From 6a1a26717af28e5b404feee52e14e18391019ed0 Mon Sep 17 00:00:00 2001 From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Date: Thu, 9 May 2024 03:08:11 -0400 Subject: [PATCH] [8.14] [ES|QL] implicit casting changes (#182989) (#183011) # Backport This will backport the following commits from `main` to `8.14`: - [[ES|QL] implicit casting changes (#182989)](https://github.com/elastic/kibana/pull/182989) ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) Co-authored-by: Drew Tate --- .../src/definitions/builtin.ts | 79 +- .../src/definitions/functions.ts | 2 +- .../esql_validation_meta_tests.json | 3527 ++++++++++++----- .../src/validation/validation.test.ts | 101 +- 4 files changed, 2638 insertions(+), 1071 deletions(-) diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts index 20adda63602df..5910237ba893e 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/builtin.ts @@ -91,7 +91,22 @@ function createComparisonDefinition( ], returnType: 'boolean', }, - ...['date', 'number'].flatMap((type) => [ + { + params: [ + { name: 'left', type: 'version' }, + { name: 'right', type: 'version' }, + ], + returnType: 'boolean', + }, + // constant strings okay because of implicit casting for + // string to version and ip + // + // boolean casting is handled on the specific comparison function + // that support booleans + // + // date casting is handled in the validation routine since it's a + // general rule. Look in compareLiteralType() + ...['ip', 'version'].flatMap((type) => [ { params: [ { name: 'left', type }, @@ -214,6 +229,21 @@ export const builtinFunctions: FunctionDefinition[] = [ ], returnType: 'boolean', }, + // constant strings okay because of implicit casting + { + params: [ + { name: 'left', type: 'boolean' }, + { name: 'right', type: 'string', constantOnly: true }, + ], + returnType: 'boolean', + }, + { + params: [ + { name: 'right', type: 'string', constantOnly: true }, + { name: 'right', type: 'boolean' }, + ], + returnType: 'boolean', + }, ], }, { @@ -232,6 +262,21 @@ export const builtinFunctions: FunctionDefinition[] = [ ], returnType: 'boolean', }, + // constant strings okay because of implicit casting + { + params: [ + { name: 'left', type: 'boolean' }, + { name: 'right', type: 'string', constantOnly: true }, + ], + returnType: 'boolean', + }, + { + params: [ + { name: 'right', type: 'string', constantOnly: true }, + { name: 'right', type: 'boolean' }, + ], + returnType: 'boolean', + }, ], }, { @@ -318,6 +363,15 @@ export const builtinFunctions: FunctionDefinition[] = [ }, { name: 'not_in', description: '' }, ].map(({ name, description }) => ({ + // set all arrays to type "any" for now + // this only applies to the "in" operator + // e.g. "foo" in ( "foo", "bar" ) + // + // we did this because the "in" operator now supports + // mixed-type arrays like ( "1.2.3", versionVar ) + // because of implicit casting. + // + // we need to revisit with more robust validation type: 'builtin', ignoreAsSuggestion: /not/.test(name), name, @@ -327,28 +381,43 @@ export const builtinFunctions: FunctionDefinition[] = [ { params: [ { name: 'left', type: 'number' }, - { name: 'right', type: 'number[]' }, + + { name: 'right', type: 'any[]' }, ], returnType: 'boolean', }, { params: [ { name: 'left', type: 'string' }, - { name: 'right', type: 'string[]' }, + { name: 'right', type: 'any[]' }, ], returnType: 'boolean', }, { params: [ { name: 'left', type: 'boolean' }, - { name: 'right', type: 'boolean[]' }, + { name: 'right', type: 'any[]' }, ], returnType: 'boolean', }, { params: [ { name: 'left', type: 'date' }, - { name: 'right', type: 'date[]' }, + { name: 'right', type: 'any[]' }, + ], + returnType: 'boolean', + }, + { + params: [ + { name: 'left', type: 'version' }, + { name: 'right', type: 'any[]' }, + ], + returnType: 'boolean', + }, + { + params: [ + { name: 'left', type: 'ip' }, + { name: 'right', type: 'any[]' }, ], returnType: 'boolean', }, diff --git a/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts b/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts index 205b2d158fd05..e55ddf9f92a27 100644 --- a/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts +++ b/packages/kbn-esql-validation-autocomplete/src/definitions/functions.ts @@ -557,7 +557,7 @@ export const evalFunctionsDefinitions: FunctionDefinition[] = [ signatures: [ { params: [{ name: 'field', type: 'string' }], - returnType: 'string', + returnType: 'version', examples: [`from index | EVAL version = to_version(stringField)`], }, ], diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json b/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json index 3c34710b12f01..2320f11d4a1ab 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json +++ b/packages/kbn-esql-validation-autocomplete/src/validation/esql_validation_meta_tests.json @@ -1,5 +1,12 @@ { - "indexes": ["a_index", "index", "other_index", ".secret_index", "my-index", "unsupported_index"], + "indexes": [ + "a_index", + "index", + "other_index", + ".secret_index", + "my-index", + "unsupported_index" + ], "fields": [ { "name": "numberField", @@ -13,6 +20,10 @@ "name": "booleanField", "type": "boolean" }, + { + "name": "versionField", + "type": "version" + }, { "name": "ipField", "type": "ip" @@ -71,15 +82,25 @@ "policies": [ { "name": "policy", - "sourceIndices": ["enrich_index"], + "sourceIndices": [ + "enrich_index" + ], "matchField": "otherStringField", - "enrichFields": ["otherField", "yetAnotherField"] + "enrichFields": [ + "otherField", + "yetAnotherField" + ] }, { "name": "policy$", - "sourceIndices": ["enrich_index"], + "sourceIndices": [ + "enrich_index" + ], "matchField": "otherStringField", - "enrichFields": ["otherField", "yetAnotherField"] + "enrichFields": [ + "otherField", + "yetAnotherField" + ] } ], "unsupported_field": [ @@ -161,17 +182,24 @@ }, { "query": "from ", - "error": ["SyntaxError: missing FROM_UNQUOTED_IDENTIFIER at ''"], + "error": [ + "SyntaxError: missing FROM_UNQUOTED_IDENTIFIER at ''" + ], "warning": [] }, { "query": "from index,", - "error": ["SyntaxError: missing FROM_UNQUOTED_IDENTIFIER at ''"], + "error": [ + "SyntaxError: missing FROM_UNQUOTED_IDENTIFIER at ''" + ], "warning": [] }, { "query": "from assignment = 1", - "error": ["SyntaxError: mismatched input '=' expecting ", "Unknown index [assignment]"], + "error": [ + "SyntaxError: mismatched input '=' expecting ", + "Unknown index [assignment]" + ], "warning": [] }, { @@ -196,55 +224,77 @@ }, { "query": "from index, missingIndex", - "error": ["Unknown index [missingIndex]"], + "error": [ + "Unknown index [missingIndex]" + ], "warning": [] }, { "query": "from fn()", - "error": ["Unknown index [fn()]"], + "error": [ + "Unknown index [fn()]" + ], "warning": [] }, { "query": "from average()", - "error": ["Unknown index [average()]"], + "error": [ + "Unknown index [average()]" + ], "warning": [] }, { "query": "from index [METADATA _id]", "error": [], - "warning": ["Square brackets '[]' need to be removed from FROM METADATA declaration"] + "warning": [ + "Square brackets '[]' need to be removed from FROM METADATA declaration" + ] }, { "query": "from index [metadata _id]", "error": [], - "warning": ["Square brackets '[]' need to be removed from FROM METADATA declaration"] + "warning": [ + "Square brackets '[]' need to be removed from FROM METADATA declaration" + ] }, { "query": "from index [METADATA _id, _source]", "error": [], - "warning": ["Square brackets '[]' need to be removed from FROM METADATA declaration"] + "warning": [ + "Square brackets '[]' need to be removed from FROM METADATA declaration" + ] }, { "query": "from index [METADATA _id, _source2]", "error": [ "Metadata field [_source2] is not available. Available metadata fields are: [_id, _source]" ], - "warning": ["Square brackets '[]' need to be removed from FROM METADATA declaration"] + "warning": [ + "Square brackets '[]' need to be removed from FROM METADATA declaration" + ] }, { "query": "from index [metadata _id, _source] [METADATA _id2]", - "error": ["SyntaxError: mismatched input '[' expecting "], - "warning": ["Square brackets '[]' need to be removed from FROM METADATA declaration"] + "error": [ + "SyntaxError: mismatched input '[' expecting " + ], + "warning": [ + "Square brackets '[]' need to be removed from FROM METADATA declaration" + ] }, { "query": "from remote-ccs:indexes [METADATA _id]", "error": [], - "warning": ["Square brackets '[]' need to be removed from FROM METADATA declaration"] + "warning": [ + "Square brackets '[]' need to be removed from FROM METADATA declaration" + ] }, { "query": "from *:indexes [METADATA _id]", "error": [], - "warning": ["Square brackets '[]' need to be removed from FROM METADATA declaration"] + "warning": [ + "Square brackets '[]' need to be removed from FROM METADATA declaration" + ] }, { "query": "from index METADATA _id", @@ -270,7 +320,9 @@ }, { "query": "from index metadata _id, _source METADATA _id2", - "error": ["SyntaxError: mismatched input 'METADATA' expecting "], + "error": [ + "SyntaxError: mismatched input 'METADATA' expecting " + ], "warning": [] }, { @@ -285,7 +337,9 @@ }, { "query": "from index (metadata _id)", - "error": ["SyntaxError: mismatched input '(metadata' expecting "], + "error": [ + "SyntaxError: mismatched input '(metadata' expecting " + ], "warning": [] }, { @@ -370,7 +424,9 @@ }, { "query": "from indexes*", - "error": ["Unknown index [indexes*]"], + "error": [ + "Unknown index [indexes*]" + ], "warning": [] }, { @@ -405,12 +461,16 @@ }, { "query": "from numberField", - "error": ["Unknown index [numberField]"], + "error": [ + "Unknown index [numberField]" + ], "warning": [] }, { "query": "from policy", - "error": ["Unknown index [policy]"], + "error": [ + "Unknown index [policy]" + ], "warning": [] }, { @@ -422,17 +482,24 @@ }, { "query": "row missing_column", - "error": ["Unknown column [missing_column]"], + "error": [ + "Unknown column [missing_column]" + ], "warning": [] }, { "query": "row fn()", - "error": ["Unknown function [fn]"], + "error": [ + "Unknown function [fn]" + ], "warning": [] }, { "query": "row missing_column, missing_column2", - "error": ["Unknown column [missing_column]", "Unknown column [missing_column2]"], + "error": [ + "Unknown column [missing_column]", + "Unknown column [missing_column2]" + ], "warning": [] }, { @@ -442,12 +509,16 @@ }, { "query": "row a=1, missing_column", - "error": ["Unknown column [missing_column]"], + "error": [ + "Unknown column [missing_column]" + ], "warning": [] }, { "query": "row a=1, b = average()", - "error": ["Unknown function [average]"], + "error": [ + "Unknown function [average]" + ], "warning": [] }, { @@ -505,7 +576,9 @@ }, { "query": "row var = 1 in ", - "error": ["SyntaxError: mismatched input '' expecting '('"], + "error": [ + "SyntaxError: mismatched input '' expecting '('" + ], "warning": [] }, { @@ -518,7 +591,9 @@ }, { "query": "row var = 1 not in ", - "error": ["SyntaxError: mismatched input '' expecting '('"], + "error": [ + "SyntaxError: mismatched input '' expecting '('" + ], "warning": [] }, { @@ -558,30 +633,22 @@ }, { "query": "row var = 1 in (\"a\", \"b\", \"c\")", - "error": [ - "Argument of [in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]" - ], + "error": [], "warning": [] }, { "query": "row var = 5 in (\"a\", \"b\", \"c\")", - "error": [ - "Argument of [in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]" - ], + "error": [], "warning": [] }, { "query": "row var = 5 not in (\"a\", \"b\", \"c\")", - "error": [ - "Argument of [not_in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]" - ], + "error": [], "warning": [] }, { "query": "row var = 5 not in (1, 2, 3, \"a\")", - "error": [ - "Argument of [not_in] must be [number[]], found value [(1, 2, 3, \"a\")] type [(number, number, number, string)]" - ], + "error": [], "warning": [] }, { @@ -641,7 +708,9 @@ }, { "query": "row var = abs(\"a\")", - "error": ["Argument of [abs] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [abs] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -661,7 +730,9 @@ }, { "query": "row var = acos(\"a\")", - "error": ["Argument of [acos] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [acos] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -681,7 +752,9 @@ }, { "query": "row var = asin(\"a\")", - "error": ["Argument of [asin] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [asin] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -701,7 +774,9 @@ }, { "query": "row var = atan(\"a\")", - "error": ["Argument of [atan] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [atan] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -754,7 +829,9 @@ }, { "query": "row var = ceil(\"a\")", - "error": ["Argument of [ceil] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [ceil] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -807,7 +884,9 @@ }, { "query": "row var = concat(5, 5)", - "error": ["Argument of [concat] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [concat] must be [string], found value [5] type [number]" + ], "warning": [] }, { @@ -827,7 +906,9 @@ }, { "query": "row var = cos(\"a\")", - "error": ["Argument of [cos] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [cos] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -847,7 +928,9 @@ }, { "query": "row var = cosh(\"a\")", - "error": ["Argument of [cosh] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [cosh] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -963,7 +1046,9 @@ }, { "query": "row var = floor(\"a\")", - "error": ["Argument of [floor] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [floor] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -1026,7 +1111,9 @@ }, { "query": "row var = length(5)", - "error": ["Argument of [length] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [length] must be [string], found value [5] type [number]" + ], "warning": [] }, { @@ -1069,7 +1156,9 @@ }, { "query": "row var = log10(\"a\")", - "error": ["Argument of [log10] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [log10] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -1089,7 +1178,9 @@ }, { "query": "row var = ltrim(5)", - "error": ["Argument of [ltrim] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [ltrim] must be [string], found value [5] type [number]" + ], "warning": [] }, { @@ -1109,7 +1200,9 @@ }, { "query": "row var = mv_avg(\"a\")", - "error": ["Argument of [mv_avg] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [mv_avg] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -1202,7 +1295,9 @@ }, { "query": "row var = mv_median(\"a\")", - "error": ["Argument of [mv_median] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [mv_median] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -1252,7 +1347,9 @@ }, { "query": "row var = mv_sum(\"a\")", - "error": ["Argument of [mv_sum] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [mv_sum] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -1429,7 +1526,9 @@ }, { "query": "row var = rtrim(5)", - "error": ["Argument of [rtrim] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [rtrim] must be [string], found value [5] type [number]" + ], "warning": [] }, { @@ -1449,7 +1548,9 @@ }, { "query": "row var = signum(\"a\")", - "error": ["Argument of [signum] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [signum] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -1469,7 +1570,9 @@ }, { "query": "row var = sin(\"a\")", - "error": ["Argument of [sin] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [sin] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -1489,7 +1592,9 @@ }, { "query": "row var = sinh(\"a\")", - "error": ["Argument of [sinh] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [sinh] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -1532,7 +1637,9 @@ }, { "query": "row var = sqrt(\"a\")", - "error": ["Argument of [sqrt] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [sqrt] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -2288,7 +2395,9 @@ }, { "query": "row var = st_x(\"a\")", - "error": ["Argument of [st_x] must be [geo_point], found value [\"a\"] type [string]"], + "error": [ + "Argument of [st_x] must be [geo_point], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -2308,7 +2417,9 @@ }, { "query": "row var = st_x(\"a\")", - "error": ["Argument of [st_x] must be [geo_point], found value [\"a\"] type [string]"], + "error": [ + "Argument of [st_x] must be [geo_point], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -2328,7 +2439,9 @@ }, { "query": "row var = st_y(\"a\")", - "error": ["Argument of [st_y] must be [geo_point], found value [\"a\"] type [string]"], + "error": [ + "Argument of [st_y] must be [geo_point], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -2348,7 +2461,9 @@ }, { "query": "row var = st_y(\"a\")", - "error": ["Argument of [st_y] must be [geo_point], found value [\"a\"] type [string]"], + "error": [ + "Argument of [st_y] must be [geo_point], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -2415,7 +2530,9 @@ }, { "query": "row var = tan(\"a\")", - "error": ["Argument of [tan] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [tan] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -2435,7 +2552,9 @@ }, { "query": "row var = tanh(\"a\")", - "error": ["Argument of [tanh] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [tanh] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -2525,7 +2644,9 @@ }, { "query": "row var = to_degrees(\"a\")", - "error": ["Argument of [to_degrees] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [to_degrees] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -2615,7 +2736,9 @@ }, { "query": "row var = to_lower(5)", - "error": ["Argument of [to_lower] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [to_lower] must be [string], found value [5] type [number]" + ], "warning": [] }, { @@ -2635,7 +2758,9 @@ }, { "query": "row var = to_radians(\"a\")", - "error": ["Argument of [to_radians] must be [number], found value [\"a\"] type [string]"], + "error": [ + "Argument of [to_radians] must be [number], found value [\"a\"] type [string]" + ], "warning": [] }, { @@ -2690,7 +2815,9 @@ }, { "query": "row var = to_upper(5)", - "error": ["Argument of [to_upper] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [to_upper] must be [string], found value [5] type [number]" + ], "warning": [] }, { @@ -2725,7 +2852,9 @@ }, { "query": "row var = trim(5)", - "error": ["Argument of [trim] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [trim] must be [string], found value [5] type [number]" + ], "warning": [] }, { @@ -2740,7 +2869,9 @@ }, { "query": "row var = (numberField > 0)", - "error": ["Unknown column [numberField]"], + "error": [ + "Unknown column [numberField]" + ], "warning": [] }, { @@ -2776,16 +2907,6 @@ "error": [], "warning": [] }, - { - "query": "row var = 42 > \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "row var = \"2022\" > 42", - "error": [], - "warning": [] - }, { "query": "row var = 5 >= 0", "error": [], @@ -2798,7 +2919,9 @@ }, { "query": "row var = (numberField >= 0)", - "error": ["Unknown column [numberField]"], + "error": [ + "Unknown column [numberField]" + ], "warning": [] }, { @@ -2834,16 +2957,6 @@ "error": [], "warning": [] }, - { - "query": "row var = 42 >= \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "row var = \"2022\" >= 42", - "error": [], - "warning": [] - }, { "query": "row var = 5 < 0", "error": [], @@ -2856,7 +2969,9 @@ }, { "query": "row var = (numberField < 0)", - "error": ["Unknown column [numberField]"], + "error": [ + "Unknown column [numberField]" + ], "warning": [] }, { @@ -2892,16 +3007,6 @@ "error": [], "warning": [] }, - { - "query": "row var = 42 < \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "row var = \"2022\" < 42", - "error": [], - "warning": [] - }, { "query": "row var = 5 <= 0", "error": [], @@ -2914,7 +3019,9 @@ }, { "query": "row var = (numberField <= 0)", - "error": ["Unknown column [numberField]"], + "error": [ + "Unknown column [numberField]" + ], "warning": [] }, { @@ -2950,16 +3057,6 @@ "error": [], "warning": [] }, - { - "query": "row var = 42 <= \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "row var = \"2022\" <= 42", - "error": [], - "warning": [] - }, { "query": "row var = 5 == 0", "error": [], @@ -2972,7 +3069,9 @@ }, { "query": "row var = (numberField == 0)", - "error": ["Unknown column [numberField]"], + "error": [ + "Unknown column [numberField]" + ], "warning": [] }, { @@ -3005,16 +3104,6 @@ "error": [], "warning": [] }, - { - "query": "row var = 42 == \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "row var = \"2022\" == 42", - "error": [], - "warning": [] - }, { "query": "row var = 5 != 0", "error": [], @@ -3027,7 +3116,9 @@ }, { "query": "row var = (numberField != 0)", - "error": ["Unknown column [numberField]"], + "error": [ + "Unknown column [numberField]" + ], "warning": [] }, { @@ -3060,16 +3151,6 @@ "error": [], "warning": [] }, - { - "query": "row var = 42 != \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "row var = \"2022\" != 42", - "error": [], - "warning": [] - }, { "query": "row var = 1 + 1", "error": [], @@ -3082,7 +3163,9 @@ }, { "query": "row var = now() + now()", - "error": ["Argument of [+] must be [time_literal], found value [now()] type [date]"], + "error": [ + "Argument of [+] must be [time_literal], found value [now()] type [date]" + ], "warning": [] }, { @@ -3097,7 +3180,9 @@ }, { "query": "row var = now() - now()", - "error": ["Argument of [-] must be [time_literal], found value [now()] type [date]"], + "error": [ + "Argument of [-] must be [time_literal], found value [now()] type [date]" + ], "warning": [] }, { @@ -3176,22 +3261,30 @@ }, { "query": "row var = 5 like \"?a\"", - "error": ["Argument of [like] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [like] must be [string], found value [5] type [number]" + ], "warning": [] }, { "query": "row var = 5 NOT like \"?a\"", - "error": ["Argument of [not_like] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [not_like] must be [string], found value [5] type [number]" + ], "warning": [] }, { "query": "row var = NOT 5 like \"?a\"", - "error": ["Argument of [like] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [like] must be [string], found value [5] type [number]" + ], "warning": [] }, { "query": "row var = NOT 5 NOT like \"?a\"", - "error": ["Argument of [not_like] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [not_like] must be [string], found value [5] type [number]" + ], "warning": [] }, { @@ -3216,28 +3309,38 @@ }, { "query": "row var = 5 rlike \"?a\"", - "error": ["Argument of [rlike] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [rlike] must be [string], found value [5] type [number]" + ], "warning": [] }, { "query": "row var = 5 NOT rlike \"?a\"", - "error": ["Argument of [not_rlike] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [not_rlike] must be [string], found value [5] type [number]" + ], "warning": [] }, { "query": "row var = NOT 5 rlike \"?a\"", - "error": ["Argument of [rlike] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [rlike] must be [string], found value [5] type [number]" + ], "warning": [] }, { "query": "row var = NOT 5 NOT rlike \"?a\"", - "error": ["Argument of [not_rlike] must be [string], found value [5] type [number]"], + "error": [ + "Argument of [not_rlike] must be [string], found value [5] type [number]" + ], "warning": [] }, { "query": "row var = mv_sort([\"a\", \"b\"], \"bogus\")", "error": [], - "warning": ["Invalid option [\"bogus\"] for mv_sort. Supported options: [\"asc\", \"desc\"]."] + "warning": [ + "Invalid option [\"bogus\"] for mv_sort. Supported options: [\"asc\", \"desc\"]." + ] }, { "query": "row var = mv_sort([\"a\", \"b\"], \"ASC\")", @@ -3251,27 +3354,37 @@ }, { "query": "row 1 anno", - "error": ["ROW does not support [date_period] in expression [1 anno]"], + "error": [ + "ROW does not support [date_period] in expression [1 anno]" + ], "warning": [] }, { "query": "row var = 1 anno", - "error": ["Unexpected time interval qualifier: 'anno'"], + "error": [ + "Unexpected time interval qualifier: 'anno'" + ], "warning": [] }, { "query": "row now() + 1 anno", - "error": ["Unexpected time interval qualifier: 'anno'"], + "error": [ + "Unexpected time interval qualifier: 'anno'" + ], "warning": [] }, { "query": "row 1 year", - "error": ["ROW does not support [date_period] in expression [1 year]"], + "error": [ + "ROW does not support [date_period] in expression [1 year]" + ], "warning": [] }, { "query": "row 1 year", - "error": ["ROW does not support [date_period] in expression [1 year]"], + "error": [ + "ROW does not support [date_period] in expression [1 year]" + ], "warning": [] }, { @@ -3296,7 +3409,9 @@ }, { "query": "row 1 year + 1 year", - "error": ["Argument of [+] must be [date], found value [1 year] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 year] type [duration]" + ], "warning": [] }, { @@ -3325,12 +3440,16 @@ }, { "query": "row 1 years", - "error": ["ROW does not support [date_period] in expression [1 years]"], + "error": [ + "ROW does not support [date_period] in expression [1 years]" + ], "warning": [] }, { "query": "row 1 years", - "error": ["ROW does not support [date_period] in expression [1 years]"], + "error": [ + "ROW does not support [date_period] in expression [1 years]" + ], "warning": [] }, { @@ -3355,7 +3474,9 @@ }, { "query": "row 1 years + 1 year", - "error": ["Argument of [+] must be [date], found value [1 years] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 years] type [duration]" + ], "warning": [] }, { @@ -3384,12 +3505,16 @@ }, { "query": "row 1 month", - "error": ["ROW does not support [date_period] in expression [1 month]"], + "error": [ + "ROW does not support [date_period] in expression [1 month]" + ], "warning": [] }, { "query": "row 1 month", - "error": ["ROW does not support [date_period] in expression [1 month]"], + "error": [ + "ROW does not support [date_period] in expression [1 month]" + ], "warning": [] }, { @@ -3414,7 +3539,9 @@ }, { "query": "row 1 month + 1 year", - "error": ["Argument of [+] must be [date], found value [1 month] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 month] type [duration]" + ], "warning": [] }, { @@ -3443,12 +3570,16 @@ }, { "query": "row 1 months", - "error": ["ROW does not support [date_period] in expression [1 months]"], + "error": [ + "ROW does not support [date_period] in expression [1 months]" + ], "warning": [] }, { "query": "row 1 months", - "error": ["ROW does not support [date_period] in expression [1 months]"], + "error": [ + "ROW does not support [date_period] in expression [1 months]" + ], "warning": [] }, { @@ -3473,7 +3604,9 @@ }, { "query": "row 1 months + 1 year", - "error": ["Argument of [+] must be [date], found value [1 months] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 months] type [duration]" + ], "warning": [] }, { @@ -3502,12 +3635,16 @@ }, { "query": "row 1 week", - "error": ["ROW does not support [date_period] in expression [1 week]"], + "error": [ + "ROW does not support [date_period] in expression [1 week]" + ], "warning": [] }, { "query": "row 1 week", - "error": ["ROW does not support [date_period] in expression [1 week]"], + "error": [ + "ROW does not support [date_period] in expression [1 week]" + ], "warning": [] }, { @@ -3532,7 +3669,9 @@ }, { "query": "row 1 week + 1 year", - "error": ["Argument of [+] must be [date], found value [1 week] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 week] type [duration]" + ], "warning": [] }, { @@ -3561,12 +3700,16 @@ }, { "query": "row 1 weeks", - "error": ["ROW does not support [date_period] in expression [1 weeks]"], + "error": [ + "ROW does not support [date_period] in expression [1 weeks]" + ], "warning": [] }, { "query": "row 1 weeks", - "error": ["ROW does not support [date_period] in expression [1 weeks]"], + "error": [ + "ROW does not support [date_period] in expression [1 weeks]" + ], "warning": [] }, { @@ -3591,8 +3734,10 @@ }, { "query": "row 1 weeks + 1 year", - "error": ["Argument of [+] must be [date], found value [1 weeks] type [duration]"], - "warning": [] + "error": [ + "Argument of [+] must be [date], found value [1 weeks] type [duration]" + ], + "warning": [] }, { "query": "row var = now() * 1 weeks", @@ -3620,12 +3765,16 @@ }, { "query": "row 1 day", - "error": ["ROW does not support [date_period] in expression [1 day]"], + "error": [ + "ROW does not support [date_period] in expression [1 day]" + ], "warning": [] }, { "query": "row 1 day", - "error": ["ROW does not support [date_period] in expression [1 day]"], + "error": [ + "ROW does not support [date_period] in expression [1 day]" + ], "warning": [] }, { @@ -3650,7 +3799,9 @@ }, { "query": "row 1 day + 1 year", - "error": ["Argument of [+] must be [date], found value [1 day] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 day] type [duration]" + ], "warning": [] }, { @@ -3679,12 +3830,16 @@ }, { "query": "row 1 days", - "error": ["ROW does not support [date_period] in expression [1 days]"], + "error": [ + "ROW does not support [date_period] in expression [1 days]" + ], "warning": [] }, { "query": "row 1 days", - "error": ["ROW does not support [date_period] in expression [1 days]"], + "error": [ + "ROW does not support [date_period] in expression [1 days]" + ], "warning": [] }, { @@ -3709,7 +3864,9 @@ }, { "query": "row 1 days + 1 year", - "error": ["Argument of [+] must be [date], found value [1 days] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 days] type [duration]" + ], "warning": [] }, { @@ -3738,12 +3895,16 @@ }, { "query": "row 1 hour", - "error": ["ROW does not support [date_period] in expression [1 hour]"], + "error": [ + "ROW does not support [date_period] in expression [1 hour]" + ], "warning": [] }, { "query": "row 1 hour", - "error": ["ROW does not support [date_period] in expression [1 hour]"], + "error": [ + "ROW does not support [date_period] in expression [1 hour]" + ], "warning": [] }, { @@ -3768,7 +3929,9 @@ }, { "query": "row 1 hour + 1 year", - "error": ["Argument of [+] must be [date], found value [1 hour] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 hour] type [duration]" + ], "warning": [] }, { @@ -3797,12 +3960,16 @@ }, { "query": "row 1 hours", - "error": ["ROW does not support [date_period] in expression [1 hours]"], + "error": [ + "ROW does not support [date_period] in expression [1 hours]" + ], "warning": [] }, { "query": "row 1 hours", - "error": ["ROW does not support [date_period] in expression [1 hours]"], + "error": [ + "ROW does not support [date_period] in expression [1 hours]" + ], "warning": [] }, { @@ -3827,7 +3994,9 @@ }, { "query": "row 1 hours + 1 year", - "error": ["Argument of [+] must be [date], found value [1 hours] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 hours] type [duration]" + ], "warning": [] }, { @@ -3856,12 +4025,16 @@ }, { "query": "row 1 minute", - "error": ["ROW does not support [date_period] in expression [1 minute]"], + "error": [ + "ROW does not support [date_period] in expression [1 minute]" + ], "warning": [] }, { "query": "row 1 minute", - "error": ["ROW does not support [date_period] in expression [1 minute]"], + "error": [ + "ROW does not support [date_period] in expression [1 minute]" + ], "warning": [] }, { @@ -3886,7 +4059,9 @@ }, { "query": "row 1 minute + 1 year", - "error": ["Argument of [+] must be [date], found value [1 minute] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 minute] type [duration]" + ], "warning": [] }, { @@ -3915,12 +4090,16 @@ }, { "query": "row 1 minutes", - "error": ["ROW does not support [date_period] in expression [1 minutes]"], + "error": [ + "ROW does not support [date_period] in expression [1 minutes]" + ], "warning": [] }, { "query": "row 1 minutes", - "error": ["ROW does not support [date_period] in expression [1 minutes]"], + "error": [ + "ROW does not support [date_period] in expression [1 minutes]" + ], "warning": [] }, { @@ -3945,7 +4124,9 @@ }, { "query": "row 1 minutes + 1 year", - "error": ["Argument of [+] must be [date], found value [1 minutes] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 minutes] type [duration]" + ], "warning": [] }, { @@ -3974,12 +4155,16 @@ }, { "query": "row 1 second", - "error": ["ROW does not support [date_period] in expression [1 second]"], + "error": [ + "ROW does not support [date_period] in expression [1 second]" + ], "warning": [] }, { "query": "row 1 second", - "error": ["ROW does not support [date_period] in expression [1 second]"], + "error": [ + "ROW does not support [date_period] in expression [1 second]" + ], "warning": [] }, { @@ -4004,7 +4189,9 @@ }, { "query": "row 1 second + 1 year", - "error": ["Argument of [+] must be [date], found value [1 second] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 second] type [duration]" + ], "warning": [] }, { @@ -4033,12 +4220,16 @@ }, { "query": "row 1 seconds", - "error": ["ROW does not support [date_period] in expression [1 seconds]"], + "error": [ + "ROW does not support [date_period] in expression [1 seconds]" + ], "warning": [] }, { "query": "row 1 seconds", - "error": ["ROW does not support [date_period] in expression [1 seconds]"], + "error": [ + "ROW does not support [date_period] in expression [1 seconds]" + ], "warning": [] }, { @@ -4063,7 +4254,9 @@ }, { "query": "row 1 seconds + 1 year", - "error": ["Argument of [+] must be [date], found value [1 seconds] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 seconds] type [duration]" + ], "warning": [] }, { @@ -4092,12 +4285,16 @@ }, { "query": "row 1 millisecond", - "error": ["ROW does not support [date_period] in expression [1 millisecond]"], + "error": [ + "ROW does not support [date_period] in expression [1 millisecond]" + ], "warning": [] }, { "query": "row 1 millisecond", - "error": ["ROW does not support [date_period] in expression [1 millisecond]"], + "error": [ + "ROW does not support [date_period] in expression [1 millisecond]" + ], "warning": [] }, { @@ -4122,7 +4319,9 @@ }, { "query": "row 1 millisecond + 1 year", - "error": ["Argument of [+] must be [date], found value [1 millisecond] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 millisecond] type [duration]" + ], "warning": [] }, { @@ -4151,12 +4350,16 @@ }, { "query": "row 1 milliseconds", - "error": ["ROW does not support [date_period] in expression [1 milliseconds]"], + "error": [ + "ROW does not support [date_period] in expression [1 milliseconds]" + ], "warning": [] }, { "query": "row 1 milliseconds", - "error": ["ROW does not support [date_period] in expression [1 milliseconds]"], + "error": [ + "ROW does not support [date_period] in expression [1 milliseconds]" + ], "warning": [] }, { @@ -4181,7 +4384,9 @@ }, { "query": "row 1 milliseconds + 1 year", - "error": ["Argument of [+] must be [date], found value [1 milliseconds] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 milliseconds] type [duration]" + ], "warning": [] }, { @@ -4210,7 +4415,9 @@ }, { "query": "meta", - "error": ["SyntaxError: missing 'functions' at ''"], + "error": [ + "SyntaxError: missing 'functions' at ''" + ], "warning": [] }, { @@ -4248,7 +4455,9 @@ }, { "query": "show", - "error": ["SyntaxError: missing 'info' at ''"], + "error": [ + "SyntaxError: missing 'info' at ''" + ], "warning": [] }, { @@ -4290,7 +4499,9 @@ }, { "query": "from index | limit ", - "error": ["SyntaxError: missing INTEGER_LITERAL at ''"], + "error": [ + "SyntaxError: missing INTEGER_LITERAL at ''" + ], "warning": [] }, { @@ -4300,22 +4511,30 @@ }, { "query": "from index | limit 4.5", - "error": ["SyntaxError: mismatched input '4.5' expecting INTEGER_LITERAL"], + "error": [ + "SyntaxError: mismatched input '4.5' expecting INTEGER_LITERAL" + ], "warning": [] }, { "query": "from index | limit a", - "error": ["SyntaxError: mismatched input 'a' expecting INTEGER_LITERAL"], + "error": [ + "SyntaxError: mismatched input 'a' expecting INTEGER_LITERAL" + ], "warning": [] }, { "query": "from index | limit numberField", - "error": ["SyntaxError: mismatched input 'numberField' expecting INTEGER_LITERAL"], + "error": [ + "SyntaxError: mismatched input 'numberField' expecting INTEGER_LITERAL" + ], "warning": [] }, { "query": "from index | limit stringField", - "error": ["SyntaxError: mismatched input 'stringField' expecting INTEGER_LITERAL"], + "error": [ + "SyntaxError: mismatched input 'stringField' expecting INTEGER_LITERAL" + ], "warning": [] }, { @@ -4325,7 +4544,9 @@ }, { "query": "from index | keep ", - "error": ["SyntaxError: missing ID_PATTERN at ''"], + "error": [ + "SyntaxError: missing ID_PATTERN at ''" + ], "warning": [] }, { @@ -4350,12 +4571,16 @@ }, { "query": "from index | keep `4.5`", - "error": ["Unknown column [4.5]"], + "error": [ + "Unknown column [4.5]" + ], "warning": [] }, { "query": "from index | keep missingField, numberField, dateField", - "error": ["Unknown column [missingField]"], + "error": [ + "Unknown column [missingField]" + ], "warning": [] }, { @@ -4418,17 +4643,23 @@ }, { "query": "from index | keep m*", - "error": ["Unknown column [m*]"], + "error": [ + "Unknown column [m*]" + ], "warning": [] }, { "query": "from index | keep *m", - "error": ["Unknown column [*m]"], + "error": [ + "Unknown column [*m]" + ], "warning": [] }, { "query": "from index | keep d*m", - "error": ["Unknown column [d*m]"], + "error": [ + "Unknown column [d*m]" + ], "warning": [] }, { @@ -4450,7 +4681,9 @@ }, { "query": "from index | drop ", - "error": ["SyntaxError: missing ID_PATTERN at ''"], + "error": [ + "SyntaxError: missing ID_PATTERN at ''" + ], "warning": [] }, { @@ -4470,7 +4703,9 @@ }, { "query": "from index | drop missingField, numberField, dateField", - "error": ["Unknown column [missingField]"], + "error": [ + "Unknown column [missingField]" + ], "warning": [] }, { @@ -4520,38 +4755,52 @@ }, { "query": "from index | drop m*", - "error": ["Unknown column [m*]"], + "error": [ + "Unknown column [m*]" + ], "warning": [] }, { "query": "from index | drop *m", - "error": ["Unknown column [*m]"], + "error": [ + "Unknown column [*m]" + ], "warning": [] }, { "query": "from index | drop d*m", - "error": ["Unknown column [d*m]"], + "error": [ + "Unknown column [d*m]" + ], "warning": [] }, { "query": "from index | drop *", - "error": ["Removing all fields is not allowed [*]"], + "error": [ + "Removing all fields is not allowed [*]" + ], "warning": [] }, { "query": "from index | drop stringField, *", - "error": ["Removing all fields is not allowed [*]"], + "error": [ + "Removing all fields is not allowed [*]" + ], "warning": [] }, { "query": "from index | drop @timestamp", "error": [], - "warning": ["Drop [@timestamp] will remove all time filters to the search results"] + "warning": [ + "Drop [@timestamp] will remove all time filters to the search results" + ] }, { "query": "from index | drop stringField, @timestamp", "error": [], - "warning": ["Drop [@timestamp] will remove all time filters to the search results"] + "warning": [ + "Drop [@timestamp] will remove all time filters to the search results" + ] }, { "query": "FROM index | STATS ROUND(AVG(numberField * 1.5)), COUNT(*), MIN(numberField * 10) | DROP `MIN(numberField * 10)`", @@ -4565,7 +4814,9 @@ }, { "query": "from a_index | mv_expand ", - "error": ["SyntaxError: missing {UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER} at ''"], + "error": [ + "SyntaxError: missing {UNQUOTED_IDENTIFIER, QUOTED_IDENTIFIER} at ''" + ], "warning": [] }, { @@ -4623,27 +4874,39 @@ }, { "query": "from a_index | rename", - "error": ["SyntaxError: mismatched input '' expecting ID_PATTERN"], + "error": [ + "SyntaxError: mismatched input '' expecting ID_PATTERN" + ], "warning": [] }, { "query": "from a_index | rename stringField", - "error": ["SyntaxError: mismatched input '' expecting 'as'"], + "error": [ + "SyntaxError: mismatched input '' expecting 'as'" + ], "warning": [] }, { "query": "from a_index | rename a", - "error": ["SyntaxError: mismatched input '' expecting 'as'", "Unknown column [a]"], + "error": [ + "SyntaxError: mismatched input '' expecting 'as'", + "Unknown column [a]" + ], "warning": [] }, { "query": "from a_index | rename stringField as", - "error": ["SyntaxError: missing ID_PATTERN at ''"], + "error": [ + "SyntaxError: missing ID_PATTERN at ''" + ], "warning": [] }, { "query": "from a_index | rename missingField as", - "error": ["SyntaxError: missing ID_PATTERN at ''", "Unknown column [missingField]"], + "error": [ + "SyntaxError: missing ID_PATTERN at ''", + "Unknown column [missingField]" + ], "warning": [] }, { @@ -4688,12 +4951,17 @@ }, { "query": "from a_index |eval numberField + 1 | rename `numberField + 1` as ", - "error": ["SyntaxError: missing ID_PATTERN at ''"], + "error": [ + "SyntaxError: missing ID_PATTERN at ''" + ], "warning": [] }, { "query": "from a_index | rename s* as strings", - "error": ["Using wildcards (*) in RENAME is not allowed [s*]", "Unknown column [strings]"], + "error": [ + "Using wildcards (*) in RENAME is not allowed [s*]", + "Unknown column [strings]" + ], "warning": [] }, { @@ -4703,7 +4971,9 @@ }, { "query": "row a = 10 | rename a as this is fine", - "error": ["SyntaxError: mismatched input 'is' expecting "], + "error": [ + "SyntaxError: mismatched input 'is' expecting " + ], "warning": [] }, { @@ -4715,12 +4985,16 @@ }, { "query": "from a_index | dissect stringField", - "error": ["SyntaxError: missing QUOTED_STRING at ''"], + "error": [ + "SyntaxError: missing QUOTED_STRING at ''" + ], "warning": [] }, { "query": "from a_index | dissect stringField 2", - "error": ["SyntaxError: mismatched input '2' expecting QUOTED_STRING"], + "error": [ + "SyntaxError: mismatched input '2' expecting QUOTED_STRING" + ], "warning": [] }, { @@ -4746,12 +5020,16 @@ }, { "query": "from a_index | dissect numberField \"%{firstWord}\"", - "error": ["DISSECT only supports string type values, found [numberField] of type [number]"], + "error": [ + "DISSECT only supports string type values, found [numberField] of type [number]" + ], "warning": [] }, { "query": "from a_index | dissect stringField \"%{firstWord}\" option ", - "error": ["SyntaxError: mismatched input '' expecting '='"], + "error": [ + "SyntaxError: mismatched input '' expecting '='" + ], "warning": [] }, { @@ -4764,7 +5042,9 @@ }, { "query": "from a_index | dissect stringField \"%{firstWord}\" option = 1", - "error": ["Invalid option for DISSECT: [option]"], + "error": [ + "Invalid option for DISSECT: [option]" + ], "warning": [] }, { @@ -4774,12 +5054,16 @@ }, { "query": "from a_index | dissect stringField \"%{firstWord}\" ignore_missing = true", - "error": ["Invalid option for DISSECT: [ignore_missing]"], + "error": [ + "Invalid option for DISSECT: [ignore_missing]" + ], "warning": [] }, { "query": "from a_index | dissect stringField \"%{firstWord}\" append_separator = true", - "error": ["Invalid value for DISSECT append_separator: expected a string, but was [true]"], + "error": [ + "Invalid value for DISSECT append_separator: expected a string, but was [true]" + ], "warning": [] }, { @@ -4796,12 +5080,16 @@ }, { "query": "from a_index | grok stringField", - "error": ["SyntaxError: missing QUOTED_STRING at ''"], + "error": [ + "SyntaxError: missing QUOTED_STRING at ''" + ], "warning": [] }, { "query": "from a_index | grok stringField 2", - "error": ["SyntaxError: mismatched input '2' expecting QUOTED_STRING"], + "error": [ + "SyntaxError: mismatched input '2' expecting QUOTED_STRING" + ], "warning": [] }, { @@ -4814,7 +5102,9 @@ }, { "query": "from a_index | grok stringField %a", - "error": ["SyntaxError: mismatched input '%' expecting QUOTED_STRING"], + "error": [ + "SyntaxError: mismatched input '%' expecting QUOTED_STRING" + ], "warning": [] }, { @@ -4824,7 +5114,9 @@ }, { "query": "from a_index | grok numberField \"%{firstWord}\"", - "error": ["GROK only supports string type values, found [numberField] of type [number]"], + "error": [ + "GROK only supports string type values, found [numberField] of type [number]" + ], "warning": [] }, { @@ -4834,7 +5126,9 @@ }, { "query": "from a_index | where b", - "error": ["Unknown column [b]"], + "error": [ + "Unknown column [b]" + ], "warning": [] }, { @@ -4980,46 +5274,6 @@ "error": [], "warning": [] }, - { - "query": "from a_index | where numberField > stringField", - "error": ["Argument of [>] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where stringField > numberField", - "error": ["Argument of [>] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where numberField > \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where dateField > stringField", - "error": ["Argument of [>] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | where stringField > dateField", - "error": ["Argument of [>] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | where dateField > \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField > 0", - "error": ["Argument of [>] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where stringField > now()", - "error": ["Argument of [>] must be [string], found value [now()] type [date]"], - "warning": [] - }, { "query": "from a_index | where numberField >= 0", "error": [], @@ -5073,46 +5327,6 @@ "error": [], "warning": [] }, - { - "query": "from a_index | where numberField >= stringField", - "error": ["Argument of [>=] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where stringField >= numberField", - "error": ["Argument of [>=] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where numberField >= \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where dateField >= stringField", - "error": ["Argument of [>=] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | where stringField >= dateField", - "error": ["Argument of [>=] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | where dateField >= \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField >= 0", - "error": ["Argument of [>=] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where stringField >= now()", - "error": ["Argument of [>=] must be [string], found value [now()] type [date]"], - "warning": [] - }, { "query": "from a_index | where numberField < 0", "error": [], @@ -5166,46 +5380,6 @@ "error": [], "warning": [] }, - { - "query": "from a_index | where numberField < stringField", - "error": ["Argument of [<] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where stringField < numberField", - "error": ["Argument of [<] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where numberField < \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where dateField < stringField", - "error": ["Argument of [<] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | where stringField < dateField", - "error": ["Argument of [<] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | where dateField < \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField < 0", - "error": ["Argument of [<] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where stringField < now()", - "error": ["Argument of [<] must be [string], found value [now()] type [date]"], - "warning": [] - }, { "query": "from a_index | where numberField <= 0", "error": [], @@ -5260,135 +5434,55 @@ "warning": [] }, { - "query": "from a_index | where numberField <= stringField", - "error": ["Argument of [<=] must be [number], found value [stringField] type [string]"], + "query": "from a_index | where numberField == 0", + "error": [], "warning": [] }, { - "query": "from a_index | where stringField <= numberField", - "error": ["Argument of [<=] must be [number], found value [stringField] type [string]"], + "query": "from a_index | where NOT numberField == 0", + "error": [], "warning": [] }, { - "query": "from a_index | where numberField <= \"2022\"", + "query": "from a_index | where (numberField == 0)", "error": [], "warning": [] }, { - "query": "from a_index | where dateField <= stringField", - "error": ["Argument of [<=] must be [string], found value [dateField] type [date]"], + "query": "from a_index | where (NOT (numberField == 0))", + "error": [], "warning": [] }, { - "query": "from a_index | where stringField <= dateField", - "error": ["Argument of [<=] must be [string], found value [dateField] type [date]"], + "query": "from a_index | where 1 == 0", + "error": [], "warning": [] }, { - "query": "from a_index | where dateField <= \"2022\"", + "query": "from a_index | where stringField == stringField", "error": [], "warning": [] }, { - "query": "from a_index | where stringField <= 0", - "error": ["Argument of [<=] must be [number], found value [stringField] type [string]"], + "query": "from a_index | where numberField == numberField", + "error": [], "warning": [] }, { - "query": "from a_index | where stringField <= now()", - "error": ["Argument of [<=] must be [string], found value [now()] type [date]"], + "query": "from a_index | where dateField == dateField", + "error": [], "warning": [] }, { - "query": "from a_index | where numberField == 0", + "query": "from a_index | where booleanField == booleanField", "error": [], "warning": [] }, { - "query": "from a_index | where NOT numberField == 0", + "query": "from a_index | where ipField == ipField", "error": [], "warning": [] }, - { - "query": "from a_index | where (numberField == 0)", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where (NOT (numberField == 0))", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where 1 == 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField == stringField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where numberField == numberField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where dateField == dateField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where booleanField == booleanField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where ipField == ipField", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where numberField == stringField", - "error": ["Argument of [==] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where stringField == numberField", - "error": ["Argument of [==] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where numberField == \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where dateField == stringField", - "error": ["Argument of [==] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | where stringField == dateField", - "error": ["Argument of [==] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | where dateField == \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField == 0", - "error": ["Argument of [==] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where stringField == now()", - "error": ["Argument of [==] must be [string], found value [now()] type [date]"], - "warning": [] - }, { "query": "from a_index | where numberField != 0", "error": [], @@ -5439,46 +5533,6 @@ "error": [], "warning": [] }, - { - "query": "from a_index | where numberField != stringField", - "error": ["Argument of [!=] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where stringField != numberField", - "error": ["Argument of [!=] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where numberField != \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where dateField != stringField", - "error": ["Argument of [!=] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | where stringField != dateField", - "error": ["Argument of [!=] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | where dateField != \"2022\"", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where stringField != 0", - "error": ["Argument of [!=] must be [number], found value [stringField] type [string]"], - "warning": [] - }, - { - "query": "from a_index | where stringField != now()", - "error": ["Argument of [!=] must be [string], found value [now()] type [date]"], - "warning": [] - }, { "query": "from a_index | where - numberField > 0", "error": [], @@ -5882,7 +5936,9 @@ }, { "query": "from a_index | eval stringField =~ 0", - "error": ["Argument of [=~] must be [string], found value [0] type [number]"], + "error": [ + "Argument of [=~] must be [string], found value [0] type [number]" + ], "warning": [] }, { @@ -5907,22 +5963,30 @@ }, { "query": "from a_index | where numberField like \"?a\"", - "error": ["Argument of [like] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [like] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | where numberField NOT like \"?a\"", - "error": ["Argument of [not_like] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [not_like] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | where NOT numberField like \"?a\"", - "error": ["Argument of [like] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [like] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | where NOT numberField NOT like \"?a\"", - "error": ["Argument of [not_like] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [not_like] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -5947,7 +6011,9 @@ }, { "query": "from a_index | where numberField rlike \"?a\"", - "error": ["Argument of [rlike] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [rlike] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -5959,7 +6025,9 @@ }, { "query": "from a_index | where NOT numberField rlike \"?a\"", - "error": ["Argument of [rlike] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [rlike] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -5971,7 +6039,9 @@ }, { "query": "from a_index | where cidr_match(ipField)", - "error": ["Error: [cidr_match] function expects at least 2 arguments, got 1."], + "error": [ + "Error: [cidr_match] function expects at least 2 arguments, got 1." + ], "warning": [] }, { @@ -6099,6 +6169,46 @@ "error": [], "warning": [] }, + { + "query": "from a_index | where versionField IS NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField IS null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField is null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField is NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField IS NOT NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField IS NOT null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField IS not NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | where versionField Is nOt NuLL", + "error": [], + "warning": [] + }, { "query": "from a_index | where ipField IS NULL", "error": [], @@ -6346,112 +6456,156 @@ }, { "query": "from a_index | where avg(numberField)", - "error": ["WHERE does not support function avg"], + "error": [ + "WHERE does not support function avg" + ], "warning": [] }, { "query": "from a_index | where avg(numberField) > 0", - "error": ["WHERE does not support function avg"], + "error": [ + "WHERE does not support function avg" + ], "warning": [] }, { "query": "from a_index | where sum(numberField)", - "error": ["WHERE does not support function sum"], + "error": [ + "WHERE does not support function sum" + ], "warning": [] }, { "query": "from a_index | where sum(numberField) > 0", - "error": ["WHERE does not support function sum"], + "error": [ + "WHERE does not support function sum" + ], "warning": [] }, { "query": "from a_index | where median(numberField)", - "error": ["WHERE does not support function median"], + "error": [ + "WHERE does not support function median" + ], "warning": [] }, { "query": "from a_index | where median(numberField) > 0", - "error": ["WHERE does not support function median"], + "error": [ + "WHERE does not support function median" + ], "warning": [] }, { "query": "from a_index | where median_absolute_deviation(numberField)", - "error": ["WHERE does not support function median_absolute_deviation"], + "error": [ + "WHERE does not support function median_absolute_deviation" + ], "warning": [] }, { "query": "from a_index | where median_absolute_deviation(numberField) > 0", - "error": ["WHERE does not support function median_absolute_deviation"], + "error": [ + "WHERE does not support function median_absolute_deviation" + ], "warning": [] }, { "query": "from a_index | where percentile(numberField, 5)", - "error": ["WHERE does not support function percentile"], + "error": [ + "WHERE does not support function percentile" + ], "warning": [] }, { "query": "from a_index | where percentile(numberField, 5) > 0", - "error": ["WHERE does not support function percentile"], + "error": [ + "WHERE does not support function percentile" + ], "warning": [] }, { "query": "from a_index | where max(numberField)", - "error": ["WHERE does not support function max"], + "error": [ + "WHERE does not support function max" + ], "warning": [] }, { "query": "from a_index | where max(numberField) > 0", - "error": ["WHERE does not support function max"], + "error": [ + "WHERE does not support function max" + ], "warning": [] }, { "query": "from a_index | where max(dateField)", - "error": ["WHERE does not support function max"], + "error": [ + "WHERE does not support function max" + ], "warning": [] }, { "query": "from a_index | where max(dateField) > 0", - "error": ["WHERE does not support function max"], + "error": [ + "WHERE does not support function max" + ], "warning": [] }, { "query": "from a_index | where min(numberField)", - "error": ["WHERE does not support function min"], + "error": [ + "WHERE does not support function min" + ], "warning": [] }, { "query": "from a_index | where min(numberField) > 0", - "error": ["WHERE does not support function min"], + "error": [ + "WHERE does not support function min" + ], "warning": [] }, { "query": "from a_index | where min(dateField)", - "error": ["WHERE does not support function min"], + "error": [ + "WHERE does not support function min" + ], "warning": [] }, { "query": "from a_index | where min(dateField) > 0", - "error": ["WHERE does not support function min"], + "error": [ + "WHERE does not support function min" + ], "warning": [] }, { "query": "from a_index | where count(stringField)", - "error": ["WHERE does not support function count"], + "error": [ + "WHERE does not support function count" + ], "warning": [] }, { "query": "from a_index | where count(stringField) > 0", - "error": ["WHERE does not support function count"], + "error": [ + "WHERE does not support function count" + ], "warning": [] }, { "query": "from a_index | where count_distinct(stringField, numberField)", - "error": ["WHERE does not support function count_distinct"], + "error": [ + "WHERE does not support function count_distinct" + ], "warning": [] }, { "query": "from a_index | where count_distinct(stringField, numberField) > 0", - "error": ["WHERE does not support function count_distinct"], + "error": [ + "WHERE does not support function count_distinct" + ], "warning": [] }, { @@ -6461,7 +6615,9 @@ }, { "query": "from a_index | where abs(stringField) > 0", - "error": ["Argument of [abs] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [abs] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6471,7 +6627,9 @@ }, { "query": "from a_index | where acos(stringField) > 0", - "error": ["Argument of [acos] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [acos] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6481,7 +6639,9 @@ }, { "query": "from a_index | where asin(stringField) > 0", - "error": ["Argument of [asin] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [asin] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6491,7 +6651,9 @@ }, { "query": "from a_index | where atan(stringField) > 0", - "error": ["Argument of [atan] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [atan] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6514,7 +6676,9 @@ }, { "query": "from a_index | where ceil(stringField) > 0", - "error": ["Argument of [ceil] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [ceil] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6524,7 +6688,9 @@ }, { "query": "from a_index | where length(concat(numberField, numberField)) > 0", - "error": ["Argument of [concat] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [concat] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -6534,7 +6700,9 @@ }, { "query": "from a_index | where cos(stringField) > 0", - "error": ["Argument of [cos] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [cos] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6544,7 +6712,9 @@ }, { "query": "from a_index | where cosh(stringField) > 0", - "error": ["Argument of [cosh] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [cosh] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6564,7 +6734,9 @@ }, { "query": "from a_index | where floor(stringField) > 0", - "error": ["Argument of [floor] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [floor] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6587,7 +6759,9 @@ }, { "query": "from a_index | where length(numberField) > 0", - "error": ["Argument of [length] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [length] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -6610,7 +6784,9 @@ }, { "query": "from a_index | where log10(stringField) > 0", - "error": ["Argument of [log10] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [log10] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6620,7 +6796,9 @@ }, { "query": "from a_index | where length(ltrim(numberField)) > 0", - "error": ["Argument of [ltrim] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [ltrim] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -6630,7 +6808,9 @@ }, { "query": "from a_index | where mv_avg(stringField) > 0", - "error": ["Argument of [mv_avg] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [mv_avg] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6665,7 +6845,9 @@ }, { "query": "from a_index | where mv_sum(stringField) > 0", - "error": ["Argument of [mv_sum] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [mv_sum] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6752,7 +6934,9 @@ }, { "query": "from a_index | where length(rtrim(numberField)) > 0", - "error": ["Argument of [rtrim] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [rtrim] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -6762,7 +6946,9 @@ }, { "query": "from a_index | where signum(stringField) > 0", - "error": ["Argument of [signum] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [signum] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6772,7 +6958,9 @@ }, { "query": "from a_index | where sin(stringField) > 0", - "error": ["Argument of [sin] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [sin] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6782,7 +6970,9 @@ }, { "query": "from a_index | where sinh(stringField) > 0", - "error": ["Argument of [sinh] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [sinh] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6805,7 +6995,9 @@ }, { "query": "from a_index | where sqrt(stringField) > 0", - "error": ["Argument of [sqrt] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [sqrt] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6829,7 +7021,9 @@ }, { "query": "from a_index | where tan(stringField) > 0", - "error": ["Argument of [tan] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [tan] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6839,7 +7033,9 @@ }, { "query": "from a_index | where tanh(stringField) > 0", - "error": ["Argument of [tanh] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [tanh] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -6871,7 +7067,9 @@ }, { "query": "from a_index | where length(to_lower(numberField)) > 0", - "error": ["Argument of [to_lower] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [to_lower] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -6893,18 +7091,8 @@ }, { "query": "from a_index | where length(to_upper(numberField)) > 0", - "error": ["Argument of [to_upper] must be [string], found value [numberField] type [number]"], - "warning": [] - }, - { - "query": "from a_index | where length(to_version(stringField)) > 0", - "error": [], - "warning": [] - }, - { - "query": "from a_index | where length(to_version(numberField)) > 0", "error": [ - "Argument of [to_version] must be [string], found value [numberField] type [number]" + "Argument of [to_upper] must be [string], found value [numberField] type [number]" ], "warning": [] }, @@ -6915,7 +7103,9 @@ }, { "query": "from a_index | where length(trim(numberField)) > 0", - "error": ["Argument of [trim] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [trim] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -6942,17 +7132,23 @@ }, { "query": "from a_index | eval numberField + ", - "error": ["SyntaxError: no viable alternative at input 'numberField + '"], + "error": [ + "SyntaxError: no viable alternative at input 'numberField + '" + ], "warning": [] }, { "query": "from a_index | eval stringField + 1", - "error": ["Argument of [+] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [+] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval a=b", - "error": ["Unknown column [b]"], + "error": [ + "Unknown column [b]" + ], "warning": [] }, { @@ -6965,12 +7161,16 @@ }, { "query": "from a_index | eval a=round", - "error": ["Unknown column [round]"], + "error": [ + "Unknown column [round]" + ], "warning": [] }, { "query": "from a_index | eval a=round(", - "error": ["SyntaxError: no viable alternative at input 'round('"], + "error": [ + "SyntaxError: no viable alternative at input 'round('" + ], "warning": [] }, { @@ -6992,12 +7192,16 @@ }, { "query": "from a_index | eval a=round(numberField) + round(stringField) ", - "error": ["Argument of [round] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [round] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval a=round(numberField) + round(stringField), numberField ", - "error": ["Argument of [round] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [round] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { @@ -7136,12 +7340,47 @@ "warning": [] }, { - "query": "from a_index | eval ipField IS NULL", + "query": "from a_index | eval versionField IS NULL", "error": [], "warning": [] }, { - "query": "from a_index | eval ipField IS null", + "query": "from a_index | eval versionField IS null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField is null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField is NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField IS NOT NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField IS NOT null", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField IS not NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval ipField IS NULL", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval ipField IS null", "error": [], "warning": [] }, @@ -7788,282 +8027,394 @@ }, { "query": "from a_index | eval var = avg(numberField)", - "error": ["EVAL does not support function avg"], + "error": [ + "EVAL does not support function avg" + ], "warning": [] }, { "query": "from a_index | eval var = avg(numberField) > 0", - "error": ["EVAL does not support function avg"], + "error": [ + "EVAL does not support function avg" + ], "warning": [] }, { "query": "from a_index | eval avg(numberField)", - "error": ["EVAL does not support function avg"], + "error": [ + "EVAL does not support function avg" + ], "warning": [] }, { "query": "from a_index | eval avg(numberField) > 0", - "error": ["EVAL does not support function avg"], + "error": [ + "EVAL does not support function avg" + ], "warning": [] }, { "query": "from a_index | eval var = sum(numberField)", - "error": ["EVAL does not support function sum"], + "error": [ + "EVAL does not support function sum" + ], "warning": [] }, { "query": "from a_index | eval var = sum(numberField) > 0", - "error": ["EVAL does not support function sum"], + "error": [ + "EVAL does not support function sum" + ], "warning": [] }, { "query": "from a_index | eval sum(numberField)", - "error": ["EVAL does not support function sum"], + "error": [ + "EVAL does not support function sum" + ], "warning": [] }, { "query": "from a_index | eval sum(numberField) > 0", - "error": ["EVAL does not support function sum"], + "error": [ + "EVAL does not support function sum" + ], "warning": [] }, { "query": "from a_index | eval var = median(numberField)", - "error": ["EVAL does not support function median"], + "error": [ + "EVAL does not support function median" + ], "warning": [] }, { "query": "from a_index | eval var = median(numberField) > 0", - "error": ["EVAL does not support function median"], + "error": [ + "EVAL does not support function median" + ], "warning": [] }, { "query": "from a_index | eval median(numberField)", - "error": ["EVAL does not support function median"], + "error": [ + "EVAL does not support function median" + ], "warning": [] }, { "query": "from a_index | eval median(numberField) > 0", - "error": ["EVAL does not support function median"], + "error": [ + "EVAL does not support function median" + ], "warning": [] }, { "query": "from a_index | eval var = median_absolute_deviation(numberField)", - "error": ["EVAL does not support function median_absolute_deviation"], + "error": [ + "EVAL does not support function median_absolute_deviation" + ], "warning": [] }, { "query": "from a_index | eval var = median_absolute_deviation(numberField) > 0", - "error": ["EVAL does not support function median_absolute_deviation"], + "error": [ + "EVAL does not support function median_absolute_deviation" + ], "warning": [] }, { "query": "from a_index | eval median_absolute_deviation(numberField)", - "error": ["EVAL does not support function median_absolute_deviation"], + "error": [ + "EVAL does not support function median_absolute_deviation" + ], "warning": [] }, { "query": "from a_index | eval median_absolute_deviation(numberField) > 0", - "error": ["EVAL does not support function median_absolute_deviation"], + "error": [ + "EVAL does not support function median_absolute_deviation" + ], "warning": [] }, { "query": "from a_index | eval var = percentile(numberField, 5)", - "error": ["EVAL does not support function percentile"], + "error": [ + "EVAL does not support function percentile" + ], "warning": [] }, { "query": "from a_index | eval var = percentile(numberField, 5) > 0", - "error": ["EVAL does not support function percentile"], + "error": [ + "EVAL does not support function percentile" + ], "warning": [] }, { "query": "from a_index | eval percentile(numberField, 5)", - "error": ["EVAL does not support function percentile"], + "error": [ + "EVAL does not support function percentile" + ], "warning": [] }, { "query": "from a_index | eval percentile(numberField, 5) > 0", - "error": ["EVAL does not support function percentile"], + "error": [ + "EVAL does not support function percentile" + ], "warning": [] }, { "query": "from a_index | eval var = max(numberField)", - "error": ["EVAL does not support function max"], + "error": [ + "EVAL does not support function max" + ], "warning": [] }, { "query": "from a_index | eval var = max(numberField) > 0", - "error": ["EVAL does not support function max"], + "error": [ + "EVAL does not support function max" + ], "warning": [] }, { "query": "from a_index | eval max(numberField)", - "error": ["EVAL does not support function max"], + "error": [ + "EVAL does not support function max" + ], "warning": [] }, { "query": "from a_index | eval max(numberField) > 0", - "error": ["EVAL does not support function max"], + "error": [ + "EVAL does not support function max" + ], "warning": [] }, { "query": "from a_index | eval var = max(dateField)", - "error": ["EVAL does not support function max"], + "error": [ + "EVAL does not support function max" + ], "warning": [] }, { "query": "from a_index | eval var = max(dateField) > 0", - "error": ["EVAL does not support function max"], + "error": [ + "EVAL does not support function max" + ], "warning": [] }, { "query": "from a_index | eval max(dateField)", - "error": ["EVAL does not support function max"], + "error": [ + "EVAL does not support function max" + ], "warning": [] }, { "query": "from a_index | eval max(dateField) > 0", - "error": ["EVAL does not support function max"], + "error": [ + "EVAL does not support function max" + ], "warning": [] }, { "query": "from a_index | eval var = min(numberField)", - "error": ["EVAL does not support function min"], + "error": [ + "EVAL does not support function min" + ], "warning": [] }, { "query": "from a_index | eval var = min(numberField) > 0", - "error": ["EVAL does not support function min"], + "error": [ + "EVAL does not support function min" + ], "warning": [] }, { "query": "from a_index | eval min(numberField)", - "error": ["EVAL does not support function min"], + "error": [ + "EVAL does not support function min" + ], "warning": [] }, { "query": "from a_index | eval min(numberField) > 0", - "error": ["EVAL does not support function min"], + "error": [ + "EVAL does not support function min" + ], "warning": [] }, { "query": "from a_index | eval var = min(dateField)", - "error": ["EVAL does not support function min"], + "error": [ + "EVAL does not support function min" + ], "warning": [] }, { "query": "from a_index | eval var = min(dateField) > 0", - "error": ["EVAL does not support function min"], + "error": [ + "EVAL does not support function min" + ], "warning": [] }, { "query": "from a_index | eval min(dateField)", - "error": ["EVAL does not support function min"], + "error": [ + "EVAL does not support function min" + ], "warning": [] }, { "query": "from a_index | eval min(dateField) > 0", - "error": ["EVAL does not support function min"], + "error": [ + "EVAL does not support function min" + ], "warning": [] }, { "query": "from a_index | eval var = count(stringField)", - "error": ["EVAL does not support function count"], + "error": [ + "EVAL does not support function count" + ], "warning": [] }, { "query": "from a_index | eval var = count(stringField) > 0", - "error": ["EVAL does not support function count"], + "error": [ + "EVAL does not support function count" + ], "warning": [] }, { "query": "from a_index | eval count(stringField)", - "error": ["EVAL does not support function count"], + "error": [ + "EVAL does not support function count" + ], "warning": [] }, { "query": "from a_index | eval count(stringField) > 0", - "error": ["EVAL does not support function count"], + "error": [ + "EVAL does not support function count" + ], "warning": [] }, { "query": "from a_index | eval var = count_distinct(stringField, numberField)", - "error": ["EVAL does not support function count_distinct"], + "error": [ + "EVAL does not support function count_distinct" + ], "warning": [] }, { "query": "from a_index | eval var = count_distinct(stringField, numberField) > 0", - "error": ["EVAL does not support function count_distinct"], + "error": [ + "EVAL does not support function count_distinct" + ], "warning": [] }, { "query": "from a_index | eval count_distinct(stringField, numberField)", - "error": ["EVAL does not support function count_distinct"], + "error": [ + "EVAL does not support function count_distinct" + ], "warning": [] }, { "query": "from a_index | eval count_distinct(stringField, numberField) > 0", - "error": ["EVAL does not support function count_distinct"], + "error": [ + "EVAL does not support function count_distinct" + ], "warning": [] }, { "query": "from a_index | eval var = st_centroid_agg(cartesianPointField)", - "error": ["EVAL does not support function st_centroid_agg"], + "error": [ + "EVAL does not support function st_centroid_agg" + ], "warning": [] }, { "query": "from a_index | eval var = st_centroid_agg(cartesianPointField) > 0", - "error": ["EVAL does not support function st_centroid_agg"], + "error": [ + "EVAL does not support function st_centroid_agg" + ], "warning": [] }, { "query": "from a_index | eval st_centroid_agg(cartesianPointField)", - "error": ["EVAL does not support function st_centroid_agg"], + "error": [ + "EVAL does not support function st_centroid_agg" + ], "warning": [] }, { "query": "from a_index | eval st_centroid_agg(cartesianPointField) > 0", - "error": ["EVAL does not support function st_centroid_agg"], + "error": [ + "EVAL does not support function st_centroid_agg" + ], "warning": [] }, { "query": "from a_index | eval var = st_centroid_agg(geoPointField)", - "error": ["EVAL does not support function st_centroid_agg"], + "error": [ + "EVAL does not support function st_centroid_agg" + ], "warning": [] }, { "query": "from a_index | eval var = st_centroid_agg(geoPointField) > 0", - "error": ["EVAL does not support function st_centroid_agg"], + "error": [ + "EVAL does not support function st_centroid_agg" + ], "warning": [] }, { "query": "from a_index | eval st_centroid_agg(geoPointField)", - "error": ["EVAL does not support function st_centroid_agg"], + "error": [ + "EVAL does not support function st_centroid_agg" + ], "warning": [] }, { "query": "from a_index | eval st_centroid_agg(geoPointField) > 0", - "error": ["EVAL does not support function st_centroid_agg"], + "error": [ + "EVAL does not support function st_centroid_agg" + ], "warning": [] }, { "query": "from a_index | eval var = values(stringField)", - "error": ["EVAL does not support function values"], + "error": [ + "EVAL does not support function values" + ], "warning": [] }, { "query": "from a_index | eval var = values(stringField) > 0", - "error": ["EVAL does not support function values"], + "error": [ + "EVAL does not support function values" + ], "warning": [] }, { "query": "from a_index | eval values(stringField)", - "error": ["EVAL does not support function values"], + "error": [ + "EVAL does not support function values" + ], "warning": [] }, { "query": "from a_index | eval values(stringField) > 0", - "error": ["EVAL does not support function values"], + "error": [ + "EVAL does not support function values" + ], "warning": [] }, { @@ -8083,17 +8434,23 @@ }, { "query": "from a_index | eval abs(stringField)", - "error": ["Argument of [abs] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [abs] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval abs(numberField, extraArg)", - "error": ["Error: [abs] function expects exactly one argument, got 2."], + "error": [ + "Error: [abs] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = abs(*)", - "error": ["Using wildcards (*) in abs is not allowed"], + "error": [ + "Using wildcards (*) in abs is not allowed" + ], "warning": [] }, { @@ -8113,17 +8470,23 @@ }, { "query": "from a_index | eval acos(stringField)", - "error": ["Argument of [acos] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [acos] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval acos(numberField, extraArg)", - "error": ["Error: [acos] function expects exactly one argument, got 2."], + "error": [ + "Error: [acos] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = acos(*)", - "error": ["Using wildcards (*) in acos is not allowed"], + "error": [ + "Using wildcards (*) in acos is not allowed" + ], "warning": [] }, { @@ -8143,17 +8506,23 @@ }, { "query": "from a_index | eval asin(stringField)", - "error": ["Argument of [asin] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [asin] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval asin(numberField, extraArg)", - "error": ["Error: [asin] function expects exactly one argument, got 2."], + "error": [ + "Error: [asin] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = asin(*)", - "error": ["Using wildcards (*) in asin is not allowed"], + "error": [ + "Using wildcards (*) in asin is not allowed" + ], "warning": [] }, { @@ -8173,17 +8542,23 @@ }, { "query": "from a_index | eval atan(stringField)", - "error": ["Argument of [atan] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [atan] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval atan(numberField, extraArg)", - "error": ["Error: [atan] function expects exactly one argument, got 2."], + "error": [ + "Error: [atan] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = atan(*)", - "error": ["Using wildcards (*) in atan is not allowed"], + "error": [ + "Using wildcards (*) in atan is not allowed" + ], "warning": [] }, { @@ -8211,7 +8586,9 @@ }, { "query": "from a_index | eval atan2(numberField, numberField, extraArg)", - "error": ["Error: [atan2] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [atan2] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -8241,17 +8618,23 @@ }, { "query": "from a_index | eval ceil(stringField)", - "error": ["Argument of [ceil] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [ceil] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval ceil(numberField, extraArg)", - "error": ["Error: [ceil] function expects exactly one argument, got 2."], + "error": [ + "Error: [ceil] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = ceil(*)", - "error": ["Using wildcards (*) in ceil is not allowed"], + "error": [ + "Using wildcards (*) in ceil is not allowed" + ], "warning": [] }, { @@ -8304,7 +8687,9 @@ }, { "query": "from a_index | eval concat(numberField, numberField)", - "error": ["Argument of [concat] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [concat] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -8324,17 +8709,23 @@ }, { "query": "from a_index | eval cos(stringField)", - "error": ["Argument of [cos] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [cos] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval cos(numberField, extraArg)", - "error": ["Error: [cos] function expects exactly one argument, got 2."], + "error": [ + "Error: [cos] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = cos(*)", - "error": ["Using wildcards (*) in cos is not allowed"], + "error": [ + "Using wildcards (*) in cos is not allowed" + ], "warning": [] }, { @@ -8354,17 +8745,23 @@ }, { "query": "from a_index | eval cosh(stringField)", - "error": ["Argument of [cosh] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [cosh] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval cosh(numberField, extraArg)", - "error": ["Error: [cosh] function expects exactly one argument, got 2."], + "error": [ + "Error: [cosh] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = cosh(*)", - "error": ["Using wildcards (*) in cosh is not allowed"], + "error": [ + "Using wildcards (*) in cosh is not allowed" + ], "warning": [] }, { @@ -8393,7 +8790,9 @@ }, { "query": "from a_index | eval date_diff(\"year\", dateField, dateField, extraArg)", - "error": ["Error: [date_diff] function expects exactly 3 arguments, got 4."], + "error": [ + "Error: [date_diff] function expects exactly 3 arguments, got 4." + ], "warning": [] }, { @@ -8421,7 +8820,9 @@ }, { "query": "from a_index | eval date_extract(\"ALIGNED_DAY_OF_WEEK_IN_MONTH\", dateField, extraArg)", - "error": ["Error: [date_extract] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [date_extract] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -8449,7 +8850,9 @@ }, { "query": "from a_index | eval date_format(dateField, stringField, extraArg)", - "error": ["Error: [date_format] function expects no more than 2 arguments, got 3."], + "error": [ + "Error: [date_format] function expects no more than 2 arguments, got 3." + ], "warning": [] }, { @@ -8477,7 +8880,9 @@ }, { "query": "from a_index | eval date_parse(stringField, stringField, extraArg)", - "error": ["Error: [date_parse] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [date_parse] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -8505,7 +8910,9 @@ }, { "query": "from a_index | eval date_trunc(1 year, dateField, extraArg)", - "error": ["Error: [date_trunc] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [date_trunc] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -8530,7 +8937,9 @@ }, { "query": "from a_index | eval e(extraArg)", - "error": ["Error: [e] function expects exactly 0 arguments, got 1."], + "error": [ + "Error: [e] function expects exactly 0 arguments, got 1." + ], "warning": [] }, { @@ -8558,7 +8967,9 @@ }, { "query": "from a_index | eval ends_with(stringField, stringField, extraArg)", - "error": ["Error: [ends_with] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [ends_with] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -8578,17 +8989,23 @@ }, { "query": "from a_index | eval floor(stringField)", - "error": ["Argument of [floor] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [floor] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval floor(numberField, extraArg)", - "error": ["Error: [floor] function expects exactly one argument, got 2."], + "error": [ + "Error: [floor] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = floor(*)", - "error": ["Using wildcards (*) in floor is not allowed"], + "error": [ + "Using wildcards (*) in floor is not allowed" + ], "warning": [] }, { @@ -8636,7 +9053,9 @@ }, { "query": "from a_index | eval left(stringField, numberField, extraArg)", - "error": ["Error: [left] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [left] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -8656,17 +9075,23 @@ }, { "query": "from a_index | eval length(numberField)", - "error": ["Argument of [length] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [length] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | eval length(stringField, extraArg)", - "error": ["Error: [length] function expects exactly one argument, got 2."], + "error": [ + "Error: [length] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = length(*)", - "error": ["Using wildcards (*) in length is not allowed"], + "error": [ + "Using wildcards (*) in length is not allowed" + ], "warning": [] }, { @@ -8694,7 +9119,9 @@ }, { "query": "from a_index | eval log(numberField, numberField, extraArg)", - "error": ["Error: [log] function expects no more than 2 arguments, got 3."], + "error": [ + "Error: [log] function expects no more than 2 arguments, got 3." + ], "warning": [] }, { @@ -8714,17 +9141,23 @@ }, { "query": "from a_index | eval log10(stringField)", - "error": ["Argument of [log10] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [log10] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval log10(numberField, extraArg)", - "error": ["Error: [log10] function expects exactly one argument, got 2."], + "error": [ + "Error: [log10] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = log10(*)", - "error": ["Using wildcards (*) in log10 is not allowed"], + "error": [ + "Using wildcards (*) in log10 is not allowed" + ], "warning": [] }, { @@ -8744,17 +9177,23 @@ }, { "query": "from a_index | eval ltrim(numberField)", - "error": ["Argument of [ltrim] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [ltrim] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | eval ltrim(stringField, extraArg)", - "error": ["Error: [ltrim] function expects exactly one argument, got 2."], + "error": [ + "Error: [ltrim] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = ltrim(*)", - "error": ["Using wildcards (*) in ltrim is not allowed"], + "error": [ + "Using wildcards (*) in ltrim is not allowed" + ], "warning": [] }, { @@ -8774,17 +9213,23 @@ }, { "query": "from a_index | eval mv_avg(stringField)", - "error": ["Argument of [mv_avg] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [mv_avg] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval mv_avg(numberField, extraArg)", - "error": ["Error: [mv_avg] function expects exactly one argument, got 2."], + "error": [ + "Error: [mv_avg] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = mv_avg(*)", - "error": ["Using wildcards (*) in mv_avg is not allowed"], + "error": [ + "Using wildcards (*) in mv_avg is not allowed" + ], "warning": [] }, { @@ -8812,7 +9257,9 @@ }, { "query": "from a_index | eval mv_concat(stringField, stringField, extraArg)", - "error": ["Error: [mv_concat] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [mv_concat] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -8827,7 +9274,9 @@ }, { "query": "from a_index | eval var = mv_count(*)", - "error": ["Using wildcards (*) in mv_count is not allowed"], + "error": [ + "Using wildcards (*) in mv_count is not allowed" + ], "warning": [] }, { @@ -8842,7 +9291,9 @@ }, { "query": "from a_index | eval var = mv_dedupe(*)", - "error": ["Using wildcards (*) in mv_dedupe is not allowed"], + "error": [ + "Using wildcards (*) in mv_dedupe is not allowed" + ], "warning": [] }, { @@ -8857,7 +9308,9 @@ }, { "query": "from a_index | eval var = mv_first(*)", - "error": ["Using wildcards (*) in mv_first is not allowed"], + "error": [ + "Using wildcards (*) in mv_first is not allowed" + ], "warning": [] }, { @@ -8872,7 +9325,9 @@ }, { "query": "from a_index | eval var = mv_last(*)", - "error": ["Using wildcards (*) in mv_last is not allowed"], + "error": [ + "Using wildcards (*) in mv_last is not allowed" + ], "warning": [] }, { @@ -8887,7 +9342,9 @@ }, { "query": "from a_index | eval var = mv_max(*)", - "error": ["Using wildcards (*) in mv_max is not allowed"], + "error": [ + "Using wildcards (*) in mv_max is not allowed" + ], "warning": [] }, { @@ -8914,12 +9371,16 @@ }, { "query": "from a_index | eval mv_median(numberField, extraArg)", - "error": ["Error: [mv_median] function expects exactly one argument, got 2."], + "error": [ + "Error: [mv_median] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = mv_median(*)", - "error": ["Using wildcards (*) in mv_median is not allowed"], + "error": [ + "Using wildcards (*) in mv_median is not allowed" + ], "warning": [] }, { @@ -8934,7 +9395,9 @@ }, { "query": "from a_index | eval var = mv_min(*)", - "error": ["Using wildcards (*) in mv_min is not allowed"], + "error": [ + "Using wildcards (*) in mv_min is not allowed" + ], "warning": [] }, { @@ -8974,17 +9437,23 @@ }, { "query": "from a_index | eval mv_sum(stringField)", - "error": ["Argument of [mv_sum] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [mv_sum] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval mv_sum(numberField, extraArg)", - "error": ["Error: [mv_sum] function expects exactly one argument, got 2."], + "error": [ + "Error: [mv_sum] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = mv_sum(*)", - "error": ["Using wildcards (*) in mv_sum is not allowed"], + "error": [ + "Using wildcards (*) in mv_sum is not allowed" + ], "warning": [] }, { @@ -9013,7 +9482,9 @@ }, { "query": "from a_index | eval mv_zip(stringField, stringField, stringField, extraArg)", - "error": ["Error: [mv_zip] function expects exactly 3 arguments, got 4."], + "error": [ + "Error: [mv_zip] function expects exactly 3 arguments, got 4." + ], "warning": [] }, { @@ -9038,7 +9509,9 @@ }, { "query": "from a_index | eval now(extraArg)", - "error": ["Error: [now] function expects exactly 0 arguments, got 1."], + "error": [ + "Error: [now] function expects exactly 0 arguments, got 1." + ], "warning": [] }, { @@ -9063,7 +9536,9 @@ }, { "query": "from a_index | eval pi(extraArg)", - "error": ["Error: [pi] function expects exactly 0 arguments, got 1."], + "error": [ + "Error: [pi] function expects exactly 0 arguments, got 1." + ], "warning": [] }, { @@ -9091,7 +9566,9 @@ }, { "query": "from a_index | eval pow(numberField, numberField, extraArg)", - "error": ["Error: [pow] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [pow] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9120,7 +9597,9 @@ }, { "query": "from a_index | eval replace(stringField, stringField, stringField, extraArg)", - "error": ["Error: [replace] function expects exactly 3 arguments, got 4."], + "error": [ + "Error: [replace] function expects exactly 3 arguments, got 4." + ], "warning": [] }, { @@ -9148,7 +9627,9 @@ }, { "query": "from a_index | eval right(stringField, numberField, extraArg)", - "error": ["Error: [right] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [right] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9176,7 +9657,9 @@ }, { "query": "from a_index | eval round(numberField, numberField, extraArg)", - "error": ["Error: [round] function expects no more than 2 arguments, got 3."], + "error": [ + "Error: [round] function expects no more than 2 arguments, got 3." + ], "warning": [] }, { @@ -9196,17 +9679,23 @@ }, { "query": "from a_index | eval rtrim(numberField)", - "error": ["Argument of [rtrim] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [rtrim] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | eval rtrim(stringField, extraArg)", - "error": ["Error: [rtrim] function expects exactly one argument, got 2."], + "error": [ + "Error: [rtrim] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = rtrim(*)", - "error": ["Using wildcards (*) in rtrim is not allowed"], + "error": [ + "Using wildcards (*) in rtrim is not allowed" + ], "warning": [] }, { @@ -9226,17 +9715,23 @@ }, { "query": "from a_index | eval signum(stringField)", - "error": ["Argument of [signum] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [signum] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval signum(numberField, extraArg)", - "error": ["Error: [signum] function expects exactly one argument, got 2."], + "error": [ + "Error: [signum] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = signum(*)", - "error": ["Using wildcards (*) in signum is not allowed"], + "error": [ + "Using wildcards (*) in signum is not allowed" + ], "warning": [] }, { @@ -9256,17 +9751,23 @@ }, { "query": "from a_index | eval sin(stringField)", - "error": ["Argument of [sin] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [sin] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval sin(numberField, extraArg)", - "error": ["Error: [sin] function expects exactly one argument, got 2."], + "error": [ + "Error: [sin] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = sin(*)", - "error": ["Using wildcards (*) in sin is not allowed"], + "error": [ + "Using wildcards (*) in sin is not allowed" + ], "warning": [] }, { @@ -9286,17 +9787,23 @@ }, { "query": "from a_index | eval sinh(stringField)", - "error": ["Argument of [sinh] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [sinh] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval sinh(numberField, extraArg)", - "error": ["Error: [sinh] function expects exactly one argument, got 2."], + "error": [ + "Error: [sinh] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = sinh(*)", - "error": ["Using wildcards (*) in sinh is not allowed"], + "error": [ + "Using wildcards (*) in sinh is not allowed" + ], "warning": [] }, { @@ -9324,7 +9831,9 @@ }, { "query": "from a_index | eval split(stringField, stringField, extraArg)", - "error": ["Error: [split] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [split] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9344,17 +9853,23 @@ }, { "query": "from a_index | eval sqrt(stringField)", - "error": ["Argument of [sqrt] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [sqrt] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval sqrt(numberField, extraArg)", - "error": ["Error: [sqrt] function expects exactly one argument, got 2."], + "error": [ + "Error: [sqrt] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = sqrt(*)", - "error": ["Using wildcards (*) in sqrt is not allowed"], + "error": [ + "Using wildcards (*) in sqrt is not allowed" + ], "warning": [] }, { @@ -9382,7 +9897,9 @@ }, { "query": "from a_index | eval st_contains(geoPointField, geoPointField, extraArg)", - "error": ["Error: [st_contains] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9410,7 +9927,9 @@ }, { "query": "from a_index | eval st_contains(geoPointField, geoShapeField, extraArg)", - "error": ["Error: [st_contains] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9438,7 +9957,9 @@ }, { "query": "from a_index | eval st_contains(geoShapeField, geoPointField, extraArg)", - "error": ["Error: [st_contains] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9466,7 +9987,9 @@ }, { "query": "from a_index | eval st_contains(geoShapeField, geoShapeField, extraArg)", - "error": ["Error: [st_contains] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9494,7 +10017,9 @@ }, { "query": "from a_index | eval st_contains(cartesianPointField, cartesianPointField, extraArg)", - "error": ["Error: [st_contains] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9522,7 +10047,9 @@ }, { "query": "from a_index | eval st_contains(cartesianPointField, cartesianShapeField, extraArg)", - "error": ["Error: [st_contains] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9550,7 +10077,9 @@ }, { "query": "from a_index | eval st_contains(cartesianShapeField, cartesianPointField, extraArg)", - "error": ["Error: [st_contains] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9578,7 +10107,9 @@ }, { "query": "from a_index | eval st_contains(cartesianShapeField, cartesianShapeField, extraArg)", - "error": ["Error: [st_contains] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_contains] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9606,7 +10137,9 @@ }, { "query": "from a_index | eval st_disjoint(geoPointField, geoPointField, extraArg)", - "error": ["Error: [st_disjoint] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9634,7 +10167,9 @@ }, { "query": "from a_index | eval st_disjoint(geoPointField, geoShapeField, extraArg)", - "error": ["Error: [st_disjoint] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9662,7 +10197,9 @@ }, { "query": "from a_index | eval st_disjoint(geoShapeField, geoPointField, extraArg)", - "error": ["Error: [st_disjoint] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9690,7 +10227,9 @@ }, { "query": "from a_index | eval st_disjoint(geoShapeField, geoShapeField, extraArg)", - "error": ["Error: [st_disjoint] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9718,7 +10257,9 @@ }, { "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianPointField, extraArg)", - "error": ["Error: [st_disjoint] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9746,7 +10287,9 @@ }, { "query": "from a_index | eval st_disjoint(cartesianPointField, cartesianShapeField, extraArg)", - "error": ["Error: [st_disjoint] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9774,7 +10317,9 @@ }, { "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianPointField, extraArg)", - "error": ["Error: [st_disjoint] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9802,7 +10347,9 @@ }, { "query": "from a_index | eval st_disjoint(cartesianShapeField, cartesianShapeField, extraArg)", - "error": ["Error: [st_disjoint] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_disjoint] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9830,7 +10377,9 @@ }, { "query": "from a_index | eval st_intersects(geoPointField, geoPointField, extraArg)", - "error": ["Error: [st_intersects] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9858,7 +10407,9 @@ }, { "query": "from a_index | eval st_intersects(geoPointField, geoShapeField, extraArg)", - "error": ["Error: [st_intersects] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9886,7 +10437,9 @@ }, { "query": "from a_index | eval st_intersects(geoShapeField, geoPointField, extraArg)", - "error": ["Error: [st_intersects] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9914,7 +10467,9 @@ }, { "query": "from a_index | eval st_intersects(geoShapeField, geoShapeField, extraArg)", - "error": ["Error: [st_intersects] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9942,7 +10497,9 @@ }, { "query": "from a_index | eval st_intersects(cartesianPointField, cartesianPointField, extraArg)", - "error": ["Error: [st_intersects] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9970,7 +10527,9 @@ }, { "query": "from a_index | eval st_intersects(cartesianPointField, cartesianShapeField, extraArg)", - "error": ["Error: [st_intersects] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -9998,7 +10557,9 @@ }, { "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianPointField, extraArg)", - "error": ["Error: [st_intersects] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10026,7 +10587,9 @@ }, { "query": "from a_index | eval st_intersects(cartesianShapeField, cartesianShapeField, extraArg)", - "error": ["Error: [st_intersects] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_intersects] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10054,7 +10617,9 @@ }, { "query": "from a_index | eval st_within(geoPointField, geoPointField, extraArg)", - "error": ["Error: [st_within] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10082,7 +10647,9 @@ }, { "query": "from a_index | eval st_within(geoPointField, geoShapeField, extraArg)", - "error": ["Error: [st_within] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10110,7 +10677,9 @@ }, { "query": "from a_index | eval st_within(geoShapeField, geoPointField, extraArg)", - "error": ["Error: [st_within] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10138,7 +10707,9 @@ }, { "query": "from a_index | eval st_within(geoShapeField, geoShapeField, extraArg)", - "error": ["Error: [st_within] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10166,7 +10737,9 @@ }, { "query": "from a_index | eval st_within(cartesianPointField, cartesianPointField, extraArg)", - "error": ["Error: [st_within] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10194,7 +10767,9 @@ }, { "query": "from a_index | eval st_within(cartesianPointField, cartesianShapeField, extraArg)", - "error": ["Error: [st_within] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10222,7 +10797,9 @@ }, { "query": "from a_index | eval st_within(cartesianShapeField, cartesianPointField, extraArg)", - "error": ["Error: [st_within] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10250,7 +10827,9 @@ }, { "query": "from a_index | eval st_within(cartesianShapeField, cartesianShapeField, extraArg)", - "error": ["Error: [st_within] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [st_within] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10270,17 +10849,23 @@ }, { "query": "from a_index | eval st_x(stringField)", - "error": ["Argument of [st_x] must be [geo_point], found value [stringField] type [string]"], + "error": [ + "Argument of [st_x] must be [geo_point], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval st_x(geoPointField, extraArg)", - "error": ["Error: [st_x] function expects exactly one argument, got 2."], + "error": [ + "Error: [st_x] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = st_x(*)", - "error": ["Using wildcards (*) in st_x is not allowed"], + "error": [ + "Using wildcards (*) in st_x is not allowed" + ], "warning": [] }, { @@ -10300,17 +10885,23 @@ }, { "query": "from a_index | eval st_x(stringField)", - "error": ["Argument of [st_x] must be [geo_point], found value [stringField] type [string]"], + "error": [ + "Argument of [st_x] must be [geo_point], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval st_x(cartesianPointField, extraArg)", - "error": ["Error: [st_x] function expects exactly one argument, got 2."], + "error": [ + "Error: [st_x] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = st_x(*)", - "error": ["Using wildcards (*) in st_x is not allowed"], + "error": [ + "Using wildcards (*) in st_x is not allowed" + ], "warning": [] }, { @@ -10330,17 +10921,23 @@ }, { "query": "from a_index | eval st_y(stringField)", - "error": ["Argument of [st_y] must be [geo_point], found value [stringField] type [string]"], + "error": [ + "Argument of [st_y] must be [geo_point], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval st_y(geoPointField, extraArg)", - "error": ["Error: [st_y] function expects exactly one argument, got 2."], + "error": [ + "Error: [st_y] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = st_y(*)", - "error": ["Using wildcards (*) in st_y is not allowed"], + "error": [ + "Using wildcards (*) in st_y is not allowed" + ], "warning": [] }, { @@ -10360,17 +10957,23 @@ }, { "query": "from a_index | eval st_y(stringField)", - "error": ["Argument of [st_y] must be [geo_point], found value [stringField] type [string]"], + "error": [ + "Argument of [st_y] must be [geo_point], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval st_y(cartesianPointField, extraArg)", - "error": ["Error: [st_y] function expects exactly one argument, got 2."], + "error": [ + "Error: [st_y] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = st_y(*)", - "error": ["Using wildcards (*) in st_y is not allowed"], + "error": [ + "Using wildcards (*) in st_y is not allowed" + ], "warning": [] }, { @@ -10398,7 +11001,9 @@ }, { "query": "from a_index | eval starts_with(stringField, stringField, extraArg)", - "error": ["Error: [starts_with] function expects exactly 2 arguments, got 3."], + "error": [ + "Error: [starts_with] function expects exactly 2 arguments, got 3." + ], "warning": [] }, { @@ -10427,7 +11032,9 @@ }, { "query": "from a_index | eval substring(stringField, numberField, numberField, extraArg)", - "error": ["Error: [substring] function expects exactly 3 arguments, got 4."], + "error": [ + "Error: [substring] function expects exactly 3 arguments, got 4." + ], "warning": [] }, { @@ -10447,17 +11054,23 @@ }, { "query": "from a_index | eval tan(stringField)", - "error": ["Argument of [tan] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [tan] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval tan(numberField, extraArg)", - "error": ["Error: [tan] function expects exactly one argument, got 2."], + "error": [ + "Error: [tan] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = tan(*)", - "error": ["Using wildcards (*) in tan is not allowed"], + "error": [ + "Using wildcards (*) in tan is not allowed" + ], "warning": [] }, { @@ -10477,17 +11090,23 @@ }, { "query": "from a_index | eval tanh(stringField)", - "error": ["Argument of [tanh] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [tanh] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval tanh(numberField, extraArg)", - "error": ["Error: [tanh] function expects exactly one argument, got 2."], + "error": [ + "Error: [tanh] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = tanh(*)", - "error": ["Using wildcards (*) in tanh is not allowed"], + "error": [ + "Using wildcards (*) in tanh is not allowed" + ], "warning": [] }, { @@ -10512,7 +11131,9 @@ }, { "query": "from a_index | eval tau(extraArg)", - "error": ["Error: [tau] function expects exactly 0 arguments, got 1."], + "error": [ + "Error: [tau] function expects exactly 0 arguments, got 1." + ], "warning": [] }, { @@ -10532,7 +11153,9 @@ }, { "query": "from a_index | eval var = to_boolean(*)", - "error": ["Using wildcards (*) in to_boolean is not allowed"], + "error": [ + "Using wildcards (*) in to_boolean is not allowed" + ], "warning": [] }, { @@ -10547,7 +11170,9 @@ }, { "query": "from a_index | eval var = to_cartesianpoint(*)", - "error": ["Using wildcards (*) in to_cartesianpoint is not allowed"], + "error": [ + "Using wildcards (*) in to_cartesianpoint is not allowed" + ], "warning": [] }, { @@ -10562,7 +11187,9 @@ }, { "query": "from a_index | eval var = to_cartesianshape(*)", - "error": ["Using wildcards (*) in to_cartesianshape is not allowed"], + "error": [ + "Using wildcards (*) in to_cartesianshape is not allowed" + ], "warning": [] }, { @@ -10582,7 +11209,9 @@ }, { "query": "from a_index | eval var = to_datetime(*)", - "error": ["Using wildcards (*) in to_datetime is not allowed"], + "error": [ + "Using wildcards (*) in to_datetime is not allowed" + ], "warning": [] }, { @@ -10609,12 +11238,16 @@ }, { "query": "from a_index | eval to_degrees(numberField, extraArg)", - "error": ["Error: [to_degrees] function expects exactly one argument, got 2."], + "error": [ + "Error: [to_degrees] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = to_degrees(*)", - "error": ["Using wildcards (*) in to_degrees is not allowed"], + "error": [ + "Using wildcards (*) in to_degrees is not allowed" + ], "warning": [] }, { @@ -10634,7 +11267,9 @@ }, { "query": "from a_index | eval var = to_double(*)", - "error": ["Using wildcards (*) in to_double is not allowed"], + "error": [ + "Using wildcards (*) in to_double is not allowed" + ], "warning": [] }, { @@ -10649,7 +11284,9 @@ }, { "query": "from a_index | eval var = to_geopoint(*)", - "error": ["Using wildcards (*) in to_geopoint is not allowed"], + "error": [ + "Using wildcards (*) in to_geopoint is not allowed" + ], "warning": [] }, { @@ -10664,7 +11301,9 @@ }, { "query": "from a_index | eval var = to_geoshape(*)", - "error": ["Using wildcards (*) in to_geoshape is not allowed"], + "error": [ + "Using wildcards (*) in to_geoshape is not allowed" + ], "warning": [] }, { @@ -10684,7 +11323,9 @@ }, { "query": "from a_index | eval var = to_integer(*)", - "error": ["Using wildcards (*) in to_integer is not allowed"], + "error": [ + "Using wildcards (*) in to_integer is not allowed" + ], "warning": [] }, { @@ -10699,7 +11340,9 @@ }, { "query": "from a_index | eval var = to_ip(*)", - "error": ["Using wildcards (*) in to_ip is not allowed"], + "error": [ + "Using wildcards (*) in to_ip is not allowed" + ], "warning": [] }, { @@ -10714,7 +11357,9 @@ }, { "query": "from a_index | eval var = to_long(*)", - "error": ["Using wildcards (*) in to_long is not allowed"], + "error": [ + "Using wildcards (*) in to_long is not allowed" + ], "warning": [] }, { @@ -10734,17 +11379,23 @@ }, { "query": "from a_index | eval to_lower(numberField)", - "error": ["Argument of [to_lower] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [to_lower] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | eval to_lower(stringField, extraArg)", - "error": ["Error: [to_lower] function expects exactly one argument, got 2."], + "error": [ + "Error: [to_lower] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = to_lower(*)", - "error": ["Using wildcards (*) in to_lower is not allowed"], + "error": [ + "Using wildcards (*) in to_lower is not allowed" + ], "warning": [] }, { @@ -10771,12 +11422,16 @@ }, { "query": "from a_index | eval to_radians(numberField, extraArg)", - "error": ["Error: [to_radians] function expects exactly one argument, got 2."], + "error": [ + "Error: [to_radians] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = to_radians(*)", - "error": ["Using wildcards (*) in to_radians is not allowed"], + "error": [ + "Using wildcards (*) in to_radians is not allowed" + ], "warning": [] }, { @@ -10796,7 +11451,9 @@ }, { "query": "from a_index | eval var = to_string(*)", - "error": ["Using wildcards (*) in to_string is not allowed"], + "error": [ + "Using wildcards (*) in to_string is not allowed" + ], "warning": [] }, { @@ -10821,7 +11478,9 @@ }, { "query": "from a_index | eval var = to_unsigned_long(*)", - "error": ["Using wildcards (*) in to_unsigned_long is not allowed"], + "error": [ + "Using wildcards (*) in to_unsigned_long is not allowed" + ], "warning": [] }, { @@ -10841,17 +11500,23 @@ }, { "query": "from a_index | eval to_upper(numberField)", - "error": ["Argument of [to_upper] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [to_upper] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | eval to_upper(stringField, extraArg)", - "error": ["Error: [to_upper] function expects exactly one argument, got 2."], + "error": [ + "Error: [to_upper] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = to_upper(*)", - "error": ["Using wildcards (*) in to_upper is not allowed"], + "error": [ + "Using wildcards (*) in to_upper is not allowed" + ], "warning": [] }, { @@ -10871,7 +11536,9 @@ }, { "query": "from a_index | eval var = to_version(*)", - "error": ["Using wildcards (*) in to_version is not allowed"], + "error": [ + "Using wildcards (*) in to_version is not allowed" + ], "warning": [] }, { @@ -10891,33 +11558,45 @@ }, { "query": "from a_index | eval trim(numberField)", - "error": ["Argument of [trim] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [trim] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | eval trim(stringField, extraArg)", - "error": ["Error: [trim] function expects exactly one argument, got 2."], + "error": [ + "Error: [trim] function expects exactly one argument, got 2." + ], "warning": [] }, { "query": "from a_index | eval var = trim(*)", - "error": ["Using wildcards (*) in trim is not allowed"], + "error": [ + "Using wildcards (*) in trim is not allowed" + ], "warning": [] }, { "query": "from a_index | eval log10(-1)", "error": [], - "warning": ["Log of a negative number results in null: -1"] + "warning": [ + "Log of a negative number results in null: -1" + ] }, { "query": "from a_index | eval log(-1)", "error": [], - "warning": ["Log of a negative number results in null: -1"] + "warning": [ + "Log of a negative number results in null: -1" + ] }, { "query": "from a_index | eval log(-1, 20)", "error": [], - "warning": ["Log of a negative number results in null: -1"] + "warning": [ + "Log of a negative number results in null: -1" + ] }, { "query": "from a_index | eval log(-1, -20)", @@ -10990,90 +11669,143 @@ }, { "query": "from a_index | eval numberField > stringField", - "error": ["Argument of [>] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [>] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval stringField > numberField", - "error": ["Argument of [>] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [>] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval numberField > \"2022\"", - "error": [], + "error": [ + "Argument of [>] must be [number], found value [\"2022\"] type [string]" + ], "warning": [] }, { "query": "from a_index | eval dateField > stringField", - "error": ["Argument of [>] must be [string], found value [dateField] type [date]"], + "error": [ + "Argument of [>] must be [string], found value [dateField] type [date]" + ], "warning": [] }, { "query": "from a_index | eval stringField > dateField", - "error": ["Argument of [>] must be [string], found value [dateField] type [date]"], - "warning": [] - }, - { - "query": "from a_index | eval dateField > \"2022\"", - "error": [], + "error": [ + "Argument of [>] must be [string], found value [dateField] type [date]" + ], "warning": [] }, { "query": "from a_index | eval stringField > 0", - "error": ["Argument of [>] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [>] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval stringField > now()", - "error": ["Argument of [>] must be [string], found value [now()] type [date]"], + "error": [ + "Argument of [>] must be [string], found value [now()] type [date]" + ], "warning": [] }, { - "query": "from a_index | eval numberField >= 0", + "query": "from a_index | eval dateField > \"2022\"", "error": [], "warning": [] }, { - "query": "from a_index | eval NOT numberField >= 0", + "query": "from a_index | eval \"2022\" > dateField", "error": [], "warning": [] }, { - "query": "from a_index | eval (numberField >= 0)", + "query": "from a_index | eval versionField > \"1.2.3\"", "error": [], "warning": [] }, { - "query": "from a_index | eval (NOT (numberField >= 0))", + "query": "from a_index | eval \"1.2.3\" > versionField", "error": [], "warning": [] }, { - "query": "from a_index | eval 1 >= 0", - "error": [], + "query": "from a_index | eval booleanField > \"true\"", + "error": [ + "Argument of [>] must be [string], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval stringField >= stringField", - "error": [], + "query": "from a_index | eval \"true\" > booleanField", + "error": [ + "Argument of [>] must be [string], found value [booleanField] type [boolean]" + ], "warning": [] }, { - "query": "from a_index | eval numberField >= numberField", + "query": "from a_index | eval ipField > \"136.36.3.205\"", "error": [], "warning": [] }, { - "query": "from a_index | eval dateField >= dateField", + "query": "from a_index | eval \"136.36.3.205\" > ipField", "error": [], "warning": [] }, { - "query": "from a_index | eval booleanField >= booleanField", - "error": [ - "Argument of [>=] must be [number], found value [booleanField] type [boolean]", - "Argument of [>=] must be [number], found value [booleanField] type [boolean]" - ], + "query": "from a_index | eval numberField >= 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval NOT numberField >= 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval (numberField >= 0)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval (NOT (numberField >= 0))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval 1 >= 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval stringField >= stringField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval numberField >= numberField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval dateField >= dateField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval booleanField >= booleanField", + "error": [ + "Argument of [>=] must be [number], found value [booleanField] type [boolean]", + "Argument of [>=] must be [number], found value [booleanField] type [boolean]" + ], "warning": [] }, { @@ -11083,27 +11815,51 @@ }, { "query": "from a_index | eval numberField >= stringField", - "error": ["Argument of [>=] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [>=] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval stringField >= numberField", - "error": ["Argument of [>=] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [>=] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval numberField >= \"2022\"", - "error": [], + "error": [ + "Argument of [>=] must be [number], found value [\"2022\"] type [string]" + ], "warning": [] }, { "query": "from a_index | eval dateField >= stringField", - "error": ["Argument of [>=] must be [string], found value [dateField] type [date]"], + "error": [ + "Argument of [>=] must be [string], found value [dateField] type [date]" + ], "warning": [] }, { "query": "from a_index | eval stringField >= dateField", - "error": ["Argument of [>=] must be [string], found value [dateField] type [date]"], + "error": [ + "Argument of [>=] must be [string], found value [dateField] type [date]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField >= 0", + "error": [ + "Argument of [>=] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField >= now()", + "error": [ + "Argument of [>=] must be [string], found value [now()] type [date]" + ], "warning": [] }, { @@ -11112,13 +11868,42 @@ "warning": [] }, { - "query": "from a_index | eval stringField >= 0", - "error": ["Argument of [>=] must be [number], found value [stringField] type [string]"], + "query": "from a_index | eval \"2022\" >= dateField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField >= now()", - "error": ["Argument of [>=] must be [string], found value [now()] type [date]"], + "query": "from a_index | eval versionField >= \"1.2.3\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"1.2.3\" >= versionField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval booleanField >= \"true\"", + "error": [ + "Argument of [>=] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval \"true\" >= booleanField", + "error": [ + "Argument of [>=] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval ipField >= \"136.36.3.205\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"136.36.3.205\" >= ipField", + "error": [], "warning": [] }, { @@ -11176,27 +11961,51 @@ }, { "query": "from a_index | eval numberField < stringField", - "error": ["Argument of [<] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [<] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval stringField < numberField", - "error": ["Argument of [<] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [<] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval numberField < \"2022\"", - "error": [], + "error": [ + "Argument of [<] must be [number], found value [\"2022\"] type [string]" + ], "warning": [] }, { "query": "from a_index | eval dateField < stringField", - "error": ["Argument of [<] must be [string], found value [dateField] type [date]"], + "error": [ + "Argument of [<] must be [string], found value [dateField] type [date]" + ], "warning": [] }, { "query": "from a_index | eval stringField < dateField", - "error": ["Argument of [<] must be [string], found value [dateField] type [date]"], + "error": [ + "Argument of [<] must be [string], found value [dateField] type [date]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField < 0", + "error": [ + "Argument of [<] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField < now()", + "error": [ + "Argument of [<] must be [string], found value [now()] type [date]" + ], "warning": [] }, { @@ -11205,13 +12014,42 @@ "warning": [] }, { - "query": "from a_index | eval stringField < 0", - "error": ["Argument of [<] must be [number], found value [stringField] type [string]"], + "query": "from a_index | eval \"2022\" < dateField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField < now()", - "error": ["Argument of [<] must be [string], found value [now()] type [date]"], + "query": "from a_index | eval versionField < \"1.2.3\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"1.2.3\" < versionField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval booleanField < \"true\"", + "error": [ + "Argument of [<] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval \"true\" < booleanField", + "error": [ + "Argument of [<] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval ipField < \"136.36.3.205\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"136.36.3.205\" < ipField", + "error": [], "warning": [] }, { @@ -11269,27 +12107,51 @@ }, { "query": "from a_index | eval numberField <= stringField", - "error": ["Argument of [<=] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [<=] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval stringField <= numberField", - "error": ["Argument of [<=] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [<=] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval numberField <= \"2022\"", - "error": [], + "error": [ + "Argument of [<=] must be [number], found value [\"2022\"] type [string]" + ], "warning": [] }, { "query": "from a_index | eval dateField <= stringField", - "error": ["Argument of [<=] must be [string], found value [dateField] type [date]"], + "error": [ + "Argument of [<=] must be [string], found value [dateField] type [date]" + ], "warning": [] }, { "query": "from a_index | eval stringField <= dateField", - "error": ["Argument of [<=] must be [string], found value [dateField] type [date]"], + "error": [ + "Argument of [<=] must be [string], found value [dateField] type [date]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField <= 0", + "error": [ + "Argument of [<=] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField <= now()", + "error": [ + "Argument of [<=] must be [string], found value [now()] type [date]" + ], "warning": [] }, { @@ -11298,13 +12160,42 @@ "warning": [] }, { - "query": "from a_index | eval stringField <= 0", - "error": ["Argument of [<=] must be [number], found value [stringField] type [string]"], + "query": "from a_index | eval \"2022\" <= dateField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField <= now()", - "error": ["Argument of [<=] must be [string], found value [now()] type [date]"], + "query": "from a_index | eval versionField <= \"1.2.3\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"1.2.3\" <= versionField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval booleanField <= \"true\"", + "error": [ + "Argument of [<=] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval \"true\" <= booleanField", + "error": [ + "Argument of [<=] must be [string], found value [booleanField] type [boolean]" + ], + "warning": [] + }, + { + "query": "from a_index | eval ipField <= \"136.36.3.205\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"136.36.3.205\" <= ipField", + "error": [], "warning": [] }, { @@ -11359,27 +12250,51 @@ }, { "query": "from a_index | eval numberField == stringField", - "error": ["Argument of [==] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [==] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval stringField == numberField", - "error": ["Argument of [==] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [==] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval numberField == \"2022\"", - "error": [], + "error": [ + "Argument of [==] must be [number], found value [\"2022\"] type [string]" + ], "warning": [] }, { "query": "from a_index | eval dateField == stringField", - "error": ["Argument of [==] must be [string], found value [dateField] type [date]"], + "error": [ + "Argument of [==] must be [string], found value [dateField] type [date]" + ], "warning": [] }, { "query": "from a_index | eval stringField == dateField", - "error": ["Argument of [==] must be [string], found value [dateField] type [date]"], + "error": [ + "Argument of [==] must be [string], found value [dateField] type [date]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField == 0", + "error": [ + "Argument of [==] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField == now()", + "error": [ + "Argument of [==] must be [string], found value [now()] type [date]" + ], "warning": [] }, { @@ -11388,13 +12303,197 @@ "warning": [] }, { - "query": "from a_index | eval stringField == 0", - "error": ["Argument of [==] must be [number], found value [stringField] type [string]"], + "query": "from a_index | eval \"2022\" == dateField", + "error": [], "warning": [] }, { - "query": "from a_index | eval stringField == now()", - "error": ["Argument of [==] must be [string], found value [now()] type [date]"], + "query": "from a_index | eval versionField == \"1.2.3\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"1.2.3\" == versionField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval booleanField == \"true\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"true\" == booleanField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval ipField == \"136.36.3.205\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"136.36.3.205\" == ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval numberField != 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval NOT numberField != 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval (numberField != 0)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval (NOT (numberField != 0))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval 1 != 0", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval stringField != stringField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval numberField != numberField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval dateField != dateField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval booleanField != booleanField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval ipField != ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval numberField != stringField", + "error": [ + "Argument of [!=] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField != numberField", + "error": [ + "Argument of [!=] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval numberField != \"2022\"", + "error": [ + "Argument of [!=] must be [number], found value [\"2022\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval dateField != stringField", + "error": [ + "Argument of [!=] must be [string], found value [dateField] type [date]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField != dateField", + "error": [ + "Argument of [!=] must be [string], found value [dateField] type [date]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField != 0", + "error": [ + "Argument of [!=] must be [number], found value [stringField] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval stringField != now()", + "error": [ + "Argument of [!=] must be [string], found value [now()] type [date]" + ], + "warning": [] + }, + { + "query": "from a_index | eval dateField != \"2022\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"2022\" != dateField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField != \"1.2.3\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"1.2.3\" != versionField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval booleanField != \"true\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"true\" != booleanField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval ipField != \"136.36.3.205\"", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval \"136.36.3.205\" != ipField", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval versionField in (\"1.2.3\", \"4.5.6\", to_version(\"2.3.2\"))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval dateField in (\"2023-12-12\", \"2024-12-12\", date_parse(\"yyyy-MM-dd\", \"2025-12-12\"))", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval booleanField in (\"true\", \"false\", false)", + "error": [], + "warning": [] + }, + { + "query": "from a_index | eval ipField in (\"136.36.3.205\", \"136.36.3.206\", to_ip(\"136.36.3.207\"))", + "error": [], "warning": [] }, { @@ -11414,7 +12513,23 @@ }, { "query": "from a_index | eval now() + now()", - "error": ["Argument of [+] must be [time_literal], found value [now()] type [date]"], + "error": [ + "Argument of [+] must be [time_literal], found value [now()] type [date]" + ], + "warning": [] + }, + { + "query": "from a_index | eval 1 + \"1\"", + "error": [ + "Argument of [+] must be [number], found value [\"1\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval \"1\" + 1", + "error": [ + "Argument of [+] must be [number], found value [\"1\"] type [string]" + ], "warning": [] }, { @@ -11434,7 +12549,23 @@ }, { "query": "from a_index | eval now() - now()", - "error": ["Argument of [-] must be [time_literal], found value [now()] type [date]"], + "error": [ + "Argument of [-] must be [time_literal], found value [now()] type [date]" + ], + "warning": [] + }, + { + "query": "from a_index | eval 1 - \"1\"", + "error": [ + "Argument of [-] must be [number], found value [\"1\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval \"1\" - 1", + "error": [ + "Argument of [-] must be [number], found value [\"1\"] type [string]" + ], "warning": [] }, { @@ -11460,6 +12591,20 @@ ], "warning": [] }, + { + "query": "from a_index | eval 1 * \"1\"", + "error": [ + "Argument of [*] must be [number], found value [\"1\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval \"1\" * 1", + "error": [ + "Argument of [*] must be [number], found value [\"1\"] type [string]" + ], + "warning": [] + }, { "query": "from a_index | eval numberField / 1", "error": [], @@ -11483,6 +12628,20 @@ ], "warning": [] }, + { + "query": "from a_index | eval 1 / \"1\"", + "error": [ + "Argument of [/] must be [number], found value [\"1\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval \"1\" / 1", + "error": [ + "Argument of [/] must be [number], found value [\"1\"] type [string]" + ], + "warning": [] + }, { "query": "from a_index | eval numberField % 1", "error": [], @@ -11506,35 +12665,61 @@ ], "warning": [] }, + { + "query": "from a_index | eval 1 % \"1\"", + "error": [ + "Argument of [%] must be [number], found value [\"1\"] type [string]" + ], + "warning": [] + }, + { + "query": "from a_index | eval \"1\" % 1", + "error": [ + "Argument of [%] must be [number], found value [\"1\"] type [string]" + ], + "warning": [] + }, { "query": "from a_index | eval 1/0", "error": [], - "warning": ["Cannot divide by zero: 1/0"] + "warning": [ + "Cannot divide by zero: 1/0" + ] }, { "query": "from a_index | eval var = 1/0", "error": [], - "warning": ["Cannot divide by zero: 1/0"] + "warning": [ + "Cannot divide by zero: 1/0" + ] }, { "query": "from a_index | eval 1 + 1/0", "error": [], - "warning": ["Cannot divide by zero: 1/0"] + "warning": [ + "Cannot divide by zero: 1/0" + ] }, { "query": "from a_index | eval 1%0", "error": [], - "warning": ["Module by zero can return null value: 1%0"] + "warning": [ + "Module by zero can return null value: 1%0" + ] }, { "query": "from a_index | eval var = 1%0", "error": [], - "warning": ["Module by zero can return null value: 1%0"] + "warning": [ + "Module by zero can return null value: 1%0" + ] }, { "query": "from a_index | eval 1 + 1%0", "error": [], - "warning": ["Module by zero can return null value: 1%0"] + "warning": [ + "Module by zero can return null value: 1%0" + ] }, { "query": "from a_index | eval stringField like \"?a\"", @@ -11558,22 +12743,30 @@ }, { "query": "from a_index | eval numberField like \"?a\"", - "error": ["Argument of [like] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [like] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | eval numberField NOT like \"?a\"", - "error": ["Argument of [not_like] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [not_like] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | eval NOT numberField like \"?a\"", - "error": ["Argument of [like] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [like] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { "query": "from a_index | eval NOT numberField NOT like \"?a\"", - "error": ["Argument of [not_like] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [not_like] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -11598,7 +12791,9 @@ }, { "query": "from a_index | eval numberField rlike \"?a\"", - "error": ["Argument of [rlike] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [rlike] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -11610,7 +12805,9 @@ }, { "query": "from a_index | eval NOT numberField rlike \"?a\"", - "error": ["Argument of [rlike] must be [string], found value [numberField] type [number]"], + "error": [ + "Argument of [rlike] must be [string], found value [numberField] type [number]" + ], "warning": [] }, { @@ -11667,35 +12864,29 @@ }, { "query": "from a_index | eval 1 in (\"a\", \"b\", \"c\")", - "error": [ - "Argument of [in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]" - ], + "error": [], "warning": [] }, { "query": "from a_index | eval numberField in (\"a\", \"b\", \"c\")", - "error": [ - "Argument of [in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]" - ], + "error": [], "warning": [] }, { "query": "from a_index | eval numberField not in (\"a\", \"b\", \"c\")", - "error": [ - "Argument of [not_in] must be [number[]], found value [(\"a\", \"b\", \"c\")] type [(string, string, string)]" - ], + "error": [], "warning": [] }, { "query": "from a_index | eval numberField not in (1, 2, 3, stringField)", - "error": [ - "Argument of [not_in] must be [number[]], found value [(1, 2, 3, stringField)] type [(number, number, number, string)]" - ], + "error": [], "warning": [] }, { "query": "from a_index | eval avg(numberField)", - "error": ["EVAL does not support function avg"], + "error": [ + "EVAL does not support function avg" + ], "warning": [] }, { @@ -11745,7 +12936,9 @@ { "query": "from a_index | eval mv_sort([\"a\", \"b\"], \"bogus\")", "error": [], - "warning": ["Invalid option [\"bogus\"] for mv_sort. Supported options: [\"asc\", \"desc\"]."] + "warning": [ + "Invalid option [\"bogus\"] for mv_sort. Supported options: [\"asc\", \"desc\"]." + ] }, { "query": "from a_index | eval mv_sort([\"a\", \"b\"], \"ASC\")", @@ -11779,27 +12972,37 @@ }, { "query": "from a_index | eval 1 anno", - "error": ["EVAL does not support [date_period] in expression [1 anno]"], + "error": [ + "EVAL does not support [date_period] in expression [1 anno]" + ], "warning": [] }, { "query": "from a_index | eval var = 1 anno", - "error": ["Unexpected time interval qualifier: 'anno'"], + "error": [ + "Unexpected time interval qualifier: 'anno'" + ], "warning": [] }, { "query": "from a_index | eval now() + 1 anno", - "error": ["Unexpected time interval qualifier: 'anno'"], + "error": [ + "Unexpected time interval qualifier: 'anno'" + ], "warning": [] }, { "query": "from a_index | eval 1 year", - "error": ["EVAL does not support [date_period] in expression [1 year]"], + "error": [ + "EVAL does not support [date_period] in expression [1 year]" + ], "warning": [] }, { "query": "from a_index | eval 1 year", - "error": ["EVAL does not support [date_period] in expression [1 year]"], + "error": [ + "EVAL does not support [date_period] in expression [1 year]" + ], "warning": [] }, { @@ -11829,7 +13032,9 @@ }, { "query": "from a_index | eval 1 year + 1 year", - "error": ["Argument of [+] must be [date], found value [1 year] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 year] type [duration]" + ], "warning": [] }, { @@ -11858,12 +13063,16 @@ }, { "query": "from a_index | eval 1 years", - "error": ["EVAL does not support [date_period] in expression [1 years]"], + "error": [ + "EVAL does not support [date_period] in expression [1 years]" + ], "warning": [] }, { "query": "from a_index | eval 1 years", - "error": ["EVAL does not support [date_period] in expression [1 years]"], + "error": [ + "EVAL does not support [date_period] in expression [1 years]" + ], "warning": [] }, { @@ -11893,7 +13102,9 @@ }, { "query": "from a_index | eval 1 years + 1 year", - "error": ["Argument of [+] must be [date], found value [1 years] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 years] type [duration]" + ], "warning": [] }, { @@ -11922,12 +13133,16 @@ }, { "query": "from a_index | eval 1 month", - "error": ["EVAL does not support [date_period] in expression [1 month]"], + "error": [ + "EVAL does not support [date_period] in expression [1 month]" + ], "warning": [] }, { "query": "from a_index | eval 1 month", - "error": ["EVAL does not support [date_period] in expression [1 month]"], + "error": [ + "EVAL does not support [date_period] in expression [1 month]" + ], "warning": [] }, { @@ -11957,7 +13172,9 @@ }, { "query": "from a_index | eval 1 month + 1 year", - "error": ["Argument of [+] must be [date], found value [1 month] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 month] type [duration]" + ], "warning": [] }, { @@ -11986,12 +13203,16 @@ }, { "query": "from a_index | eval 1 months", - "error": ["EVAL does not support [date_period] in expression [1 months]"], + "error": [ + "EVAL does not support [date_period] in expression [1 months]" + ], "warning": [] }, { "query": "from a_index | eval 1 months", - "error": ["EVAL does not support [date_period] in expression [1 months]"], + "error": [ + "EVAL does not support [date_period] in expression [1 months]" + ], "warning": [] }, { @@ -12021,7 +13242,9 @@ }, { "query": "from a_index | eval 1 months + 1 year", - "error": ["Argument of [+] must be [date], found value [1 months] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 months] type [duration]" + ], "warning": [] }, { @@ -12050,12 +13273,16 @@ }, { "query": "from a_index | eval 1 week", - "error": ["EVAL does not support [date_period] in expression [1 week]"], + "error": [ + "EVAL does not support [date_period] in expression [1 week]" + ], "warning": [] }, { "query": "from a_index | eval 1 week", - "error": ["EVAL does not support [date_period] in expression [1 week]"], + "error": [ + "EVAL does not support [date_period] in expression [1 week]" + ], "warning": [] }, { @@ -12085,7 +13312,9 @@ }, { "query": "from a_index | eval 1 week + 1 year", - "error": ["Argument of [+] must be [date], found value [1 week] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 week] type [duration]" + ], "warning": [] }, { @@ -12114,12 +13343,16 @@ }, { "query": "from a_index | eval 1 weeks", - "error": ["EVAL does not support [date_period] in expression [1 weeks]"], + "error": [ + "EVAL does not support [date_period] in expression [1 weeks]" + ], "warning": [] }, { "query": "from a_index | eval 1 weeks", - "error": ["EVAL does not support [date_period] in expression [1 weeks]"], + "error": [ + "EVAL does not support [date_period] in expression [1 weeks]" + ], "warning": [] }, { @@ -12149,7 +13382,9 @@ }, { "query": "from a_index | eval 1 weeks + 1 year", - "error": ["Argument of [+] must be [date], found value [1 weeks] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 weeks] type [duration]" + ], "warning": [] }, { @@ -12178,12 +13413,16 @@ }, { "query": "from a_index | eval 1 day", - "error": ["EVAL does not support [date_period] in expression [1 day]"], + "error": [ + "EVAL does not support [date_period] in expression [1 day]" + ], "warning": [] }, { "query": "from a_index | eval 1 day", - "error": ["EVAL does not support [date_period] in expression [1 day]"], + "error": [ + "EVAL does not support [date_period] in expression [1 day]" + ], "warning": [] }, { @@ -12213,7 +13452,9 @@ }, { "query": "from a_index | eval 1 day + 1 year", - "error": ["Argument of [+] must be [date], found value [1 day] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 day] type [duration]" + ], "warning": [] }, { @@ -12242,12 +13483,16 @@ }, { "query": "from a_index | eval 1 days", - "error": ["EVAL does not support [date_period] in expression [1 days]"], + "error": [ + "EVAL does not support [date_period] in expression [1 days]" + ], "warning": [] }, { "query": "from a_index | eval 1 days", - "error": ["EVAL does not support [date_period] in expression [1 days]"], + "error": [ + "EVAL does not support [date_period] in expression [1 days]" + ], "warning": [] }, { @@ -12277,7 +13522,9 @@ }, { "query": "from a_index | eval 1 days + 1 year", - "error": ["Argument of [+] must be [date], found value [1 days] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 days] type [duration]" + ], "warning": [] }, { @@ -12306,12 +13553,16 @@ }, { "query": "from a_index | eval 1 hour", - "error": ["EVAL does not support [date_period] in expression [1 hour]"], + "error": [ + "EVAL does not support [date_period] in expression [1 hour]" + ], "warning": [] }, { "query": "from a_index | eval 1 hour", - "error": ["EVAL does not support [date_period] in expression [1 hour]"], + "error": [ + "EVAL does not support [date_period] in expression [1 hour]" + ], "warning": [] }, { @@ -12341,7 +13592,9 @@ }, { "query": "from a_index | eval 1 hour + 1 year", - "error": ["Argument of [+] must be [date], found value [1 hour] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 hour] type [duration]" + ], "warning": [] }, { @@ -12370,12 +13623,16 @@ }, { "query": "from a_index | eval 1 hours", - "error": ["EVAL does not support [date_period] in expression [1 hours]"], + "error": [ + "EVAL does not support [date_period] in expression [1 hours]" + ], "warning": [] }, { "query": "from a_index | eval 1 hours", - "error": ["EVAL does not support [date_period] in expression [1 hours]"], + "error": [ + "EVAL does not support [date_period] in expression [1 hours]" + ], "warning": [] }, { @@ -12405,7 +13662,9 @@ }, { "query": "from a_index | eval 1 hours + 1 year", - "error": ["Argument of [+] must be [date], found value [1 hours] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 hours] type [duration]" + ], "warning": [] }, { @@ -12434,12 +13693,16 @@ }, { "query": "from a_index | eval 1 minute", - "error": ["EVAL does not support [date_period] in expression [1 minute]"], + "error": [ + "EVAL does not support [date_period] in expression [1 minute]" + ], "warning": [] }, { "query": "from a_index | eval 1 minute", - "error": ["EVAL does not support [date_period] in expression [1 minute]"], + "error": [ + "EVAL does not support [date_period] in expression [1 minute]" + ], "warning": [] }, { @@ -12469,7 +13732,9 @@ }, { "query": "from a_index | eval 1 minute + 1 year", - "error": ["Argument of [+] must be [date], found value [1 minute] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 minute] type [duration]" + ], "warning": [] }, { @@ -12498,12 +13763,16 @@ }, { "query": "from a_index | eval 1 minutes", - "error": ["EVAL does not support [date_period] in expression [1 minutes]"], + "error": [ + "EVAL does not support [date_period] in expression [1 minutes]" + ], "warning": [] }, { "query": "from a_index | eval 1 minutes", - "error": ["EVAL does not support [date_period] in expression [1 minutes]"], + "error": [ + "EVAL does not support [date_period] in expression [1 minutes]" + ], "warning": [] }, { @@ -12533,7 +13802,9 @@ }, { "query": "from a_index | eval 1 minutes + 1 year", - "error": ["Argument of [+] must be [date], found value [1 minutes] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 minutes] type [duration]" + ], "warning": [] }, { @@ -12562,12 +13833,16 @@ }, { "query": "from a_index | eval 1 second", - "error": ["EVAL does not support [date_period] in expression [1 second]"], + "error": [ + "EVAL does not support [date_period] in expression [1 second]" + ], "warning": [] }, { "query": "from a_index | eval 1 second", - "error": ["EVAL does not support [date_period] in expression [1 second]"], + "error": [ + "EVAL does not support [date_period] in expression [1 second]" + ], "warning": [] }, { @@ -12597,7 +13872,9 @@ }, { "query": "from a_index | eval 1 second + 1 year", - "error": ["Argument of [+] must be [date], found value [1 second] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 second] type [duration]" + ], "warning": [] }, { @@ -12626,12 +13903,16 @@ }, { "query": "from a_index | eval 1 seconds", - "error": ["EVAL does not support [date_period] in expression [1 seconds]"], + "error": [ + "EVAL does not support [date_period] in expression [1 seconds]" + ], "warning": [] }, { "query": "from a_index | eval 1 seconds", - "error": ["EVAL does not support [date_period] in expression [1 seconds]"], + "error": [ + "EVAL does not support [date_period] in expression [1 seconds]" + ], "warning": [] }, { @@ -12661,7 +13942,9 @@ }, { "query": "from a_index | eval 1 seconds + 1 year", - "error": ["Argument of [+] must be [date], found value [1 seconds] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 seconds] type [duration]" + ], "warning": [] }, { @@ -12690,12 +13973,16 @@ }, { "query": "from a_index | eval 1 millisecond", - "error": ["EVAL does not support [date_period] in expression [1 millisecond]"], + "error": [ + "EVAL does not support [date_period] in expression [1 millisecond]" + ], "warning": [] }, { "query": "from a_index | eval 1 millisecond", - "error": ["EVAL does not support [date_period] in expression [1 millisecond]"], + "error": [ + "EVAL does not support [date_period] in expression [1 millisecond]" + ], "warning": [] }, { @@ -12725,7 +14012,9 @@ }, { "query": "from a_index | eval 1 millisecond + 1 year", - "error": ["Argument of [+] must be [date], found value [1 millisecond] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 millisecond] type [duration]" + ], "warning": [] }, { @@ -12754,12 +14043,16 @@ }, { "query": "from a_index | eval 1 milliseconds", - "error": ["EVAL does not support [date_period] in expression [1 milliseconds]"], + "error": [ + "EVAL does not support [date_period] in expression [1 milliseconds]" + ], "warning": [] }, { "query": "from a_index | eval 1 milliseconds", - "error": ["EVAL does not support [date_period] in expression [1 milliseconds]"], + "error": [ + "EVAL does not support [date_period] in expression [1 milliseconds]" + ], "warning": [] }, { @@ -12789,7 +14082,9 @@ }, { "query": "from a_index | eval 1 milliseconds + 1 year", - "error": ["Argument of [+] must be [date], found value [1 milliseconds] type [duration]"], + "error": [ + "Argument of [+] must be [date], found value [1 milliseconds] type [duration]" + ], "warning": [] }, { @@ -12818,7 +14113,9 @@ }, { "query": "from a_index | stats ", - "error": ["At least one aggregation or grouping expression required in [STATS]"], + "error": [ + "At least one aggregation or grouping expression required in [STATS]" + ], "warning": [] }, { @@ -12856,17 +14153,23 @@ }, { "query": "from a_index | stats avg(numberField) by wrongField", - "error": ["Unknown column [wrongField]"], + "error": [ + "Unknown column [wrongField]" + ], "warning": [] }, { "query": "from a_index | stats avg(numberField) by wrongField + 1", - "error": ["Unknown column [wrongField]"], + "error": [ + "Unknown column [wrongField]" + ], "warning": [] }, { "query": "from a_index | stats avg(numberField) by var0 = wrongField + 1", - "error": ["Unknown column [wrongField]"], + "error": [ + "Unknown column [wrongField]" + ], "warning": [] }, { @@ -12876,7 +14179,9 @@ }, { "query": "from a_index | stats avg(numberField) by percentile(numberField)", - "error": ["STATS BY does not support function percentile"], + "error": [ + "STATS BY does not support function percentile" + ], "warning": [] }, { @@ -12949,17 +14254,23 @@ }, { "query": "from a_index | stats count(* + 1) BY ipField", - "error": ["SyntaxError: no viable alternative at input 'count(* +'"], + "error": [ + "SyntaxError: no viable alternative at input 'count(* +'" + ], "warning": [] }, { "query": "from a_index | stats count(* + round(numberField)) BY ipField", - "error": ["SyntaxError: no viable alternative at input 'count(* +'"], + "error": [ + "SyntaxError: no viable alternative at input 'count(* +'" + ], "warning": [] }, { "query": "from a_index | stats count(round(*)) BY ipField", - "error": ["Using wildcards (*) in round is not allowed"], + "error": [ + "Using wildcards (*) in round is not allowed" + ], "warning": [] }, { @@ -12971,7 +14282,9 @@ }, { "query": "from a_index | stats numberField + 1", - "error": ["At least one aggregation function required in [STATS], found [numberField+1]"], + "error": [ + "At least one aggregation function required in [STATS], found [numberField+1]" + ], "warning": [] }, { @@ -12986,17 +14299,23 @@ }, { "query": "from a_index | stats 5 +1 + numberField", - "error": ["At least one aggregation function required in [STATS], found [5+1+numberField]"], + "error": [ + "At least one aggregation function required in [STATS], found [5+1+numberField]" + ], "warning": [] }, { "query": "from a_index | stats 5 + numberField +1", - "error": ["At least one aggregation function required in [STATS], found [5+numberField+1]"], + "error": [ + "At least one aggregation function required in [STATS], found [5+numberField+1]" + ], "warning": [] }, { "query": "from a_index | stats 5 + numberField +1, var0 = sum(numberField)", - "error": ["At least one aggregation function required in [STATS], found [5+numberField+1]"], + "error": [ + "At least one aggregation function required in [STATS], found [5+numberField+1]" + ], "warning": [] }, { @@ -13067,17 +14386,23 @@ }, { "query": "from a_index | stats 5 +1+1 + numberField", - "error": ["At least one aggregation function required in [STATS], found [5+1+1+numberField]"], + "error": [ + "At least one aggregation function required in [STATS], found [5+1+1+numberField]" + ], "warning": [] }, { "query": "from a_index | stats 5 + numberField +1+1", - "error": ["At least one aggregation function required in [STATS], found [5+numberField+1+1]"], + "error": [ + "At least one aggregation function required in [STATS], found [5+numberField+1+1]" + ], "warning": [] }, { "query": "from a_index | stats 5 + numberField +1+1, var0 = sum(numberField)", - "error": ["At least one aggregation function required in [STATS], found [5+numberField+1+1]"], + "error": [ + "At least one aggregation function required in [STATS], found [5+numberField+1+1]" + ], "warning": [] }, { @@ -13312,12 +14637,16 @@ }, { "query": "from a_index | stats 5 + numberField + 1", - "error": ["At least one aggregation function required in [STATS], found [5+numberField+1]"], + "error": [ + "At least one aggregation function required in [STATS], found [5+numberField+1]" + ], "warning": [] }, { "query": "from a_index | stats numberField + 1 by ipField", - "error": ["At least one aggregation function required in [STATS], found [numberField+1]"], + "error": [ + "At least one aggregation function required in [STATS], found [numberField+1]" + ], "warning": [] }, { @@ -13352,7 +14681,9 @@ }, { "query": "from a_index | stats var0 = avg(fn(number)), count(*)", - "error": ["Unknown function [fn]"], + "error": [ + "Unknown function [fn]" + ], "warning": [] }, { @@ -13485,12 +14816,16 @@ }, { "query": "from a_index | stats avg(stringField)", - "error": ["Argument of [avg] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [avg] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | stats var = avg(*)", - "error": ["Using wildcards (*) in avg is not allowed"], + "error": [ + "Using wildcards (*) in avg is not allowed" + ], "warning": [] }, { @@ -13609,12 +14944,16 @@ }, { "query": "from a_index | stats sum(stringField)", - "error": ["Argument of [sum] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [sum] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | stats var = sum(*)", - "error": ["Using wildcards (*) in sum is not allowed"], + "error": [ + "Using wildcards (*) in sum is not allowed" + ], "warning": [] }, { @@ -13733,12 +15072,16 @@ }, { "query": "from a_index | stats median(stringField)", - "error": ["Argument of [median] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [median] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | stats var = median(*)", - "error": ["Using wildcards (*) in median is not allowed"], + "error": [ + "Using wildcards (*) in median is not allowed" + ], "warning": [] }, { @@ -13864,7 +15207,9 @@ }, { "query": "from a_index | stats var = median_absolute_deviation(*)", - "error": ["Using wildcards (*) in median_absolute_deviation is not allowed"], + "error": [ + "Using wildcards (*) in median_absolute_deviation is not allowed" + ], "warning": [] }, { @@ -13899,7 +15244,9 @@ }, { "query": "from a_index | stats percentile(numberField, numberField)", - "error": ["Argument of [percentile] must be a constant, received [numberField]"], + "error": [ + "Argument of [percentile] must be a constant, received [numberField]" + ], "warning": [] }, { @@ -14109,12 +15456,16 @@ }, { "query": "from a_index | stats max(stringField)", - "error": ["Argument of [max] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [max] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | stats var = max(*)", - "error": ["Using wildcards (*) in max is not allowed"], + "error": [ + "Using wildcards (*) in max is not allowed" + ], "warning": [] }, { @@ -14163,12 +15514,16 @@ }, { "query": "from a_index | stats max(stringField)", - "error": ["Argument of [max] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [max] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | stats var = max(*)", - "error": ["Using wildcards (*) in max is not allowed"], + "error": [ + "Using wildcards (*) in max is not allowed" + ], "warning": [] }, { @@ -14287,12 +15642,16 @@ }, { "query": "from a_index | stats min(stringField)", - "error": ["Argument of [min] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [min] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | stats var = min(*)", - "error": ["Using wildcards (*) in min is not allowed"], + "error": [ + "Using wildcards (*) in min is not allowed" + ], "warning": [] }, { @@ -14341,12 +15700,16 @@ }, { "query": "from a_index | stats min(stringField)", - "error": ["Argument of [min] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [min] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | stats var = min(*)", - "error": ["Using wildcards (*) in min is not allowed"], + "error": [ + "Using wildcards (*) in min is not allowed" + ], "warning": [] }, { @@ -14442,7 +15805,9 @@ }, { "query": "from a_index | stats var = st_centroid_agg(*)", - "error": ["Using wildcards (*) in st_centroid_agg is not allowed"], + "error": [ + "Using wildcards (*) in st_centroid_agg is not allowed" + ], "warning": [] }, { @@ -14478,7 +15843,9 @@ }, { "query": "from a_index | stats var = st_centroid_agg(*)", - "error": ["Using wildcards (*) in st_centroid_agg is not allowed"], + "error": [ + "Using wildcards (*) in st_centroid_agg is not allowed" + ], "warning": [] }, { @@ -14513,7 +15880,9 @@ }, { "query": "from a_index | stats by bucket(numberField, numberField)", - "error": ["Argument of [bucket] must be a constant, received [numberField]"], + "error": [ + "Argument of [bucket] must be a constant, received [numberField]" + ], "warning": [] }, { @@ -14638,12 +16007,16 @@ }, { "query": "from index | stats by bucket(dateField, abs(numberField), \"\", \"\")", - "error": ["Argument of [bucket] must be a constant, received [abs(numberField)]"], + "error": [ + "Argument of [bucket] must be a constant, received [abs(numberField)]" + ], "warning": [] }, { "query": "from index | stats by bucket(dateField, abs(length(numberField)), \"\", \"\")", - "error": ["Argument of [bucket] must be a constant, received [abs(length(numberField))]"], + "error": [ + "Argument of [bucket] must be a constant, received [abs(length(numberField))]" + ], "warning": [] }, { @@ -14684,7 +16057,9 @@ }, { "query": "from a_index | sort wrongField ", - "error": ["Unknown column [wrongField]"], + "error": [ + "Unknown column [wrongField]" + ], "warning": [] }, { @@ -14711,7 +16086,9 @@ }, { "query": "from a_index | sort numberField desc nulls ", - "error": ["SyntaxError: missing {'first', 'last'} at ''"], + "error": [ + "SyntaxError: missing {'first', 'last'} at ''" + ], "warning": [] }, { @@ -14721,7 +16098,9 @@ }, { "query": "from a_index | sort numberField desc first", - "error": ["SyntaxError: extraneous input 'first' expecting "], + "error": [ + "SyntaxError: extraneous input 'first' expecting " + ], "warning": [] }, { @@ -14731,7 +16110,9 @@ }, { "query": "from a_index | sort numberField desc last", - "error": ["SyntaxError: extraneous input 'last' expecting "], + "error": [ + "SyntaxError: extraneous input 'last' expecting " + ], "warning": [] }, { @@ -14746,7 +16127,9 @@ }, { "query": "from a_index | sort numberField asc nulls ", - "error": ["SyntaxError: missing {'first', 'last'} at ''"], + "error": [ + "SyntaxError: missing {'first', 'last'} at ''" + ], "warning": [] }, { @@ -14756,7 +16139,9 @@ }, { "query": "from a_index | sort numberField asc first", - "error": ["SyntaxError: extraneous input 'first' expecting "], + "error": [ + "SyntaxError: extraneous input 'first' expecting " + ], "warning": [] }, { @@ -14766,7 +16151,9 @@ }, { "query": "from a_index | sort numberField asc last", - "error": ["SyntaxError: extraneous input 'last' expecting "], + "error": [ + "SyntaxError: extraneous input 'last' expecting " + ], "warning": [] }, { @@ -14776,7 +16163,9 @@ }, { "query": "from a_index | sort numberField first", - "error": ["SyntaxError: extraneous input 'first' expecting "], + "error": [ + "SyntaxError: extraneous input 'first' expecting " + ], "warning": [] }, { @@ -14786,7 +16175,9 @@ }, { "query": "from a_index | sort numberField last", - "error": ["SyntaxError: extraneous input 'last' expecting "], + "error": [ + "SyntaxError: extraneous input 'last' expecting " + ], "warning": [] }, { @@ -14806,62 +16197,86 @@ }, { "query": "from a_index | sort avg(numberField)", - "error": ["SORT does not support function avg"], + "error": [ + "SORT does not support function avg" + ], "warning": [] }, { "query": "from a_index | sort sum(numberField)", - "error": ["SORT does not support function sum"], + "error": [ + "SORT does not support function sum" + ], "warning": [] }, { "query": "from a_index | sort median(numberField)", - "error": ["SORT does not support function median"], + "error": [ + "SORT does not support function median" + ], "warning": [] }, { "query": "from a_index | sort median_absolute_deviation(numberField)", - "error": ["SORT does not support function median_absolute_deviation"], + "error": [ + "SORT does not support function median_absolute_deviation" + ], "warning": [] }, { "query": "from a_index | sort percentile(numberField, 5)", - "error": ["SORT does not support function percentile"], + "error": [ + "SORT does not support function percentile" + ], "warning": [] }, { "query": "from a_index | sort max(numberField)", - "error": ["SORT does not support function max"], + "error": [ + "SORT does not support function max" + ], "warning": [] }, { "query": "from a_index | sort min(numberField)", - "error": ["SORT does not support function min"], + "error": [ + "SORT does not support function min" + ], "warning": [] }, { "query": "from a_index | sort count(stringField)", - "error": ["SORT does not support function count"], + "error": [ + "SORT does not support function count" + ], "warning": [] }, { "query": "from a_index | sort count_distinct(stringField, numberField)", - "error": ["SORT does not support function count_distinct"], + "error": [ + "SORT does not support function count_distinct" + ], "warning": [] }, { "query": "from a_index | sort st_centroid_agg(cartesianPointField)", - "error": ["SORT does not support function st_centroid_agg"], + "error": [ + "SORT does not support function st_centroid_agg" + ], "warning": [] }, { "query": "from a_index | sort values(stringField)", - "error": ["SORT does not support function values"], + "error": [ + "SORT does not support function values" + ], "warning": [] }, { "query": "from a_index | sort bucket(dateField, 1 year)", - "error": ["SORT does not support function bucket"], + "error": [ + "SORT does not support function bucket" + ], "warning": [] }, { @@ -15271,27 +16686,38 @@ }, { "query": "from a_index | sort sin(stringField)", - "error": ["Argument of [sin] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [sin] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | sort numberField + stringField", - "error": ["Argument of [+] must be [number], found value [stringField] type [string]"], + "error": [ + "Argument of [+] must be [number], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | enrich", - "error": ["SyntaxError: missing ENRICH_POLICY_NAME at ''"], + "error": [ + "SyntaxError: missing ENRICH_POLICY_NAME at ''" + ], "warning": [] }, { "query": "from a_index | enrich _", - "error": ["Unknown policy [_]"], + "error": [ + "Unknown policy [_]" + ], "warning": [] }, { "query": "from a_index | enrich _:", - "error": ["SyntaxError: token recognition error at: ':'", "Unknown policy [_]"], + "error": [ + "SyntaxError: token recognition error at: ':'", + "Unknown policy [_]" + ], "warning": [] }, { @@ -15303,17 +16729,25 @@ }, { "query": "from a_index | enrich :policy", - "error": ["SyntaxError: token recognition error at: ':'"], + "error": [ + "SyntaxError: token recognition error at: ':'" + ], "warning": [] }, { "query": "from a_index | enrich any:", - "error": ["SyntaxError: token recognition error at: ':'", "Unknown policy [any]"], + "error": [ + "SyntaxError: token recognition error at: ':'", + "Unknown policy [any]" + ], "warning": [] }, { "query": "from a_index | enrich _any:", - "error": ["SyntaxError: token recognition error at: ':'", "Unknown policy [_any]"], + "error": [ + "SyntaxError: token recognition error at: ':'", + "Unknown policy [_any]" + ], "warning": [] }, { @@ -15330,12 +16764,17 @@ }, { "query": "from a_index | enrich `this``is fine`", - "error": ["SyntaxError: mismatched input '`this``is fine`' expecting ENRICH_POLICY_NAME"], + "error": [ + "SyntaxError: mismatched input '`this``is fine`' expecting ENRICH_POLICY_NAME" + ], "warning": [] }, { "query": "from a_index | enrich this is fine", - "error": ["SyntaxError: mismatched input 'is' expecting ", "Unknown policy [this]"], + "error": [ + "SyntaxError: mismatched input 'is' expecting ", + "Unknown policy [this]" + ], "warning": [] }, { @@ -15446,47 +16885,68 @@ }, { "query": "from a_index |enrich missing-policy ", - "error": ["Unknown policy [missing-policy]"], + "error": [ + "Unknown policy [missing-policy]" + ], "warning": [] }, { "query": "from a_index |enrich policy on ", - "error": ["SyntaxError: missing ID_PATTERN at ''"], + "error": [ + "SyntaxError: missing ID_PATTERN at ''" + ], "warning": [] }, { "query": "from a_index | enrich policy on b ", - "error": ["Unknown column [b]"], + "error": [ + "Unknown column [b]" + ], "warning": [] }, { "query": "from a_index | enrich policy on `this``is fine`", - "error": ["Unknown column [this`is fine]"], + "error": [ + "Unknown column [this`is fine]" + ], "warning": [] }, { "query": "from a_index | enrich policy on this is fine", - "error": ["SyntaxError: mismatched input 'is' expecting ", "Unknown column [this]"], + "error": [ + "SyntaxError: mismatched input 'is' expecting ", + "Unknown column [this]" + ], "warning": [] }, { "query": "from a_index | enrich policy on stringField with ", - "error": ["SyntaxError: mismatched input '' expecting ID_PATTERN"], + "error": [ + "SyntaxError: mismatched input '' expecting ID_PATTERN" + ], "warning": [] }, { "query": "from a_index | enrich policy on stringField with var0 ", - "error": ["Unknown column [var0]"], + "error": [ + "Unknown column [var0]" + ], "warning": [] }, { "query": "from a_index |enrich policy on numberField with var0 = ", - "error": ["SyntaxError: missing ID_PATTERN at ''", "Unknown column [var0]"], + "error": [ + "SyntaxError: missing ID_PATTERN at ''", + "Unknown column [var0]" + ], "warning": [] }, { "query": "from a_index | enrich policy on stringField with var0 = c ", - "error": ["Unknown column [var0]", "Unknown column [c]"], + "error": [ + "Unknown column [var0]", + "Unknown column [c]" + ], "warning": [] }, { @@ -15500,7 +16960,9 @@ }, { "query": "from a_index | enrich policy on stringField with var0 = otherField, var1 ", - "error": ["Unknown column [var1]"], + "error": [ + "Unknown column [var1]" + ], "warning": [] }, { @@ -15515,7 +16977,10 @@ }, { "query": "from a_index |enrich policy on numberField with var0 = otherField, var1 = ", - "error": ["SyntaxError: missing ID_PATTERN at ''", "Unknown column [var1]"], + "error": [ + "SyntaxError: missing ID_PATTERN at ''", + "Unknown column [var1]" + ], "warning": [] }, { @@ -15530,7 +16995,9 @@ }, { "query": "from a_index | enrich policy with ", - "error": ["SyntaxError: mismatched input '' expecting ID_PATTERN"], + "error": [ + "SyntaxError: mismatched input '' expecting ID_PATTERN" + ], "warning": [] }, { @@ -15550,18 +17017,24 @@ }, { "query": "from a_index | enrich my-pol*", - "error": ["Using wildcards (*) in ENRICH is not allowed [my-pol*]"], + "error": [ + "Using wildcards (*) in ENRICH is not allowed [my-pol*]" + ], "warning": [] }, { "query": "from a_index | eval stringField = 5", "error": [], - "warning": ["Column [stringField] of type string has been overwritten as new type: number"] + "warning": [ + "Column [stringField] of type string has been overwritten as new type: number" + ] }, { "query": "from a_index | eval numberField = \"5\"", "error": [], - "warning": ["Column [numberField] of type number has been overwritten as new type: string"] + "warning": [ + "Column [numberField] of type number has been overwritten as new type: string" + ] }, { "query": "from a_index | eval round(numberField) + 1 | eval `round(numberField) + 1` + 1 | keep ```round(numberField) + 1`` + 1`", @@ -15617,13 +17090,17 @@ }, { "query": "from a_index | eval date_diff(\"month\", stringField, dateField)", - "error": ["Argument of [date_diff] must be [date], found value [stringField] type [string]"], + "error": [ + "Argument of [date_diff] must be [date], found value [stringField] type [string]" + ], "warning": [] }, { "query": "from a_index | eval date_diff(\"month\", dateField, stringField)", - "error": ["Argument of [date_diff] must be [date], found value [stringField] type [string]"], + "error": [ + "Argument of [date_diff] must be [date], found value [stringField] type [string]" + ], "warning": [] } ] -} +} \ No newline at end of file diff --git a/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts b/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts index ff8210ebc26da..c37ea71ef1be4 100644 --- a/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts +++ b/packages/kbn-esql-validation-autocomplete/src/validation/validation.test.ts @@ -24,6 +24,7 @@ const fieldTypes = [ 'number', 'date', 'boolean', + 'version', 'ip', 'string', 'cartesian_point', @@ -549,16 +550,16 @@ describe('validation logic', () => { testErrorsAndWarnings('row var = "a" in ("a", "b", "c")', []); testErrorsAndWarnings('row var = "a" not in ("a", "b", "c")', []); testErrorsAndWarnings('row var = 1 in ("a", "b", "c")', [ - 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', + // 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', ]); testErrorsAndWarnings('row var = 5 in ("a", "b", "c")', [ - 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', + // 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', ]); testErrorsAndWarnings('row var = 5 not in ("a", "b", "c")', [ - 'Argument of [not_in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', + // 'Argument of [not_in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', ]); testErrorsAndWarnings('row var = 5 not in (1, 2, 3, "a")', [ - 'Argument of [not_in] must be [number[]], found value [(1, 2, 3, "a")] type [(number, number, number, string)]', + // 'Argument of [not_in] must be [number[]], found value [(1, 2, 3, "a")] type [(number, number, number, string)]', ]); // test that "and" and "or" accept null... not sure if this is the best place or not... @@ -689,10 +690,7 @@ describe('validation logic', () => { `Argument of [${op}] must be [number], found value [false] type [boolean]`, ] ); - for (const [valueTypeA, valueTypeB] of [ - ['now()', '"2022"'], - ['42', '"2022"'], - ]) { + for (const [valueTypeA, valueTypeB] of [['now()', '"2022"']]) { testErrorsAndWarnings(`row var = ${valueTypeA} ${op} ${valueTypeB}`, []); testErrorsAndWarnings(`row var = ${valueTypeB} ${op} ${valueTypeA}`, []); } @@ -1123,31 +1121,6 @@ describe('validation logic', () => { ] ); } - - // Implicit casting of literal values tests - testErrorsAndWarnings(`from a_index | where numberField ${op} stringField`, [ - `Argument of [${op}] must be [number], found value [stringField] type [string]`, - ]); - testErrorsAndWarnings(`from a_index | where stringField ${op} numberField`, [ - `Argument of [${op}] must be [number], found value [stringField] type [string]`, - ]); - testErrorsAndWarnings(`from a_index | where numberField ${op} "2022"`, []); - - testErrorsAndWarnings(`from a_index | where dateField ${op} stringField`, [ - `Argument of [${op}] must be [string], found value [dateField] type [date]`, - ]); - testErrorsAndWarnings(`from a_index | where stringField ${op} dateField`, [ - `Argument of [${op}] must be [string], found value [dateField] type [date]`, - ]); - testErrorsAndWarnings(`from a_index | where dateField ${op} "2022"`, []); - - // Check that the implicit cast doesn't apply for fields - testErrorsAndWarnings(`from a_index | where stringField ${op} 0`, [ - `Argument of [${op}] must be [number], found value [stringField] type [string]`, - ]); - testErrorsAndWarnings(`from a_index | where stringField ${op} now()`, [ - `Argument of [${op}] must be [string], found value [now()] type [date]`, - ]); } for (const nesting of NESTED_DEPTHS) { @@ -1709,7 +1682,7 @@ describe('validation logic', () => { 'Log of a negative number results in null: -20', ] ); - for (const op of ['>', '>=', '<', '<=', '==']) { + for (const op of ['>', '>=', '<', '<=', '==', '!=']) { testErrorsAndWarnings(`from a_index | eval numberField ${op} 0`, []); testErrorsAndWarnings(`from a_index | eval NOT numberField ${op} 0`, []); testErrorsAndWarnings(`from a_index | eval (numberField ${op} 0)`, []); @@ -1733,7 +1706,9 @@ describe('validation logic', () => { testErrorsAndWarnings(`from a_index | eval stringField ${op} numberField`, [ `Argument of [${op}] must be [number], found value [stringField] type [string]`, ]); - testErrorsAndWarnings(`from a_index | eval numberField ${op} "2022"`, []); + testErrorsAndWarnings(`from a_index | eval numberField ${op} "2022"`, [ + `Argument of [${op}] must be [number], found value ["2022"] type [string]`, + ]); testErrorsAndWarnings(`from a_index | eval dateField ${op} stringField`, [ `Argument of [${op}] must be [string], found value [dateField] type [date]`, @@ -1741,7 +1716,6 @@ describe('validation logic', () => { testErrorsAndWarnings(`from a_index | eval stringField ${op} dateField`, [ `Argument of [${op}] must be [string], found value [dateField] type [date]`, ]); - testErrorsAndWarnings(`from a_index | eval dateField ${op} "2022"`, []); // Check that the implicit cast doesn't apply for fields testErrorsAndWarnings(`from a_index | eval stringField ${op} 0`, [ @@ -1750,7 +1724,45 @@ describe('validation logic', () => { testErrorsAndWarnings(`from a_index | eval stringField ${op} now()`, [ `Argument of [${op}] must be [string], found value [now()] type [date]`, ]); + + testErrorsAndWarnings(`from a_index | eval dateField ${op} "2022"`, []); + testErrorsAndWarnings(`from a_index | eval "2022" ${op} dateField`, []); + + testErrorsAndWarnings(`from a_index | eval versionField ${op} "1.2.3"`, []); + testErrorsAndWarnings(`from a_index | eval "1.2.3" ${op} versionField`, []); + + testErrorsAndWarnings( + `from a_index | eval booleanField ${op} "true"`, + ['==', '!='].includes(op) + ? [] + : [`Argument of [${op}] must be [string], found value [booleanField] type [boolean]`] + ); + testErrorsAndWarnings( + `from a_index | eval "true" ${op} booleanField`, + ['==', '!='].includes(op) + ? [] + : [`Argument of [${op}] must be [string], found value [booleanField] type [boolean]`] + ); + + testErrorsAndWarnings(`from a_index | eval ipField ${op} "136.36.3.205"`, []); + testErrorsAndWarnings(`from a_index | eval "136.36.3.205" ${op} ipField`, []); } + + // casting for IN for version, date, boolean, ip + testErrorsAndWarnings( + 'from a_index | eval versionField in ("1.2.3", "4.5.6", to_version("2.3.2"))', + [] + ); + testErrorsAndWarnings( + 'from a_index | eval dateField in ("2023-12-12", "2024-12-12", date_parse("yyyy-MM-dd", "2025-12-12"))', + [] + ); + testErrorsAndWarnings('from a_index | eval booleanField in ("true", "false", false)', []); + testErrorsAndWarnings( + 'from a_index | eval ipField in ("136.36.3.205", "136.36.3.206", to_ip("136.36.3.207"))', + [] + ); + for (const op of ['+', '-', '*', '/', '%']) { testErrorsAndWarnings(`from a_index | eval numberField ${op} 1`, []); testErrorsAndWarnings(`from a_index | eval (numberField ${op} 1)`, []); @@ -1764,6 +1776,15 @@ describe('validation logic', () => { `Argument of [${op}] must be [number], found value [now()] type [date]`, ] ); + + testErrorsAndWarnings(`from a_index | eval 1 ${op} "1"`, [ + `Argument of [${op}] must be [number], found value [\"1\"] type [string]`, + ]); + testErrorsAndWarnings(`from a_index | eval "1" ${op} 1`, [ + `Argument of [${op}] must be [number], found value [\"1\"] type [string]`, + ]); + // TODO: enable when https://github.com/elastic/elasticsearch/issues/108432 is complete + // testErrorsAndWarnings(`from a_index | eval "2022" ${op} 1 day`, []); } for (const divideByZeroExpr of ['1/0', 'var = 1/0', '1 + 1/0']) { testErrorsAndWarnings( @@ -1811,16 +1832,16 @@ describe('validation logic', () => { [] ); testErrorsAndWarnings('from a_index | eval 1 in ("a", "b", "c")', [ - 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', + // 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', ]); testErrorsAndWarnings('from a_index | eval numberField in ("a", "b", "c")', [ - 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', + // 'Argument of [in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', ]); testErrorsAndWarnings('from a_index | eval numberField not in ("a", "b", "c")', [ - 'Argument of [not_in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', + // 'Argument of [not_in] must be [number[]], found value [("a", "b", "c")] type [(string, string, string)]', ]); testErrorsAndWarnings('from a_index | eval numberField not in (1, 2, 3, stringField)', [ - 'Argument of [not_in] must be [number[]], found value [(1, 2, 3, stringField)] type [(number, number, number, string)]', + // 'Argument of [not_in] must be [number[]], found value [(1, 2, 3, stringField)] type [(number, number, number, string)]', ]); testErrorsAndWarnings('from a_index | eval avg(numberField)', [