|
@@ -1,5 +1,5 @@
|
|
|
standard aggs
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS count=COUNT(),
|
|
@@ -17,7 +17,7 @@ count:long | sum:long | avg:double | count_distinct:long | category:keyw
|
|
|
;
|
|
|
|
|
|
values aggs
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS values=MV_SORT(VALUES(message)),
|
|
@@ -33,7 +33,7 @@ values:keyword | top
|
|
|
;
|
|
|
|
|
|
mv
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM mv_sample_data
|
|
|
| STATS COUNT(), SUM(event_duration) BY category=CATEGORIZE(message)
|
|
@@ -48,7 +48,7 @@ COUNT():long | SUM(event_duration):long | category:keyword
|
|
|
;
|
|
|
|
|
|
row mv
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
ROW message = ["connected to a", "connected to b", "disconnected"], str = ["a", "b", "c"]
|
|
|
| STATS COUNT(), VALUES(str) BY category=CATEGORIZE(message)
|
|
@@ -61,7 +61,7 @@ COUNT():long | VALUES(str):keyword | category:keyword
|
|
|
;
|
|
|
|
|
|
with multiple indices
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
required_capability: union_types
|
|
|
|
|
|
FROM sample_data*
|
|
@@ -76,7 +76,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
mv with many values
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM employees
|
|
|
| STATS COUNT() BY category=CATEGORIZE(job_positions)
|
|
@@ -92,24 +92,37 @@ COUNT():long | category:keyword
|
|
|
10 | .*?Head.+?Human.+?Resources.*?
|
|
|
;
|
|
|
|
|
|
-# Throws when calling AbstractCategorizeBlockHash.seenGroupIds() - Requires nulls support?
|
|
|
-mv with many values-Ignore
|
|
|
-required_capability: categorize_v2
|
|
|
+mv with many values and SUM
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM employees
|
|
|
| STATS SUM(languages) BY category=CATEGORIZE(job_positions)
|
|
|
- | SORT category DESC
|
|
|
+ | SORT category
|
|
|
| LIMIT 3
|
|
|
;
|
|
|
|
|
|
-SUM(languages):integer | category:keyword
|
|
|
- 43 | .*?Accountant.*?
|
|
|
- 46 | .*?Architect.*?
|
|
|
- 35 | .*?Business.+?Analyst.*?
|
|
|
+SUM(languages):long | category:keyword
|
|
|
+ 43 | .*?Accountant.*?
|
|
|
+ 46 | .*?Architect.*?
|
|
|
+ 35 | .*?Business.+?Analyst.*?
|
|
|
+;
|
|
|
+
|
|
|
+mv with many values and nulls and SUM
|
|
|
+required_capability: categorize_v3
|
|
|
+
|
|
|
+FROM employees
|
|
|
+ | STATS SUM(languages) BY category=CATEGORIZE(job_positions)
|
|
|
+ | SORT category DESC
|
|
|
+ | LIMIT 2
|
|
|
+;
|
|
|
+
|
|
|
+SUM(languages):long | category:keyword
|
|
|
+ 27 | null
|
|
|
+ 46 | .*?Tech.+?Lead.*?
|
|
|
;
|
|
|
|
|
|
mv via eval
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| EVAL message = MV_APPEND(message, "Banana")
|
|
@@ -125,7 +138,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
mv via eval const
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| EVAL message = ["Banana", "Bread"]
|
|
@@ -139,7 +152,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
mv via eval const without aliases
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| EVAL message = ["Banana", "Bread"]
|
|
@@ -153,7 +166,7 @@ COUNT():long | CATEGORIZE(message):keyword
|
|
|
;
|
|
|
|
|
|
mv const in parameter
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS COUNT() BY c = CATEGORIZE(["Banana", "Bread"])
|
|
@@ -166,7 +179,7 @@ COUNT():long | c:keyword
|
|
|
;
|
|
|
|
|
|
agg alias shadowing
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS c = COUNT() BY c = CATEGORIZE(["Banana", "Bread"])
|
|
@@ -181,7 +194,7 @@ c:keyword
|
|
|
;
|
|
|
|
|
|
chained aggregations using categorize
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS COUNT() BY category=CATEGORIZE(message)
|
|
@@ -196,7 +209,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
stats without aggs
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS BY category=CATEGORIZE(message)
|
|
@@ -210,7 +223,7 @@ category:keyword
|
|
|
;
|
|
|
|
|
|
text field
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM hosts
|
|
|
| STATS COUNT() BY category=CATEGORIZE(host_group)
|
|
@@ -221,10 +234,11 @@ COUNT():long | category:keyword
|
|
|
2 | .*?DB.+?servers.*?
|
|
|
2 | .*?Gateway.+?instances.*?
|
|
|
5 | .*?Kubernetes.+?cluster.*?
|
|
|
+ 1 | null
|
|
|
;
|
|
|
|
|
|
on TO_UPPER
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS COUNT() BY category=CATEGORIZE(TO_UPPER(message))
|
|
@@ -238,7 +252,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
on CONCAT
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS COUNT() BY category=CATEGORIZE(CONCAT(message, " banana"))
|
|
@@ -252,7 +266,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
on CONCAT with unicode
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS COUNT() BY category=CATEGORIZE(CONCAT(message, " 👍🏽😊"))
|
|
@@ -266,7 +280,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
on REVERSE(CONCAT())
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS COUNT() BY category=CATEGORIZE(REVERSE(CONCAT(message, " 👍🏽😊")))
|
|
@@ -280,7 +294,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
and then TO_LOWER
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS COUNT() BY category=CATEGORIZE(message)
|
|
@@ -294,9 +308,8 @@ COUNT():long | category:keyword
|
|
|
1 | .*?disconnected.*?
|
|
|
;
|
|
|
|
|
|
-# Throws NPE - Requires nulls support
|
|
|
-on const empty string-Ignore
|
|
|
-required_capability: categorize_v2
|
|
|
+on const empty string
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS COUNT() BY category=CATEGORIZE("")
|
|
@@ -304,12 +317,11 @@ FROM sample_data
|
|
|
;
|
|
|
|
|
|
COUNT():long | category:keyword
|
|
|
- 7 | .*?.*?
|
|
|
+ 7 | null
|
|
|
;
|
|
|
|
|
|
-# Throws NPE - Requires nulls support
|
|
|
-on const empty string from eval-Ignore
|
|
|
-required_capability: categorize_v2
|
|
|
+on const empty string from eval
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| EVAL x = ""
|
|
@@ -318,26 +330,24 @@ FROM sample_data
|
|
|
;
|
|
|
|
|
|
COUNT():long | category:keyword
|
|
|
- 7 | .*?.*?
|
|
|
+ 7 | null
|
|
|
;
|
|
|
|
|
|
-# Doesn't give the correct results - Requires nulls support
|
|
|
-on null-Ignore
|
|
|
-required_capability: categorize_v2
|
|
|
+on null
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| EVAL x = null
|
|
|
- | STATS COUNT() BY category=CATEGORIZE(x)
|
|
|
+ | STATS COUNT(), SUM(event_duration) BY category=CATEGORIZE(x)
|
|
|
| SORT category
|
|
|
;
|
|
|
|
|
|
-COUNT():long | category:keyword
|
|
|
- 7 | null
|
|
|
+COUNT():long | SUM(event_duration):long | category:keyword
|
|
|
+ 7 | 23231327 | null
|
|
|
;
|
|
|
|
|
|
-# Doesn't give the correct results - Requires nulls support
|
|
|
-on null string-Ignore
|
|
|
-required_capability: categorize_v2
|
|
|
+on null string
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| EVAL x = null::string
|
|
@@ -350,7 +360,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
filtering out all data
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| WHERE @timestamp < "2023-10-23T00:00:00Z"
|
|
@@ -362,7 +372,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
filtering out all data with constant
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS COUNT() BY category=CATEGORIZE(message)
|
|
@@ -373,7 +383,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
drop output columns
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS count=COUNT() BY category=CATEGORIZE(message)
|
|
@@ -388,7 +398,7 @@ x:integer
|
|
|
;
|
|
|
|
|
|
category value processing
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
ROW message = ["connected to a", "connected to b", "disconnected"]
|
|
|
| STATS COUNT() BY category=CATEGORIZE(message)
|
|
@@ -402,7 +412,7 @@ COUNT():long | category:keyword
|
|
|
;
|
|
|
|
|
|
row aliases
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
ROW message = "connected to a"
|
|
|
| EVAL x = message
|
|
@@ -416,7 +426,7 @@ COUNT():long | category:keyword | y:keyword
|
|
|
;
|
|
|
|
|
|
from aliases
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| EVAL x = message
|
|
@@ -432,7 +442,7 @@ COUNT():long | category:keyword | y:keyword
|
|
|
;
|
|
|
|
|
|
row aliases with keep
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
ROW message = "connected to a"
|
|
|
| EVAL x = message
|
|
@@ -448,7 +458,7 @@ COUNT():long | y:keyword
|
|
|
;
|
|
|
|
|
|
from aliases with keep
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| EVAL x = message
|
|
@@ -466,7 +476,7 @@ COUNT():long | y:keyword
|
|
|
;
|
|
|
|
|
|
row rename
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
ROW message = "connected to a"
|
|
|
| RENAME message as x
|
|
@@ -480,7 +490,7 @@ COUNT():long | y:keyword
|
|
|
;
|
|
|
|
|
|
from rename
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| RENAME message as x
|
|
@@ -496,7 +506,7 @@ COUNT():long | y:keyword
|
|
|
;
|
|
|
|
|
|
row drop
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
ROW message = "connected to a"
|
|
|
| STATS c = COUNT() BY category=CATEGORIZE(message)
|
|
@@ -509,7 +519,7 @@ c:long
|
|
|
;
|
|
|
|
|
|
from drop
|
|
|
-required_capability: categorize_v2
|
|
|
+required_capability: categorize_v3
|
|
|
|
|
|
FROM sample_data
|
|
|
| STATS c = COUNT() BY category=CATEGORIZE(message)
|