true + }, + { + "query": "from a_index | rename s* as strings", + "error": true + }, + { + "query": "row a = 10 | rename a as `this``is fine`", + "error": false + }, + { + "query": "row a = 10 | rename a as this is fine", + "error": true + }, + { + "query": "from a_index | dissect", + "error": true + }, + { + "query": "from a_index | dissect stringField", + "error": true + }, + { + "query": "from a_index | dissect stringField 2", + "error": true + }, + { + "query": "from a_index | dissect stringField .", + "error": true + }, + { + "query": "from a_index | dissect stringField %a", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\"", + "error": false + }, + { + "query": "from a_index | dissect numberField \"%{firstWord}\"", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" option ", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" option = ", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" option = 1", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" append_separator = \"-\"", + "error": false + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" ignore_missing = true", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" append_separator = true", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" | keep firstWord", + "error": false + }, + { + "query": "from a_index | grok", + "error": true + }, + { + "query": "from a_index | grok stringField", + "error": true + }, + { + "query": "from a_index | grok stringField 2", + "error": true + }, + { + "query": "from a_index | grok stringField .", + "error": true + }, + { + "query": "from a_index | grok stringField %a", + "error": true + }, + { + "query": "from a_index | grok stringField \"%{firstWord}\"", + "error": false + }, + { + "query": "from a_index | grok numberField \"%{firstWord}\"", + "error": true + }, + { + "query": "from a_index | grok stringField \"%{firstWord}\" | keep firstWord", + "error": false + }, + { + "query": "from a_index | where b", + "error": true + }, + { + "query": "from a_index | where true", + "error": false + }, + { + "query": "from a_index | where NOT true", + "error": false + }, + { + "query": "from a_index | where false", + "error": false + }, + { + "query": "from a_index | where NOT false", + "error": false + }, + { + "query": "from a_index | where 1 > 0", + "error": false + }, + { + "query": "from a_index | where NOT 1 > 0", + "error": false + }, + { + "query": "from a_index | where +1 > 0", + "error": false + }, + { + "query": "from a_index | where NOT +1 > 0", + "error": false + }, + { + "query": "from a_index | where 1 * 1 > 0", + "error": false + }, + { + "query": "from a_index | where NOT 1 * 1 > 0", + "error": false + }, + { + "query": "from a_index | where -1 > 0", + "error": false + }, + { + "query": "from a_index | where NOT -1 > 0", + "error": false + }, + { + "query": "from a_index | where 1 / 1 > 0", + "error": false + }, + { + "query": "from a_index | where NOT 1 / 1 > 0", + "error": false + }, + { + "query": "from a_index | where 1.0 > 0", + "error": false + }, + { + "query": "from a_index | where NOT 1.0 > 0", + "error": false + }, + { + "query": "from a_index | where 1.5 > 0", + "error": false + }, + { + "query": "from a_index | where NOT 1.5 > 0", + "error": false + }, + { + "query": "from a_index | where numberField > 0", + "error": false + }, + { + "query": "from a_index | where NOT numberField > 0", + "error": false + }, + { + "query": "from a_index | where (numberField > 0)", + "error": false + }, + { + "query": "from a_index | where (NOT (numberField > 0))", + "error": false + }, + { + "query": "from a_index | where 1 > 0", + "error": false + }, + { + "query": "from a_index | eval stringField > 0", + "error": true + }, + { + "query": "from a_index | where numberField >= 0", + "error": false + }, + { + "query": "from a_index | where NOT numberField >= 0", + "error": false + }, + { + "query": "from a_index | where (numberField >= 0)", + "error": false + }, + { + "query": "from a_index | where (NOT (numberField >= 0))", + "error": false + }, + { + "query": "from a_index | where 1 >= 0", + "error": false + }, + { + "query": "from a_index | eval stringField >= 0", + "error": true + }, + { + "query": "from a_index | where numberField < 0", + "error": false + }, + { + "query": "from a_index | where NOT numberField < 0", + "error": false + }, + { + "query": "from a_index | where (numberField < 0)", + "error": false + }, + { + "query": "from a_index | where (NOT (numberField < 0))", + "error": false + }, + { + "query": "from a_index | where 1 < 0", + "error": false + }, + { + "query": "from a_index | eval stringField < 0", + "error": true + }, + { + "query": "from a_index | where numberField <= 0", + "error": false + }, + { + "query": "from a_index | where NOT numberField <= 0", + "error": false + }, + { + "query": "from a_index | where (numberField <= 0)", + "error": false + }, + { + "query": "from a_index | where (NOT (numberField <= 0))", + "error": false + }, + { + "query": "from a_index | where 1 <= 0", + "error": false + }, + { + "query": "from a_index | eval stringField <= 0", + "error": true + }, + { + "query": "from a_index | where numberField == 0", + "error": false + }, + { + "query": "from a_index | where NOT numberField == 0", + "error": false + }, + { + "query": "from a_index | where (numberField == 0)", + "error": false + }, + { + "query": "from a_index | where (NOT (numberField == 0))", + "error": false + }, + { + "query": "from a_index | where 1 == 0", + "error": false + }, + { + "query": "from a_index | eval stringField == 0", + "error": true + }, + { + "query": "from a_index | where - numberField > 0", + "error": false + }, + { + "query": "from a_index | where - round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + - numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 - numberField > 0", + "error": false + }, + { + "query": "from a_index | where - numberField > 0", + "error": false + }, + { + "query": "from a_index | where - round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + - numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 - numberField > 0", + "error": false + }, + { + "query": "from a_index | where + numberField > 0", + "error": false + }, + { + "query": "from a_index | where + round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + + numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 + numberField > 0", + "error": false + }, + { + "query": "from a_index | where + numberField > 0", + "error": false + }, + { + "query": "from a_index | where + round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + + numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 + numberField > 0", + "error": false + }, + { + "query": "from a_index | where not booleanField", + "error": false + }, + { + "query": "from a_index | where -- numberField > 0", + "error": false + }, + { + "query": "from a_index | where -- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + -- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 -- numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + -+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 -+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where +- numberField > 0", + "error": false + }, + { + "query": "from a_index | where +- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + +- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 +- numberField > 0", + "error": false + }, + { + "query": "from a_index | where ++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where ++ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + ++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 ++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where not not booleanField", + "error": false + }, + { + "query": "from a_index | where --- numberField > 0", + "error": false + }, + { + "query": "from a_index | where --- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + --- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 --- numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + -+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 -+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where +-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where +-+ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + +-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 +-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where +++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where +++ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + +++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 +++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where not not not booleanField", + "error": false + }, + { + "query": "from a_index | where ---- numberField > 0", + "error": false + }, + { + "query": "from a_index | where ---- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + ---- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 ---- numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+-+ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + -+-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 -+-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where +-+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where +-+- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + +-+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 +-+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where ++++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where ++++ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + ++++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 ++++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where not not not not booleanField", + "error": false + }, + { + "query": "from a_index | where *+ numberField", + "error": true + }, + { + "query": "from a_index | where /+ numberField", + "error": true + }, + { + "query": "from a_index | where %+ numberField", + "error": true + }, + { + "query": "from a_index | where numberField =~ 0", + "error": true + }, + { + "query": "from a_index | where NOT numberField =~ 0", + "error": true + }, + { + "query": "from a_index | where (numberField =~ 0)", + "error": true + }, + { + "query": "from a_index | where (NOT (numberField =~ 0))", + "error": true + }, + { + "query": "from a_index | where 1 =~ 0", + "error": true + }, + { + "query": "from a_index | eval stringField =~ 0", + "error": true + }, + { + "query": "from a_index | where stringField like \"?a\"", + "error": false + }, + { + "query": "from a_index | where stringField NOT like \"?a\"", + "error": false + }, + { + "query": "from a_index | where NOT stringField like \"?a\"", + "error": false + }, + { + "query": "from a_index | where NOT stringField NOT like \"?a\"", + "error": false + }, + { + "query": "from a_index | where numberField like \"?a\"", + "error": true + }, + { + "query": "from a_index | where numberField NOT like \"?a\"", + "error": true + }, + { + "query": "from a_index | where NOT numberField like \"?a\"", + "error": true + }, + { + "query": "from a_index | where NOT numberField NOT like \"?a\"", + "error": true + }, + { + "query": "from a_index | where stringField rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | where stringField NOT rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | where NOT stringField rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | where NOT stringField NOT rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | where numberField rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | where numberField NOT rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | where NOT numberField rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | where NOT numberField NOT rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | where cidr_match(ipField)", + "error": true + }, + { + "query": "from a_index | eval cidr = \"172.0.0.1/30\" | where cidr_match(ipField, \"172.0.0.1/30\", cidr)", + "error": false + }, + { + "query": "from a_index | where numberField IS NULL", + "error": false + }, + { + "query": "from a_index | where numberField IS null", + "error": false + }, + { + "query": "from a_index | where numberField is null", + "error": false + }, + { + "query": "from a_index | where numberField is NULL", + "error": false + }, + { + "query": "from a_index | where numberField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where numberField IS NOT null", + "error": false + }, + { + "query": "from a_index | where numberField IS not NULL", + "error": false + }, + { + "query": "from a_index | where numberField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where dateField IS NULL", + "error": false + }, + { + "query": "from a_index | where dateField IS null", + "error": false + }, + { + "query": "from a_index | where dateField is null", + "error": false + }, + { + "query": "from a_index | where dateField is NULL", + "error": false + }, + { + "query": "from a_index | where dateField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where dateField IS NOT null", + "error": false + }, + { + "query": "from a_index | where dateField IS not NULL", + "error": false + }, + { + "query": "from a_index | where dateField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where booleanField IS NULL", + "error": false + }, + { + "query": "from a_index | where booleanField IS null", + "error": false + }, + { + "query": "from a_index | where booleanField is null", + "error": false + }, + { + "query": "from a_index | where booleanField is NULL", + "error": false + }, + { + "query": "from a_index | where booleanField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where booleanField IS NOT null", + "error": false + }, + { + "query": "from a_index | where booleanField IS not NULL", + "error": false + }, + { + "query": "from a_index | where booleanField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where ipField IS NULL", + "error": false + }, + { + "query": "from a_index | where ipField IS null", + "error": false + }, + { + "query": "from a_index | where ipField is null", + "error": false + }, + { + "query": "from a_index | where ipField is NULL", + "error": false + }, + { + "query": "from a_index | where ipField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where ipField IS NOT null", + "error": false + }, + { + "query": "from a_index | where ipField IS not NULL", + "error": false + }, + { + "query": "from a_index | where ipField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where stringField IS NULL", + "error": false + }, + { + "query": "from a_index | where stringField IS null", + "error": false + }, + { + "query": "from a_index | where stringField is null", + "error": false + }, + { + "query": "from a_index | where stringField is NULL", + "error": false + }, + { + "query": "from a_index | where stringField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where stringField IS NOT null", + "error": false + }, + { + "query": "from a_index | where stringField IS not NULL", + "error": false + }, + { + "query": "from a_index | where stringField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where cartesianPointField IS NULL", + "error": false + }, + { + "query": "from a_index | where cartesianPointField IS null", + "error": false + }, + { + "query": "from a_index | where cartesianPointField is null", + "error": false + }, + { + "query": "from a_index | where cartesianPointField is NULL", + "error": false + }, + { + "query": "from a_index | where cartesianPointField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where cartesianPointField IS NOT null", + "error": false + }, + { + "query": "from a_index | where cartesianPointField IS not NULL", + "error": false + }, + { + "query": "from a_index | where cartesianPointField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where geoPointField IS NULL", + "error": false + }, + { + "query": "from a_index | where geoPointField IS null", + "error": false + }, + { + "query": "from a_index | where geoPointField is null", + "error": false + }, + { + "query": "from a_index | where geoPointField is NULL", + "error": false + }, + { + "query": "from a_index | where geoPointField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where geoPointField IS NOT null", + "error": false + }, + { + "query": "from a_index | where geoPointField IS not NULL", + "error": false + }, + { + "query": "from a_index | where geoPointField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where abs(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where abs(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where acos(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where acos(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where asin(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where asin(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where atan(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where atan(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where atan2(numberField, numberField) > 0", + "error": false + }, + { + "query": "from a_index | where atan2(stringField, stringField) > 0", + "error": true + }, + { + "query": "from a_index | where ceil(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where ceil(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(concat(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(concat(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where cos(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where cos(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where cosh(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where cosh(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where e() > 0", + "error": false + }, + { + "query": "from a_index | where e() > 0", + "error": false + }, + { + "query": "from a_index | where floor(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where floor(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(left(stringField, numberField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(left(numberField, stringField)) > 0", + "error": true + }, + { + "query": "from a_index | where length(stringField) > 0", + "error": false + }, + { + "query": "from a_index | where length(numberField) > 0", + "error": true + }, + { + "query": "from a_index | where log(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where log(stringField, stringField) > 0", + "error": true + }, + { + "query": "from a_index | where log10(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where log10(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(ltrim(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(ltrim(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where mv_avg(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where mv_avg(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(mv_concat(stringField, stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(mv_concat(numberField, numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where mv_median(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where mv_median(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where mv_sum(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where mv_sum(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where pi() > 0", + "error": false + }, + { + "query": "from a_index | where pi() > 0", + "error": false + }, + { + "query": "from a_index | where pow(numberField, numberField) > 0", + "error": false + }, + { + "query": "from a_index | where pow(stringField, stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(replace(stringField, stringField, stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(replace(numberField, numberField, numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where length(right(stringField, numberField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(right(numberField, stringField)) > 0", + "error": true + }, + { + "query": "from a_index | where round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where round(stringField, stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(rtrim(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(rtrim(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where sin(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where sin(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where sinh(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where sinh(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(split(stringField, stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(split(numberField, numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where sqrt(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where sqrt(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(substring(stringField, numberField, numberField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(substring(numberField, stringField, stringField)) > 0", + "error": true + }, + { + "query": "from a_index | where tan(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where tan(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where tanh(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where tanh(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where tau() > 0", + "error": false + }, + { + "query": "from a_index | where tau() > 0", + "error": false + }, + { + "query": "from a_index | where to_degrees(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where to_degrees(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(to_lower(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(to_lower(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where to_radians(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where to_radians(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(to_upper(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(to_upper(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where length(trim(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(trim(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | eval ", + "error": true + }, + { + "query": "from a_index | eval stringField ", + "error": false + }, + { + "query": "from a_index | eval b = stringField", + "error": false + }, + { + "query": "from a_index | eval numberField + 1", + "error": false + }, + { + "query": "from a_index | eval numberField + ", + "error": true + }, + { + "query": "from a_index | eval stringField + 1", + "error": true + }, + { + "query": "from a_index | eval a=b", + "error": true + }, + { + "query": "from a_index | eval a=b, ", + "error": true + }, + { + "query": "from a_index | eval a=round", + "error": true + }, + { + "query": "from a_index | eval a=round(", + "error": true + }, + { + "query": "from a_index | eval a=round(numberField) ", + "error": false + }, + { + "query": "from a_index | eval a=round(numberField), ", + "error": true + }, + { + "query": "from a_index | eval a=round(numberField) + round(numberField) ", + "error": false + }, + { + "query": "from a_index | eval a=round(numberField) + round(stringField) ", + "error": true + }, + { + "query": "from a_index | eval a=round(numberField) + round(stringField), numberField ", + "error": true + }, + { + "query": "from a_index | eval a=round(numberField) + round(numberField), numberField ", + "error": false + }, + { + "query": "from a_index | eval a=round(numberField) + round(numberField), b = numberField ", + "error": false + }, + { + "query": "from a_index | eval a=[1, 2, 3]", + "error": false + }, + { + "query": "from a_index | eval a=[true, false]", + "error": false + }, + { + "query": "from a_index | eval a=[\"a\", \"b\"]", + "error": false + }, + { + "query": "from a_index | eval a=null", + "error": false + }, + { + "query": "from a_index | eval numberField IS NULL", + "error": false + }, + { + "query": "from a_index | eval numberField IS null", + "error": false + }, + { + "query": "from a_index | eval numberField is null", + "error": false + }, + { + "query": "from a_index | eval numberField is NULL", + "error": false + }, + { + "query": "from a_index | eval numberField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval numberField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval numberField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval dateField IS NULL", + "error": false + }, + { + "query": "from a_index | eval dateField IS null", + "error": false + }, + { + "query": "from a_index | eval dateField is null", + "error": false + }, + { + "query": "from a_index | eval dateField is NULL", + "error": false + }, + { + "query": "from a_index | eval dateField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval dateField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval dateField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval booleanField IS NULL", + "error": false + }, + { + "query": "from a_index | eval booleanField IS null", + "error": false + }, + { + "query": "from a_index | eval booleanField is null", + "error": false + }, + { + "query": "from a_index | eval booleanField is NULL", + "error": false + }, + { + "query": "from a_index | eval booleanField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval booleanField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval booleanField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval ipField IS NULL", + "error": false + }, + { + "query": "from a_index | eval ipField IS null", + "error": false + }, + { + "query": "from a_index | eval ipField is null", + "error": false + }, + { + "query": "from a_index | eval ipField is NULL", + "error": false + }, + { + "query": "from a_index | eval ipField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval ipField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval ipField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval stringField IS NULL", + "error": false + }, + { + "query": "from a_index | eval stringField IS null", + "error": false + }, + { + "query": "from a_index | eval stringField is null", + "error": false + }, + { + "query": "from a_index | eval stringField is NULL", + "error": false + }, + { + "query": "from a_index | eval stringField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval stringField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval stringField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField IS NULL", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField IS null", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField is null", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField is NULL", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval geoPointField IS NULL", + "error": false + }, + { + "query": "from a_index | eval geoPointField IS null", + "error": false + }, + { + "query": "from a_index | eval geoPointField is null", + "error": false + }, + { + "query": "from a_index | eval geoPointField is NULL", + "error": false + }, + { + "query": "from a_index | eval geoPointField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval geoPointField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval geoPointField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval - numberField", + "error": false + }, + { + "query": "from a_index | eval a=- numberField", + "error": false + }, + { + "query": "from a_index | eval a=- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + - numberField", + "error": false + }, + { + "query": "from a_index | eval 1 - numberField", + "error": false + }, + { + "query": "from a_index | eval - numberField", + "error": false + }, + { + "query": "from a_index | eval a=- numberField", + "error": false + }, + { + "query": "from a_index | eval a=- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + - numberField", + "error": false + }, + { + "query": "from a_index | eval 1 - numberField", + "error": false + }, + { + "query": "from a_index | eval + numberField", + "error": false + }, + { + "query": "from a_index | eval a=+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + + numberField", + "error": false + }, + { + "query": "from a_index | eval 1 + numberField", + "error": false + }, + { + "query": "from a_index | eval + numberField", + "error": false + }, + { + "query": "from a_index | eval a=+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + + numberField", + "error": false + }, + { + "query": "from a_index | eval 1 + numberField", + "error": false + }, + { + "query": "from a_index | eval not booleanField", + "error": false + }, + { + "query": "from a_index | eval -- numberField", + "error": false + }, + { + "query": "from a_index | eval a=-- numberField", + "error": false + }, + { + "query": "from a_index | eval a=-- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + -- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 -- numberField", + "error": false + }, + { + "query": "from a_index | eval -+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + -+ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 -+ numberField", + "error": false + }, + { + "query": "from a_index | eval +- numberField", + "error": false + }, + { + "query": "from a_index | eval a=+- numberField", + "error": false + }, + { + "query": "from a_index | eval a=+- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + +- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 +- numberField", + "error": false + }, + { + "query": "from a_index | eval ++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=++ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + ++ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 ++ numberField", + "error": false + }, + { + "query": "from a_index | eval not not booleanField", + "error": false + }, + { + "query": "from a_index | eval --- numberField", + "error": false + }, + { + "query": "from a_index | eval a=--- numberField", + "error": false + }, + { + "query": "from a_index | eval a=--- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + --- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 --- numberField", + "error": false + }, + { + "query": "from a_index | eval -+- numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+- numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + -+- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 -+- numberField", + "error": false + }, + { + "query": "from a_index | eval +-+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+-+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+-+ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + +-+ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 +-+ numberField", + "error": false + }, + { + "query": "from a_index | eval +++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+++ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + +++ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 +++ numberField", + "error": false + }, + { + "query": "from a_index | eval not not not booleanField", + "error": false + }, + { + "query": "from a_index | eval ---- numberField", + "error": false + }, + { + "query": "from a_index | eval a=---- numberField", + "error": false + }, + { + "query": "from a_index | eval a=---- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + ---- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 ---- numberField", + "error": false + }, + { + "query": "from a_index | eval -+-+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+-+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+-+ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + -+-+ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 -+-+ numberField", + "error": false + }, + { + "query": "from a_index | eval +-+- numberField", + "error": false + }, + { + "query": "from a_index | eval a=+-+- numberField", + "error": false + }, + { + "query": "from a_index | eval a=+-+- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + +-+- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 +-+- numberField", + "error": false + }, + { + "query": "from a_index | eval ++++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=++++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=++++ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + ++++ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 ++++ numberField", + "error": false + }, + { + "query": "from a_index | eval not not not not booleanField", + "error": false + }, + { + "query": "from a_index | eval *+ numberField", + "error": true + }, + { + "query": "from a_index | eval /+ numberField", + "error": true + }, + { + "query": "from a_index | eval %+ numberField", + "error": true + }, + { + "query": "from a_index | eval var = abs(numberField)", + "error": false + }, + { + "query": "from a_index | eval abs(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = abs(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval abs(stringField)", + "error": true + }, + { + "query": "from a_index | eval abs(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = abs(*)", + "error": true + }, + { + "query": "from a_index | eval var = acos(numberField)", + "error": false + }, + { + "query": "from a_index | eval acos(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = acos(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval acos(stringField)", + "error": true + }, + { + "query": "from a_index | eval acos(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = acos(*)", + "error": true + }, + { + "query": "from a_index | eval var = asin(numberField)", + "error": false + }, + { + "query": "from a_index | eval asin(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = asin(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval asin(stringField)", + "error": true + }, + { + "query": "from a_index | eval asin(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = asin(*)", + "error": true + }, + { + "query": "from a_index | eval var = atan(numberField)", + "error": false + }, + { + "query": "from a_index | eval atan(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = atan(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval atan(stringField)", + "error": true + }, + { + "query": "from a_index | eval atan(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = atan(*)", + "error": true + }, + { + "query": "from a_index | eval var = atan2(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval atan2(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = atan2(to_integer(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval atan2(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval atan2(numberField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = auto_bucket(dateField, numberField, \"a\", \"a\")", + "error": false + }, + { + "query": "from a_index | eval auto_bucket(dateField, numberField, \"a\", \"a\")", + "error": false + }, + { + "query": "from a_index | eval auto_bucket(dateField, numberField, stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval var = auto_bucket(dateField, numberField, 5, 5)", + "error": false + }, + { + "query": "from a_index | eval auto_bucket(dateField, numberField, 5, 5)", + "error": false + }, + { + "query": "from a_index | eval auto_bucket(dateField, numberField, numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval var = case(booleanField, stringField)", + "error": false + }, + { + "query": "from a_index | eval case(booleanField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = ceil(numberField)", + "error": false + }, + { + "query": "from a_index | eval ceil(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = ceil(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval ceil(stringField)", + "error": true + }, + { + "query": "from a_index | eval ceil(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = ceil(*)", + "error": true + }, + { + "query": "from a_index | eval var = cidr_match(ipField, stringField)", + "error": false + }, + { + "query": "from a_index | eval cidr_match(ipField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = cidr_match(to_ip(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval cidr_match(stringField, numberField)", + "error": true + }, + { + "query": "from a_index | eval var = coalesce(stringField)", + "error": false + }, + { + "query": "from a_index | eval coalesce(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = coalesce(*)", + "error": true + }, + { + "query": "from a_index | eval var = concat(stringField)", + "error": false + }, + { + "query": "from a_index | eval concat(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = concat(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval concat(numberField)", + "error": true + }, + { + "query": "from a_index | eval var = concat(*)", + "error": true + }, + { + "query": "from a_index | eval var = cos(numberField)", + "error": false + }, + { + "query": "from a_index | eval cos(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = cos(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval cos(stringField)", + "error": true + }, + { + "query": "from a_index | eval cos(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = cos(*)", + "error": true + }, + { + "query": "from a_index | eval var = cosh(numberField)", + "error": false + }, + { + "query": "from a_index | eval cosh(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = cosh(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval cosh(stringField)", + "error": true + }, + { + "query": "from a_index | eval cosh(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = cosh(*)", + "error": true + }, + { + "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "error": false + }, + { + "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "error": false + }, + { + "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(stringField))", + "error": false + }, + { + "query": "from a_index | eval date_extract(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = date_format(dateField, stringField)", + "error": false + }, + { + "query": "from a_index | eval date_format(dateField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = date_format(to_datetime(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval date_format(stringField, numberField)", + "error": true + }, + { + "query": "from a_index | eval date_format(dateField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = date_parse(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval date_parse(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = date_parse(to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval date_parse(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval date_parse(stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = date_trunc(1 year, dateField)", + "error": false + }, + { + "query": "from a_index | eval date_trunc(1 year, dateField)", + "error": false + }, + { + "query": "from a_index | eval var = date_trunc(1 year, to_datetime(stringField))", + "error": false + }, + { + "query": "from a_index | eval date_trunc(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval date_trunc(1 year, dateField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = e()", + "error": false + }, + { + "query": "from a_index | eval e()", + "error": false + }, + { + "query": "from a_index | eval var = e()", + "error": false + }, + { + "query": "from a_index | eval e()", + "error": false + }, + { + "query": "from a_index | eval e(extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = ends_with(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval ends_with(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = ends_with(to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval ends_with(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval ends_with(stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = floor(numberField)", + "error": false + }, + { + "query": "from a_index | eval floor(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = floor(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval floor(stringField)", + "error": true + }, + { + "query": "from a_index | eval floor(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = floor(*)", + "error": true + }, + { + "query": "from a_index | eval var = greatest(stringField)", + "error": false + }, + { + "query": "from a_index | eval greatest(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = greatest(*)", + "error": true + }, + { + "query": "from a_index | eval var = least(stringField)", + "error": false + }, + { + "query": "from a_index | eval least(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = least(*)", + "error": true + }, + { + "query": "from a_index | eval var = left(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | eval left(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = left(to_string(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval left(numberField, stringField)", + "error": true + }, + { + "query": "from a_index | eval left(stringField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = length(stringField)", + "error": false + }, + { + "query": "from a_index | eval length(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = length(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval length(numberField)", + "error": true + }, + { + "query": "from a_index | eval length(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = length(*)", + "error": true + }, + { + "query": "from a_index | eval var = log(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval log(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = log(to_integer(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval log(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval log(numberField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = log10(numberField)", + "error": false + }, + { + "query": "from a_index | eval log10(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = log10(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval log10(stringField)", + "error": true + }, + { + "query": "from a_index | eval log10(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = log10(*)", + "error": true + }, + { + "query": "from a_index | eval var = ltrim(stringField)", + "error": false + }, + { + "query": "from a_index | eval ltrim(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = ltrim(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval ltrim(numberField)", + "error": true + }, + { + "query": "from a_index | eval ltrim(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = ltrim(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_avg(numberField)", + "error": false + }, + { + "query": "from a_index | eval mv_avg(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_avg(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval mv_avg(stringField)", + "error": true + }, + { + "query": "from a_index | eval mv_avg(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = mv_avg(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_concat(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_concat(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_concat(to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval mv_concat(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval mv_concat(stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = mv_count(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_count(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_count(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_dedupe(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_dedupe(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_dedupe(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_first(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_first(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_first(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_last(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_last(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_last(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_max(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_max(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_max(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_median(numberField)", + "error": false + }, + { + "query": "from a_index | eval mv_median(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_median(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval mv_median(stringField)", + "error": true + }, + { + "query": "from a_index | eval mv_median(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = mv_median(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_min(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_min(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_min(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_sum(numberField)", + "error": false + }, + { + "query": "from a_index | eval mv_sum(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_sum(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval mv_sum(stringField)", + "error": true + }, + { + "query": "from a_index | eval mv_sum(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = mv_sum(*)", + "error": true + }, + { + "query": "from a_index | eval var = now()", + "error": false + }, + { + "query": "from a_index | eval now()", + "error": false + }, + { + "query": "from a_index | eval var = now()", + "error": false + }, + { + "query": "from a_index | eval now()", + "error": false + }, + { + "query": "from a_index | eval now(extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = pi()", + "error": false + }, + { + "query": "from a_index | eval pi()", + "error": false + }, + { + "query": "from a_index | eval var = pi()", + "error": false + }, + { + "query": "from a_index | eval pi()", + "error": false + }, + { + "query": "from a_index | eval pi(extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = pow(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval pow(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = pow(to_integer(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval pow(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval pow(numberField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = replace(stringField, stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval replace(stringField, stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = replace(to_string(stringField), to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval replace(numberField, numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval replace(stringField, stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = right(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | eval right(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = right(to_string(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval right(numberField, stringField)", + "error": true + }, + { + "query": "from a_index | eval right(stringField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = round(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval round(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = round(to_integer(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval round(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval round(numberField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = rtrim(stringField)", + "error": false + }, + { + "query": "from a_index | eval rtrim(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = rtrim(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval rtrim(numberField)", + "error": true + }, + { + "query": "from a_index | eval rtrim(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = rtrim(*)", + "error": true + }, + { + "query": "from a_index | eval var = sin(numberField)", + "error": false + }, + { + "query": "from a_index | eval sin(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = sin(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval sin(stringField)", + "error": true + }, + { + "query": "from a_index | eval sin(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = sin(*)", + "error": true + }, + { + "query": "from a_index | eval var = sinh(numberField)", + "error": false + }, + { + "query": "from a_index | eval sinh(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = sinh(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval sinh(stringField)", + "error": true + }, + { + "query": "from a_index | eval sinh(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = sinh(*)", + "error": true + }, + { + "query": "from a_index | eval var = split(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval split(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = split(to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval split(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval split(stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = sqrt(numberField)", + "error": false + }, + { + "query": "from a_index | eval sqrt(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = sqrt(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval sqrt(stringField)", + "error": true + }, + { + "query": "from a_index | eval sqrt(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = sqrt(*)", + "error": true + }, + { + "query": "from a_index | eval var = starts_with(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval starts_with(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = starts_with(to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval starts_with(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval starts_with(stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = substring(stringField, numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval substring(stringField, numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = substring(to_string(stringField), to_integer(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval substring(numberField, stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval substring(stringField, numberField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = tan(numberField)", + "error": false + }, + { + "query": "from a_index | eval tan(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = tan(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval tan(stringField)", + "error": true + }, + { + "query": "from a_index | eval tan(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = tan(*)", + "error": true + }, + { + "query": "from a_index | eval var = tanh(numberField)", + "error": false + }, + { + "query": "from a_index | eval tanh(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = tanh(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval tanh(stringField)", + "error": true + }, + { + "query": "from a_index | eval tanh(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = tanh(*)", + "error": true + }, + { + "query": "from a_index | eval var = tau()", + "error": false + }, + { + "query": "from a_index | eval tau()", + "error": false + }, + { + "query": "from a_index | eval var = tau()", + "error": false + }, + { + "query": "from a_index | eval tau()", + "error": false + }, + { + "query": "from a_index | eval tau(extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = to_boolean(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_boolean(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_bool(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_boolean(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_cartesianpoint(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_cartesianpoint(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_cartesianpoint(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_cartesianshape(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_cartesianshape(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_cartesianshape(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_datetime(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_datetime(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_dt(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_datetime(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_degrees(numberField)", + "error": false + }, + { + "query": "from a_index | eval to_degrees(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = to_degrees(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval to_degrees(stringField)", + "error": true + }, + { + "query": "from a_index | eval to_degrees(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = to_degrees(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_double(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_double(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_dbl(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_double(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_geopoint(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_geopoint(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_geopoint(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_geoshape(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_geoshape(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_geoshape(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_integer(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_integer(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_int(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_integer(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_ip(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_ip(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_ip(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_long(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_long(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_long(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_lower(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_lower(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_lower(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval to_lower(numberField)", + "error": true + }, + { + "query": "from a_index | eval to_lower(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = to_lower(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_radians(numberField)", + "error": false + }, + { + "query": "from a_index | eval to_radians(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = to_radians(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval to_radians(stringField)", + "error": true + }, + { + "query": "from a_index | eval to_radians(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = to_radians(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_string(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_string(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_str(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_string(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_unsigned_long(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_unsigned_long(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_ul(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_ulong(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_unsigned_long(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_upper(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_upper(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_upper(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval to_upper(numberField)", + "error": true + }, + { + "query": "from a_index | eval to_upper(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = to_upper(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_version(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_version(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_ver(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_version(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_version(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_version(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_ver(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_version(*)", + "error": true + }, + { + "query": "from a_index | eval var = trim(stringField)", + "error": false + }, + { + "query": "from a_index | eval trim(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = trim(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval trim(numberField)", + "error": true + }, + { + "query": "from a_index | eval trim(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = trim(*)", + "error": true + }, + { + "query": "from a_index | eval log10(-1)", + "error": false + }, + { + "query": "from a_index | eval log(-1)", + "error": false + }, + { + "query": "from a_index | eval log(-1, 20)", + "error": false + }, + { + "query": "from a_index | eval log(-1, -20)", + "error": false + }, + { + "query": "from a_index | eval var0 = log(-1, -20)", + "error": false + }, + { + "query": "from a_index | eval numberField > 0", + "error": false + }, + { + "query": "from a_index | eval NOT numberField > 0", + "error": false + }, + { + "query": "from a_index | eval (numberField > 0)", + "error": false + }, + { + "query": "from a_index | eval (NOT (numberField > 0))", + "error": false + }, + { + "query": "from a_index | eval 1 > 0", + "error": false + }, + { + "query": "from a_index | eval stringField > 0", + "error": true + }, + { + "query": "from a_index | eval numberField >= 0", + "error": false + }, + { + "query": "from a_index | eval NOT numberField >= 0", + "error": false + }, + { + "query": "from a_index | eval (numberField >= 0)", + "error": false + }, + { + "query": "from a_index | eval (NOT (numberField >= 0))", + "error": false + }, + { + "query": "from a_index | eval 1 >= 0", + "error": false + }, + { + "query": "from a_index | eval stringField >= 0", + "error": true + }, + { + "query": "from a_index | eval numberField < 0", + "error": false + }, + { + "query": "from a_index | eval NOT numberField < 0", + "error": false + }, + { + "query": "from a_index | eval (numberField < 0)", + "error": false + }, + { + "query": "from a_index | eval (NOT (numberField < 0))", + "error": false + }, + { + "query": "from a_index | eval 1 < 0", + "error": false + }, + { + "query": "from a_index | eval stringField < 0", + "error": true + }, + { + "query": "from a_index | eval numberField <= 0", + "error": false + }, + { + "query": "from a_index | eval NOT numberField <= 0", + "error": false + }, + { + "query": "from a_index | eval (numberField <= 0)", + "error": false + }, + { + "query": "from a_index | eval (NOT (numberField <= 0))", + "error": false + }, + { + "query": "from a_index | eval 1 <= 0", + "error": false + }, + { + "query": "from a_index | eval stringField <= 0", + "error": true + }, + { + "query": "from a_index | eval numberField == 0", + "error": false + }, + { + "query": "from a_index | eval NOT numberField == 0", + "error": false + }, + { + "query": "from a_index | eval (numberField == 0)", + "error": false + }, + { + "query": "from a_index | eval (NOT (numberField == 0))", + "error": false + }, + { + "query": "from a_index | eval 1 == 0", + "error": false + }, + { + "query": "from a_index | eval stringField == 0", + "error": true + }, + { + "query": "from a_index | eval numberField + 1", + "error": false + }, + { + "query": "from a_index | eval (numberField + 1)", + "error": false + }, + { + "query": "from a_index | eval 1 + 1", + "error": false + }, + { + "query": "from a_index | eval numberField - 1", + "error": false + }, + { + "query": "from a_index | eval (numberField - 1)", + "error": false + }, + { + "query": "from a_index | eval 1 - 1", + "error": false + }, + { + "query": "from a_index | eval numberField * 1", + "error": false + }, + { + "query": "from a_index | eval (numberField * 1)", + "error": false + }, + { + "query": "from a_index | eval 1 * 1", + "error": false + }, + { + "query": "from a_index | eval numberField / 1", + "error": false + }, + { + "query": "from a_index | eval (numberField / 1)", + "error": false + }, + { + "query": "from a_index | eval 1 / 1", + "error": false + }, + { + "query": "from a_index | eval numberField % 1", + "error": false + }, + { + "query": "from a_index | eval (numberField % 1)", + "error": false + }, + { + "query": "from a_index | eval 1 % 1", + "error": false + }, + { + "query": "from a_index | eval 1/0", + "error": false + }, + { + "query": "from a_index | eval var = 1/0", + "error": false + }, + { + "query": "from a_index | eval 1 + 1/0", + "error": false + }, + { + "query": "from a_index | eval 1%0", + "error": false + }, + { + "query": "from a_index | eval var = 1%0", + "error": false + }, + { + "query": "from a_index | eval 1 + 1%0", + "error": false + }, + { + "query": "from a_index | eval stringField like \"?a\"", + "error": false + }, + { + "query": "from a_index | eval stringField NOT like \"?a\"", + "error": false + }, + { + "query": "from a_index | eval NOT stringField like \"?a\"", + "error": false + }, + { + "query": "from a_index | eval NOT stringField NOT like \"?a\"", + "error": false + }, + { + "query": "from a_index | eval numberField like \"?a\"", + "error": true + }, + { + "query": "from a_index | eval numberField NOT like \"?a\"", + "error": true + }, + { + "query": "from a_index | eval NOT numberField like \"?a\"", + "error": true + }, + { + "query": "from a_index | eval NOT numberField NOT like \"?a\"", + "error": true + }, + { + "query": "from a_index | eval stringField rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | eval stringField NOT rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | eval NOT stringField rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | eval NOT stringField NOT rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | eval numberField rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | eval numberField NOT rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | eval NOT numberField rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | eval NOT numberField NOT rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | eval 1 in (1, 2, 3)", + "error": false + }, + { + "query": "from a_index | eval numberField in (1, 2, 3)", + "error": false + }, + { + "query": "from a_index | eval numberField not in (1, 2, 3)", + "error": false + }, + { + "query": "from a_index | eval numberField not in (1, 2, 3, numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 in (1, 2, 3, round(numberField))", + "error": false + }, + { + "query": "from a_index | eval \"a\" in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "from a_index | eval stringField in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "from a_index | eval stringField not in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "from a_index | eval stringField not in (\"a\", \"b\", \"c\", stringField)", + "error": false + }, + { + "query": "from a_index | eval 1 in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "from a_index | eval numberField in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "from a_index | eval numberField not in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "from a_index | eval numberField not in (1, 2, 3, stringField)", + "error": true + }, + { + "query": "from a_index | eval avg(numberField)", + "error": true + }, + { + "query": "from a_index | stats avg(numberField) | eval `avg(numberField)` + 1", + "error": false + }, + { + "query": "from a_index | eval not", + "error": true + }, + { + "query": "from a_index | eval in", + "error": true + }, + { + "query": "from a_index | eval stringField in stringField", + "error": true + }, + { + "query": "from a_index | eval stringField in stringField)", + "error": true + }, + { + "query": "from a_index | eval stringField not in stringField", + "error": true + }, + { + "query": "from a_index | eval 1 anno", + "error": true + }, + { + "query": "from a_index | eval var = 1 anno", + "error": true + }, + { + "query": "from a_index | eval now() + 1 anno", + "error": true + }, + { + "query": "from a_index | eval 1 year", + "error": true + }, + { + "query": "from a_index | eval 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 year", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 year", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 YEAR", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Year", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 year", + "error": false + }, + { + "query": "from a_index | eval 1 year + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 year", + "error": true + }, + { + "query": "from a_index | eval 1 years", + "error": true + }, + { + "query": "from a_index | eval 1 years", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 years", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 years", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 YEARS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Years", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 years", + "error": false + }, + { + "query": "from a_index | eval 1 years + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 years", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 years", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 years", + "error": true + }, + { + "query": "from a_index | eval 1 month", + "error": true + }, + { + "query": "from a_index | eval 1 month", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 month", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 month", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MONTH", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Month", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 month", + "error": false + }, + { + "query": "from a_index | eval 1 month + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 month", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 month", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 month", + "error": true + }, + { + "query": "from a_index | eval 1 months", + "error": true + }, + { + "query": "from a_index | eval 1 months", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 months", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 months", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MONTHS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Months", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 months", + "error": false + }, + { + "query": "from a_index | eval 1 months + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 months", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 months", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 months", + "error": true + }, + { + "query": "from a_index | eval 1 week", + "error": true + }, + { + "query": "from a_index | eval 1 week", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 week", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 week", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 WEEK", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Week", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 week", + "error": false + }, + { + "query": "from a_index | eval 1 week + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 week", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 week", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 week", + "error": true + }, + { + "query": "from a_index | eval 1 weeks", + "error": true + }, + { + "query": "from a_index | eval 1 weeks", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 weeks", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 weeks", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 WEEKS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Weeks", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 weeks", + "error": false + }, + { + "query": "from a_index | eval 1 weeks + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 weeks", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 weeks", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 weeks", + "error": true + }, + { + "query": "from a_index | eval 1 day", + "error": true + }, + { + "query": "from a_index | eval 1 day", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 day", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 day", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 DAY", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Day", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 day", + "error": false + }, + { + "query": "from a_index | eval 1 day + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 day", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 day", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 day", + "error": true + }, + { + "query": "from a_index | eval 1 days", + "error": true + }, + { + "query": "from a_index | eval 1 days", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 days", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 days", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 DAYS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Days", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 days", + "error": false + }, + { + "query": "from a_index | eval 1 days + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 days", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 days", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 days", + "error": true + }, + { + "query": "from a_index | eval 1 hour", + "error": true + }, + { + "query": "from a_index | eval 1 hour", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 hour", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 hour", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 HOUR", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Hour", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 hour", + "error": false + }, + { + "query": "from a_index | eval 1 hour + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 hour", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 hour", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 hour", + "error": true + }, + { + "query": "from a_index | eval 1 hours", + "error": true + }, + { + "query": "from a_index | eval 1 hours", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 hours", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 hours", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 HOURS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Hours", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 hours", + "error": false + }, + { + "query": "from a_index | eval 1 hours + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 hours", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 hours", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 hours", + "error": true + }, + { + "query": "from a_index | eval 1 minute", + "error": true + }, + { + "query": "from a_index | eval 1 minute", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 minute", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 minute", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MINUTE", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Minute", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 minute", + "error": false + }, + { + "query": "from a_index | eval 1 minute + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 minute", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 minute", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 minute", + "error": true + }, + { + "query": "from a_index | eval 1 minutes", + "error": true + }, + { + "query": "from a_index | eval 1 minutes", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 minutes", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 minutes", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MINUTES", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Minutes", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 minutes", + "error": false + }, + { + "query": "from a_index | eval 1 minutes + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 minutes", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 minutes", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 minutes", + "error": true + }, + { + "query": "from a_index | eval 1 second", + "error": true + }, + { + "query": "from a_index | eval 1 second", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 second", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 second", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 SECOND", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Second", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 second", + "error": false + }, + { + "query": "from a_index | eval 1 second + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 second", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 second", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 second", + "error": true + }, + { + "query": "from a_index | eval 1 seconds", + "error": true + }, + { + "query": "from a_index | eval 1 seconds", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 seconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 seconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 SECONDS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Seconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 seconds", + "error": false + }, + { + "query": "from a_index | eval 1 seconds + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 seconds", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 seconds", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 seconds", + "error": true + }, + { + "query": "from a_index | eval 1 millisecond", + "error": true + }, + { + "query": "from a_index | eval 1 millisecond", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 millisecond", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 millisecond", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MILLISECOND", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Millisecond", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 millisecond", + "error": false + }, + { + "query": "from a_index | eval 1 millisecond + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 millisecond", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 millisecond", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 millisecond", + "error": true + }, + { + "query": "from a_index | eval 1 milliseconds", + "error": true + }, + { + "query": "from a_index | eval 1 milliseconds", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 milliseconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 milliseconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MILLISECONDS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Milliseconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 milliseconds", + "error": false + }, + { + "query": "from a_index | eval 1 milliseconds + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 milliseconds", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 milliseconds", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 milliseconds", + "error": true + }, + { + "query": "from a_index | stats ", + "error": true + }, + { + "query": "from a_index | stats by stringField", + "error": false + }, + { + "query": "from a_index | stats by ", + "error": true + }, + { + "query": "from a_index | stats numberField ", + "error": true + }, + { + "query": "from a_index | stats numberField=", + "error": true + }, + { + "query": "from a_index | stats numberField=5 by ", + "error": true + }, + { + "query": "from a_index | stats avg(numberField) by wrongField", + "error": true + }, + { + "query": "from a_index | stats avg(numberField) by wrongField + 1", + "error": true + }, + { + "query": "from a_index | stats avg(numberField) by var0 = wrongField + 1", + "error": true + }, + { + "query": "from a_index | stats avg(numberField) by 1", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) by percentile(numberField)", + "error": true + }, + { + "query": "from a_index | stats count(`numberField`)", + "error": false + }, + { + "query": "from a_index | stats count(`numberField`) | keep `count(``numberField``)` ", + "error": false + }, + { + "query": "from a_index | stats count(`numberField`) | drop `count(``numberField``)` ", + "error": false + }, + { + "query": "from a_index | stats count(`numberField`) | eval `count(``numberField``)` ", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) by stringField, percentile(numberField) by ipField", + "error": true + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 50) by ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) + percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) - percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) * percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) / percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) % percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats count(* + 1) BY ipField", + "error": true + }, + { + "query": "from a_index | stats count(* + round(numberField)) BY ipField", + "error": true + }, + { + "query": "from a_index | stats count(round(*)) BY ipField", + "error": true + }, + { + "query": "from a_index | stats count(count(*)) BY ipField", + "error": true + }, + { + "query": "from a_index | stats numberField + 1", + "error": true + }, + { + "query": "from a_index | stats 5 + avg(numberField) +1", + "error": false + }, + { + "query": "from a_index | stats 5 +1 + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats 5 +1 + numberField", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1, var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round( sum(numberField) )", + "error": false + }, + { + "query": "from a_index | stats round( sum(numberField) ) + round( sum(numberField) )", + "error": false + }, + { + "query": "from a_index | stats round( numberField + sum(numberField) )", + "error": true + }, + { + "query": "from a_index | stats round( numberField + sum(numberField) ), var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats var0 = round( numberField + sum(numberField) ), var1 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round( sum(numberField + numberField) )", + "error": false + }, + { + "query": "from a_index | stats round( sum(numberField + round(numberField)) )", + "error": false + }, + { + "query": "from a_index | stats round( sum(numberField + round(numberField)) ) + round( sum(numberField + round(numberField)) )", + "error": false + }, + { + "query": "from a_index | stats sum(round( numberField ) )", + "error": false + }, + { + "query": "from a_index | stats sum(round( numberField ) ) + sum(round( numberField ) )", + "error": false + }, + { + "query": "from a_index | stats 5 + avg(numberField) +1+1", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1 + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1 + numberField", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1, var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round( sum(numberField) ))", + "error": false + }, + { + "query": "from a_index | stats round(round( sum(numberField) )) + round(round( sum(numberField) ))", + "error": false + }, + { + "query": "from a_index | stats round(round( numberField + sum(numberField) ))", + "error": true + }, + { + "query": "from a_index | stats round(round( numberField + sum(numberField) )), var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats var0 = round(round( numberField + sum(numberField) )), var1 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round( sum(numberField + numberField) ))", + "error": false + }, + { + "query": "from a_index | stats round(round( sum(numberField + round(numberField)) ))", + "error": false + }, + { + "query": "from a_index | stats round(round( sum(numberField + round(numberField)) )) + round(round( sum(numberField + round(numberField)) ))", + "error": false + }, + { + "query": "from a_index | stats sum(round(round( numberField )) )", + "error": false + }, + { + "query": "from a_index | stats sum(round(round( numberField )) ) + sum(round(round( numberField )) )", + "error": false + }, + { + "query": "from a_index | stats 5 + avg(numberField) +1+1+1", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1+1 + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1+1 + numberField", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1+1", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1+1, var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round(round( sum(numberField) )))", + "error": false + }, + { + "query": "from a_index | stats round(round(round( sum(numberField) ))) + round(round(round( sum(numberField) )))", + "error": false + }, + { + "query": "from a_index | stats round(round(round( numberField + sum(numberField) )))", + "error": true + }, + { + "query": "from a_index | stats round(round(round( numberField + sum(numberField) ))), var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats var0 = round(round(round( numberField + sum(numberField) ))), var1 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round(round( sum(numberField + numberField) )))", + "error": false + }, + { + "query": "from a_index | stats round(round(round( sum(numberField + round(numberField)) )))", + "error": false + }, + { + "query": "from a_index | stats round(round(round( sum(numberField + round(numberField)) ))) + round(round(round( sum(numberField + round(numberField)) )))", + "error": false + }, + { + "query": "from a_index | stats sum(round(round(round( numberField ))) )", + "error": false + }, + { + "query": "from a_index | stats sum(round(round(round( numberField ))) ) + sum(round(round(round( numberField ))) )", + "error": false + }, + { + "query": "from a_index | stats 5 + avg(numberField) +1+1+1+1", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1+1+1 + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1+1+1 + numberField", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1+1+1", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1+1+1, var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round(round(round( sum(numberField) ))))", + "error": false + }, + { + "query": "from a_index | stats round(round(round(round( sum(numberField) )))) + round(round(round(round( sum(numberField) ))))", + "error": false + }, + { + "query": "from a_index | stats round(round(round(round( numberField + sum(numberField) ))))", + "error": true + }, + { + "query": "from a_index | stats round(round(round(round( numberField + sum(numberField) )))), var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats var0 = round(round(round(round( numberField + sum(numberField) )))), var1 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round(round(round( sum(numberField + numberField) ))))", + "error": false + }, + { + "query": "from a_index | stats round(round(round(round( sum(numberField + round(numberField)) ))))", + "error": false + }, + { + "query": "from a_index | stats round(round(round(round( sum(numberField + round(numberField)) )))) + round(round(round(round( sum(numberField + round(numberField)) ))))", + "error": false + }, + { + "query": "from a_index | stats sum(round(round(round(round( numberField )))) )", + "error": false + }, + { + "query": "from a_index | stats sum(round(round(round(round( numberField )))) ) + sum(round(round(round(round( numberField )))) )", + "error": false + }, + { + "query": "from a_index | stats 5 + numberField + 1", + "error": true + }, + { + "query": "from a_index | stats numberField + 1 by ipField", + "error": true + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 50) + 1 by ipField", + "error": false + }, + { + "query": "from a_index | stats count(*)", + "error": false + }, + { + "query": "from a_index | stats count()", + "error": false + }, + { + "query": "from a_index | stats var0 = count(*)", + "error": false + }, + { + "query": "from a_index | stats var0 = count()", + "error": false + }, + { + "query": "from a_index | stats var0 = avg(numberField), count(*)", + "error": false + }, + { + "query": "from a_index | stats var0 = avg(fn(number)), count(*)", + "error": true + }, + { + "query": "from a_index | STATS sum( numberField ) + abs( numberField ) ", + "error": true + }, + { + "query": "from a_index | STATS abs( numberField + sum( numberField )) ", + "error": true + }, + { + "query": "from a_index | stats var = avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(avg(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(avg(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(avg(numberField)) + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(avg(numberField)) + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = avg(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = avg(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = avg(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats avg(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats avg(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = avg(*)", + "error": true + }, + { + "query": "from a_index | stats var = max(numberField)", + "error": false + }, + { + "query": "from a_index | stats max(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(max(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(max(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(max(numberField)) + max(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(max(numberField)) + max(numberField)", + "error": false + }, + { + "query": "from a_index | stats max(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = max(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), max(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats max(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = max(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), max(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField)", + "error": false + }, + { + "query": "from a_index | stats max(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = max(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = max(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats max(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats max(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = max(*)", + "error": true + }, + { + "query": "from a_index | stats var = min(numberField)", + "error": false + }, + { + "query": "from a_index | stats min(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(min(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(min(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(min(numberField)) + min(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(min(numberField)) + min(numberField)", + "error": false + }, + { + "query": "from a_index | stats min(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = min(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), min(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats min(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = min(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), min(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField)", + "error": false + }, + { + "query": "from a_index | stats min(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = min(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = min(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats min(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats min(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = min(*)", + "error": true + }, + { + "query": "from a_index | stats var = sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(sum(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(sum(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(sum(numberField)) + sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(sum(numberField)) + sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats sum(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = sum(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats sum(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = sum(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = sum(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats sum(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats sum(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = sum(*)", + "error": true + }, + { + "query": "from a_index | stats var = median(numberField)", + "error": false + }, + { + "query": "from a_index | stats median(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(median(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(median(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(median(numberField)) + median(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(median(numberField)) + median(numberField)", + "error": false + }, + { + "query": "from a_index | stats median(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = median(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats median(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = median(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField)", + "error": false + }, + { + "query": "from a_index | stats median(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = median(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = median(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats median(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats median(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = median(*)", + "error": true + }, + { + "query": "from a_index | stats var = median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(median_absolute_deviation(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = median_absolute_deviation(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats median_absolute_deviation(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats median_absolute_deviation(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = median_absolute_deviation(*)", + "error": true + }, + { + "query": "from a_index | stats var = percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats var = round(percentile(numberField, 5))", + "error": false + }, + { + "query": "from a_index | stats round(percentile(numberField, 5))", + "error": false + }, + { + "query": "from a_index | stats var = round(percentile(numberField, 5)) + percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats round(percentile(numberField, 5)) + percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats percentile(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | stats percentile(numberField / 2, 5)", + "error": false + }, + { + "query": "from a_index | stats var0 = percentile(numberField / 2, 5)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField / 2, 5)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField / 2, 5)", + "error": false + }, + { + "query": "from a_index | stats percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats var0 = percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats percentile(numberField, 5) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = percentile(numberField, 5) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = percentile(avg(numberField), 5)", + "error": true + }, + { + "query": "from a_index | stats percentile(avg(numberField), 5)", + "error": true + }, + { + "query": "from a_index | stats percentile(stringField, 5)", + "error": true + }, + { + "query": "from a_index | stats var = count(stringField)", + "error": false + }, + { + "query": "from a_index | stats count(stringField)", + "error": false + }, + { + "query": "from a_index | stats var = round(count(stringField))", + "error": false + }, + { + "query": "from a_index | stats round(count(stringField))", + "error": false + }, + { + "query": "from a_index | stats var = round(count(stringField)) + count(stringField)", + "error": false + }, + { + "query": "from a_index | stats round(count(stringField)) + count(stringField)", + "error": false + }, + { + "query": "from a_index | stats var = count_distinct(stringField)", + "error": false + }, + { + "query": "from a_index | stats count_distinct(stringField)", + "error": false + }, + { + "query": "from a_index | stats var = round(count_distinct(stringField))", + "error": false + }, + { + "query": "from a_index | stats round(count_distinct(stringField))", + "error": false + }, + { + "query": "from a_index | stats var = round(count_distinct(stringField)) + count_distinct(stringField)", + "error": false + }, + { + "query": "from a_index | stats round(count_distinct(stringField)) + count_distinct(stringField)", + "error": false + }, + { + "query": "from a_index | stats var = st_centroid(cartesianPointField)", + "error": false + }, + { + "query": "from a_index | stats st_centroid(cartesianPointField)", + "error": false + }, + { + "query": "from a_index | stats var = st_centroid(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats st_centroid(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats st_centroid(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = st_centroid(*)", + "error": true + }, + { + "query": "from a_index | stats var = st_centroid(geoPointField)", + "error": false + }, + { + "query": "from a_index | stats st_centroid(geoPointField)", + "error": false + }, + { + "query": "from a_index | stats var = st_centroid(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats st_centroid(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats st_centroid(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = st_centroid(*)", + "error": true + }, + { + "query": "FROM index\n | EVAL numberField * 3.281\n | STATS avg_numberField = AVG(`numberField * 3.281`)", + "error": false + }, + { + "query": "from a_index | sort ", + "error": true + }, + { + "query": "from a_index | sort \"field\" ", + "error": false + }, + { + "query": "from a_index | sort wrongField ", + "error": true + }, + { + "query": "from a_index | sort numberField, ", + "error": true + }, + { + "query": "from a_index | sort numberField, stringField", + "error": false + }, + { + "query": "from a_index | sort \"field\" desc ", + "error": false + }, + { + "query": "from a_index | sort numberField desc ", + "error": false + }, + { + "query": "from a_index | sort numberField desc nulls ", + "error": true + }, + { + "query": "from a_index | sort numberField desc nulls first", + "error": false + }, + { + "query": "from a_index | sort numberField desc first", + "error": true + }, + { + "query": "from a_index | sort numberField desc nulls last", + "error": false + }, + { + "query": "from a_index | sort numberField desc last", + "error": true + }, + { + "query": "from a_index | sort \"field\" asc ", + "error": false + }, + { + "query": "from a_index | sort numberField asc ", + "error": false + }, + { + "query": "from a_index | sort numberField asc nulls ", + "error": true + }, + { + "query": "from a_index | sort numberField asc nulls first", + "error": false + }, + { + "query": "from a_index | sort numberField asc first", + "error": true + }, + { + "query": "from a_index | sort numberField asc nulls last", + "error": false + }, + { + "query": "from a_index | sort numberField asc last", + "error": true + }, + { + "query": "from a_index | sort numberField nulls first", + "error": false + }, + { + "query": "from a_index | sort numberField first", + "error": true + }, + { + "query": "from a_index | sort numberField nulls last", + "error": false + }, + { + "query": "from a_index | sort numberField last", + "error": true + }, + { + "query": "row a = 1 | stats COUNT(*) | sort `COUNT(*)`", + "error": false + }, + { + "query": "ROW a = 1 | STATS couNt(*) | SORT `couNt(*)`", + "error": false + }, + { + "query": "from a_index | enrich", + "error": true + }, + { + "query": "from a_index | enrich _", + "error": true + }, + { + "query": "from a_index | enrich _:", + "error": true + }, + { + "query": "from a_index | enrich _:policy", + "error": true + }, + { + "query": "from a_index | enrich :policy", + "error": true + }, + { + "query": "from a_index | enrich any:", + "error": true + }, + { + "query": "from a_index | enrich _any:", + "error": true + }, + { + "query": "from a_index | enrich any:policy", + "error": true + }, + { + "query": "from a_index | enrich policy ", + "error": false + }, + { + "query": "from a_index | enrich `this``is fine`", + "error": true + }, + { + "query": "from a_index | enrich this is fine", + "error": true + }, + { + "query": "from a_index | enrich _any:policy ", + "error": false + }, + { + "query": "from a_index | enrich _any : policy ", + "error": true + }, + { + "query": "from a_index | enrich _any: policy ", + "error": true + }, + { + "query": "from a_index | enrich _any:policy ", + "error": false + }, + { + "query": "from a_index | enrich _ANY:policy ", + "error": false + }, + { + "query": "from a_index | enrich _coordinator:policy ", + "error": false + }, + { + "query": "from a_index | enrich _coordinator : policy ", + "error": true + }, + { + "query": "from a_index | enrich _coordinator: policy ", + "error": true + }, + { + "query": "from a_index | enrich _coordinator:policy ", + "error": false + }, + { + "query": "from a_index | enrich _COORDINATOR:policy ", + "error": false + }, + { + "query": "from a_index | enrich _remote:policy ", + "error": false + }, + { + "query": "from a_index | enrich _remote : policy ", + "error": true + }, + { + "query": "from a_index | enrich _remote: policy ", + "error": true + }, + { + "query": "from a_index | enrich _remote:policy ", + "error": false + }, + { + "query": "from a_index | enrich _REMOTE:policy ", + "error": false + }, + { + "query": "from a_index | enrich _unknown:policy", + "error": true + }, + { + "query": "from a_index |enrich missing-policy ", + "error": true + }, + { + "query": "from a_index |enrich policy on ", + "error": true + }, + { + "query": "from a_index | enrich policy on b ", + "error": true + }, + { + "query": "from a_index | enrich policy on `this``is fine`", + "error": true + }, + { + "query": "from a_index | enrich policy on this is fine", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with ", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with var0 ", + "error": true + }, + { + "query": "from a_index |enrich policy on numberField with var0 = ", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with var0 = c ", + "error": true + }, + { + "query": "from a_index |enrich policy on numberField with var0 = , ", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with var0 = otherField, var1 ", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with var0 = otherField ", + "error": false + }, + { + "query": "from a_index | enrich policy on stringField with var0 = otherField, yetAnotherField ", + "error": false + }, + { + "query": "from a_index |enrich policy on numberField with var0 = otherField, var1 = ", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with var0 = otherField, var1 = yetAnotherField", + "error": false + }, + { + "query": "from a_index | enrich policy on stringField with var0 = otherField, `this``is fine` = yetAnotherField", + "error": false + }, + { + "query": "from a_index | enrich policy with ", + "error": true + }, + { + "query": "from a_index | enrich policy with otherField", + "error": false + }, + { + "query": "from a_index | enrich policy | eval otherField", + "error": false + }, + { + "query": "from a_index | enrich policy with var0 = otherField | eval var0", + "error": false + }, + { + "query": "from a_index | enrich my-pol*", + "error": true + }, + { + "query": "from a_index | eval stringField = 5", + "error": false + }, + { + "query": "from a_index | eval numberField = \"5\"", + "error": false + } + ] +} \ No newline at end of file diff --git a/packages/kbn-monaco/src/esql/lib/ast/validation/validation.test.ts b/packages/kbn-monaco/src/esql/lib/ast/validation/validation.test.ts index 1219637a563dd..e1c67272b0640 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/validation/validation.test.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/validation/validation.test.ts @@ -8,8 +8,8 @@ import { CharStreams } from 'antlr4ts'; import { getParser, ROOT_STATEMENT } from '../../antlr_facade'; -// import { mathCommandDefinition } from '../../autocomplete/autocomplete_definitions'; -// import { getDurationItemsWithQuantifier } from '../../autocomplete/helpers'; +import { join } from 'path'; +import { writeFile } from 'fs/promises'; import { AstListener } from '../ast_factory'; import { validateAst } from './validation'; import { ESQLAst } from '../types'; @@ -254,6 +254,31 @@ function generateWrongMappingForArgs( } describe('validation logic', () => { + const testCases: Array<{ query: string; error: boolean }> = []; + + afterAll(async () => { + const targetFolder = join(__dirname, 'esql_validation_meta_tests.json'); + try { + await writeFile( + targetFolder, + JSON.stringify( + { + indexes, + fields: fields.concat([{ name: policies[0].matchField, type: 'keyword' }]), + enrichFields: enrichFields.concat([{ name: policies[0].matchField, type: 'keyword' }]), + policies, + unsupported_field, + testCases, + }, + null, + 2 + ) + ); + } catch (e) { + throw new Error(`Error writing test cases to ${targetFolder}: ${e.message}`); + } + }); + const getAstAndErrors = async ( text: string | undefined ): Promise<{ @@ -279,6 +304,8 @@ describe('validation logic', () => { { only, skip }: { only?: boolean; skip?: boolean } = {} ) { const testFn = only ? it.only : skip ? it.skip : it; + testCases.push({ query: statement, error: Boolean(expectedErrors.length) }); + testFn( `${statement} => ${expectedErrors.length} errors, ${expectedWarnings.length} warnings`, async () => { diff --git a/test/api_integration/apis/esql/errors.ts b/test/api_integration/apis/esql/errors.ts new file mode 100644 index 0000000000000..8aca4b704ce42 --- /dev/null +++ b/test/api_integration/apis/esql/errors.ts @@ -0,0 +1,263 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import Fs from 'fs'; +import Path from 'path'; +import expect from '@kbn/expect'; +import { MappingProperty } from '@elastic/elasticsearch/lib/api/types'; +import { REPO_ROOT } from '@kbn/repo-info'; +import uniqBy from 'lodash/uniqBy'; +import { groupBy, mapValues } from 'lodash'; +import { FtrProviderContext } from '../../ftr_provider_context'; + +function getConfigPath() { + return Path.resolve( + REPO_ROOT, + 'packages', + 'kbn-monaco', + 'src', + 'esql', + 'lib', + 'ast', + 'validation' + ); +} + +function getSetupPath() { + return Path.resolve(getConfigPath(), 'esql_validation_meta_tests.json'); +} + +function getMissmatchedPath() { + return Path.resolve(getConfigPath(), 'esql_validation_missmatches.json'); +} + +function readSetupFromESQLPackage() { + const esqlPackagePath = getSetupPath(); + const json = Fs.readFileSync(esqlPackagePath, 'utf8'); + const esqlPackage = JSON.parse(json); + return esqlPackage; +} + +function createIndexRequest( + index: string, + fields: Array<{ name: string; type: string }>, + stringType: 'text' | 'keyword', + numberType: 'integer' | 'double' | 'long' | 'unsigned_long' +) { + return { + index, + mappings: { + properties: fields.reduce( + (memo: Record, { name, type }: { name: string; type: string }) => { + let esType = type; + if (type === 'string') { + esType = stringType; + } + if (type === 'number') { + esType = numberType; + } + if (type === 'cartesian_point') { + esType = 'point'; + } + if (type === 'unsupported') { + esType = 'integer_range'; + } + memo[name] = { type: esType } as MappingProperty; + return memo; + }, + {} + ), + }, + }; +} + +interface JSONConfig { + testCases: Array<{ query: string; error: boolean }>; + indexes: string[]; + policies: Array<{ + name: string; + sourceIndices: string[]; + matchField: string; + enrichFields: string[]; + }>; + unsupported_field: Array<{ name: string; type: string }>; + fields: Array<{ name: string; type: string }>; + enrichFields: Array<{ name: string; type: string }>; +} + +export interface EsqlResultColumn { + name: string; + type: string; +} + +export type EsqlResultRow = Array; + +export interface EsqlTable { + columns: EsqlResultColumn[]; + values: EsqlResultRow[]; +} + +function parseConfig(config: JSONConfig) { + return { + queryToErrors: config.testCases, + indexes: config.indexes, + policies: config.policies.map(({ name }: { name: string }) => name), + }; +} + +export default function ({ getService }: FtrProviderContext) { + const es = getService('es'); + const log = getService('log'); + + // Send raw ES|QL query directly to ES endpoint bypassing Kibana + // as we do not need more overhead here + async function sendESQLQuery(query: string): Promise<{ + resp: EsqlTable | undefined; + error: { message: string } | undefined; + }> { + try { + const resp = await es.transport.request({ + method: 'POST', + path: '/_query', + body: { + query, + }, + }); + return { resp, error: undefined }; + } catch (e) { + return { resp: undefined, error: { message: e.meta.body.error.root_cause[0].reason } }; + } + } + + describe('error messages', () => { + const config = readSetupFromESQLPackage(); + const { queryToErrors, indexes, policies } = parseConfig(config); + const missmatches: Array<{ query: string; error: string }> = []; + // Swap these for DEBUG/further investigation on ES bugs + const stringVariants = ['text', 'keyword'] as const; + const numberVariants = ['integer', 'long', 'double', 'long'] as const; + + async function cleanup() { + // clean it up all indexes and policies + log.info(`cleaning up all indexes: ${indexes.join(', ')}`); + await es.indices.delete({ index: indexes, ignore_unavailable: true }, { ignore: [404] }); + await es.indices.delete( + { index: config.policies[0].sourceIndices[0], ignore_unavailable: true }, + { ignore: [404] } + ); + for (const policy of policies) { + log.info(`deleting policy "${policy}"...`); + await es.enrich.deletePolicy({ name: policy }, { ignore: [404] }); + } + } + + after(async () => { + if (missmatches.length) { + const distinctMissmatches = uniqBy( + missmatches, + (missmatch) => missmatch.query + missmatch.error + ); + const missmatchesGrouped = mapValues( + groupBy(distinctMissmatches, (missmatch) => missmatch.error), + (list) => list.map(({ query }) => query) + ); + log.info(`writing ${Object.keys(missmatchesGrouped).length} missmatches to file...`); + Fs.writeFileSync(getMissmatchedPath(), JSON.stringify(missmatchesGrouped, null, 2)); + } + }); + + for (const stringFieldType of stringVariants) { + for (const numberFieldType of numberVariants) { + describe(`Using string field type: ${stringFieldType} and number field type: ${numberFieldType}`, () => { + before(async () => { + await cleanup(); + + log.info(`creating ${indexes.length} indexes...`); + + for (const index of indexes) { + // setup all indexes, mappings and policies here + log.info(`creating a index "${index}" with mapping...`); + await es.indices.create( + createIndexRequest( + index, + /unsupported/.test(index) ? config.unsupported_field : config.fields, + stringFieldType, + numberFieldType + ), + { ignore: [409] } + ); + } + + for (const { sourceIndices, matchField } of config.policies.slice(0, 1)) { + const enrichFields = [{ name: matchField, type: 'string' }].concat( + config.enrichFields + ); + log.info(`creating a index "${sourceIndices[0]}" for policy with mapping...`); + await es.indices.create( + createIndexRequest( + sourceIndices[0], + enrichFields, + stringFieldType, + numberFieldType + ), + { + ignore: [409], + } + ); + } + + log.info(`creating ${policies.length} policies...`); + for (const { name, sourceIndices, matchField, enrichFields } of config.policies) { + log.info(`creating a policy "${name}"...`); + await es.enrich.putPolicy( + { + name, + body: { + match: { + indices: sourceIndices, + match_field: matchField, + enrich_fields: enrichFields, + }, + }, + }, + { ignore: [409] } + ); + log.info(`executing policy "${name}"...`); + await es.enrich.executePolicy({ name }); + } + }); + + after(async () => { + await cleanup(); + }); + + it(`Checking error messages`, async () => { + for (const { query, error } of queryToErrors) { + const jsonBody = await sendESQLQuery(query); + + const clientSideHasError = error; + const serverSideHasError = Boolean(jsonBody.error); + + if (clientSideHasError !== serverSideHasError) { + if (clientSideHasError) { + // in this case it's a problem, so fail the test + expect().fail(`Client side errored but ES server did not: ${query}`); + } + if (serverSideHasError) { + // in this case client side validator can improve, but it's not hard failure + // rather log it as it can be a useful to investigate a bug on the ES implementation side for some type combination + missmatches.push({ query, error: jsonBody.error!.message }); + } + } + } + }); + }); + } + } + }); +} diff --git a/test/api_integration/apis/esql/index.ts b/test/api_integration/apis/esql/index.ts new file mode 100644 index 0000000000000..e280f2c2b34d5 --- /dev/null +++ b/test/api_integration/apis/esql/index.ts @@ -0,0 +1,15 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { FtrProviderContext } from '../../ftr_provider_context'; + +export default function ({ loadTestFile }: FtrProviderContext) { + describe('ESQL sync', () => { + loadTestFile(require.resolve('./errors')); + }); +} diff --git a/test/api_integration/apis/index.ts b/test/api_integration/apis/index.ts index c132970084df1..f04a96bf65f72 100644 --- a/test/api_integration/apis/index.ts +++ b/test/api_integration/apis/index.ts @@ -32,5 +32,6 @@ export default function ({ loadTestFile }: FtrProviderContext) { loadTestFile(require.resolve('./ui_counters')); loadTestFile(require.resolve('./telemetry')); loadTestFile(require.resolve('./guided_onboarding')); + loadTestFile(require.resolve('./esql')); }); }