From 18fe06fbbbd168dba8695bb6cb22161a0b12e399 Mon Sep 17 00:00:00 2001 From: Marco Liberati Date: Thu, 7 Mar 2024 13:57:27 +0100 Subject: [PATCH] [ES|QL] Fix some validation misconfiguration (#177783) ## Summary Related issue #177699 Fix variables logic for expressions at `stats by ...` level. Fix validation logic for agg functions within `eval` or `where` scope. Fix validation and autocomplete logic for nested quoted expressions * i.e. ``` from index | eval round(numberField) + 1 | eval `round(numberField) + 1` + 1 | eval ```round(numberField) + 1`` + 1` + 1 | eval ```````round(numberField) + 1```` + 1`` + 1` + 1 | eval ```````````````round(numberField) + 1```````` + 1```` + 1`` + 1` + 1 | keep ```````````````````````````````round(numberField) + 1```````````````` + 1```````` + 1```` + 1`` + 1` ``` * updated `count_distinct` agg definition to have the `precision` second optional param. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Stratoula Kalafateli (cherry picked from commit cad276fcbd9fe5b13c18f08fd01bcf0c802b7ec9) # Conflicts: # packages/kbn-monaco/src/esql/lib/ast/validation/esql_validation_meta_tests.json --- .../lib/ast/autocomplete/autocomplete.test.ts | 17 +- .../esql/lib/ast/autocomplete/autocomplete.ts | 32 +- .../esql/lib/ast/autocomplete/factories.ts | 2 +- .../src/esql/lib/ast/definitions/aggs.ts | 5 +- .../src/esql/lib/ast/shared/constants.ts | 2 +- .../src/esql/lib/ast/shared/helpers.ts | 15 +- .../src/esql/lib/ast/shared/variables.ts | 133 +- .../esql_validation_meta_tests.json | 8626 +++++++++++++++++ .../src/esql/lib/ast/validation/types.ts | 1 + .../lib/ast/validation/validation.test.ts | 165 +- .../src/esql/lib/ast/validation/validation.ts | 9 +- 11 files changed, 8910 insertions(+), 97 deletions(-) create mode 100644 packages/kbn-monaco/src/esql/lib/ast/validation/esql_validation_meta_tests.json diff --git a/packages/kbn-monaco/src/esql/lib/ast/autocomplete/autocomplete.test.ts b/packages/kbn-monaco/src/esql/lib/ast/autocomplete/autocomplete.test.ts index 960eaaeedd813..5c8bfbb22fc68 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/autocomplete/autocomplete.test.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/autocomplete/autocomplete.test.ts @@ -562,6 +562,18 @@ describe('autocomplete', () => { `from a | ${command} stringField, `, getFieldNamesByType('any').filter((name) => name !== 'stringField') ); + + testSuggestions( + `from a_index | eval round(numberField) + 1 | eval \`round(numberField) + 1\` + 1 | eval \`\`\`round(numberField) + 1\`\` + 1\` + 1 | eval \`\`\`\`\`\`\`round(numberField) + 1\`\`\`\` + 1\`\` + 1\` + 1 | eval \`\`\`\`\`\`\`\`\`\`\`\`\`\`\`round(numberField) + 1\`\`\`\`\`\`\`\` + 1\`\`\`\` + 1\`\` + 1\` + 1 | ${command} `, + [ + ...getFieldNamesByType('any'), + '`round(numberField) + 1`', + '```round(numberField) + 1`` + 1`', + '```````round(numberField) + 1```` + 1`` + 1`', + '```````````````round(numberField) + 1```````` + 1```` + 1`` + 1`', + '```````````````````````````````round(numberField) + 1```````````````` + 1```````` + 1```` + 1`` + 1`', + ] + ); }); } @@ -927,10 +939,7 @@ describe('autocomplete', () => { [ 'var0 =', ...getFieldNamesByType('any'), - // @TODO: leverage the location data to get the original text - // For now return back the trimmed version: - // the ANTLR parser trims all text so that's what it's stored in the AST - '`abs(numberField)+1`', + '`abs(numberField) + 1`', ...getFunctionSignaturesByReturnType('eval', 'any', { evalMath: true }), ], ' ' diff --git a/packages/kbn-monaco/src/esql/lib/ast/autocomplete/autocomplete.ts b/packages/kbn-monaco/src/esql/lib/ast/autocomplete/autocomplete.ts index 93ef31c0914c8..6ac334ffe6229 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/autocomplete/autocomplete.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/autocomplete/autocomplete.ts @@ -71,7 +71,7 @@ import { buildOptionDefinition, buildSettingDefinitions, } from './factories'; -import { EDITOR_MARKER } from '../shared/constants'; +import { EDITOR_MARKER, SINGLE_BACKTICK } from '../shared/constants'; import { getAstContext, removeMarkerArgFromArgsList } from '../shared/context'; import { buildQueryUntilPreviousCommand, @@ -563,7 +563,7 @@ async function getExpressionSuggestionsByType( // collect all fields + variables to suggest const fieldsMap: Map = await (argDef ? getFieldsMap() : new Map()); - const anyVariables = collectVariables(commands, fieldsMap); + const anyVariables = collectVariables(commands, fieldsMap, innerText); // enrich with assignment has some special rules who are handled somewhere else const canHaveAssignments = ['eval', 'stats', 'row'].includes(command.name); @@ -1017,13 +1017,20 @@ async function getFieldsOrFunctionsSuggestions( } // due to a bug on the ES|QL table side, filter out fields list with underscored variable names (??) // avg( numberField ) => avg_numberField_ + const ALPHANUMERIC_REGEXP = /[^a-zA-Z\d]/g; if ( filteredVariablesByType.length && - filteredVariablesByType.some((v) => /[^a-zA-Z\d]/.test(v)) + filteredVariablesByType.some((v) => ALPHANUMERIC_REGEXP.test(v)) ) { for (const variable of filteredVariablesByType) { - const underscoredName = variable.replace(/[^a-zA-Z\d]/g, '_'); - const index = filteredFieldsByType.findIndex(({ label }) => underscoredName === label); + // remove backticks if present + const sanitizedVariable = variable.startsWith(SINGLE_BACKTICK) + ? variable.slice(1, variable.length - 1) + : variable; + const underscoredName = sanitizedVariable.replace(ALPHANUMERIC_REGEXP, '_'); + const index = filteredFieldsByType.findIndex( + ({ label }) => underscoredName === label || `_${underscoredName}_` === label + ); if (index >= 0) { filteredFieldsByType.splice(index); } @@ -1067,7 +1074,8 @@ async function getFunctionArgsSuggestions( const variablesExcludingCurrentCommandOnes = excludeVariablesFromCurrentCommand( commands, command, - fieldsMap + fieldsMap, + innerText ); // pick the type of the next arg const shouldGetNextArgument = node.text.includes(EDITOR_MARKER); @@ -1102,7 +1110,10 @@ async function getFunctionArgsSuggestions( const isUnknownColumn = arg && isColumnItem(arg) && - !columnExists(arg, { fields: fieldsMap, variables: variablesExcludingCurrentCommandOnes }).hit; + !columnExists(arg, { + fields: fieldsMap, + variables: variablesExcludingCurrentCommandOnes, + }).hit; if (noArgDefined || isUnknownColumn) { const commandArgIndex = command.args.findIndex( (cmdArg) => isSingleItem(cmdArg) && cmdArg.location.max >= node.location.max @@ -1213,7 +1224,7 @@ async function getListArgsSuggestions( // so extract the type of the first argument and suggest fields of that type if (node && isFunctionItem(node)) { const fieldsMap: Map = await getFieldsMaps(); - const anyVariables = collectVariables(commands, fieldsMap); + const anyVariables = collectVariables(commands, fieldsMap, innerText); // extract the current node from the variables inferred anyVariables.forEach((values, key) => { if (values.some((v) => v.location === node.location)) { @@ -1301,7 +1312,7 @@ async function getOptionArgsSuggestions( const isNewExpression = isRestartingExpression(innerText) || option.args.length === 0; const fieldsMap = await getFieldsMaps(); - const anyVariables = collectVariables(commands, fieldsMap); + const anyVariables = collectVariables(commands, fieldsMap, innerText); const references = { fields: fieldsMap, @@ -1339,7 +1350,8 @@ async function getOptionArgsSuggestions( const policyMetadata = await getPolicyMetadata(policyName); const anyEnhancedVariables = collectVariables( commands, - appendEnrichFields(fieldsMap, policyMetadata) + appendEnrichFields(fieldsMap, policyMetadata), + innerText ); if (isNewExpression) { diff --git a/packages/kbn-monaco/src/esql/lib/ast/autocomplete/factories.ts b/packages/kbn-monaco/src/esql/lib/ast/autocomplete/factories.ts index 312bd981298eb..a51a754ef1b2e 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/autocomplete/factories.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/autocomplete/factories.ts @@ -129,7 +129,7 @@ export const buildFieldsDefinitions = (fields: string[]): AutocompleteCommandDef export const buildVariablesDefinitions = (variables: string[]): AutocompleteCommandDefinition[] => variables.map((label) => ({ label, - insertText: getSafeInsertText(label), + insertText: label, kind: 4, detail: i18n.translate('monaco.esql.autocomplete.variableDefinition', { defaultMessage: `Variable specified by the user within the ES|QL query`, diff --git a/packages/kbn-monaco/src/esql/lib/ast/definitions/aggs.ts b/packages/kbn-monaco/src/esql/lib/ast/definitions/aggs.ts index c0b3dcd97c787..36615b265dbc1 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/definitions/aggs.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/definitions/aggs.ts @@ -125,7 +125,10 @@ export const statsAggregationFunctionDefinitions: FunctionDefinition[] = [ supportedCommands: ['stats'], signatures: [ { - params: [{ name: 'column', type: 'any', noNestingFunctions: true }], + params: [ + { name: 'column', type: 'any', noNestingFunctions: true }, + { name: 'precision', type: 'number', noNestingFunctions: true, optional: true }, + ], returnType: 'number', examples: [ `from index | stats result = count_distinct(field)`, diff --git a/packages/kbn-monaco/src/esql/lib/ast/shared/constants.ts b/packages/kbn-monaco/src/esql/lib/ast/shared/constants.ts index fffd8af2f68ec..ed4e854f95e97 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/shared/constants.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/shared/constants.ts @@ -8,7 +8,7 @@ export const EDITOR_MARKER = 'marker_esql_editor'; -export const TICKS_REGEX = /^(`)|(`)$/g; +export const TICKS_REGEX = /^`{1}|`{1}$/g; export const DOUBLE_TICKS_REGEX = /``/g; export const SINGLE_TICK_REGEX = /`/g; export const SINGLE_BACKTICK = '`'; diff --git a/packages/kbn-monaco/src/esql/lib/ast/shared/helpers.ts b/packages/kbn-monaco/src/esql/lib/ast/shared/helpers.ts index 7060ce40aecc2..93826be54bf5b 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/shared/helpers.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/shared/helpers.ts @@ -352,7 +352,8 @@ export function isEqualType( item: ESQLSingleAstItem, argDef: SignatureArgType, references: ReferenceMaps, - parentCommand?: string + parentCommand?: string, + nameHit?: string ) { const argType = 'innerType' in argDef && argDef.innerType ? argDef.innerType : argDef.type; if (argType === 'any') { @@ -375,10 +376,8 @@ export function isEqualType( // anything goes, so avoid any effort here return true; } - // perform a double check, but give priority to the non trimmed version - const hit = getColumnHit(item.name, references); - const hitTrimmed = getColumnHit(item.name.replace(/\s/g, ''), references); - const validHit = hit || hitTrimmed; + const hit = getColumnHit(nameHit ?? item.name, references); + const validHit = hit; if (!validHit) { return false; } @@ -445,9 +444,9 @@ export function columnExists( return { hit: true, nameHit: column.name }; } if (column.quoted) { - const trimmedName = column.name.replace(/`/g, '``').replace(/\s/g, ''); - if (variables.has(trimmedName)) { - return { hit: true, nameHit: trimmedName }; + const originalName = column.text; + if (variables.has(originalName)) { + return { hit: true, nameHit: originalName }; } } if ( diff --git a/packages/kbn-monaco/src/esql/lib/ast/shared/variables.ts b/packages/kbn-monaco/src/esql/lib/ast/shared/variables.ts index 6dd05b788d4d2..f6f8d1cfaf3dd 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/shared/variables.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/shared/variables.ts @@ -6,9 +6,9 @@ * Side Public License, v 1. */ -import type { ESQLColumn, ESQLAstItem, ESQLCommand, ESQLCommandOption } from '../types'; +import type { ESQLAstItem, ESQLCommand, ESQLCommandOption, ESQLFunction } from '../types'; import type { ESQLVariable, ESQLRealField } from '../validation/types'; -import { DOUBLE_TICKS_REGEX, EDITOR_MARKER, SINGLE_BACKTICK, TICKS_REGEX } from './constants'; +import { DOUBLE_BACKTICK, EDITOR_MARKER, SINGLE_BACKTICK } from './constants'; import { isColumnItem, isAssignment, @@ -26,21 +26,6 @@ function addToVariableOccurrencies(variables: Map, insta variablesOccurrencies.push(instance); } -function replaceTrimmedVariable( - variables: Map, - newRef: ESQLColumn, - oldRef: ESQLVariable[] -) { - // now replace the existing trimmed version with this original one - addToVariableOccurrencies(variables, { - name: newRef.name, - type: oldRef[0].type, - location: newRef.location, - }); - // remove the trimmed one - variables.delete(oldRef[0].name); -} - function addToVariables( oldArg: ESQLAstItem, newArg: ESQLAstItem, @@ -55,20 +40,11 @@ function addToVariables( }; // Now workout the exact type // it can be a rename of another variable as well - let oldRef = fields.get(oldArg.name) || variables.get(oldArg.name); + const oldRef = + fields.get(oldArg.name) || variables.get(oldArg.quoted ? oldArg.text : oldArg.name); if (oldRef) { addToVariableOccurrencies(variables, newVariable); newVariable.type = Array.isArray(oldRef) ? oldRef[0].type : oldRef.type; - } else if (oldArg.quoted) { - // a last attempt in case the user tried to rename an expression: - // trim every space and try a new hit - const expressionTrimmedRef = oldArg.name.replace(/\s/g, ''); - oldRef = variables.get(expressionTrimmedRef); - if (oldRef) { - addToVariableOccurrencies(variables, newVariable); - newVariable.type = oldRef[0].type; - replaceTrimmedVariable(variables, oldArg, oldRef); - } } } } @@ -99,10 +75,11 @@ function getAssignRightHandSideType(item: ESQLAstItem, fields: Map + fieldsMap: Map, + queryString: string ) { - const anyVariables = collectVariables(commands, fieldsMap); - const currentCommandVariables = collectVariables([currentCommand], fieldsMap); + const anyVariables = collectVariables(commands, fieldsMap, queryString); + const currentCommandVariables = collectVariables([currentCommand], fieldsMap, queryString); const resultVariables = new Map(); anyVariables.forEach((value, key) => { if (!currentCommandVariables.has(key)) { @@ -112,36 +89,65 @@ export function excludeVariablesFromCurrentCommand( return resultVariables; } +function extractExpressionAsQuotedVariable( + originalQuery: string, + location: { min: number; max: number } +) { + const extractExpressionText = originalQuery.substring(location.min, location.max + 1); + // now inject quotes and save it as variable + return `\`${extractExpressionText.replaceAll(SINGLE_BACKTICK, DOUBLE_BACKTICK)}\``; +} + +function addVariableFromAssignment( + assignOperation: ESQLFunction, + variables: Map, + fields: Map +) { + if (isColumnItem(assignOperation.args[0])) { + const rightHandSideArgType = getAssignRightHandSideType(assignOperation.args[1], fields); + addToVariableOccurrencies(variables, { + name: assignOperation.args[0].name, + type: rightHandSideArgType || 'number' /* fallback to number */, + location: assignOperation.args[0].location, + }); + } +} + +function addVariableFromExpression( + expressionOperation: ESQLFunction, + queryString: string, + variables: Map +) { + if (!expressionOperation.text.includes(EDITOR_MARKER)) { + // save the variable in its quoted usable way + // (a bit of forward thinking here to simplyfy lookups later) + const forwardThinkingVariableName = extractExpressionAsQuotedVariable( + queryString, + expressionOperation.location + ); + const expressionType = 'number'; + addToVariableOccurrencies(variables, { + name: forwardThinkingVariableName, + type: expressionType, + location: expressionOperation.location, + }); + } +} + export function collectVariables( commands: ESQLCommand[], - fields: Map + fields: Map, + queryString: string ): Map { const variables = new Map(); for (const command of commands) { if (['row', 'eval', 'stats'].includes(command.name)) { - const assignOperations = command.args.filter(isAssignment); - for (const assignOperation of assignOperations) { - if (isColumnItem(assignOperation.args[0])) { - const rightHandSideArgType = getAssignRightHandSideType(assignOperation.args[1], fields); - addToVariableOccurrencies(variables, { - name: assignOperation.args[0].name, - type: rightHandSideArgType || 'number' /* fallback to number */, - location: assignOperation.args[0].location, - }); + for (const arg of command.args) { + if (isAssignment(arg)) { + addVariableFromAssignment(arg, variables, fields); } - } - const expressionOperations = command.args.filter(isExpression); - for (const expressionOperation of expressionOperations) { - if (!expressionOperation.text.includes(EDITOR_MARKER)) { - // just save the entire expression as variable string - const expressionType = 'number'; - addToVariableOccurrencies(variables, { - name: expressionOperation.text - .replace(TICKS_REGEX, '') - .replace(DOUBLE_TICKS_REGEX, SINGLE_BACKTICK), - type: expressionType, - location: expressionOperation.location, - }); + if (isExpression(arg)) { + addVariableFromExpression(arg, queryString, variables); } } if (command.name === 'stats') { @@ -149,18 +155,12 @@ export function collectVariables( (arg) => isOptionItem(arg) && arg.name === 'by' ) as ESQLCommandOption[]; for (const commandOption of commandOptionsWithAssignment) { - const optionAssignOperations = commandOption.args.filter(isAssignment); - for (const assignOperation of optionAssignOperations) { - if (isColumnItem(assignOperation.args[0])) { - const rightHandSideArgType = getAssignRightHandSideType( - assignOperation.args[1], - fields - ); - addToVariableOccurrencies(variables, { - name: assignOperation.args[0].name, - type: rightHandSideArgType || 'number' /* fallback to number */, - location: assignOperation.args[0].location, - }); + for (const optArg of commandOption.args) { + if (isAssignment(optArg)) { + addVariableFromAssignment(optArg, variables, fields); + } + if (isExpression(optArg)) { + addVariableFromExpression(optArg, queryString, variables); } } } @@ -171,6 +171,7 @@ export function collectVariables( (arg) => isOptionItem(arg) && arg.name === 'with' ) as ESQLCommandOption[]; for (const commandOption of commandOptionsWithAssignment) { + // Enrich assignment has some special behaviour, so do not use the version above here... for (const assignFn of commandOption.args) { if (isFunctionItem(assignFn)) { const [newArg, oldArg] = assignFn?.args || []; diff --git a/packages/kbn-monaco/src/esql/lib/ast/validation/esql_validation_meta_tests.json b/packages/kbn-monaco/src/esql/lib/ast/validation/esql_validation_meta_tests.json new file mode 100644 index 0000000000000..6a6331d9c0bce --- /dev/null +++ b/packages/kbn-monaco/src/esql/lib/ast/validation/esql_validation_meta_tests.json @@ -0,0 +1,8626 @@ +{ + "indexes": [ + "a_index", + "index", + "other_index", + ".secret_index", + "my-index", + "unsupported_index" + ], + "fields": [ + { + "name": "numberField", + "type": "number" + }, + { + "name": "dateField", + "type": "date" + }, + { + "name": "booleanField", + "type": "boolean" + }, + { + "name": "ipField", + "type": "ip" + }, + { + "name": "stringField", + "type": "string" + }, + { + "name": "cartesianPointField", + "type": "cartesian_point" + }, + { + "name": "geoPointField", + "type": "geo_point" + }, + { + "name": "any#Char$Field", + "type": "number" + }, + { + "name": "kubernetes.something.something", + "type": "number" + }, + { + "name": "@timestamp", + "type": "date" + }, + { + "name": "otherStringField", + "type": "keyword" + } + ], + "enrichFields": [ + { + "name": "otherField", + "type": "string" + }, + { + "name": "yetAnotherField", + "type": "number" + }, + { + "name": "otherStringField", + "type": "keyword" + } + ], + "policies": [ + { + "name": "policy", + "sourceIndices": [ + "enrich_index" + ], + "matchField": "otherStringField", + "enrichFields": [ + "otherField", + "yetAnotherField" + ] + }, + { + "name": "policy$", + "sourceIndices": [ + "enrich_index" + ], + "matchField": "otherStringField", + "enrichFields": [ + "otherField", + "yetAnotherField" + ] + } + ], + "unsupported_field": [ + { + "name": "unsupported_field", + "type": "unsupported" + } + ], + "testCases": [ + { + "query": "eval", + "error": true + }, + { + "query": "stats", + "error": true + }, + { + "query": "rename", + "error": true + }, + { + "query": "limit", + "error": true + }, + { + "query": "keep", + "error": true + }, + { + "query": "drop", + "error": true + }, + { + "query": "mv_expand", + "error": true + }, + { + "query": "dissect", + "error": true + }, + { + "query": "grok", + "error": true + }, + { + "query": "f", + "error": true + }, + { + "query": "from ", + "error": true + }, + { + "query": "from index,", + "error": true + }, + { + "query": "from assignment = 1", + "error": true + }, + { + "query": "from index", + "error": false + }, + { + "query": "FROM index", + "error": false + }, + { + "query": "FrOm index", + "error": false + }, + { + "query": "from `index`", + "error": false + }, + { + "query": "from index, other_index", + "error": false + }, + { + "query": "from index, missingIndex", + "error": true + }, + { + "query": "from fn()", + "error": true + }, + { + "query": "from average()", + "error": true + }, + { + "query": "from index [METADATA _id]", + "error": false + }, + { + "query": "from index [metadata _id]", + "error": false + }, + { + "query": "from index [METADATA _id, _source]", + "error": false + }, + { + "query": "from index [METADATA _id, _source2]", + "error": true + }, + { + "query": "from index [metadata _id, _source] [METADATA _id2]", + "error": true + }, + { + "query": "from remote-ccs:indexes [METADATA _id]", + "error": false + }, + { + "query": "from *:indexes [METADATA _id]", + "error": false + }, + { + "query": "from index METADATA _id", + "error": false + }, + { + "query": "from index metadata _id", + "error": false + }, + { + "query": "from index METADATA _id, _source", + "error": false + }, + { + "query": "from index METADATA _id, _source2", + "error": true + }, + { + "query": "from index metadata _id, _source METADATA _id2", + "error": true + }, + { + "query": "from remote-ccs:indexes METADATA _id", + "error": false + }, + { + "query": "from *:indexes METADATA _id", + "error": false + }, + { + "query": "from index (metadata _id)", + "error": true + }, + { + "query": "from ind*, other*", + "error": false + }, + { + "query": "from index*", + "error": false + }, + { + "query": "from *ex", + "error": false + }, + { + "query": "from in*ex", + "error": false + }, + { + "query": "from ind*ex", + "error": false + }, + { + "query": "from indexes*", + "error": true + }, + { + "query": "from remote-*:indexes*", + "error": false + }, + { + "query": "from remote-*:indexes", + "error": false + }, + { + "query": "from remote-ccs:indexes", + "error": false + }, + { + "query": "from a_index, remote-ccs:indexes", + "error": false + }, + { + "query": "from .secret_index", + "error": false + }, + { + "query": "from my-index", + "error": false + }, + { + "query": "from numberField", + "error": true + }, + { + "query": "from policy", + "error": true + }, + { + "query": "row", + "error": true + }, + { + "query": "row missing_column", + "error": true + }, + { + "query": "row fn()", + "error": true + }, + { + "query": "row missing_column, missing_column2", + "error": true + }, + { + "query": "row a=1", + "error": false + }, + { + "query": "row a=1, missing_column", + "error": true + }, + { + "query": "row a=1, b = average()", + "error": true + }, + { + "query": "row a = [1, 2, 3]", + "error": false + }, + { + "query": "row a = [true, false]", + "error": false + }, + { + "query": "row a = [\"a\", \"b\"]", + "error": false + }, + { + "query": "row a = null", + "error": false + }, + { + "query": "row a = (1)", + "error": false + }, + { + "query": "row a = (1, 2, 3)", + "error": true + }, + { + "query": "row a=NOT true", + "error": false + }, + { + "query": "row NOT true", + "error": false + }, + { + "query": "row a=NOT false", + "error": false + }, + { + "query": "row NOT false", + "error": false + }, + { + "query": "row var = 1 in ", + "error": true + }, + { + "query": "row var = 1 in (", + "error": true + }, + { + "query": "row var = 1 not in ", + "error": true + }, + { + "query": "row var = 1 in (1, 2, 3)", + "error": false + }, + { + "query": "row var = 5 in (1, 2, 3)", + "error": false + }, + { + "query": "row var = 5 not in (1, 2, 3)", + "error": false + }, + { + "query": "row var = 1 in (1, 2, 3, round(5))", + "error": false + }, + { + "query": "row var = \"a\" in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "row var = \"a\" in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "row var = \"a\" not in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "row var = 1 in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "row var = 5 in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "row var = 5 not in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "row var = 5 not in (1, 2, 3, \"a\")", + "error": true + }, + { + "query": "row var = abs(5)", + "error": false + }, + { + "query": "row abs(5)", + "error": false + }, + { + "query": "row var = abs(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = abs(\"a\")", + "error": true + }, + { + "query": "row var = acos(5)", + "error": false + }, + { + "query": "row acos(5)", + "error": false + }, + { + "query": "row var = acos(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = acos(\"a\")", + "error": true + }, + { + "query": "row var = asin(5)", + "error": false + }, + { + "query": "row asin(5)", + "error": false + }, + { + "query": "row var = asin(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = asin(\"a\")", + "error": true + }, + { + "query": "row var = atan(5)", + "error": false + }, + { + "query": "row atan(5)", + "error": false + }, + { + "query": "row var = atan(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = atan(\"a\")", + "error": true + }, + { + "query": "row var = atan2(5, 5)", + "error": false + }, + { + "query": "row atan2(5, 5)", + "error": false + }, + { + "query": "row var = atan2(to_integer(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = atan2(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = auto_bucket(now(), 5, \"a\", \"a\")", + "error": false + }, + { + "query": "row auto_bucket(now(), 5, \"a\", \"a\")", + "error": false + }, + { + "query": "row var = auto_bucket(now(), 5, 5, 5)", + "error": false + }, + { + "query": "row auto_bucket(now(), 5, 5, 5)", + "error": false + }, + { + "query": "row var = case(true, \"a\", \"a\", \"a\")", + "error": false + }, + { + "query": "row case(true, \"a\", \"a\", \"a\")", + "error": false + }, + { + "query": "row var = ceil(5)", + "error": false + }, + { + "query": "row ceil(5)", + "error": false + }, + { + "query": "row var = ceil(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = ceil(\"a\")", + "error": true + }, + { + "query": "row var = cidr_match(to_ip(\"127.0.0.1\"), \"a\", \"a\")", + "error": false + }, + { + "query": "row cidr_match(to_ip(\"127.0.0.1\"), \"a\", \"a\")", + "error": false + }, + { + "query": "row var = cidr_match(to_ip(\"a\"), to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = cidr_match(\"a\", 5, 5)", + "error": true + }, + { + "query": "row var = coalesce(\"a\")", + "error": false + }, + { + "query": "row coalesce(\"a\")", + "error": false + }, + { + "query": "row var = concat(\"a\", \"a\", \"a\")", + "error": false + }, + { + "query": "row concat(\"a\", \"a\", \"a\")", + "error": false + }, + { + "query": "row var = concat(to_string(\"a\"), to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = concat(5, 5, 5)", + "error": true + }, + { + "query": "row var = cos(5)", + "error": false + }, + { + "query": "row cos(5)", + "error": false + }, + { + "query": "row var = cos(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = cos(\"a\")", + "error": true + }, + { + "query": "row var = cosh(5)", + "error": false + }, + { + "query": "row cosh(5)", + "error": false + }, + { + "query": "row var = cosh(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = cosh(\"a\")", + "error": true + }, + { + "query": "row var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", now())", + "error": false + }, + { + "query": "row date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", now())", + "error": false + }, + { + "query": "row var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(\"a\"))", + "error": false + }, + { + "query": "row var = date_extract(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = date_format(now(), \"a\")", + "error": false + }, + { + "query": "row date_format(now(), \"a\")", + "error": false + }, + { + "query": "row var = date_format(to_datetime(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = date_format(\"a\", 5)", + "error": true + }, + { + "query": "row var = date_parse(\"a\", \"a\")", + "error": false + }, + { + "query": "row date_parse(\"a\", \"a\")", + "error": false + }, + { + "query": "row var = date_parse(to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = date_parse(5, 5)", + "error": true + }, + { + "query": "row var = date_trunc(1 year, now())", + "error": false + }, + { + "query": "row date_trunc(1 year, now())", + "error": false + }, + { + "query": "row var = date_trunc(1 year, to_datetime(\"a\"))", + "error": false + }, + { + "query": "row var = date_trunc(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = e()", + "error": false + }, + { + "query": "row e()", + "error": false + }, + { + "query": "row var = e()", + "error": false + }, + { + "query": "row var = e()", + "error": false + }, + { + "query": "row var = ends_with(\"a\", \"a\")", + "error": false + }, + { + "query": "row ends_with(\"a\", \"a\")", + "error": false + }, + { + "query": "row var = ends_with(to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = ends_with(5, 5)", + "error": true + }, + { + "query": "row var = floor(5)", + "error": false + }, + { + "query": "row floor(5)", + "error": false + }, + { + "query": "row var = floor(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = floor(\"a\")", + "error": true + }, + { + "query": "row var = greatest(\"a\")", + "error": false + }, + { + "query": "row greatest(\"a\")", + "error": false + }, + { + "query": "row var = least(\"a\")", + "error": false + }, + { + "query": "row least(\"a\")", + "error": false + }, + { + "query": "row var = left(\"a\", 5)", + "error": false + }, + { + "query": "row left(\"a\", 5)", + "error": false + }, + { + "query": "row var = left(to_string(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = left(5, \"a\")", + "error": true + }, + { + "query": "row var = length(\"a\")", + "error": false + }, + { + "query": "row length(\"a\")", + "error": false + }, + { + "query": "row var = length(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = length(5)", + "error": true + }, + { + "query": "row var = log(5, 5)", + "error": false + }, + { + "query": "row log(5, 5)", + "error": false + }, + { + "query": "row var = log(to_integer(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = log(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = log10(5)", + "error": false + }, + { + "query": "row log10(5)", + "error": false + }, + { + "query": "row var = log10(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = log10(\"a\")", + "error": true + }, + { + "query": "row var = ltrim(\"a\")", + "error": false + }, + { + "query": "row ltrim(\"a\")", + "error": false + }, + { + "query": "row var = ltrim(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = ltrim(5)", + "error": true + }, + { + "query": "row var = mv_avg(5)", + "error": false + }, + { + "query": "row mv_avg(5)", + "error": false + }, + { + "query": "row var = mv_avg(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = mv_avg(\"a\")", + "error": true + }, + { + "query": "row var = mv_concat(\"a\", \"a\")", + "error": false + }, + { + "query": "row mv_concat(\"a\", \"a\")", + "error": false + }, + { + "query": "row var = mv_concat(to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = mv_concat(5, 5)", + "error": true + }, + { + "query": "row var = mv_count(\"a\")", + "error": false + }, + { + "query": "row mv_count(\"a\")", + "error": false + }, + { + "query": "row var = mv_dedupe(\"a\")", + "error": false + }, + { + "query": "row mv_dedupe(\"a\")", + "error": false + }, + { + "query": "row var = mv_first(\"a\")", + "error": false + }, + { + "query": "row mv_first(\"a\")", + "error": false + }, + { + "query": "row var = mv_last(\"a\")", + "error": false + }, + { + "query": "row mv_last(\"a\")", + "error": false + }, + { + "query": "row var = mv_max(\"a\")", + "error": false + }, + { + "query": "row mv_max(\"a\")", + "error": false + }, + { + "query": "row var = mv_median(5)", + "error": false + }, + { + "query": "row mv_median(5)", + "error": false + }, + { + "query": "row var = mv_median(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = mv_median(\"a\")", + "error": true + }, + { + "query": "row var = mv_min(\"a\")", + "error": false + }, + { + "query": "row mv_min(\"a\")", + "error": false + }, + { + "query": "row var = mv_sum(5)", + "error": false + }, + { + "query": "row mv_sum(5)", + "error": false + }, + { + "query": "row var = mv_sum(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = mv_sum(\"a\")", + "error": true + }, + { + "query": "row var = now()", + "error": false + }, + { + "query": "row now()", + "error": false + }, + { + "query": "row var = now()", + "error": false + }, + { + "query": "row var = now()", + "error": false + }, + { + "query": "row var = pi()", + "error": false + }, + { + "query": "row pi()", + "error": false + }, + { + "query": "row var = pi()", + "error": false + }, + { + "query": "row var = pi()", + "error": false + }, + { + "query": "row var = pow(5, 5)", + "error": false + }, + { + "query": "row pow(5, 5)", + "error": false + }, + { + "query": "row var = pow(to_integer(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = pow(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = replace(\"a\", \"a\", \"a\")", + "error": false + }, + { + "query": "row replace(\"a\", \"a\", \"a\")", + "error": false + }, + { + "query": "row var = replace(to_string(\"a\"), to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = replace(5, 5, 5)", + "error": true + }, + { + "query": "row var = right(\"a\", 5)", + "error": false + }, + { + "query": "row right(\"a\", 5)", + "error": false + }, + { + "query": "row var = right(to_string(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = right(5, \"a\")", + "error": true + }, + { + "query": "row var = round(5, 5)", + "error": false + }, + { + "query": "row round(5, 5)", + "error": false + }, + { + "query": "row var = round(to_integer(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = round(\"a\", \"a\")", + "error": true + }, + { + "query": "row var = rtrim(\"a\")", + "error": false + }, + { + "query": "row rtrim(\"a\")", + "error": false + }, + { + "query": "row var = rtrim(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = rtrim(5)", + "error": true + }, + { + "query": "row var = sin(5)", + "error": false + }, + { + "query": "row sin(5)", + "error": false + }, + { + "query": "row var = sin(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = sin(\"a\")", + "error": true + }, + { + "query": "row var = sinh(5)", + "error": false + }, + { + "query": "row sinh(5)", + "error": false + }, + { + "query": "row var = sinh(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = sinh(\"a\")", + "error": true + }, + { + "query": "row var = split(\"a\", \"a\")", + "error": false + }, + { + "query": "row split(\"a\", \"a\")", + "error": false + }, + { + "query": "row var = split(to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = split(5, 5)", + "error": true + }, + { + "query": "row var = sqrt(5)", + "error": false + }, + { + "query": "row sqrt(5)", + "error": false + }, + { + "query": "row var = sqrt(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = sqrt(\"a\")", + "error": true + }, + { + "query": "row var = starts_with(\"a\", \"a\")", + "error": false + }, + { + "query": "row starts_with(\"a\", \"a\")", + "error": false + }, + { + "query": "row var = starts_with(to_string(\"a\"), to_string(\"a\"))", + "error": false + }, + { + "query": "row var = starts_with(5, 5)", + "error": true + }, + { + "query": "row var = substring(\"a\", 5, 5)", + "error": false + }, + { + "query": "row substring(\"a\", 5, 5)", + "error": false + }, + { + "query": "row var = substring(to_string(\"a\"), to_integer(\"a\"), to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = substring(5, \"a\", \"a\")", + "error": true + }, + { + "query": "row var = tan(5)", + "error": false + }, + { + "query": "row tan(5)", + "error": false + }, + { + "query": "row var = tan(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = tan(\"a\")", + "error": true + }, + { + "query": "row var = tanh(5)", + "error": false + }, + { + "query": "row tanh(5)", + "error": false + }, + { + "query": "row var = tanh(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = tanh(\"a\")", + "error": true + }, + { + "query": "row var = tau()", + "error": false + }, + { + "query": "row tau()", + "error": false + }, + { + "query": "row var = tau()", + "error": false + }, + { + "query": "row var = tau()", + "error": false + }, + { + "query": "row var = to_boolean(\"a\")", + "error": false + }, + { + "query": "row to_boolean(\"a\")", + "error": false + }, + { + "query": "row var = to_bool(\"a\")", + "error": false + }, + { + "query": "row var = to_cartesianpoint(\"a\")", + "error": false + }, + { + "query": "row to_cartesianpoint(\"a\")", + "error": false + }, + { + "query": "row var = to_cartesianshape(\"a\")", + "error": false + }, + { + "query": "row to_cartesianshape(\"a\")", + "error": false + }, + { + "query": "row var = to_datetime(\"a\")", + "error": false + }, + { + "query": "row to_datetime(\"a\")", + "error": false + }, + { + "query": "row var = to_dt(\"a\")", + "error": false + }, + { + "query": "row var = to_degrees(5)", + "error": false + }, + { + "query": "row to_degrees(5)", + "error": false + }, + { + "query": "row var = to_degrees(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = to_degrees(\"a\")", + "error": true + }, + { + "query": "row var = to_double(\"a\")", + "error": false + }, + { + "query": "row to_double(\"a\")", + "error": false + }, + { + "query": "row var = to_dbl(\"a\")", + "error": false + }, + { + "query": "row var = to_geopoint(\"a\")", + "error": false + }, + { + "query": "row to_geopoint(\"a\")", + "error": false + }, + { + "query": "row var = to_geoshape(\"a\")", + "error": false + }, + { + "query": "row to_geoshape(\"a\")", + "error": false + }, + { + "query": "row var = to_integer(\"a\")", + "error": false + }, + { + "query": "row to_integer(\"a\")", + "error": false + }, + { + "query": "row var = to_int(\"a\")", + "error": false + }, + { + "query": "row var = to_ip(\"a\")", + "error": false + }, + { + "query": "row to_ip(\"a\")", + "error": false + }, + { + "query": "row var = to_long(\"a\")", + "error": false + }, + { + "query": "row to_long(\"a\")", + "error": false + }, + { + "query": "row var = to_lower(\"a\")", + "error": false + }, + { + "query": "row to_lower(\"a\")", + "error": false + }, + { + "query": "row var = to_lower(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = to_lower(5)", + "error": true + }, + { + "query": "row var = to_radians(5)", + "error": false + }, + { + "query": "row to_radians(5)", + "error": false + }, + { + "query": "row var = to_radians(to_integer(\"a\"))", + "error": false + }, + { + "query": "row var = to_radians(\"a\")", + "error": true + }, + { + "query": "row var = to_string(\"a\")", + "error": false + }, + { + "query": "row to_string(\"a\")", + "error": false + }, + { + "query": "row var = to_str(\"a\")", + "error": false + }, + { + "query": "row var = to_unsigned_long(\"a\")", + "error": false + }, + { + "query": "row to_unsigned_long(\"a\")", + "error": false + }, + { + "query": "row var = to_ul(\"a\")", + "error": false + }, + { + "query": "row var = to_ulong(\"a\")", + "error": false + }, + { + "query": "row var = to_upper(\"a\")", + "error": false + }, + { + "query": "row to_upper(\"a\")", + "error": false + }, + { + "query": "row var = to_upper(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = to_upper(5)", + "error": true + }, + { + "query": "row var = to_version(\"a\")", + "error": false + }, + { + "query": "row to_version(\"a\")", + "error": false + }, + { + "query": "row var = to_ver(\"a\")", + "error": false + }, + { + "query": "row var = to_version(\"a\")", + "error": false + }, + { + "query": "row to_version(\"a\")", + "error": false + }, + { + "query": "row var = to_ver(\"a\")", + "error": false + }, + { + "query": "row var = trim(\"a\")", + "error": false + }, + { + "query": "row trim(\"a\")", + "error": false + }, + { + "query": "row var = trim(to_string(\"a\"))", + "error": false + }, + { + "query": "row var = trim(5)", + "error": true + }, + { + "query": "row var = 5 > 0", + "error": false + }, + { + "query": "row var = NOT 5 > 0", + "error": false + }, + { + "query": "row var = (numberField > 0)", + "error": true + }, + { + "query": "row var = (NOT (5 > 0))", + "error": false + }, + { + "query": "row var = \"a\" > 0", + "error": true + }, + { + "query": "row var = 5 >= 0", + "error": false + }, + { + "query": "row var = NOT 5 >= 0", + "error": false + }, + { + "query": "row var = (numberField >= 0)", + "error": true + }, + { + "query": "row var = (NOT (5 >= 0))", + "error": false + }, + { + "query": "row var = \"a\" >= 0", + "error": true + }, + { + "query": "row var = 5 < 0", + "error": false + }, + { + "query": "row var = NOT 5 < 0", + "error": false + }, + { + "query": "row var = (numberField < 0)", + "error": true + }, + { + "query": "row var = (NOT (5 < 0))", + "error": false + }, + { + "query": "row var = \"a\" < 0", + "error": true + }, + { + "query": "row var = 5 <= 0", + "error": false + }, + { + "query": "row var = NOT 5 <= 0", + "error": false + }, + { + "query": "row var = (numberField <= 0)", + "error": true + }, + { + "query": "row var = (NOT (5 <= 0))", + "error": false + }, + { + "query": "row var = \"a\" <= 0", + "error": true + }, + { + "query": "row var = 5 == 0", + "error": false + }, + { + "query": "row var = NOT 5 == 0", + "error": false + }, + { + "query": "row var = (numberField == 0)", + "error": true + }, + { + "query": "row var = (NOT (5 == 0))", + "error": false + }, + { + "query": "row var = \"a\" == 0", + "error": true + }, + { + "query": "row var = 1 + 1", + "error": false + }, + { + "query": "row var = (5 + 1)", + "error": false + }, + { + "query": "row var = 1 - 1", + "error": false + }, + { + "query": "row var = (5 - 1)", + "error": false + }, + { + "query": "row var = 1 * 1", + "error": false + }, + { + "query": "row var = (5 * 1)", + "error": false + }, + { + "query": "row var = 1 / 1", + "error": false + }, + { + "query": "row var = (5 / 1)", + "error": false + }, + { + "query": "row var = 1 % 1", + "error": false + }, + { + "query": "row var = (5 % 1)", + "error": false + }, + { + "query": "row var = \"a\" like \"?a\"", + "error": false + }, + { + "query": "row var = \"a\" NOT like \"?a\"", + "error": false + }, + { + "query": "row var = NOT \"a\" like \"?a\"", + "error": false + }, + { + "query": "row var = NOT \"a\" NOT like \"?a\"", + "error": false + }, + { + "query": "row var = 5 like \"?a\"", + "error": true + }, + { + "query": "row var = 5 NOT like \"?a\"", + "error": true + }, + { + "query": "row var = NOT 5 like \"?a\"", + "error": true + }, + { + "query": "row var = NOT 5 NOT like \"?a\"", + "error": true + }, + { + "query": "row var = \"a\" rlike \"?a\"", + "error": false + }, + { + "query": "row var = \"a\" NOT rlike \"?a\"", + "error": false + }, + { + "query": "row var = NOT \"a\" rlike \"?a\"", + "error": false + }, + { + "query": "row var = NOT \"a\" NOT rlike \"?a\"", + "error": false + }, + { + "query": "row var = 5 rlike \"?a\"", + "error": true + }, + { + "query": "row var = 5 NOT rlike \"?a\"", + "error": true + }, + { + "query": "row var = NOT 5 rlike \"?a\"", + "error": true + }, + { + "query": "row var = NOT 5 NOT rlike \"?a\"", + "error": true + }, + { + "query": "row 1 anno", + "error": true + }, + { + "query": "row var = 1 anno", + "error": true + }, + { + "query": "row now() + 1 anno", + "error": true + }, + { + "query": "row 1 year", + "error": true + }, + { + "query": "row 1 year", + "error": true + }, + { + "query": "row var = now() - 1 year", + "error": false + }, + { + "query": "row var = now() - 1 YEAR", + "error": false + }, + { + "query": "row var = now() - 1 Year", + "error": false + }, + { + "query": "row var = now() + 1 year", + "error": false + }, + { + "query": "row 1 year + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 year", + "error": true + }, + { + "query": "row var = now() / 1 year", + "error": true + }, + { + "query": "row var = now() % 1 year", + "error": true + }, + { + "query": "row 1 years", + "error": true + }, + { + "query": "row 1 years", + "error": true + }, + { + "query": "row var = now() - 1 years", + "error": false + }, + { + "query": "row var = now() - 1 YEARS", + "error": false + }, + { + "query": "row var = now() - 1 Years", + "error": false + }, + { + "query": "row var = now() + 1 years", + "error": false + }, + { + "query": "row 1 years + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 years", + "error": true + }, + { + "query": "row var = now() / 1 years", + "error": true + }, + { + "query": "row var = now() % 1 years", + "error": true + }, + { + "query": "row 1 month", + "error": true + }, + { + "query": "row 1 month", + "error": true + }, + { + "query": "row var = now() - 1 month", + "error": false + }, + { + "query": "row var = now() - 1 MONTH", + "error": false + }, + { + "query": "row var = now() - 1 Month", + "error": false + }, + { + "query": "row var = now() + 1 month", + "error": false + }, + { + "query": "row 1 month + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 month", + "error": true + }, + { + "query": "row var = now() / 1 month", + "error": true + }, + { + "query": "row var = now() % 1 month", + "error": true + }, + { + "query": "row 1 months", + "error": true + }, + { + "query": "row 1 months", + "error": true + }, + { + "query": "row var = now() - 1 months", + "error": false + }, + { + "query": "row var = now() - 1 MONTHS", + "error": false + }, + { + "query": "row var = now() - 1 Months", + "error": false + }, + { + "query": "row var = now() + 1 months", + "error": false + }, + { + "query": "row 1 months + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 months", + "error": true + }, + { + "query": "row var = now() / 1 months", + "error": true + }, + { + "query": "row var = now() % 1 months", + "error": true + }, + { + "query": "row 1 week", + "error": true + }, + { + "query": "row 1 week", + "error": true + }, + { + "query": "row var = now() - 1 week", + "error": false + }, + { + "query": "row var = now() - 1 WEEK", + "error": false + }, + { + "query": "row var = now() - 1 Week", + "error": false + }, + { + "query": "row var = now() + 1 week", + "error": false + }, + { + "query": "row 1 week + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 week", + "error": true + }, + { + "query": "row var = now() / 1 week", + "error": true + }, + { + "query": "row var = now() % 1 week", + "error": true + }, + { + "query": "row 1 weeks", + "error": true + }, + { + "query": "row 1 weeks", + "error": true + }, + { + "query": "row var = now() - 1 weeks", + "error": false + }, + { + "query": "row var = now() - 1 WEEKS", + "error": false + }, + { + "query": "row var = now() - 1 Weeks", + "error": false + }, + { + "query": "row var = now() + 1 weeks", + "error": false + }, + { + "query": "row 1 weeks + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 weeks", + "error": true + }, + { + "query": "row var = now() / 1 weeks", + "error": true + }, + { + "query": "row var = now() % 1 weeks", + "error": true + }, + { + "query": "row 1 day", + "error": true + }, + { + "query": "row 1 day", + "error": true + }, + { + "query": "row var = now() - 1 day", + "error": false + }, + { + "query": "row var = now() - 1 DAY", + "error": false + }, + { + "query": "row var = now() - 1 Day", + "error": false + }, + { + "query": "row var = now() + 1 day", + "error": false + }, + { + "query": "row 1 day + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 day", + "error": true + }, + { + "query": "row var = now() / 1 day", + "error": true + }, + { + "query": "row var = now() % 1 day", + "error": true + }, + { + "query": "row 1 days", + "error": true + }, + { + "query": "row 1 days", + "error": true + }, + { + "query": "row var = now() - 1 days", + "error": false + }, + { + "query": "row var = now() - 1 DAYS", + "error": false + }, + { + "query": "row var = now() - 1 Days", + "error": false + }, + { + "query": "row var = now() + 1 days", + "error": false + }, + { + "query": "row 1 days + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 days", + "error": true + }, + { + "query": "row var = now() / 1 days", + "error": true + }, + { + "query": "row var = now() % 1 days", + "error": true + }, + { + "query": "row 1 hour", + "error": true + }, + { + "query": "row 1 hour", + "error": true + }, + { + "query": "row var = now() - 1 hour", + "error": false + }, + { + "query": "row var = now() - 1 HOUR", + "error": false + }, + { + "query": "row var = now() - 1 Hour", + "error": false + }, + { + "query": "row var = now() + 1 hour", + "error": false + }, + { + "query": "row 1 hour + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 hour", + "error": true + }, + { + "query": "row var = now() / 1 hour", + "error": true + }, + { + "query": "row var = now() % 1 hour", + "error": true + }, + { + "query": "row 1 hours", + "error": true + }, + { + "query": "row 1 hours", + "error": true + }, + { + "query": "row var = now() - 1 hours", + "error": false + }, + { + "query": "row var = now() - 1 HOURS", + "error": false + }, + { + "query": "row var = now() - 1 Hours", + "error": false + }, + { + "query": "row var = now() + 1 hours", + "error": false + }, + { + "query": "row 1 hours + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 hours", + "error": true + }, + { + "query": "row var = now() / 1 hours", + "error": true + }, + { + "query": "row var = now() % 1 hours", + "error": true + }, + { + "query": "row 1 minute", + "error": true + }, + { + "query": "row 1 minute", + "error": true + }, + { + "query": "row var = now() - 1 minute", + "error": false + }, + { + "query": "row var = now() - 1 MINUTE", + "error": false + }, + { + "query": "row var = now() - 1 Minute", + "error": false + }, + { + "query": "row var = now() + 1 minute", + "error": false + }, + { + "query": "row 1 minute + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 minute", + "error": true + }, + { + "query": "row var = now() / 1 minute", + "error": true + }, + { + "query": "row var = now() % 1 minute", + "error": true + }, + { + "query": "row 1 minutes", + "error": true + }, + { + "query": "row 1 minutes", + "error": true + }, + { + "query": "row var = now() - 1 minutes", + "error": false + }, + { + "query": "row var = now() - 1 MINUTES", + "error": false + }, + { + "query": "row var = now() - 1 Minutes", + "error": false + }, + { + "query": "row var = now() + 1 minutes", + "error": false + }, + { + "query": "row 1 minutes + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 minutes", + "error": true + }, + { + "query": "row var = now() / 1 minutes", + "error": true + }, + { + "query": "row var = now() % 1 minutes", + "error": true + }, + { + "query": "row 1 second", + "error": true + }, + { + "query": "row 1 second", + "error": true + }, + { + "query": "row var = now() - 1 second", + "error": false + }, + { + "query": "row var = now() - 1 SECOND", + "error": false + }, + { + "query": "row var = now() - 1 Second", + "error": false + }, + { + "query": "row var = now() + 1 second", + "error": false + }, + { + "query": "row 1 second + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 second", + "error": true + }, + { + "query": "row var = now() / 1 second", + "error": true + }, + { + "query": "row var = now() % 1 second", + "error": true + }, + { + "query": "row 1 seconds", + "error": true + }, + { + "query": "row 1 seconds", + "error": true + }, + { + "query": "row var = now() - 1 seconds", + "error": false + }, + { + "query": "row var = now() - 1 SECONDS", + "error": false + }, + { + "query": "row var = now() - 1 Seconds", + "error": false + }, + { + "query": "row var = now() + 1 seconds", + "error": false + }, + { + "query": "row 1 seconds + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 seconds", + "error": true + }, + { + "query": "row var = now() / 1 seconds", + "error": true + }, + { + "query": "row var = now() % 1 seconds", + "error": true + }, + { + "query": "row 1 millisecond", + "error": true + }, + { + "query": "row 1 millisecond", + "error": true + }, + { + "query": "row var = now() - 1 millisecond", + "error": false + }, + { + "query": "row var = now() - 1 MILLISECOND", + "error": false + }, + { + "query": "row var = now() - 1 Millisecond", + "error": false + }, + { + "query": "row var = now() + 1 millisecond", + "error": false + }, + { + "query": "row 1 millisecond + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 millisecond", + "error": true + }, + { + "query": "row var = now() / 1 millisecond", + "error": true + }, + { + "query": "row var = now() % 1 millisecond", + "error": true + }, + { + "query": "row 1 milliseconds", + "error": true + }, + { + "query": "row 1 milliseconds", + "error": true + }, + { + "query": "row var = now() - 1 milliseconds", + "error": false + }, + { + "query": "row var = now() - 1 MILLISECONDS", + "error": false + }, + { + "query": "row var = now() - 1 Milliseconds", + "error": false + }, + { + "query": "row var = now() + 1 milliseconds", + "error": false + }, + { + "query": "row 1 milliseconds + 1 year", + "error": true + }, + { + "query": "row var = now() * 1 milliseconds", + "error": true + }, + { + "query": "row var = now() / 1 milliseconds", + "error": true + }, + { + "query": "row var = now() % 1 milliseconds", + "error": true + }, + { + "query": "show", + "error": true + }, + { + "query": "show functions", + "error": false + }, + { + "query": "show info", + "error": false + }, + { + "query": "show functions()", + "error": true + }, + { + "query": "show functions blah", + "error": true + }, + { + "query": "show numberField", + "error": true + }, + { + "query": "from index | limit ", + "error": true + }, + { + "query": "from index | limit 4 ", + "error": false + }, + { + "query": "from index | limit 4.5", + "error": true + }, + { + "query": "from index | limit a", + "error": true + }, + { + "query": "from index | limit numberField", + "error": true + }, + { + "query": "from index | limit stringField", + "error": true + }, + { + "query": "from index | limit 4", + "error": false + }, + { + "query": "from index | keep ", + "error": true + }, + { + "query": "from index | keep stringField, numberField, dateField", + "error": false + }, + { + "query": "from index | keep `stringField`, `numberField`, `dateField`", + "error": false + }, + { + "query": "from index | keep 4.5", + "error": true + }, + { + "query": "from index | keep `4.5`", + "error": true + }, + { + "query": "from index | keep missingField, numberField, dateField", + "error": true + }, + { + "query": "from index | keep `any#Char$Field`", + "error": false + }, + { + "query": "from index | project ", + "error": true + }, + { + "query": "from index | project stringField, numberField, dateField", + "error": true + }, + { + "query": "from index | PROJECT stringField, numberField, dateField", + "error": true + }, + { + "query": "from index | project missingField, numberField, dateField", + "error": true + }, + { + "query": "from index | keep s*", + "error": false + }, + { + "query": "from index | keep *Field", + "error": false + }, + { + "query": "from index | keep s*Field", + "error": false + }, + { + "query": "from index | keep string*Field", + "error": false + }, + { + "query": "from index | keep s*, n*", + "error": false + }, + { + "query": "from index | keep m*", + "error": true + }, + { + "query": "from index | keep *m", + "error": true + }, + { + "query": "from index | keep d*m", + "error": true + }, + { + "query": "from unsupported_index | keep unsupported_field", + "error": false + }, + { + "query": "FROM index | STATS ROUND(AVG(numberField * 1.5)), COUNT(*), MIN(numberField * 10) | KEEP `MIN(numberField * 10)`", + "error": false + }, + { + "query": "FROM index | STATS COUNT(*), MIN(numberField * 10), MAX(numberField)| KEEP `COUNT(*)`", + "error": false + }, + { + "query": "from index | drop ", + "error": true + }, + { + "query": "from index | drop stringField, numberField, dateField", + "error": false + }, + { + "query": "from index | drop 4.5", + "error": true + }, + { + "query": "from index | drop missingField, numberField, dateField", + "error": true + }, + { + "query": "from index | drop `any#Char$Field`", + "error": false + }, + { + "query": "from index | drop s*", + "error": false + }, + { + "query": "from index | drop *Field", + "error": false + }, + { + "query": "from index | drop s*Field", + "error": false + }, + { + "query": "from index | drop string*Field", + "error": false + }, + { + "query": "from index | drop s*, n*", + "error": false + }, + { + "query": "from index | drop m*", + "error": true + }, + { + "query": "from index | drop *m", + "error": true + }, + { + "query": "from index | drop d*m", + "error": true + }, + { + "query": "from index | drop *", + "error": true + }, + { + "query": "from index | drop stringField, *", + "error": true + }, + { + "query": "from index | drop @timestamp", + "error": false + }, + { + "query": "from index | drop stringField, @timestamp", + "error": false + }, + { + "query": "FROM index | STATS ROUND(AVG(numberField * 1.5)), COUNT(*), MIN(numberField * 10) | DROP `MIN(numberField * 10)`", + "error": false + }, + { + "query": "FROM index | STATS COUNT(*), MIN(numberField * 10), MAX(numberField)| DROP `COUNT(*)`", + "error": false + }, + { + "query": "from a_index | mv_expand ", + "error": true + }, + { + "query": "from a_index | mv_expand stringField", + "error": false + }, + { + "query": "from a_index | mv_expand numberField", + "error": false + }, + { + "query": "from a_index | mv_expand dateField", + "error": false + }, + { + "query": "from a_index | mv_expand booleanField", + "error": false + }, + { + "query": "from a_index | mv_expand ipField", + "error": false + }, + { + "query": "from a_index | mv_expand numberField, b", + "error": true + }, + { + "query": "row a = \"a\" | mv_expand a", + "error": false + }, + { + "query": "row a = [1, 2, 3] | mv_expand a", + "error": false + }, + { + "query": "row a = [true, false] | mv_expand a", + "error": false + }, + { + "query": "row a = [\"a\", \"b\"] | mv_expand a", + "error": false + }, + { + "query": "from a_index | rename", + "error": true + }, + { + "query": "from a_index | rename stringField", + "error": true + }, + { + "query": "from a_index | rename a", + "error": true + }, + { + "query": "from a_index | rename stringField as", + "error": true + }, + { + "query": "from a_index | rename missingField as", + "error": true + }, + { + "query": "from a_index | rename stringField as b", + "error": false + }, + { + "query": "from a_index | rename stringField AS b", + "error": false + }, + { + "query": "from a_index | rename stringField As b", + "error": false + }, + { + "query": "from a_index | rename stringField As b, b AS c", + "error": false + }, + { + "query": "from a_index | rename fn() as a", + "error": true + }, + { + "query": "from a_index | eval numberField + 1 | rename `numberField + 1` as a", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) | rename `avg(numberField)` as avg0", + "error": false + }, + { + "query": "from a_index |eval numberField + 1 | rename `numberField + 1` as ", + "error": true + }, + { + "query": "from a_index | rename s* as strings", + "error": true + }, + { + "query": "row a = 10 | rename a as `this``is fine`", + "error": false + }, + { + "query": "row a = 10 | rename a as this is fine", + "error": true + }, + { + "query": "from a_index | dissect", + "error": true + }, + { + "query": "from a_index | dissect stringField", + "error": true + }, + { + "query": "from a_index | dissect stringField 2", + "error": true + }, + { + "query": "from a_index | dissect stringField .", + "error": true + }, + { + "query": "from a_index | dissect stringField %a", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\"", + "error": false + }, + { + "query": "from a_index | dissect numberField \"%{firstWord}\"", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" option ", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" option = ", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" option = 1", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" append_separator = \"-\"", + "error": false + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" ignore_missing = true", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" append_separator = true", + "error": true + }, + { + "query": "from a_index | dissect stringField \"%{firstWord}\" | keep firstWord", + "error": false + }, + { + "query": "from a_index | grok", + "error": true + }, + { + "query": "from a_index | grok stringField", + "error": true + }, + { + "query": "from a_index | grok stringField 2", + "error": true + }, + { + "query": "from a_index | grok stringField .", + "error": true + }, + { + "query": "from a_index | grok stringField %a", + "error": true + }, + { + "query": "from a_index | grok stringField \"%{firstWord}\"", + "error": false + }, + { + "query": "from a_index | grok numberField \"%{firstWord}\"", + "error": true + }, + { + "query": "from a_index | grok stringField \"%{firstWord}\" | keep firstWord", + "error": false + }, + { + "query": "from a_index | where b", + "error": true + }, + { + "query": "from a_index | where true", + "error": false + }, + { + "query": "from a_index | where NOT true", + "error": false + }, + { + "query": "from a_index | where false", + "error": false + }, + { + "query": "from a_index | where NOT false", + "error": false + }, + { + "query": "from a_index | where 1 > 0", + "error": false + }, + { + "query": "from a_index | where NOT 1 > 0", + "error": false + }, + { + "query": "from a_index | where +1 > 0", + "error": false + }, + { + "query": "from a_index | where NOT +1 > 0", + "error": false + }, + { + "query": "from a_index | where 1 * 1 > 0", + "error": false + }, + { + "query": "from a_index | where NOT 1 * 1 > 0", + "error": false + }, + { + "query": "from a_index | where -1 > 0", + "error": false + }, + { + "query": "from a_index | where NOT -1 > 0", + "error": false + }, + { + "query": "from a_index | where 1 / 1 > 0", + "error": false + }, + { + "query": "from a_index | where NOT 1 / 1 > 0", + "error": false + }, + { + "query": "from a_index | where 1.0 > 0", + "error": false + }, + { + "query": "from a_index | where NOT 1.0 > 0", + "error": false + }, + { + "query": "from a_index | where 1.5 > 0", + "error": false + }, + { + "query": "from a_index | where NOT 1.5 > 0", + "error": false + }, + { + "query": "from a_index | where numberField > 0", + "error": false + }, + { + "query": "from a_index | where NOT numberField > 0", + "error": false + }, + { + "query": "from a_index | where (numberField > 0)", + "error": false + }, + { + "query": "from a_index | where (NOT (numberField > 0))", + "error": false + }, + { + "query": "from a_index | where 1 > 0", + "error": false + }, + { + "query": "from a_index | eval stringField > 0", + "error": true + }, + { + "query": "from a_index | where numberField >= 0", + "error": false + }, + { + "query": "from a_index | where NOT numberField >= 0", + "error": false + }, + { + "query": "from a_index | where (numberField >= 0)", + "error": false + }, + { + "query": "from a_index | where (NOT (numberField >= 0))", + "error": false + }, + { + "query": "from a_index | where 1 >= 0", + "error": false + }, + { + "query": "from a_index | eval stringField >= 0", + "error": true + }, + { + "query": "from a_index | where numberField < 0", + "error": false + }, + { + "query": "from a_index | where NOT numberField < 0", + "error": false + }, + { + "query": "from a_index | where (numberField < 0)", + "error": false + }, + { + "query": "from a_index | where (NOT (numberField < 0))", + "error": false + }, + { + "query": "from a_index | where 1 < 0", + "error": false + }, + { + "query": "from a_index | eval stringField < 0", + "error": true + }, + { + "query": "from a_index | where numberField <= 0", + "error": false + }, + { + "query": "from a_index | where NOT numberField <= 0", + "error": false + }, + { + "query": "from a_index | where (numberField <= 0)", + "error": false + }, + { + "query": "from a_index | where (NOT (numberField <= 0))", + "error": false + }, + { + "query": "from a_index | where 1 <= 0", + "error": false + }, + { + "query": "from a_index | eval stringField <= 0", + "error": true + }, + { + "query": "from a_index | where numberField == 0", + "error": false + }, + { + "query": "from a_index | where NOT numberField == 0", + "error": false + }, + { + "query": "from a_index | where (numberField == 0)", + "error": false + }, + { + "query": "from a_index | where (NOT (numberField == 0))", + "error": false + }, + { + "query": "from a_index | where 1 == 0", + "error": false + }, + { + "query": "from a_index | eval stringField == 0", + "error": true + }, + { + "query": "from a_index | where - numberField > 0", + "error": false + }, + { + "query": "from a_index | where - round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + - numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 - numberField > 0", + "error": false + }, + { + "query": "from a_index | where - numberField > 0", + "error": false + }, + { + "query": "from a_index | where - round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + - numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 - numberField > 0", + "error": false + }, + { + "query": "from a_index | where + numberField > 0", + "error": false + }, + { + "query": "from a_index | where + round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + + numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 + numberField > 0", + "error": false + }, + { + "query": "from a_index | where + numberField > 0", + "error": false + }, + { + "query": "from a_index | where + round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + + numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 + numberField > 0", + "error": false + }, + { + "query": "from a_index | where not booleanField", + "error": false + }, + { + "query": "from a_index | where -- numberField > 0", + "error": false + }, + { + "query": "from a_index | where -- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + -- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 -- numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + -+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 -+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where +- numberField > 0", + "error": false + }, + { + "query": "from a_index | where +- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + +- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 +- numberField > 0", + "error": false + }, + { + "query": "from a_index | where ++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where ++ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + ++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 ++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where not not booleanField", + "error": false + }, + { + "query": "from a_index | where --- numberField > 0", + "error": false + }, + { + "query": "from a_index | where --- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + --- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 --- numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + -+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 -+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where +-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where +-+ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + +-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 +-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where +++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where +++ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + +++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 +++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where not not not booleanField", + "error": false + }, + { + "query": "from a_index | where ---- numberField > 0", + "error": false + }, + { + "query": "from a_index | where ---- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + ---- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 ---- numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where -+-+ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + -+-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 -+-+ numberField > 0", + "error": false + }, + { + "query": "from a_index | where +-+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where +-+- round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + +-+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 +-+- numberField > 0", + "error": false + }, + { + "query": "from a_index | where ++++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where ++++ round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where 1 + ++++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where 1 ++++ numberField > 0", + "error": false + }, + { + "query": "from a_index | where not not not not booleanField", + "error": false + }, + { + "query": "from a_index | where *+ numberField", + "error": true + }, + { + "query": "from a_index | where /+ numberField", + "error": true + }, + { + "query": "from a_index | where %+ numberField", + "error": true + }, + { + "query": "from a_index | where numberField =~ 0", + "error": true + }, + { + "query": "from a_index | where NOT numberField =~ 0", + "error": true + }, + { + "query": "from a_index | where (numberField =~ 0)", + "error": true + }, + { + "query": "from a_index | where (NOT (numberField =~ 0))", + "error": true + }, + { + "query": "from a_index | where 1 =~ 0", + "error": true + }, + { + "query": "from a_index | eval stringField =~ 0", + "error": true + }, + { + "query": "from a_index | where stringField like \"?a\"", + "error": false + }, + { + "query": "from a_index | where stringField NOT like \"?a\"", + "error": false + }, + { + "query": "from a_index | where NOT stringField like \"?a\"", + "error": false + }, + { + "query": "from a_index | where NOT stringField NOT like \"?a\"", + "error": false + }, + { + "query": "from a_index | where numberField like \"?a\"", + "error": true + }, + { + "query": "from a_index | where numberField NOT like \"?a\"", + "error": true + }, + { + "query": "from a_index | where NOT numberField like \"?a\"", + "error": true + }, + { + "query": "from a_index | where NOT numberField NOT like \"?a\"", + "error": true + }, + { + "query": "from a_index | where stringField rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | where stringField NOT rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | where NOT stringField rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | where NOT stringField NOT rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | where numberField rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | where numberField NOT rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | where NOT numberField rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | where NOT numberField NOT rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | where cidr_match(ipField)", + "error": true + }, + { + "query": "from a_index | eval cidr = \"172.0.0.1/30\" | where cidr_match(ipField, \"172.0.0.1/30\", cidr)", + "error": false + }, + { + "query": "from a_index | where numberField IS NULL", + "error": false + }, + { + "query": "from a_index | where numberField IS null", + "error": false + }, + { + "query": "from a_index | where numberField is null", + "error": false + }, + { + "query": "from a_index | where numberField is NULL", + "error": false + }, + { + "query": "from a_index | where numberField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where numberField IS NOT null", + "error": false + }, + { + "query": "from a_index | where numberField IS not NULL", + "error": false + }, + { + "query": "from a_index | where numberField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where dateField IS NULL", + "error": false + }, + { + "query": "from a_index | where dateField IS null", + "error": false + }, + { + "query": "from a_index | where dateField is null", + "error": false + }, + { + "query": "from a_index | where dateField is NULL", + "error": false + }, + { + "query": "from a_index | where dateField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where dateField IS NOT null", + "error": false + }, + { + "query": "from a_index | where dateField IS not NULL", + "error": false + }, + { + "query": "from a_index | where dateField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where booleanField IS NULL", + "error": false + }, + { + "query": "from a_index | where booleanField IS null", + "error": false + }, + { + "query": "from a_index | where booleanField is null", + "error": false + }, + { + "query": "from a_index | where booleanField is NULL", + "error": false + }, + { + "query": "from a_index | where booleanField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where booleanField IS NOT null", + "error": false + }, + { + "query": "from a_index | where booleanField IS not NULL", + "error": false + }, + { + "query": "from a_index | where booleanField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where ipField IS NULL", + "error": false + }, + { + "query": "from a_index | where ipField IS null", + "error": false + }, + { + "query": "from a_index | where ipField is null", + "error": false + }, + { + "query": "from a_index | where ipField is NULL", + "error": false + }, + { + "query": "from a_index | where ipField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where ipField IS NOT null", + "error": false + }, + { + "query": "from a_index | where ipField IS not NULL", + "error": false + }, + { + "query": "from a_index | where ipField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where stringField IS NULL", + "error": false + }, + { + "query": "from a_index | where stringField IS null", + "error": false + }, + { + "query": "from a_index | where stringField is null", + "error": false + }, + { + "query": "from a_index | where stringField is NULL", + "error": false + }, + { + "query": "from a_index | where stringField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where stringField IS NOT null", + "error": false + }, + { + "query": "from a_index | where stringField IS not NULL", + "error": false + }, + { + "query": "from a_index | where stringField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where cartesianPointField IS NULL", + "error": false + }, + { + "query": "from a_index | where cartesianPointField IS null", + "error": false + }, + { + "query": "from a_index | where cartesianPointField is null", + "error": false + }, + { + "query": "from a_index | where cartesianPointField is NULL", + "error": false + }, + { + "query": "from a_index | where cartesianPointField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where cartesianPointField IS NOT null", + "error": false + }, + { + "query": "from a_index | where cartesianPointField IS not NULL", + "error": false + }, + { + "query": "from a_index | where cartesianPointField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where geoPointField IS NULL", + "error": false + }, + { + "query": "from a_index | where geoPointField IS null", + "error": false + }, + { + "query": "from a_index | where geoPointField is null", + "error": false + }, + { + "query": "from a_index | where geoPointField is NULL", + "error": false + }, + { + "query": "from a_index | where geoPointField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | where geoPointField IS NOT null", + "error": false + }, + { + "query": "from a_index | where geoPointField IS not NULL", + "error": false + }, + { + "query": "from a_index | where geoPointField Is nOt NuLL", + "error": false + }, + { + "query": "from a_index | where avg(numberField)", + "error": true + }, + { + "query": "from a_index | where avg(numberField) > 0", + "error": true + }, + { + "query": "from a_index | where max(numberField)", + "error": true + }, + { + "query": "from a_index | where max(numberField) > 0", + "error": true + }, + { + "query": "from a_index | where min(numberField)", + "error": true + }, + { + "query": "from a_index | where min(numberField) > 0", + "error": true + }, + { + "query": "from a_index | where sum(numberField)", + "error": true + }, + { + "query": "from a_index | where sum(numberField) > 0", + "error": true + }, + { + "query": "from a_index | where median(numberField)", + "error": true + }, + { + "query": "from a_index | where median(numberField) > 0", + "error": true + }, + { + "query": "from a_index | where median_absolute_deviation(numberField)", + "error": true + }, + { + "query": "from a_index | where median_absolute_deviation(numberField) > 0", + "error": true + }, + { + "query": "from a_index | where percentile(numberField, 5)", + "error": true + }, + { + "query": "from a_index | where percentile(numberField, 5) > 0", + "error": true + }, + { + "query": "from a_index | where count(stringField)", + "error": true + }, + { + "query": "from a_index | where count(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where count_distinct(stringField, numberField)", + "error": true + }, + { + "query": "from a_index | where count_distinct(stringField, numberField) > 0", + "error": true + }, + { + "query": "from a_index | where abs(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where abs(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where acos(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where acos(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where asin(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where asin(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where atan(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where atan(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where atan2(numberField, numberField) > 0", + "error": false + }, + { + "query": "from a_index | where atan2(stringField, stringField) > 0", + "error": true + }, + { + "query": "from a_index | where ceil(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where ceil(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(concat(stringField, stringField, stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(concat(numberField, numberField, numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where cos(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where cos(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where cosh(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where cosh(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where e() > 0", + "error": false + }, + { + "query": "from a_index | where e() > 0", + "error": false + }, + { + "query": "from a_index | where floor(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where floor(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(left(stringField, numberField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(left(numberField, stringField)) > 0", + "error": true + }, + { + "query": "from a_index | where length(stringField) > 0", + "error": false + }, + { + "query": "from a_index | where length(numberField) > 0", + "error": true + }, + { + "query": "from a_index | where log(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where log(stringField, stringField) > 0", + "error": true + }, + { + "query": "from a_index | where log10(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where log10(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(ltrim(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(ltrim(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where mv_avg(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where mv_avg(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(mv_concat(stringField, stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(mv_concat(numberField, numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where mv_median(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where mv_median(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where mv_sum(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where mv_sum(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where pi() > 0", + "error": false + }, + { + "query": "from a_index | where pi() > 0", + "error": false + }, + { + "query": "from a_index | where pow(numberField, numberField) > 0", + "error": false + }, + { + "query": "from a_index | where pow(stringField, stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(replace(stringField, stringField, stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(replace(numberField, numberField, numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where length(right(stringField, numberField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(right(numberField, stringField)) > 0", + "error": true + }, + { + "query": "from a_index | where round(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where round(stringField, stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(rtrim(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(rtrim(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where sin(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where sin(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where sinh(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where sinh(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(split(stringField, stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(split(numberField, numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where sqrt(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where sqrt(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(substring(stringField, numberField, numberField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(substring(numberField, stringField, stringField)) > 0", + "error": true + }, + { + "query": "from a_index | where tan(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where tan(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where tanh(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where tanh(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where tau() > 0", + "error": false + }, + { + "query": "from a_index | where tau() > 0", + "error": false + }, + { + "query": "from a_index | where to_degrees(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where to_degrees(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(to_lower(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(to_lower(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where to_radians(numberField) > 0", + "error": false + }, + { + "query": "from a_index | where to_radians(stringField) > 0", + "error": true + }, + { + "query": "from a_index | where length(to_upper(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(to_upper(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | where length(trim(stringField)) > 0", + "error": false + }, + { + "query": "from a_index | where length(trim(numberField)) > 0", + "error": true + }, + { + "query": "from a_index | eval ", + "error": true + }, + { + "query": "from a_index | eval stringField ", + "error": false + }, + { + "query": "from a_index | eval b = stringField", + "error": false + }, + { + "query": "from a_index | eval numberField + 1", + "error": false + }, + { + "query": "from a_index | eval numberField + ", + "error": true + }, + { + "query": "from a_index | eval stringField + 1", + "error": true + }, + { + "query": "from a_index | eval a=b", + "error": true + }, + { + "query": "from a_index | eval a=b, ", + "error": true + }, + { + "query": "from a_index | eval a=round", + "error": true + }, + { + "query": "from a_index | eval a=round(", + "error": true + }, + { + "query": "from a_index | eval a=round(numberField) ", + "error": false + }, + { + "query": "from a_index | eval a=round(numberField), ", + "error": true + }, + { + "query": "from a_index | eval a=round(numberField) + round(numberField) ", + "error": false + }, + { + "query": "from a_index | eval a=round(numberField) + round(stringField) ", + "error": true + }, + { + "query": "from a_index | eval a=round(numberField) + round(stringField), numberField ", + "error": true + }, + { + "query": "from a_index | eval a=round(numberField) + round(numberField), numberField ", + "error": false + }, + { + "query": "from a_index | eval a=round(numberField) + round(numberField), b = numberField ", + "error": false + }, + { + "query": "from a_index | eval a=[1, 2, 3]", + "error": false + }, + { + "query": "from a_index | eval a=[true, false]", + "error": false + }, + { + "query": "from a_index | eval a=[\"a\", \"b\"]", + "error": false + }, + { + "query": "from a_index | eval a=null", + "error": false + }, + { + "query": "from a_index | eval numberField IS NULL", + "error": false + }, + { + "query": "from a_index | eval numberField IS null", + "error": false + }, + { + "query": "from a_index | eval numberField is null", + "error": false + }, + { + "query": "from a_index | eval numberField is NULL", + "error": false + }, + { + "query": "from a_index | eval numberField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval numberField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval numberField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval dateField IS NULL", + "error": false + }, + { + "query": "from a_index | eval dateField IS null", + "error": false + }, + { + "query": "from a_index | eval dateField is null", + "error": false + }, + { + "query": "from a_index | eval dateField is NULL", + "error": false + }, + { + "query": "from a_index | eval dateField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval dateField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval dateField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval booleanField IS NULL", + "error": false + }, + { + "query": "from a_index | eval booleanField IS null", + "error": false + }, + { + "query": "from a_index | eval booleanField is null", + "error": false + }, + { + "query": "from a_index | eval booleanField is NULL", + "error": false + }, + { + "query": "from a_index | eval booleanField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval booleanField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval booleanField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval ipField IS NULL", + "error": false + }, + { + "query": "from a_index | eval ipField IS null", + "error": false + }, + { + "query": "from a_index | eval ipField is null", + "error": false + }, + { + "query": "from a_index | eval ipField is NULL", + "error": false + }, + { + "query": "from a_index | eval ipField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval ipField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval ipField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval stringField IS NULL", + "error": false + }, + { + "query": "from a_index | eval stringField IS null", + "error": false + }, + { + "query": "from a_index | eval stringField is null", + "error": false + }, + { + "query": "from a_index | eval stringField is NULL", + "error": false + }, + { + "query": "from a_index | eval stringField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval stringField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval stringField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField IS NULL", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField IS null", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField is null", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField is NULL", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval cartesianPointField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval geoPointField IS NULL", + "error": false + }, + { + "query": "from a_index | eval geoPointField IS null", + "error": false + }, + { + "query": "from a_index | eval geoPointField is null", + "error": false + }, + { + "query": "from a_index | eval geoPointField is NULL", + "error": false + }, + { + "query": "from a_index | eval geoPointField IS NOT NULL", + "error": false + }, + { + "query": "from a_index | eval geoPointField IS NOT null", + "error": false + }, + { + "query": "from a_index | eval geoPointField IS not NULL", + "error": false + }, + { + "query": "from a_index | eval - numberField", + "error": false + }, + { + "query": "from a_index | eval a=- numberField", + "error": false + }, + { + "query": "from a_index | eval a=- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + - numberField", + "error": false + }, + { + "query": "from a_index | eval 1 - numberField", + "error": false + }, + { + "query": "from a_index | eval - numberField", + "error": false + }, + { + "query": "from a_index | eval a=- numberField", + "error": false + }, + { + "query": "from a_index | eval a=- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + - numberField", + "error": false + }, + { + "query": "from a_index | eval 1 - numberField", + "error": false + }, + { + "query": "from a_index | eval + numberField", + "error": false + }, + { + "query": "from a_index | eval a=+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + + numberField", + "error": false + }, + { + "query": "from a_index | eval 1 + numberField", + "error": false + }, + { + "query": "from a_index | eval + numberField", + "error": false + }, + { + "query": "from a_index | eval a=+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + + numberField", + "error": false + }, + { + "query": "from a_index | eval 1 + numberField", + "error": false + }, + { + "query": "from a_index | eval not booleanField", + "error": false + }, + { + "query": "from a_index | eval -- numberField", + "error": false + }, + { + "query": "from a_index | eval a=-- numberField", + "error": false + }, + { + "query": "from a_index | eval a=-- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + -- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 -- numberField", + "error": false + }, + { + "query": "from a_index | eval -+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + -+ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 -+ numberField", + "error": false + }, + { + "query": "from a_index | eval +- numberField", + "error": false + }, + { + "query": "from a_index | eval a=+- numberField", + "error": false + }, + { + "query": "from a_index | eval a=+- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + +- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 +- numberField", + "error": false + }, + { + "query": "from a_index | eval ++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=++ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + ++ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 ++ numberField", + "error": false + }, + { + "query": "from a_index | eval not not booleanField", + "error": false + }, + { + "query": "from a_index | eval --- numberField", + "error": false + }, + { + "query": "from a_index | eval a=--- numberField", + "error": false + }, + { + "query": "from a_index | eval a=--- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + --- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 --- numberField", + "error": false + }, + { + "query": "from a_index | eval -+- numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+- numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + -+- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 -+- numberField", + "error": false + }, + { + "query": "from a_index | eval +-+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+-+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+-+ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + +-+ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 +-+ numberField", + "error": false + }, + { + "query": "from a_index | eval +++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=+++ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + +++ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 +++ numberField", + "error": false + }, + { + "query": "from a_index | eval not not not booleanField", + "error": false + }, + { + "query": "from a_index | eval ---- numberField", + "error": false + }, + { + "query": "from a_index | eval a=---- numberField", + "error": false + }, + { + "query": "from a_index | eval a=---- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + ---- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 ---- numberField", + "error": false + }, + { + "query": "from a_index | eval -+-+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+-+ numberField", + "error": false + }, + { + "query": "from a_index | eval a=-+-+ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + -+-+ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 -+-+ numberField", + "error": false + }, + { + "query": "from a_index | eval +-+- numberField", + "error": false + }, + { + "query": "from a_index | eval a=+-+- numberField", + "error": false + }, + { + "query": "from a_index | eval a=+-+- round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + +-+- numberField", + "error": false + }, + { + "query": "from a_index | eval 1 +-+- numberField", + "error": false + }, + { + "query": "from a_index | eval ++++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=++++ numberField", + "error": false + }, + { + "query": "from a_index | eval a=++++ round(numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 + ++++ numberField", + "error": false + }, + { + "query": "from a_index | eval 1 ++++ numberField", + "error": false + }, + { + "query": "from a_index | eval not not not not booleanField", + "error": false + }, + { + "query": "from a_index | eval *+ numberField", + "error": true + }, + { + "query": "from a_index | eval /+ numberField", + "error": true + }, + { + "query": "from a_index | eval %+ numberField", + "error": true + }, + { + "query": "from a_index | eval var = avg(numberField)", + "error": true + }, + { + "query": "from a_index | eval var = avg(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval avg(numberField)", + "error": true + }, + { + "query": "from a_index | eval avg(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval var = max(numberField)", + "error": true + }, + { + "query": "from a_index | eval var = max(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval max(numberField)", + "error": true + }, + { + "query": "from a_index | eval max(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval var = min(numberField)", + "error": true + }, + { + "query": "from a_index | eval var = min(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval min(numberField)", + "error": true + }, + { + "query": "from a_index | eval min(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval var = sum(numberField)", + "error": true + }, + { + "query": "from a_index | eval var = sum(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval sum(numberField)", + "error": true + }, + { + "query": "from a_index | eval sum(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval var = median(numberField)", + "error": true + }, + { + "query": "from a_index | eval var = median(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval median(numberField)", + "error": true + }, + { + "query": "from a_index | eval median(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval var = median_absolute_deviation(numberField)", + "error": true + }, + { + "query": "from a_index | eval var = median_absolute_deviation(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval median_absolute_deviation(numberField)", + "error": true + }, + { + "query": "from a_index | eval median_absolute_deviation(numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval var = percentile(numberField, 5)", + "error": true + }, + { + "query": "from a_index | eval var = percentile(numberField, 5) > 0", + "error": true + }, + { + "query": "from a_index | eval percentile(numberField, 5)", + "error": true + }, + { + "query": "from a_index | eval percentile(numberField, 5) > 0", + "error": true + }, + { + "query": "from a_index | eval var = count(stringField)", + "error": true + }, + { + "query": "from a_index | eval var = count(stringField) > 0", + "error": true + }, + { + "query": "from a_index | eval count(stringField)", + "error": true + }, + { + "query": "from a_index | eval count(stringField) > 0", + "error": true + }, + { + "query": "from a_index | eval var = count_distinct(stringField, numberField)", + "error": true + }, + { + "query": "from a_index | eval var = count_distinct(stringField, numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval count_distinct(stringField, numberField)", + "error": true + }, + { + "query": "from a_index | eval count_distinct(stringField, numberField) > 0", + "error": true + }, + { + "query": "from a_index | eval var = st_centroid(cartesianPointField)", + "error": true + }, + { + "query": "from a_index | eval var = st_centroid(cartesianPointField) > 0", + "error": true + }, + { + "query": "from a_index | eval st_centroid(cartesianPointField)", + "error": true + }, + { + "query": "from a_index | eval st_centroid(cartesianPointField) > 0", + "error": true + }, + { + "query": "from a_index | eval var = st_centroid(geoPointField)", + "error": true + }, + { + "query": "from a_index | eval var = st_centroid(geoPointField) > 0", + "error": true + }, + { + "query": "from a_index | eval st_centroid(geoPointField)", + "error": true + }, + { + "query": "from a_index | eval st_centroid(geoPointField) > 0", + "error": true + }, + { + "query": "from a_index | eval var = abs(numberField)", + "error": false + }, + { + "query": "from a_index | eval abs(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = abs(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval abs(stringField)", + "error": true + }, + { + "query": "from a_index | eval abs(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = abs(*)", + "error": true + }, + { + "query": "from a_index | eval var = acos(numberField)", + "error": false + }, + { + "query": "from a_index | eval acos(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = acos(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval acos(stringField)", + "error": true + }, + { + "query": "from a_index | eval acos(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = acos(*)", + "error": true + }, + { + "query": "from a_index | eval var = asin(numberField)", + "error": false + }, + { + "query": "from a_index | eval asin(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = asin(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval asin(stringField)", + "error": true + }, + { + "query": "from a_index | eval asin(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = asin(*)", + "error": true + }, + { + "query": "from a_index | eval var = atan(numberField)", + "error": false + }, + { + "query": "from a_index | eval atan(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = atan(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval atan(stringField)", + "error": true + }, + { + "query": "from a_index | eval atan(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = atan(*)", + "error": true + }, + { + "query": "from a_index | eval var = atan2(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval atan2(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = atan2(to_integer(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval atan2(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval atan2(numberField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = auto_bucket(dateField, numberField, \"a\", \"a\")", + "error": false + }, + { + "query": "from a_index | eval auto_bucket(dateField, numberField, \"a\", \"a\")", + "error": false + }, + { + "query": "from a_index | eval auto_bucket(dateField, numberField, stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval var = auto_bucket(dateField, numberField, 5, 5)", + "error": false + }, + { + "query": "from a_index | eval auto_bucket(dateField, numberField, 5, 5)", + "error": false + }, + { + "query": "from a_index | eval auto_bucket(dateField, numberField, numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval var = case(booleanField, stringField, stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval case(booleanField, stringField, stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = ceil(numberField)", + "error": false + }, + { + "query": "from a_index | eval ceil(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = ceil(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval ceil(stringField)", + "error": true + }, + { + "query": "from a_index | eval ceil(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = ceil(*)", + "error": true + }, + { + "query": "from a_index | eval var = cidr_match(ipField, stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval cidr_match(ipField, stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = cidr_match(to_ip(stringField), to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval cidr_match(stringField, numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval var = coalesce(stringField)", + "error": false + }, + { + "query": "from a_index | eval coalesce(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = coalesce(*)", + "error": true + }, + { + "query": "from a_index | eval var = concat(stringField, stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval concat(stringField, stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = concat(to_string(stringField), to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval concat(numberField, numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval var = cos(numberField)", + "error": false + }, + { + "query": "from a_index | eval cos(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = cos(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval cos(stringField)", + "error": true + }, + { + "query": "from a_index | eval cos(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = cos(*)", + "error": true + }, + { + "query": "from a_index | eval var = cosh(numberField)", + "error": false + }, + { + "query": "from a_index | eval cosh(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = cosh(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval cosh(stringField)", + "error": true + }, + { + "query": "from a_index | eval cosh(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = cosh(*)", + "error": true + }, + { + "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "error": false + }, + { + "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField)", + "error": false + }, + { + "query": "from a_index | eval var = date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", to_datetime(stringField))", + "error": false + }, + { + "query": "from a_index | eval date_extract(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = date_format(dateField, stringField)", + "error": false + }, + { + "query": "from a_index | eval date_format(dateField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = date_format(to_datetime(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval date_format(stringField, numberField)", + "error": true + }, + { + "query": "from a_index | eval date_format(dateField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = date_parse(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval date_parse(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = date_parse(to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval date_parse(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval date_parse(stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = date_trunc(1 year, dateField)", + "error": false + }, + { + "query": "from a_index | eval date_trunc(1 year, dateField)", + "error": false + }, + { + "query": "from a_index | eval var = date_trunc(1 year, to_datetime(stringField))", + "error": false + }, + { + "query": "from a_index | eval date_trunc(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval date_trunc(1 year, dateField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = e()", + "error": false + }, + { + "query": "from a_index | eval e()", + "error": false + }, + { + "query": "from a_index | eval var = e()", + "error": false + }, + { + "query": "from a_index | eval e()", + "error": false + }, + { + "query": "from a_index | eval e(extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = ends_with(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval ends_with(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = ends_with(to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval ends_with(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval ends_with(stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = floor(numberField)", + "error": false + }, + { + "query": "from a_index | eval floor(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = floor(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval floor(stringField)", + "error": true + }, + { + "query": "from a_index | eval floor(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = floor(*)", + "error": true + }, + { + "query": "from a_index | eval var = greatest(stringField)", + "error": false + }, + { + "query": "from a_index | eval greatest(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = greatest(*)", + "error": true + }, + { + "query": "from a_index | eval var = least(stringField)", + "error": false + }, + { + "query": "from a_index | eval least(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = least(*)", + "error": true + }, + { + "query": "from a_index | eval var = left(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | eval left(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = left(to_string(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval left(numberField, stringField)", + "error": true + }, + { + "query": "from a_index | eval left(stringField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = length(stringField)", + "error": false + }, + { + "query": "from a_index | eval length(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = length(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval length(numberField)", + "error": true + }, + { + "query": "from a_index | eval length(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = length(*)", + "error": true + }, + { + "query": "from a_index | eval var = log(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval log(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = log(to_integer(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval log(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval log(numberField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = log10(numberField)", + "error": false + }, + { + "query": "from a_index | eval log10(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = log10(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval log10(stringField)", + "error": true + }, + { + "query": "from a_index | eval log10(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = log10(*)", + "error": true + }, + { + "query": "from a_index | eval var = ltrim(stringField)", + "error": false + }, + { + "query": "from a_index | eval ltrim(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = ltrim(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval ltrim(numberField)", + "error": true + }, + { + "query": "from a_index | eval ltrim(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = ltrim(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_avg(numberField)", + "error": false + }, + { + "query": "from a_index | eval mv_avg(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_avg(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval mv_avg(stringField)", + "error": true + }, + { + "query": "from a_index | eval mv_avg(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = mv_avg(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_concat(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_concat(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_concat(to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval mv_concat(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval mv_concat(stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = mv_count(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_count(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_count(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_dedupe(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_dedupe(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_dedupe(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_first(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_first(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_first(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_last(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_last(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_last(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_max(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_max(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_max(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_median(numberField)", + "error": false + }, + { + "query": "from a_index | eval mv_median(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_median(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval mv_median(stringField)", + "error": true + }, + { + "query": "from a_index | eval mv_median(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = mv_median(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_min(stringField)", + "error": false + }, + { + "query": "from a_index | eval mv_min(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_min(*)", + "error": true + }, + { + "query": "from a_index | eval var = mv_sum(numberField)", + "error": false + }, + { + "query": "from a_index | eval mv_sum(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = mv_sum(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval mv_sum(stringField)", + "error": true + }, + { + "query": "from a_index | eval mv_sum(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = mv_sum(*)", + "error": true + }, + { + "query": "from a_index | eval var = now()", + "error": false + }, + { + "query": "from a_index | eval now()", + "error": false + }, + { + "query": "from a_index | eval var = now()", + "error": false + }, + { + "query": "from a_index | eval now()", + "error": false + }, + { + "query": "from a_index | eval now(extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = pi()", + "error": false + }, + { + "query": "from a_index | eval pi()", + "error": false + }, + { + "query": "from a_index | eval var = pi()", + "error": false + }, + { + "query": "from a_index | eval pi()", + "error": false + }, + { + "query": "from a_index | eval pi(extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = pow(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval pow(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = pow(to_integer(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval pow(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval pow(numberField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = replace(stringField, stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval replace(stringField, stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = replace(to_string(stringField), to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval replace(numberField, numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval replace(stringField, stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = right(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | eval right(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = right(to_string(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval right(numberField, stringField)", + "error": true + }, + { + "query": "from a_index | eval right(stringField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = round(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval round(numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = round(to_integer(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval round(stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval round(numberField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = rtrim(stringField)", + "error": false + }, + { + "query": "from a_index | eval rtrim(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = rtrim(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval rtrim(numberField)", + "error": true + }, + { + "query": "from a_index | eval rtrim(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = rtrim(*)", + "error": true + }, + { + "query": "from a_index | eval var = sin(numberField)", + "error": false + }, + { + "query": "from a_index | eval sin(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = sin(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval sin(stringField)", + "error": true + }, + { + "query": "from a_index | eval sin(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = sin(*)", + "error": true + }, + { + "query": "from a_index | eval var = sinh(numberField)", + "error": false + }, + { + "query": "from a_index | eval sinh(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = sinh(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval sinh(stringField)", + "error": true + }, + { + "query": "from a_index | eval sinh(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = sinh(*)", + "error": true + }, + { + "query": "from a_index | eval var = split(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval split(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = split(to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval split(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval split(stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = sqrt(numberField)", + "error": false + }, + { + "query": "from a_index | eval sqrt(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = sqrt(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval sqrt(stringField)", + "error": true + }, + { + "query": "from a_index | eval sqrt(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = sqrt(*)", + "error": true + }, + { + "query": "from a_index | eval var = starts_with(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval starts_with(stringField, stringField)", + "error": false + }, + { + "query": "from a_index | eval var = starts_with(to_string(stringField), to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval starts_with(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | eval starts_with(stringField, stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = substring(stringField, numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval substring(stringField, numberField, numberField)", + "error": false + }, + { + "query": "from a_index | eval var = substring(to_string(stringField), to_integer(stringField), to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval substring(numberField, stringField, stringField)", + "error": true + }, + { + "query": "from a_index | eval substring(stringField, numberField, numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = tan(numberField)", + "error": false + }, + { + "query": "from a_index | eval tan(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = tan(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval tan(stringField)", + "error": true + }, + { + "query": "from a_index | eval tan(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = tan(*)", + "error": true + }, + { + "query": "from a_index | eval var = tanh(numberField)", + "error": false + }, + { + "query": "from a_index | eval tanh(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = tanh(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval tanh(stringField)", + "error": true + }, + { + "query": "from a_index | eval tanh(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = tanh(*)", + "error": true + }, + { + "query": "from a_index | eval var = tau()", + "error": false + }, + { + "query": "from a_index | eval tau()", + "error": false + }, + { + "query": "from a_index | eval var = tau()", + "error": false + }, + { + "query": "from a_index | eval tau()", + "error": false + }, + { + "query": "from a_index | eval tau(extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = to_boolean(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_boolean(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_bool(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_boolean(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_cartesianpoint(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_cartesianpoint(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_cartesianpoint(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_cartesianshape(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_cartesianshape(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_cartesianshape(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_datetime(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_datetime(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_dt(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_datetime(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_degrees(numberField)", + "error": false + }, + { + "query": "from a_index | eval to_degrees(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = to_degrees(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval to_degrees(stringField)", + "error": true + }, + { + "query": "from a_index | eval to_degrees(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = to_degrees(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_double(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_double(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_dbl(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_double(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_geopoint(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_geopoint(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_geopoint(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_geoshape(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_geoshape(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_geoshape(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_integer(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_integer(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_int(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_integer(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_ip(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_ip(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_ip(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_long(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_long(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_long(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_lower(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_lower(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_lower(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval to_lower(numberField)", + "error": true + }, + { + "query": "from a_index | eval to_lower(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = to_lower(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_radians(numberField)", + "error": false + }, + { + "query": "from a_index | eval to_radians(numberField)", + "error": false + }, + { + "query": "from a_index | eval var = to_radians(to_integer(stringField))", + "error": false + }, + { + "query": "from a_index | eval to_radians(stringField)", + "error": true + }, + { + "query": "from a_index | eval to_radians(numberField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = to_radians(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_string(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_string(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_str(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_string(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_unsigned_long(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_unsigned_long(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_ul(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_ulong(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_unsigned_long(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_upper(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_upper(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_upper(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval to_upper(numberField)", + "error": true + }, + { + "query": "from a_index | eval to_upper(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = to_upper(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_version(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_version(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_ver(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_version(*)", + "error": true + }, + { + "query": "from a_index | eval var = to_version(stringField)", + "error": false + }, + { + "query": "from a_index | eval to_version(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_ver(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = to_version(*)", + "error": true + }, + { + "query": "from a_index | eval var = trim(stringField)", + "error": false + }, + { + "query": "from a_index | eval trim(stringField)", + "error": false + }, + { + "query": "from a_index | eval var = trim(to_string(stringField))", + "error": false + }, + { + "query": "from a_index | eval trim(numberField)", + "error": true + }, + { + "query": "from a_index | eval trim(stringField, extraArg)", + "error": true + }, + { + "query": "from a_index | eval var = trim(*)", + "error": true + }, + { + "query": "from a_index | eval log10(-1)", + "error": false + }, + { + "query": "from a_index | eval log(-1)", + "error": false + }, + { + "query": "from a_index | eval log(-1, 20)", + "error": false + }, + { + "query": "from a_index | eval log(-1, -20)", + "error": false + }, + { + "query": "from a_index | eval var0 = log(-1, -20)", + "error": false + }, + { + "query": "from a_index | eval numberField > 0", + "error": false + }, + { + "query": "from a_index | eval NOT numberField > 0", + "error": false + }, + { + "query": "from a_index | eval (numberField > 0)", + "error": false + }, + { + "query": "from a_index | eval (NOT (numberField > 0))", + "error": false + }, + { + "query": "from a_index | eval 1 > 0", + "error": false + }, + { + "query": "from a_index | eval stringField > 0", + "error": true + }, + { + "query": "from a_index | eval numberField >= 0", + "error": false + }, + { + "query": "from a_index | eval NOT numberField >= 0", + "error": false + }, + { + "query": "from a_index | eval (numberField >= 0)", + "error": false + }, + { + "query": "from a_index | eval (NOT (numberField >= 0))", + "error": false + }, + { + "query": "from a_index | eval 1 >= 0", + "error": false + }, + { + "query": "from a_index | eval stringField >= 0", + "error": true + }, + { + "query": "from a_index | eval numberField < 0", + "error": false + }, + { + "query": "from a_index | eval NOT numberField < 0", + "error": false + }, + { + "query": "from a_index | eval (numberField < 0)", + "error": false + }, + { + "query": "from a_index | eval (NOT (numberField < 0))", + "error": false + }, + { + "query": "from a_index | eval 1 < 0", + "error": false + }, + { + "query": "from a_index | eval stringField < 0", + "error": true + }, + { + "query": "from a_index | eval numberField <= 0", + "error": false + }, + { + "query": "from a_index | eval NOT numberField <= 0", + "error": false + }, + { + "query": "from a_index | eval (numberField <= 0)", + "error": false + }, + { + "query": "from a_index | eval (NOT (numberField <= 0))", + "error": false + }, + { + "query": "from a_index | eval 1 <= 0", + "error": false + }, + { + "query": "from a_index | eval stringField <= 0", + "error": true + }, + { + "query": "from a_index | eval numberField == 0", + "error": false + }, + { + "query": "from a_index | eval NOT numberField == 0", + "error": false + }, + { + "query": "from a_index | eval (numberField == 0)", + "error": false + }, + { + "query": "from a_index | eval (NOT (numberField == 0))", + "error": false + }, + { + "query": "from a_index | eval 1 == 0", + "error": false + }, + { + "query": "from a_index | eval stringField == 0", + "error": true + }, + { + "query": "from a_index | eval numberField + 1", + "error": false + }, + { + "query": "from a_index | eval (numberField + 1)", + "error": false + }, + { + "query": "from a_index | eval 1 + 1", + "error": false + }, + { + "query": "from a_index | eval numberField - 1", + "error": false + }, + { + "query": "from a_index | eval (numberField - 1)", + "error": false + }, + { + "query": "from a_index | eval 1 - 1", + "error": false + }, + { + "query": "from a_index | eval numberField * 1", + "error": false + }, + { + "query": "from a_index | eval (numberField * 1)", + "error": false + }, + { + "query": "from a_index | eval 1 * 1", + "error": false + }, + { + "query": "from a_index | eval numberField / 1", + "error": false + }, + { + "query": "from a_index | eval (numberField / 1)", + "error": false + }, + { + "query": "from a_index | eval 1 / 1", + "error": false + }, + { + "query": "from a_index | eval numberField % 1", + "error": false + }, + { + "query": "from a_index | eval (numberField % 1)", + "error": false + }, + { + "query": "from a_index | eval 1 % 1", + "error": false + }, + { + "query": "from a_index | eval 1/0", + "error": false + }, + { + "query": "from a_index | eval var = 1/0", + "error": false + }, + { + "query": "from a_index | eval 1 + 1/0", + "error": false + }, + { + "query": "from a_index | eval 1%0", + "error": false + }, + { + "query": "from a_index | eval var = 1%0", + "error": false + }, + { + "query": "from a_index | eval 1 + 1%0", + "error": false + }, + { + "query": "from a_index | eval stringField like \"?a\"", + "error": false + }, + { + "query": "from a_index | eval stringField NOT like \"?a\"", + "error": false + }, + { + "query": "from a_index | eval NOT stringField like \"?a\"", + "error": false + }, + { + "query": "from a_index | eval NOT stringField NOT like \"?a\"", + "error": false + }, + { + "query": "from a_index | eval numberField like \"?a\"", + "error": true + }, + { + "query": "from a_index | eval numberField NOT like \"?a\"", + "error": true + }, + { + "query": "from a_index | eval NOT numberField like \"?a\"", + "error": true + }, + { + "query": "from a_index | eval NOT numberField NOT like \"?a\"", + "error": true + }, + { + "query": "from a_index | eval stringField rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | eval stringField NOT rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | eval NOT stringField rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | eval NOT stringField NOT rlike \"?a\"", + "error": false + }, + { + "query": "from a_index | eval numberField rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | eval numberField NOT rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | eval NOT numberField rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | eval NOT numberField NOT rlike \"?a\"", + "error": true + }, + { + "query": "from a_index | eval 1 in (1, 2, 3)", + "error": false + }, + { + "query": "from a_index | eval numberField in (1, 2, 3)", + "error": false + }, + { + "query": "from a_index | eval numberField not in (1, 2, 3)", + "error": false + }, + { + "query": "from a_index | eval numberField not in (1, 2, 3, numberField)", + "error": false + }, + { + "query": "from a_index | eval 1 in (1, 2, 3, round(numberField))", + "error": false + }, + { + "query": "from a_index | eval \"a\" in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "from a_index | eval stringField in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "from a_index | eval stringField not in (\"a\", \"b\", \"c\")", + "error": false + }, + { + "query": "from a_index | eval stringField not in (\"a\", \"b\", \"c\", stringField)", + "error": false + }, + { + "query": "from a_index | eval 1 in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "from a_index | eval numberField in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "from a_index | eval numberField not in (\"a\", \"b\", \"c\")", + "error": true + }, + { + "query": "from a_index | eval numberField not in (1, 2, 3, stringField)", + "error": true + }, + { + "query": "from a_index | eval avg(numberField)", + "error": true + }, + { + "query": "from a_index | stats avg(numberField) | eval `avg(numberField)` + 1", + "error": false + }, + { + "query": "from a_index | eval not", + "error": true + }, + { + "query": "from a_index | eval in", + "error": true + }, + { + "query": "from a_index | eval stringField in stringField", + "error": true + }, + { + "query": "from a_index | eval stringField in stringField)", + "error": true + }, + { + "query": "from a_index | eval stringField not in stringField", + "error": true + }, + { + "query": "from a_index | eval 1 anno", + "error": true + }, + { + "query": "from a_index | eval var = 1 anno", + "error": true + }, + { + "query": "from a_index | eval now() + 1 anno", + "error": true + }, + { + "query": "from a_index | eval 1 year", + "error": true + }, + { + "query": "from a_index | eval 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 year", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 year", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 YEAR", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Year", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 year", + "error": false + }, + { + "query": "from a_index | eval 1 year + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 year", + "error": true + }, + { + "query": "from a_index | eval 1 years", + "error": true + }, + { + "query": "from a_index | eval 1 years", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 years", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 years", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 YEARS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Years", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 years", + "error": false + }, + { + "query": "from a_index | eval 1 years + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 years", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 years", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 years", + "error": true + }, + { + "query": "from a_index | eval 1 month", + "error": true + }, + { + "query": "from a_index | eval 1 month", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 month", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 month", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MONTH", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Month", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 month", + "error": false + }, + { + "query": "from a_index | eval 1 month + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 month", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 month", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 month", + "error": true + }, + { + "query": "from a_index | eval 1 months", + "error": true + }, + { + "query": "from a_index | eval 1 months", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 months", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 months", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MONTHS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Months", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 months", + "error": false + }, + { + "query": "from a_index | eval 1 months + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 months", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 months", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 months", + "error": true + }, + { + "query": "from a_index | eval 1 week", + "error": true + }, + { + "query": "from a_index | eval 1 week", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 week", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 week", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 WEEK", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Week", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 week", + "error": false + }, + { + "query": "from a_index | eval 1 week + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 week", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 week", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 week", + "error": true + }, + { + "query": "from a_index | eval 1 weeks", + "error": true + }, + { + "query": "from a_index | eval 1 weeks", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 weeks", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 weeks", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 WEEKS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Weeks", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 weeks", + "error": false + }, + { + "query": "from a_index | eval 1 weeks + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 weeks", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 weeks", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 weeks", + "error": true + }, + { + "query": "from a_index | eval 1 day", + "error": true + }, + { + "query": "from a_index | eval 1 day", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 day", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 day", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 DAY", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Day", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 day", + "error": false + }, + { + "query": "from a_index | eval 1 day + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 day", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 day", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 day", + "error": true + }, + { + "query": "from a_index | eval 1 days", + "error": true + }, + { + "query": "from a_index | eval 1 days", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 days", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 days", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 DAYS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Days", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 days", + "error": false + }, + { + "query": "from a_index | eval 1 days + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 days", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 days", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 days", + "error": true + }, + { + "query": "from a_index | eval 1 hour", + "error": true + }, + { + "query": "from a_index | eval 1 hour", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 hour", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 hour", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 HOUR", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Hour", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 hour", + "error": false + }, + { + "query": "from a_index | eval 1 hour + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 hour", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 hour", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 hour", + "error": true + }, + { + "query": "from a_index | eval 1 hours", + "error": true + }, + { + "query": "from a_index | eval 1 hours", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 hours", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 hours", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 HOURS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Hours", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 hours", + "error": false + }, + { + "query": "from a_index | eval 1 hours + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 hours", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 hours", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 hours", + "error": true + }, + { + "query": "from a_index | eval 1 minute", + "error": true + }, + { + "query": "from a_index | eval 1 minute", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 minute", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 minute", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MINUTE", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Minute", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 minute", + "error": false + }, + { + "query": "from a_index | eval 1 minute + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 minute", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 minute", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 minute", + "error": true + }, + { + "query": "from a_index | eval 1 minutes", + "error": true + }, + { + "query": "from a_index | eval 1 minutes", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 minutes", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 minutes", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MINUTES", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Minutes", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 minutes", + "error": false + }, + { + "query": "from a_index | eval 1 minutes + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 minutes", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 minutes", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 minutes", + "error": true + }, + { + "query": "from a_index | eval 1 second", + "error": true + }, + { + "query": "from a_index | eval 1 second", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 second", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 second", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 SECOND", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Second", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 second", + "error": false + }, + { + "query": "from a_index | eval 1 second + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 second", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 second", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 second", + "error": true + }, + { + "query": "from a_index | eval 1 seconds", + "error": true + }, + { + "query": "from a_index | eval 1 seconds", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 seconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 seconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 SECONDS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Seconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 seconds", + "error": false + }, + { + "query": "from a_index | eval 1 seconds + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 seconds", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 seconds", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 seconds", + "error": true + }, + { + "query": "from a_index | eval 1 millisecond", + "error": true + }, + { + "query": "from a_index | eval 1 millisecond", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 millisecond", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 millisecond", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MILLISECOND", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Millisecond", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 millisecond", + "error": false + }, + { + "query": "from a_index | eval 1 millisecond + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 millisecond", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 millisecond", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 millisecond", + "error": true + }, + { + "query": "from a_index | eval 1 milliseconds", + "error": true + }, + { + "query": "from a_index | eval 1 milliseconds", + "error": true + }, + { + "query": "from a_index | eval var = now() - 1 milliseconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 milliseconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 MILLISECONDS", + "error": false + }, + { + "query": "from a_index | eval var = dateField - 1 Milliseconds", + "error": false + }, + { + "query": "from a_index | eval var = dateField + 1 milliseconds", + "error": false + }, + { + "query": "from a_index | eval 1 milliseconds + 1 year", + "error": true + }, + { + "query": "from a_index | eval var = now() * 1 milliseconds", + "error": true + }, + { + "query": "from a_index | eval var = now() / 1 milliseconds", + "error": true + }, + { + "query": "from a_index | eval var = now() % 1 milliseconds", + "error": true + }, + { + "query": "from a_index | stats ", + "error": true + }, + { + "query": "from a_index | stats by stringField", + "error": false + }, + { + "query": "from a_index | stats by ", + "error": true + }, + { + "query": "from a_index | stats numberField ", + "error": true + }, + { + "query": "from a_index | stats numberField=", + "error": true + }, + { + "query": "from a_index | stats numberField=5 by ", + "error": true + }, + { + "query": "from a_index | stats avg(numberField) by wrongField", + "error": true + }, + { + "query": "from a_index | stats avg(numberField) by wrongField + 1", + "error": true + }, + { + "query": "from a_index | stats avg(numberField) by var0 = wrongField + 1", + "error": true + }, + { + "query": "from a_index | stats avg(numberField) by 1", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) by percentile(numberField)", + "error": true + }, + { + "query": "from a_index | stats count(`numberField`)", + "error": false + }, + { + "query": "from a_index | stats count(`numberField`) | keep `count(``numberField``)` ", + "error": false + }, + { + "query": "from a_index | stats count(`numberField`) | drop `count(``numberField``)` ", + "error": false + }, + { + "query": "from a_index | stats count(`numberField`) | eval `count(``numberField``)` ", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) by stringField, percentile(numberField) by ipField", + "error": true + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 50) by ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) + percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) - percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) * percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) / percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) % percentile(numberField, 50) BY ipField", + "error": false + }, + { + "query": "from a_index | stats count(* + 1) BY ipField", + "error": true + }, + { + "query": "from a_index | stats count(* + round(numberField)) BY ipField", + "error": true + }, + { + "query": "from a_index | stats count(round(*)) BY ipField", + "error": true + }, + { + "query": "from a_index | stats count(count(*)) BY ipField", + "error": true + }, + { + "query": "from a_index | stats numberField + 1", + "error": true + }, + { + "query": "from a_index | stats 5 + avg(numberField) +1", + "error": false + }, + { + "query": "from a_index | stats 5 +1 + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats 5 +1 + numberField", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1, var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round( sum(numberField) )", + "error": false + }, + { + "query": "from a_index | stats round( sum(numberField) ) + round( sum(numberField) )", + "error": false + }, + { + "query": "from a_index | stats round( numberField + sum(numberField) )", + "error": true + }, + { + "query": "from a_index | stats round( numberField + sum(numberField) ), var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats var0 = round( numberField + sum(numberField) ), var1 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round( sum(numberField + numberField) )", + "error": false + }, + { + "query": "from a_index | stats round( sum(numberField + round(numberField)) )", + "error": false + }, + { + "query": "from a_index | stats round( sum(numberField + round(numberField)) ) + round( sum(numberField + round(numberField)) )", + "error": false + }, + { + "query": "from a_index | stats sum(round( numberField ) )", + "error": false + }, + { + "query": "from a_index | stats sum(round( numberField ) ) + sum(round( numberField ) )", + "error": false + }, + { + "query": "from a_index | stats 5 + avg(numberField) +1+1", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1 + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1 + numberField", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1, var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round( sum(numberField) ))", + "error": false + }, + { + "query": "from a_index | stats round(round( sum(numberField) )) + round(round( sum(numberField) ))", + "error": false + }, + { + "query": "from a_index | stats round(round( numberField + sum(numberField) ))", + "error": true + }, + { + "query": "from a_index | stats round(round( numberField + sum(numberField) )), var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats var0 = round(round( numberField + sum(numberField) )), var1 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round( sum(numberField + numberField) ))", + "error": false + }, + { + "query": "from a_index | stats round(round( sum(numberField + round(numberField)) ))", + "error": false + }, + { + "query": "from a_index | stats round(round( sum(numberField + round(numberField)) )) + round(round( sum(numberField + round(numberField)) ))", + "error": false + }, + { + "query": "from a_index | stats sum(round(round( numberField )) )", + "error": false + }, + { + "query": "from a_index | stats sum(round(round( numberField )) ) + sum(round(round( numberField )) )", + "error": false + }, + { + "query": "from a_index | stats 5 + avg(numberField) +1+1+1", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1+1 + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1+1 + numberField", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1+1", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1+1, var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round(round( sum(numberField) )))", + "error": false + }, + { + "query": "from a_index | stats round(round(round( sum(numberField) ))) + round(round(round( sum(numberField) )))", + "error": false + }, + { + "query": "from a_index | stats round(round(round( numberField + sum(numberField) )))", + "error": true + }, + { + "query": "from a_index | stats round(round(round( numberField + sum(numberField) ))), var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats var0 = round(round(round( numberField + sum(numberField) ))), var1 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round(round( sum(numberField + numberField) )))", + "error": false + }, + { + "query": "from a_index | stats round(round(round( sum(numberField + round(numberField)) )))", + "error": false + }, + { + "query": "from a_index | stats round(round(round( sum(numberField + round(numberField)) ))) + round(round(round( sum(numberField + round(numberField)) )))", + "error": false + }, + { + "query": "from a_index | stats sum(round(round(round( numberField ))) )", + "error": false + }, + { + "query": "from a_index | stats sum(round(round(round( numberField ))) ) + sum(round(round(round( numberField ))) )", + "error": false + }, + { + "query": "from a_index | stats 5 + avg(numberField) +1+1+1+1", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1+1+1 + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats 5 +1+1+1+1 + numberField", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1+1+1", + "error": true + }, + { + "query": "from a_index | stats 5 + numberField +1+1+1+1, var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round(round(round( sum(numberField) ))))", + "error": false + }, + { + "query": "from a_index | stats round(round(round(round( sum(numberField) )))) + round(round(round(round( sum(numberField) ))))", + "error": false + }, + { + "query": "from a_index | stats round(round(round(round( numberField + sum(numberField) ))))", + "error": true + }, + { + "query": "from a_index | stats round(round(round(round( numberField + sum(numberField) )))), var0 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats var0 = round(round(round(round( numberField + sum(numberField) )))), var1 = sum(numberField)", + "error": true + }, + { + "query": "from a_index | stats round(round(round(round( sum(numberField + numberField) ))))", + "error": false + }, + { + "query": "from a_index | stats round(round(round(round( sum(numberField + round(numberField)) ))))", + "error": false + }, + { + "query": "from a_index | stats round(round(round(round( sum(numberField + round(numberField)) )))) + round(round(round(round( sum(numberField + round(numberField)) ))))", + "error": false + }, + { + "query": "from a_index | stats sum(round(round(round(round( numberField )))) )", + "error": false + }, + { + "query": "from a_index | stats sum(round(round(round(round( numberField )))) ) + sum(round(round(round(round( numberField )))) )", + "error": false + }, + { + "query": "from a_index | stats 5 + numberField + 1", + "error": true + }, + { + "query": "from a_index | stats numberField + 1 by ipField", + "error": true + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 50) + 1 by ipField", + "error": false + }, + { + "query": "from a_index | stats count(*)", + "error": false + }, + { + "query": "from a_index | stats count()", + "error": false + }, + { + "query": "from a_index | stats var0 = count(*)", + "error": false + }, + { + "query": "from a_index | stats var0 = count()", + "error": false + }, + { + "query": "from a_index | stats var0 = avg(numberField), count(*)", + "error": false + }, + { + "query": "from a_index | stats var0 = avg(fn(number)), count(*)", + "error": true + }, + { + "query": "from a_index | STATS sum( numberField ) + abs( numberField ) ", + "error": true + }, + { + "query": "from a_index | STATS abs( numberField + sum( numberField )) ", + "error": true + }, + { + "query": "from a_index | stats var = avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(avg(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(avg(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(avg(numberField)) + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(avg(numberField)) + avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = avg(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = avg(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), avg(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = avg(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = avg(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats avg(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats avg(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = avg(*)", + "error": true + }, + { + "query": "from a_index | stats var = max(numberField)", + "error": false + }, + { + "query": "from a_index | stats max(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(max(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(max(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(max(numberField)) + max(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(max(numberField)) + max(numberField)", + "error": false + }, + { + "query": "from a_index | stats max(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = max(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), max(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats max(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = max(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), max(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField)", + "error": false + }, + { + "query": "from a_index | stats max(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = max(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), max(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = max(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = max(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats max(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats max(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = max(*)", + "error": true + }, + { + "query": "from a_index | stats var = min(numberField)", + "error": false + }, + { + "query": "from a_index | stats min(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(min(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(min(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(min(numberField)) + min(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(min(numberField)) + min(numberField)", + "error": false + }, + { + "query": "from a_index | stats min(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = min(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), min(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats min(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = min(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), min(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField)", + "error": false + }, + { + "query": "from a_index | stats min(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = min(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), min(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = min(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = min(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats min(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats min(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = min(*)", + "error": true + }, + { + "query": "from a_index | stats var = sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(sum(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(sum(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(sum(numberField)) + sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(sum(numberField)) + sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats sum(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = sum(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField)", + "error": false + }, + { + "query": "from a_index | stats sum(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = sum(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), sum(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = sum(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = sum(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats sum(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats sum(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = sum(*)", + "error": true + }, + { + "query": "from a_index | stats var = median(numberField)", + "error": false + }, + { + "query": "from a_index | stats median(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(median(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(median(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(median(numberField)) + median(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(median(numberField)) + median(numberField)", + "error": false + }, + { + "query": "from a_index | stats median(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = median(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats median(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = median(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField)", + "error": false + }, + { + "query": "from a_index | stats median(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = median(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = median(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats median(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats median(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = median(*)", + "error": true + }, + { + "query": "from a_index | stats var = median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(numberField))", + "error": false + }, + { + "query": "from a_index | stats round(median_absolute_deviation(numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats round(median_absolute_deviation(numberField)) + median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField)", + "error": false + }, + { + "query": "from a_index | stats median_absolute_deviation(numberField) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), median_absolute_deviation(numberField) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = median_absolute_deviation(numberField) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = median_absolute_deviation(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats median_absolute_deviation(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats median_absolute_deviation(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = median_absolute_deviation(*)", + "error": true + }, + { + "query": "from a_index | stats var = percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats var = round(percentile(numberField, 5))", + "error": false + }, + { + "query": "from a_index | stats round(percentile(numberField, 5))", + "error": false + }, + { + "query": "from a_index | stats var = round(percentile(numberField, 5)) + percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats round(percentile(numberField, 5)) + percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats percentile(numberField, numberField)", + "error": true + }, + { + "query": "from a_index | stats percentile(numberField / 2, 5)", + "error": false + }, + { + "query": "from a_index | stats var0 = percentile(numberField / 2, 5)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField / 2, 5)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField / 2, 5)", + "error": false + }, + { + "query": "from a_index | stats percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats var0 = percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5)", + "error": false + }, + { + "query": "from a_index | stats percentile(numberField, 5) by round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats var0 = percentile(numberField, 5) by var1 = round(numberField / 2)", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), ipField", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), percentile(numberField, 5) by round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats avg(numberField), var0 = percentile(numberField, 5) by var1 = round(numberField / 2), numberField / 2", + "error": false + }, + { + "query": "from a_index | stats var = percentile(avg(numberField), 5)", + "error": true + }, + { + "query": "from a_index | stats percentile(avg(numberField), 5)", + "error": true + }, + { + "query": "from a_index | stats percentile(stringField, 5)", + "error": true + }, + { + "query": "from a_index | stats var = count(stringField)", + "error": false + }, + { + "query": "from a_index | stats count(stringField)", + "error": false + }, + { + "query": "from a_index | stats var = round(count(stringField))", + "error": false + }, + { + "query": "from a_index | stats round(count(stringField))", + "error": false + }, + { + "query": "from a_index | stats var = round(count(stringField)) + count(stringField)", + "error": false + }, + { + "query": "from a_index | stats round(count(stringField)) + count(stringField)", + "error": false + }, + { + "query": "from a_index | stats var = count_distinct(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | stats count_distinct(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | stats var = round(count_distinct(stringField, numberField))", + "error": false + }, + { + "query": "from a_index | stats round(count_distinct(stringField, numberField))", + "error": false + }, + { + "query": "from a_index | stats var = round(count_distinct(stringField, numberField)) + count_distinct(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | stats round(count_distinct(stringField, numberField)) + count_distinct(stringField, numberField)", + "error": false + }, + { + "query": "from a_index | stats var = st_centroid(cartesianPointField)", + "error": false + }, + { + "query": "from a_index | stats st_centroid(cartesianPointField)", + "error": false + }, + { + "query": "from a_index | stats var = st_centroid(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats st_centroid(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats st_centroid(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = st_centroid(*)", + "error": true + }, + { + "query": "from a_index | stats var = st_centroid(geoPointField)", + "error": false + }, + { + "query": "from a_index | stats st_centroid(geoPointField)", + "error": false + }, + { + "query": "from a_index | stats var = st_centroid(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats st_centroid(avg(numberField))", + "error": true + }, + { + "query": "from a_index | stats st_centroid(stringField)", + "error": true + }, + { + "query": "from a_index | stats var = st_centroid(*)", + "error": true + }, + { + "query": "FROM index\n | EVAL numberField * 3.281\n | STATS avg_numberField = AVG(`numberField * 3.281`)", + "error": false + }, + { + "query": "FROM index | STATS AVG(numberField) by round(numberField) + 1 | EVAL `round(numberField) + 1` / 2", + "error": false + }, + { + "query": "from a_index | sort ", + "error": true + }, + { + "query": "from a_index | sort \"field\" ", + "error": false + }, + { + "query": "from a_index | sort wrongField ", + "error": true + }, + { + "query": "from a_index | sort numberField, ", + "error": true + }, + { + "query": "from a_index | sort numberField, stringField", + "error": false + }, + { + "query": "from a_index | sort \"field\" desc ", + "error": false + }, + { + "query": "from a_index | sort numberField desc ", + "error": false + }, + { + "query": "from a_index | sort numberField desc nulls ", + "error": true + }, + { + "query": "from a_index | sort numberField desc nulls first", + "error": false + }, + { + "query": "from a_index | sort numberField desc first", + "error": true + }, + { + "query": "from a_index | sort numberField desc nulls last", + "error": false + }, + { + "query": "from a_index | sort numberField desc last", + "error": true + }, + { + "query": "from a_index | sort \"field\" asc ", + "error": false + }, + { + "query": "from a_index | sort numberField asc ", + "error": false + }, + { + "query": "from a_index | sort numberField asc nulls ", + "error": true + }, + { + "query": "from a_index | sort numberField asc nulls first", + "error": false + }, + { + "query": "from a_index | sort numberField asc first", + "error": true + }, + { + "query": "from a_index | sort numberField asc nulls last", + "error": false + }, + { + "query": "from a_index | sort numberField asc last", + "error": true + }, + { + "query": "from a_index | sort numberField nulls first", + "error": false + }, + { + "query": "from a_index | sort numberField first", + "error": true + }, + { + "query": "from a_index | sort numberField nulls last", + "error": false + }, + { + "query": "from a_index | sort numberField last", + "error": true + }, + { + "query": "row a = 1 | stats COUNT(*) | sort `COUNT(*)`", + "error": false + }, + { + "query": "ROW a = 1 | STATS couNt(*) | SORT `couNt(*)`", + "error": false + }, + { + "query": "from a_index | enrich", + "error": true + }, + { + "query": "from a_index | enrich _", + "error": true + }, + { + "query": "from a_index | enrich _:", + "error": true + }, + { + "query": "from a_index | enrich _:policy", + "error": true + }, + { + "query": "from a_index | enrich :policy", + "error": true + }, + { + "query": "from a_index | enrich any:", + "error": true + }, + { + "query": "from a_index | enrich _any:", + "error": true + }, + { + "query": "from a_index | enrich any:policy", + "error": true + }, + { + "query": "from a_index | enrich policy ", + "error": false + }, + { + "query": "from a_index | enrich `this``is fine`", + "error": true + }, + { + "query": "from a_index | enrich this is fine", + "error": true + }, + { + "query": "from a_index | enrich _any:policy ", + "error": false + }, + { + "query": "from a_index | enrich _any : policy ", + "error": true + }, + { + "query": "from a_index | enrich _any: policy ", + "error": true + }, + { + "query": "from a_index | enrich _any:policy ", + "error": false + }, + { + "query": "from a_index | enrich _ANY:policy ", + "error": false + }, + { + "query": "from a_index | enrich _coordinator:policy ", + "error": false + }, + { + "query": "from a_index | enrich _coordinator : policy ", + "error": true + }, + { + "query": "from a_index | enrich _coordinator: policy ", + "error": true + }, + { + "query": "from a_index | enrich _coordinator:policy ", + "error": false + }, + { + "query": "from a_index | enrich _COORDINATOR:policy ", + "error": false + }, + { + "query": "from a_index | enrich _remote:policy ", + "error": false + }, + { + "query": "from a_index | enrich _remote : policy ", + "error": true + }, + { + "query": "from a_index | enrich _remote: policy ", + "error": true + }, + { + "query": "from a_index | enrich _remote:policy ", + "error": false + }, + { + "query": "from a_index | enrich _REMOTE:policy ", + "error": false + }, + { + "query": "from a_index | enrich _unknown:policy", + "error": true + }, + { + "query": "from a_index |enrich missing-policy ", + "error": true + }, + { + "query": "from a_index |enrich policy on ", + "error": true + }, + { + "query": "from a_index | enrich policy on b ", + "error": true + }, + { + "query": "from a_index | enrich policy on `this``is fine`", + "error": true + }, + { + "query": "from a_index | enrich policy on this is fine", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with ", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with var0 ", + "error": true + }, + { + "query": "from a_index |enrich policy on numberField with var0 = ", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with var0 = c ", + "error": true + }, + { + "query": "from a_index |enrich policy on numberField with var0 = , ", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with var0 = otherField, var1 ", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with var0 = otherField ", + "error": false + }, + { + "query": "from a_index | enrich policy on stringField with var0 = otherField, yetAnotherField ", + "error": false + }, + { + "query": "from a_index |enrich policy on numberField with var0 = otherField, var1 = ", + "error": true + }, + { + "query": "from a_index | enrich policy on stringField with var0 = otherField, var1 = yetAnotherField", + "error": false + }, + { + "query": "from a_index | enrich policy on stringField with var0 = otherField, `this``is fine` = yetAnotherField", + "error": false + }, + { + "query": "from a_index | enrich policy with ", + "error": true + }, + { + "query": "from a_index | enrich policy with otherField", + "error": false + }, + { + "query": "from a_index | enrich policy | eval otherField", + "error": false + }, + { + "query": "from a_index | enrich policy with var0 = otherField | eval var0", + "error": false + }, + { + "query": "from a_index | enrich my-pol*", + "error": true + }, + { + "query": "from a_index | eval stringField = 5", + "error": false + }, + { + "query": "from a_index | eval numberField = \"5\"", + "error": false + }, + { + "query": "from a_index | eval round(numberField) + 1 | eval `round(numberField) + 1` + 1 | keep ```round(numberField) + 1`` + 1`", + "error": false + }, + { + "query": "from a_index | eval round(numberField) + 1 | eval `round(numberField) + 1` + 1 | eval ```round(numberField) + 1`` + 1` + 1 | keep ```````round(numberField) + 1```` + 1`` + 1`", + "error": false + }, + { + "query": "from a_index | eval round(numberField) + 1 | eval `round(numberField) + 1` + 1 | eval ```round(numberField) + 1`` + 1` + 1 | eval ```````round(numberField) + 1```` + 1`` + 1` + 1 | keep ```````````````round(numberField) + 1```````` + 1```` + 1`` + 1`", + "error": false + }, + { + "query": "from a_index | eval round(numberField) + 1 | eval `round(numberField) + 1` + 1 | eval ```round(numberField) + 1`` + 1` + 1 | eval ```````round(numberField) + 1```` + 1`` + 1` + 1 | eval ```````````````round(numberField) + 1```````` + 1```` + 1`` + 1` + 1 | keep ```````````````````````````````round(numberField) + 1```````````````` + 1```````` + 1```` + 1`` + 1`", + "error": false + } + ] +} \ No newline at end of file diff --git a/packages/kbn-monaco/src/esql/lib/ast/validation/types.ts b/packages/kbn-monaco/src/esql/lib/ast/validation/types.ts index b93bb895b6621..dd3cf92248734 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/validation/types.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/validation/types.ts @@ -33,6 +33,7 @@ export interface ReferenceMaps { fields: Map; policies: Map; metadataFields: Set; + query: string; } export interface ValidationErrors { diff --git a/packages/kbn-monaco/src/esql/lib/ast/validation/validation.test.ts b/packages/kbn-monaco/src/esql/lib/ast/validation/validation.test.ts index e981cc42d9788..10261b2232857 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/validation/validation.test.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/validation/validation.test.ts @@ -60,6 +60,11 @@ const policies = [ }, ]; +const NESTING_LEVELS = 4; +const NESTED_DEPTHS = Array(NESTING_LEVELS) + .fill(0) + .map((_, i) => i + 1); + function getCallbackMocks() { return { getFieldsFor: jest.fn(async ({ query }) => { @@ -926,7 +931,7 @@ describe('validation logic', () => { ]); } - for (const nesting of [1, 2, 3, 4]) { + for (const nesting of NESTED_DEPTHS) { for (const evenOp of ['-', '+']) { for (const oddOp of ['-', '+']) { // This builds a combination of +/- operators @@ -1019,6 +1024,48 @@ describe('validation logic', () => { testErrorsAndWarnings(`from a_index | where ${camelCase(field)}Field Is nOt NuLL`, []); } + for (const { + name, + alias, + signatures, + ...defRest + } of statsAggregationFunctionDefinitions.filter( + ({ name: fnName, signatures: statsSignatures }) => + statsSignatures.some(({ returnType, params }) => ['number'].includes(returnType)) + )) { + for (const { params, infiniteParams, ...signRest } of signatures) { + const fieldMapping = getFieldMapping(params); + + testErrorsAndWarnings( + `from a_index | where ${ + getFunctionSignatures( + { + name, + ...defRest, + signatures: [{ params: fieldMapping, ...signRest }], + }, + { withTypes: false } + )[0].declaration + }`, + [`WHERE does not support function ${name}`] + ); + + testErrorsAndWarnings( + `from a_index | where ${ + getFunctionSignatures( + { + name, + ...defRest, + signatures: [{ params: fieldMapping, ...signRest }], + }, + { withTypes: false } + )[0].declaration + } > 0`, + [`WHERE does not support function ${name}`] + ); + } + } + // Test that all functions work in where const numericOrStringFunctions = evalFunctionsDefinitions.filter(({ name, signatures }) => { return signatures.some( @@ -1132,7 +1179,7 @@ describe('validation logic', () => { testErrorsAndWarnings(`from a_index | eval ${camelCase(field)}Field IS not NULL`, []); } - for (const nesting of [1, 2, 3, 4]) { + for (const nesting of NESTED_DEPTHS) { for (const evenOp of ['-', '+']) { for (const oddOp of ['-', '+']) { // This builds a combination of +/- operators @@ -1162,6 +1209,67 @@ describe('validation logic', () => { ]); } + for (const { name, alias, signatures, ...defRest } of statsAggregationFunctionDefinitions) { + for (const { params, infiniteParams, ...signRest } of signatures) { + const fieldMapping = getFieldMapping(params); + testErrorsAndWarnings( + `from a_index | eval var = ${ + getFunctionSignatures( + { + name, + ...defRest, + signatures: [{ params: fieldMapping, ...signRest }], + }, + { withTypes: false } + )[0].declaration + }`, + [`EVAL does not support function ${name}`] + ); + + testErrorsAndWarnings( + `from a_index | eval var = ${ + getFunctionSignatures( + { + name, + ...defRest, + signatures: [{ params: fieldMapping, ...signRest }], + }, + { withTypes: false } + )[0].declaration + } > 0`, + [`EVAL does not support function ${name}`] + ); + + testErrorsAndWarnings( + `from a_index | eval ${ + getFunctionSignatures( + { + name, + ...defRest, + signatures: [{ params: fieldMapping, ...signRest }], + }, + { withTypes: false } + )[0].declaration + }`, + [`EVAL does not support function ${name}`] + ); + + testErrorsAndWarnings( + `from a_index | eval ${ + getFunctionSignatures( + { + name, + ...defRest, + signatures: [{ params: fieldMapping, ...signRest }], + }, + { withTypes: false } + )[0].declaration + } > 0`, + [`EVAL does not support function ${name}`] + ); + } + } + for (const { name, alias, signatures, ...defRest } of evalFunctionsDefinitions) { for (const { params, infiniteParams, ...signRest } of signatures) { const fieldMapping = getFieldMapping(params); @@ -1593,7 +1701,7 @@ describe('validation logic', () => { 'At least one aggregation function required in [STATS], found [numberField+1]', ]); - for (const nesting of [1, 2, 3, 4]) { + for (const nesting of NESTED_DEPTHS) { const moreBuiltinWrapping = Array(nesting).fill('+1').join(''); testErrorsAndWarnings(`from a_index | stats 5 + avg(numberField) ${moreBuiltinWrapping}`, []); testErrorsAndWarnings(`from a_index | stats 5 ${moreBuiltinWrapping} + avg(numberField)`, []); @@ -1921,6 +2029,11 @@ describe('validation logic', () => { | STATS avg_numberField = AVG(\`numberField * 3.281\`)`, [] ); + + testErrorsAndWarnings( + `FROM index | STATS AVG(numberField) by round(numberField) + 1 | EVAL \`round(numberField) + 1\` / 2`, + [] + ); }); describe('sort', () => { @@ -2096,6 +2209,52 @@ describe('validation logic', () => { ); }); + describe('quoting and escaping expressions', () => { + function getTicks(amount: number) { + return Array(amount).fill('`').join(''); + } + /** + * Given an initial quoted expression, build a new quoted expression + * that appends as many +1 to the previous one based on the nesting level + * i.e. given the expression `round(...) + 1` returns + * ```round(...) + 1`` + 1` (for nesting 1) + * ```````round(...) + 1```` + 1`` + 1` (for nesting 2) + * etc... + * Note how backticks double for each level + wrapping quotes + * The general rule follows an exponential curve given a nesting N: + * (`){ (2^N)-1 } ticks expression (`){ 2^N-1 } +1 (`){ 2^N-2 } +1 ... +1 + * + * Mind that nesting arg here is equivalent to N-1 + */ + function buildNestedExpression(expr: string, nesting: number) { + const openingTicks = getTicks(Math.pow(2, nesting + 1) - 1); + const firstClosingBatch = getTicks(Math.pow(2, nesting)); + const additionalPlusOneswithTicks = Array(nesting) + .fill(' + 1') + .reduce((acc, plusOneAppended, i) => { + // workout how many ticks to add: 2^N-i + const ticks = getTicks(Math.pow(2, nesting - 1 - i)); + return `${acc}${plusOneAppended}${ticks}`; + }, ''); + const ret = `${openingTicks}${expr}${firstClosingBatch}${additionalPlusOneswithTicks}`; + return ret; + } + + for (const nesting of NESTED_DEPTHS) { + // start with a quotable expression + const expr = 'round(numberField) + 1'; + const startingQuery = `from a_index | eval ${expr}`; + // now pipe for each nesting level a new eval command that appends a +1 to the previous quoted expression + const finalQuery = `${startingQuery} | ${Array(nesting) + .fill('') + .map((_, i) => { + return `eval ${buildNestedExpression(expr, i)} + 1`; + }) + .join(' | ')} | keep ${buildNestedExpression(expr, nesting)}`; + testErrorsAndWarnings(finalQuery, []); + } + }); + describe('callbacks', () => { it(`should not fetch source and fields list when a row command is set`, async () => { const callbackMocks = getCallbackMocks(); diff --git a/packages/kbn-monaco/src/esql/lib/ast/validation/validation.ts b/packages/kbn-monaco/src/esql/lib/ast/validation/validation.ts index b1f960d8ea320..3d92dec320530 100644 --- a/packages/kbn-monaco/src/esql/lib/ast/validation/validation.ts +++ b/packages/kbn-monaco/src/esql/lib/ast/validation/validation.ts @@ -227,7 +227,7 @@ function validateFunctionColumnArg( } // do not validate any further for now, only count() accepts wildcard as args... } else { - if (!isEqualType(actualArg, argDef, references, parentCommand)) { + if (!isEqualType(actualArg, argDef, references, parentCommand, nameHit)) { // guaranteed by the check above const columnHit = getColumnHit(nameHit!, references); messages.push( @@ -381,7 +381,9 @@ function validateFunction( parentCommand, parentOption, references, - isNested || !isAssignment(astFunction) + // use the nesting flag for now just for stats + // TODO: revisit this part later on to make it more generic + parentCommand === 'stats' ? isNested || !isAssignment(astFunction) : false ) ); } @@ -867,7 +869,7 @@ export async function validateAst( }); } - const variables = collectVariables(ast, availableFields); + const variables = collectVariables(ast, availableFields, queryString); // notify if the user is rewriting a column as variable with another type messages.push(...validateFieldsShadowing(availableFields, variables)); messages.push(...validateUnsupportedTypeFields(availableFields)); @@ -879,6 +881,7 @@ export async function validateAst( policies: availablePolicies, variables, metadataFields: availableMetadataFields, + query: queryString, }); messages.push(...commandMessages); }