Initial commit

docs/reference/esql/esql-functions.asciidoc

@@ -0,0 +1,146 @@
+[[esql-functions]]
+== ESQL functions
+
+<<esql-eval,`EVAL`>> and <<esql-where,`WHERE`>> support the following functions:
+
+[discrete]
+[[esql-abs]]
+=== `ABS`
+Returns the absolute value.
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| EVAL abs_height = ABS(0.0 - height)
+----
+
+[discrete]
+[[esql-concat]]
+=== `CONCAT`
+Concatenates two or more strings.
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| EVAL fullname = CONCAT(first_name, " ", last_name)
+----
+
+[discrete]
+[[esql-date_format]]
+=== `DATE_FORMAT`
+Returns a string representation of a date in the provided format. If no format
+is specified, the `yyyy-MM-dd'T'HH:mm:ss.SSSZ` format is used.
+
+[source,esql]
+----
+FROM employees 
+| PROJECT first_name, last_name, hire_date
+| EVAL hired = DATE_FORMAT(hire_date, "YYYY-MM-dd")
+----
+
+[discrete]
+[[esql-date_trunc]]
+=== `DATE_TRUNC`
+Rounds down a date to the closest interval. Intervals can be expressed using the
+<<esql-timespan-literals,timespan literal syntax>>.
+
+[source,esql]
+----
+FROM employees
+| EVAL year_hired = DATE_TRUNC(hire_date, 1 year)
+| STATS count(emp_no) BY year_hired
+| SORT year_hired
+----
+
+[discrete]
+[[esql-is_null]]
+=== `IS_NULL`
+Returns a boolean than indicates whether its input is `null`.  
+
+[source,esql]
+----
+FROM employees
+| WHERE is_null(first_name)
+----
+
+Combine this function with `NOT` to filter out any `null` data:
+
+[source,esql]
+----
+FROM employees
+| WHERE NOT is_null(first_name)
+----
+
+[discrete]
+[[esql-length]]
+=== `LENGTH`
+Returns the character length of a string.
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| EVAL fn_length = LENGTH(first_name)
+----
+
+[discrete]
+[[esql-round]]
+=== `ROUND`
+Rounds a number to the closest number with the specified number of digits.
+Defaults to 0 digits if no number of digits is provided. If the specified number
+of digits is negative, rounds to the number of digits left of the decimal point.
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| EVAL height = ROUND(height * 3.281, 1)
+----
+
+[discrete]
+[[esql-starts_with]]
+=== `STARTS_WITH`
+Returns a boolean that indicates whether a keyword string starts with another 
+string:
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| EVAL ln_S = STARTS_WITH(last_name, "S")
+----
+
+[discrete]
+[[esql-substring]]
+=== `SUBSTRING`
+Returns a substring of a string, specified by a start position and an optional
+length. This example returns the first three characters of every last name:
+
+[source,esql]
+----
+FROM employees
+| PROJECT last_name
+| EVAL ln_sub = SUBSTRING(last_name, 1, 3) 
+----
+
+A negative start position is interpreted as being relative to the end of the
+string. This example returns the last three characters of of every last name:
+
+[source,esql]
+----
+FROM employees
+| PROJECT last_name
+| EVAL ln_sub = SUBSTRING(last_name, -3, 3) 
+----
+
+If length is omitted, substring returns the remainder of the string. This
+example returns all characters except for the first:
+
+[source,esql]
+----
+FROM employees
+| PROJECT last_name
+| EVAL ln_sub = SUBSTRING(last_name, 2) 
+----

docs/reference/esql/esql-processing-commands.asciidoc

@@ -0,0 +1,257 @@
+[[esql-processing-commands]]
+== ESQL processing commands
+
+Processing commands change an input table by adding, removing, or changing rows
+and columns.
+
+image::images/esql/processing-command.svg[A processing command changes an input table,align="center"]
+
+[discrete]
+[[esql-limit]]
+=== `LIMIT`
+
+The `LIMIT` processing command enables you to limit the number of rows:
+
+[source,esql]
+----
+FROM employees
+| LIMIT 5
+----
+
+[discrete]
+[[esql-project]]
+=== `PROJECT`
+
+The `PROJECT` command enables you to change:
+
+* the columns that are returned,
+* the order in which they are returned,
+* and the name with which they are returned.
+
+To limit the columns that are returned, use a comma-separated list of column
+names. The columns are returned in the specified order:
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+----
+
+Rather than specify each column by name, you can use wildcards to return all
+columns with a name that matches a pattern:
+
+[source,esql]
+----
+FROM employees
+| PROJECT h*
+----
+
+The asterisk wildcard (`*`) by itself translates to all columns that do not
+match the other arguments. This query will first return all columns with a name
+that starts with an h, followed by all other columns:
+
+[source,esql]
+----
+FROM employees
+| PROJECT h*, *
+----
+
+Use a dash to specify columns you do not want returned:
+
+[source,esql]
+----
+FROM employees
+| PROJECT -h*
+----
+
+Use `=` to rename columns:
+
+[source,esql]
+----
+FROM employees
+| PROJECT current_employee = still_hired, *
+----
+
+[discrete]
+[[esql-eval]]
+=== `EVAL`
+`EVAL` enables you to add new columns to the end of the table:
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| EVAL height_feet = height * 3.281, height_cm = height * 100
+----
+
+If the specified column already exists, the existing column will be dropped, and
+the new column will be appended to the table:
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| EVAL height = height * 3.281
+----
+
+[discrete]
+==== Functions 
+`EVAL` supports various functions for calculating values. Refer to
+<<esql-functions,Functions>> for more information.
+
+[discrete]
+[[esql-sort]]
+=== `SORT`
+Use the `SORT` command to sort rows on one or more fields:
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| SORT height
+----
+
+The default sort order is ascending. Set an explicit sort order using `ASC` or
+`DESC`:
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| SORT height desc
+----
+
+If two rows have the same sort key, the original order will be preserved. You
+can provide additional sort expressions to act as tie breakers:
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| SORT height desc, first_name ASC
+----
+
+[discrete]
+==== `null` values 
+By default, `null` values are treated as being larger than any other value. With
+an ascending sort order, `null` values are sorted last, and with a descending
+sort order, `null` values are sorted first. You can change that by providing
+`NULLS FIRST` or `NULLS LAST`:
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| SORT first_name ASC NULLS FIRST
+----
+
+[discrete]
+[[esql-where]]
+=== `WHERE`
+
+Use `WHERE` to produce a table that contains all the rows from the input table
+for which the provided condition evaluates to `true`:
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, still_hired
+| WHERE still_hired == true
+----
+
+Which, because `still_hired` is a boolean field, can be simplified to:
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, still_hired
+| WHERE still_hired
+----
+
+[discrete]
+==== Operators
+These comparison operators are supported:
+
+* equality: `==`
+* inequality: `!=`
+* comparison: 
+** less than: `<`
+** less than or equal: `<=`
+** larger than: `>`
+** larger than or equal: `>=`
+
+You can use the following boolean operators:
+
+* `AND`
+* `OR`
+* `NOT`
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height, still_hired
+| WHERE height > 2 AND NOT still_hired
+----
+
+[discrete]
+==== Functions 
+`WHERE` supports various functions for calculating values. Refer to
+<<esql-functions,Functions>> for more information.
+
+[source,esql]
+----
+FROM employees
+| PROJECT first_name, last_name, height
+| WHERE length(first_name) < 4
+----
+
+[discrete]
+[[esql-stats-by]]
+=== `STATS ... BY`
+Use `STATS ... BY` to group rows according to a common value and calculate one
+or more aggregated values over the grouped rows. 
+
+[source,esql]
+----
+FROM employees
+| STATS count = COUNT(languages) BY languages
+----
+
+If `BY` is omitted, the output table contains exactly one row with the
+aggregations applied over the entire dataset:
+
+[source,esql]
+----
+FROM employees
+| STATS avg_lang = AVG(languages)
+----
+
+It's possible to calculate multiple values:
+
+[source,esql]
+----
+FROM employees
+| STATS avg_lang = AVG(languages), max_lang = MAX(languages)
+----
+
+It's also possible to group by multiple values (only supported for long and
+keyword family fields):
+
+[source,esql]
+----
+FROM employees
+| EVAL hired = DATE_FORMAT(hire_date, "YYYY")
+| STATS avg_salary = AVG(salary) BY hired, languages.long
+| EVAL avg_salary = ROUND(avg_salary)
+| SORT hired, languages.long
+----
+
+The following aggregation functions are supported:
+
+* `AVG`
+* `COUNT`
+* `MAX`
+* `MEDIAN`
+* `MEDIAN_ABSOLUTE_DEVIATION`
+* `MIN`
+* `SUM`

docs/reference/esql/esql-source-commands.asciidoc

@@ -0,0 +1,54 @@
+[[esql-source-commands]]
+== ESQL source commands
+
+A source command produces a table from Elasticsearch. 
+
+image::images/esql/source-command.svg[A source command produces a table from {es},align="center"]
+
+[discrete]
+[[esql-from]]
+=== `FROM`
+
+The `FROM` source command returns a table with up to 10,000 documents from a
+data stream, index, or alias. Each row in the resulting table represents a
+document. Each column corresponds to a field, and can be accessed by the name of
+that field.
+
+[source,esql]
+----
+FROM employees
+----
+
+You can use <<api-date-math-index-names,date math>> to refer to indices, aliases
+and data streams. This can be useful for time series data, for example to access
+today's index:
+
+[source,esql]
+----
+FROM <logs-{now/d}>
+----
+
+Use comma-separated lists or wildcards to query multiple data streams, indices,
+or aliases:
+
+[source,esql]
+----
+FROM employees-00001,employees-*
+----
+
+[discrete]
+[[esql-show]]
+=== `SHOW <item>`
+
+The `SHOW <item>` source command returns information about the deployment and
+its capabilities:
+
+* Use `SHOW INFO` to return the deployment's version, build date and hash.
+* Use `SHOW FUNCTIONS` to return a list of all supported functions and a 
+synopsis of each function.
+
+[discrete]
+[[esql-row]]
+=== `ROW`
+
+TODO

docs/reference/esql/esql-timespan-literals.asciidoc

@@ -0,0 +1,21 @@
+[[esql-timespan-literals]]
+== ESQL timespan literals
+
+Datetime intervals and timespans can be expressed using timespan literals.
+Timespan literals are a combination of a number and a qualifier. These
+qualifiers are supported:
+
+* `millisecond`/`milliseconds`
+* `second`/`seconds`
+* `minute`/`minutes`
+* `hour`/`hours`
+* `day`/`days`
+* `week`/`weeks`
+* `month`/`months`
+* `year`/`years`
+
+Timespan literals are not whitespace sensitive. These expressions are all valid:
+
+* `1day`
+* `1 day`
+* `1       day`

docs/reference/esql/from.asciidoc

@@ -1,4 +1,4 @@
-[[esql-from]]
+
 == `from`
 
 The `from` keyword in ESQL chooses which index to query.

docs/reference/esql/index.asciidoc

@@ -6,11 +6,35 @@
 
 [partintro]
 --
-ESQL is a glorious new language to query data in Elasticsearch!
+
+The Elasticsearch Query Language (ESQL) is a query language that enables the
+iterative exploration of data.
+
+An ESQL query consists of a series of commands, separated by pipes. Each query
+starts with a <<esql-source-commands,source command>>. A source command produces
+a table from {es}.
+
+image::images/esql/source-command.svg[A source command produces a table from {es},align="center"]
+
+A source command can be followed by one or more
+<<esql-processing-commands,processing commands>>. Processing commands change an
+input table by adding, removing, or changing rows and columns.
+
+image::images/esql/processing-command.svg[A processing command changes an input table,align="center"]
+
+You can chain processing commands, separated by a pipe character: `|`. Each
+processing command works on the output table of the previous command.
+
+image::images/esql/chaining-processing-commands.svg[Processing commands can be chained,align="center"]
 
 [discrete]
 [[esql-console]]
-=== Run ESQL!
+=== Run an ESQL query
+
+[discrete]
+==== The ESQL API
+
+Use the `_esql` endpoint to run an ESQL query:
 
 [source,console]
 ----
@@ -46,9 +70,55 @@ The results come back in rows:
 }
 ----
 
+By default, results are returned as JSON. To return results formatted as text,
+CSV, or TSV, use the `format` parameter:
+
+[source,console]
+----
+POST /_esql?format=txt
+{
+  "query": """
+    FROM library
+    | EVAL year = DATE_TRUNC(release_date, 1 YEARS)
+    | STATS MAX(page_count) BY year
+    | SORT year
+    | LIMIT 5
+  """
+}
+----
+// TEST[continued]
+
+[discrete]
+==== Discover and Lens
+
+ESQL can be used in Discover to explore a data set, and in Lens to visualize it.
+First, enable the `enableTextBased` setting in *Advanced Settings*. Next, in
+Discover or Lens, from the data view dropdown, select *ESQL*. 
+
+NOTE: ESQL queries in Discover and Lens are subject to the time range selected
+with the time filter.
+
+[discrete]
+[[esql-limitations]]
+=== Limitations
+
+ESQL currently supports only the following field types:
+
+- boolean
+- dates
+- keyword family (strings)
+- double/float/half_float
+- long/int/short/byte
+
 --
 
+include::esql-source-commands.asciidoc[]
+include::esql-processing-commands.asciidoc[]
+include::esql-functions.asciidoc[]
+include::esql-timespan-literals.asciidoc[]
+
 include::from.asciidoc[]
 
+
 :esql-tests!:
 :esql-specs!:

docs/reference/images/esql/processing-command.svg

@@ -0,0 +1,207 @@
+<svg width="507" height="144" viewBox="0 0 507 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_1_517)">
+<rect x="307" width="200" height="144" rx="8" fill="white"/>
+<g clip-path="url(#clip1_1_517)">
+<rect width="50" height="144" transform="translate(307)" fill="white" fill-opacity="0.01"/>
+<mask id="path-3-inside-1_1_517" fill="white">
+<path d="M307 0H357V36H307V0Z"/>
+</mask>
+<path d="M307 0H357V36H307V0Z" fill="white" fill-opacity="0.01"/>
+<path d="M307 0V-1H305V0H307ZM307 1H357V-1H307V1ZM309 36V0H305V36H309Z" fill="black" mask="url(#path-3-inside-1_1_517)"/>
+<mask id="path-5-inside-2_1_517" fill="white">
+<path d="M307 36H357V72H307V36Z"/>
+</mask>
+<path d="M307 36H357V72H307V36Z" fill="white" fill-opacity="0.01"/>
+<path d="M307 36V35H305V36H307ZM307 37H357V35H307V37ZM309 72V36H305V72H309Z" fill="black" mask="url(#path-5-inside-2_1_517)"/>
+<mask id="path-7-inside-3_1_517" fill="white">
+<path d="M307 72H357V108H307V72Z"/>
+</mask>
+<path d="M307 72H357V108H307V72Z" fill="white" fill-opacity="0.01"/>
+<path d="M307 72V71H305V72H307ZM307 73H357V71H307V73ZM309 108V72H305V108H309Z" fill="black" mask="url(#path-7-inside-3_1_517)"/>
+<mask id="path-9-inside-4_1_517" fill="white">
+<path d="M307 108H357V144H307V108Z"/>
+</mask>
+<path d="M307 108H357V144H307V108Z" fill="white" fill-opacity="0.01"/>
+<path d="M307 108V107H305V108H307ZM307 109H357V107H307V109ZM309 144V108H305V144H309Z" fill="black" mask="url(#path-9-inside-4_1_517)"/>
+</g>
+<g clip-path="url(#clip2_1_517)">
+<rect width="50" height="144" transform="translate(357)" fill="white" fill-opacity="0.01"/>
+<mask id="path-11-inside-5_1_517" fill="white">
+<path d="M357 0H407V36H357V0Z"/>
+</mask>
+<path d="M357 0H407V36H357V0Z" fill="white" fill-opacity="0.01"/>
+<path d="M357 0V-1H356V0H357ZM357 1H407V-1H357V1ZM358 36V0H356V36H358Z" fill="black" mask="url(#path-11-inside-5_1_517)"/>
+<mask id="path-13-inside-6_1_517" fill="white">
+<path d="M357 36H407V72H357V36Z"/>
+</mask>
+<path d="M357 36H407V72H357V36Z" fill="white" fill-opacity="0.01"/>
+<path d="M357 36V35H356V36H357ZM357 37H407V35H357V37ZM358 72V36H356V72H358Z" fill="black" mask="url(#path-13-inside-6_1_517)"/>
+<mask id="path-15-inside-7_1_517" fill="white">
+<path d="M357 72H407V108H357V72Z"/>
+</mask>
+<path d="M357 72H407V108H357V72Z" fill="white" fill-opacity="0.01"/>
+<path d="M357 72V71H356V72H357ZM357 73H407V71H357V73ZM358 108V72H356V108H358Z" fill="black" mask="url(#path-15-inside-7_1_517)"/>
+<mask id="path-17-inside-8_1_517" fill="white">
+<path d="M357 108H407V144H357V108Z"/>
+</mask>
+<path d="M357 108H407V144H357V108Z" fill="white" fill-opacity="0.01"/>
+<path d="M357 108V107H356V108H357ZM357 109H407V107H357V109ZM358 144V108H356V144H358Z" fill="black" mask="url(#path-17-inside-8_1_517)"/>
+</g>
+<g clip-path="url(#clip3_1_517)">
+<rect width="50" height="144" transform="translate(407)" fill="white" fill-opacity="0.01"/>
+<mask id="path-19-inside-9_1_517" fill="white">
+<path d="M407 0H457V36H407V0Z"/>
+</mask>
+<path d="M407 0H457V36H407V0Z" fill="white" fill-opacity="0.01"/>
+<path d="M407 0V-1H406V0H407ZM407 1H457V-1H407V1ZM408 36V0H406V36H408Z" fill="black" mask="url(#path-19-inside-9_1_517)"/>
+<mask id="path-21-inside-10_1_517" fill="white">
+<path d="M407 36H457V72H407V36Z"/>
+</mask>
+<path d="M407 36H457V72H407V36Z" fill="white" fill-opacity="0.01"/>
+<path d="M407 36V35H406V36H407ZM407 37H457V35H407V37ZM408 72V36H406V72H408Z" fill="black" mask="url(#path-21-inside-10_1_517)"/>
+<mask id="path-23-inside-11_1_517" fill="white">
+<path d="M407 72H457V108H407V72Z"/>
+</mask>
+<path d="M407 72H457V108H407V72Z" fill="white" fill-opacity="0.01"/>
+<path d="M407 72V71H406V72H407ZM407 73H457V71H407V73ZM408 108V72H406V108H408Z" fill="black" mask="url(#path-23-inside-11_1_517)"/>
+<mask id="path-25-inside-12_1_517" fill="white">
+<path d="M407 108H457V144H407V108Z"/>
+</mask>
+<path d="M407 108H457V144H407V108Z" fill="white" fill-opacity="0.01"/>
+<path d="M407 108V107H406V108H407ZM407 109H457V107H407V109ZM408 144V108H406V144H408Z" fill="black" mask="url(#path-25-inside-12_1_517)"/>
+</g>
+<g clip-path="url(#clip4_1_517)">
+<rect width="50" height="144" transform="translate(457)" fill="#F990C6"/>
+<mask id="path-27-inside-13_1_517" fill="white">
+<path d="M457 0H507V36H457V0Z"/>
+</mask>
+<path d="M457 0H507V36H457V0Z" fill="white" fill-opacity="0.01"/>
+<path d="M457 0V-1H456V0H457ZM457 1H507V-1H457V1ZM458 36V0H456V36H458Z" fill="black" mask="url(#path-27-inside-13_1_517)"/>
+<mask id="path-29-inside-14_1_517" fill="white">
+<path d="M457 36H507V72H457V36Z"/>
+</mask>
+<path d="M457 36H507V72H457V36Z" fill="white" fill-opacity="0.01"/>
+<path d="M457 36V35H456V36H457ZM457 37H507V35H457V37ZM458 72V36H456V72H458Z" fill="black" mask="url(#path-29-inside-14_1_517)"/>
+<mask id="path-31-inside-15_1_517" fill="white">
+<path d="M457 72H507V108H457V72Z"/>
+</mask>
+<path d="M457 72H507V108H457V72Z" fill="white" fill-opacity="0.01"/>
+<path d="M457 72V71H456V72H457ZM457 73H507V71H457V73ZM458 108V72H456V108H458Z" fill="black" mask="url(#path-31-inside-15_1_517)"/>
+<mask id="path-33-inside-16_1_517" fill="white">
+<path d="M457 108H507V144H457V108Z"/>
+</mask>
+<path d="M457 108H507V144H457V108Z" fill="white" fill-opacity="0.01"/>
+<path d="M457 108V107H456V108H457ZM457 109H507V107H457V109ZM458 144V108H456V144H458Z" fill="black" mask="url(#path-33-inside-16_1_517)"/>
+</g>
+</g>
+<rect x="308.5" y="1.5" width="197" height="141" rx="6.5" stroke="#484848" stroke-width="3"/>
+<g clip-path="url(#clip5_1_517)">
+<rect width="150" height="144" rx="8" fill="white"/>
+<g clip-path="url(#clip6_1_517)">
+<rect width="150" height="36" fill="white" fill-opacity="0.01"/>
+<mask id="path-37-inside-17_1_517" fill="white">
+<path d="M0 0H50V36H0V0Z"/>
+</mask>
+<path d="M0 0H50V36H0V0Z" fill="white" fill-opacity="0.01"/>
+<path d="M0 0V-1H-2V0H0ZM0 1H50V-1H0V1ZM2 36V0H-2V36H2Z" fill="black" mask="url(#path-37-inside-17_1_517)"/>
+<mask id="path-39-inside-18_1_517" fill="white">
+<path d="M50 0H100V36H50V0Z"/>
+</mask>
+<path d="M50 0H100V36H50V0Z" fill="white" fill-opacity="0.01"/>
+<path d="M50 0V-1H49V0H50ZM50 1H100V-1H50V1ZM51 36V0H49V36H51Z" fill="black" mask="url(#path-39-inside-18_1_517)"/>
+<mask id="path-41-inside-19_1_517" fill="white">
+<path d="M100 0H150V36H100V0Z"/>
+</mask>
+<path d="M100 0H150V36H100V0Z" fill="white" fill-opacity="0.01"/>
+<path d="M100 0V-1H99V0H100ZM100 1H150V-1H100V1ZM101 36V0H99V36H101Z" fill="black" mask="url(#path-41-inside-19_1_517)"/>
+</g>
+<g clip-path="url(#clip7_1_517)">
+<rect width="150" height="36" transform="translate(0 36)" fill="white" fill-opacity="0.01"/>
+<mask id="path-43-inside-20_1_517" fill="white">
+<path d="M0 36H50V72H0V36Z"/>
+</mask>
+<path d="M0 36H50V72H0V36Z" fill="white" fill-opacity="0.01"/>
+<path d="M0 36V35H-2V36H0ZM0 37H50V35H0V37ZM2 72V36H-2V72H2Z" fill="black" mask="url(#path-43-inside-20_1_517)"/>
+<mask id="path-45-inside-21_1_517" fill="white">
+<path d="M50 36H100V72H50V36Z"/>
+</mask>
+<path d="M50 36H100V72H50V36Z" fill="white" fill-opacity="0.01"/>
+<path d="M50 36V35H49V36H50ZM50 37H100V35H50V37ZM51 72V36H49V72H51Z" fill="black" mask="url(#path-45-inside-21_1_517)"/>
+<mask id="path-47-inside-22_1_517" fill="white">
+<path d="M100 36H150V72H100V36Z"/>
+</mask>
+<path d="M100 36H150V72H100V36Z" fill="white" fill-opacity="0.01"/>
+<path d="M100 36V35H99V36H100ZM100 37H150V35H100V37ZM101 72V36H99V72H101Z" fill="black" mask="url(#path-47-inside-22_1_517)"/>
+</g>
+<g clip-path="url(#clip8_1_517)">
+<rect width="150" height="36" transform="translate(0 72)" fill="white" fill-opacity="0.01"/>
+<mask id="path-49-inside-23_1_517" fill="white">
+<path d="M0 72H50V108H0V72Z"/>
+</mask>
+<path d="M0 72H50V108H0V72Z" fill="white" fill-opacity="0.01"/>
+<path d="M0 72V71H-2V72H0ZM0 73H50V71H0V73ZM2 108V72H-2V108H2Z" fill="black" mask="url(#path-49-inside-23_1_517)"/>
+<mask id="path-51-inside-24_1_517" fill="white">
+<path d="M50 72H100V108H50V72Z"/>
+</mask>
+<path d="M50 72H100V108H50V72Z" fill="white" fill-opacity="0.01"/>
+<path d="M50 72V71H49V72H50ZM50 73H100V71H50V73ZM51 108V72H49V108H51Z" fill="black" mask="url(#path-51-inside-24_1_517)"/>
+<mask id="path-53-inside-25_1_517" fill="white">
+<path d="M100 72H150V108H100V72Z"/>
+</mask>
+<path d="M100 72H150V108H100V72Z" fill="white" fill-opacity="0.01"/>
+<path d="M100 72V71H99V72H100ZM100 73H150V71H100V73ZM101 108V72H99V108H101Z" fill="black" mask="url(#path-53-inside-25_1_517)"/>
+</g>
+<g clip-path="url(#clip9_1_517)">
+<rect width="150" height="36" transform="translate(0 108)" fill="white" fill-opacity="0.01"/>
+<mask id="path-55-inside-26_1_517" fill="white">
+<path d="M0 108H50V144H0V108Z"/>
+</mask>
+<path d="M0 108H50V144H0V108Z" fill="white" fill-opacity="0.01"/>
+<path d="M0 108V107H-2V108H0ZM0 109H50V107H0V109ZM2 144V108H-2V144H2Z" fill="black" mask="url(#path-55-inside-26_1_517)"/>
+<mask id="path-57-inside-27_1_517" fill="white">
+<path d="M50 108H100V144H50V108Z"/>
+</mask>
+<path d="M50 108H100V144H50V108Z" fill="white" fill-opacity="0.01"/>
+<path d="M50 108V107H49V108H50ZM50 109H100V107H50V109ZM51 144V108H49V144H51Z" fill="black" mask="url(#path-57-inside-27_1_517)"/>
+<mask id="path-59-inside-28_1_517" fill="white">
+<path d="M100 108H150V144H100V108Z"/>
+</mask>
+<path d="M100 108H150V144H100V108Z" fill="white" fill-opacity="0.01"/>
+<path d="M100 108V107H99V108H100ZM100 109H150V107H100V109ZM101 144V108H99V144H101Z" fill="black" mask="url(#path-59-inside-28_1_517)"/>
+</g>
+</g>
+<rect x="1.5" y="1.5" width="147" height="141" rx="6.5" stroke="#484848" stroke-width="3"/>
+<path d="M288.233 74.2348C289.744 73.5536 290.416 71.7771 289.735 70.2667L278.635 45.6538C277.954 44.1435 276.177 43.4713 274.667 44.1524C273.156 44.8335 272.484 46.6101 273.165 48.1205L283.032 69.9986L261.154 79.8651C259.643 80.5463 258.971 82.3229 259.652 83.8332C260.334 85.3436 262.11 86.0158 263.62 85.3347L288.233 74.2348ZM171.202 74.2485C202.387 60.6052 249.566 60.5433 285.938 74.3059L288.062 68.6942C250.434 54.4566 201.613 54.3948 168.798 68.7515L171.202 74.2485Z" fill="#484848"/>
+<defs>
+<clipPath id="clip0_1_517">
+<rect x="307" width="200" height="144" rx="8" fill="white"/>
+</clipPath>
+<clipPath id="clip1_1_517">
+<rect width="50" height="144" fill="white" transform="translate(307)"/>
+</clipPath>
+<clipPath id="clip2_1_517">
+<rect width="50" height="144" fill="white" transform="translate(357)"/>
+</clipPath>
+<clipPath id="clip3_1_517">
+<rect width="50" height="144" fill="white" transform="translate(407)"/>
+</clipPath>
+<clipPath id="clip4_1_517">
+<rect width="50" height="144" fill="white" transform="translate(457)"/>
+</clipPath>
+<clipPath id="clip5_1_517">
+<rect width="150" height="144" rx="8" fill="white"/>
+</clipPath>
+<clipPath id="clip6_1_517">
+<rect width="150" height="36" fill="white"/>
+</clipPath>
+<clipPath id="clip7_1_517">
+<rect width="150" height="36" fill="white" transform="translate(0 36)"/>
+</clipPath>
+<clipPath id="clip8_1_517">
+<rect width="150" height="36" fill="white" transform="translate(0 72)"/>
+</clipPath>
+<clipPath id="clip9_1_517">
+<rect width="150" height="36" fill="white" transform="translate(0 108)"/>
+</clipPath>
+</defs>
+</svg>

docs/reference/images/esql/source-command.svg

@@ -0,0 +1,109 @@
+<svg width="389" height="144" viewBox="0 0 389 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_1_517)">
+<rect x="239" width="150" height="144" rx="8" fill="white"/>
+<g clip-path="url(#clip1_1_517)">
+<rect width="150" height="36" transform="translate(239)" fill="white" fill-opacity="0.01"/>
+<mask id="path-3-inside-1_1_517" fill="white">
+<path d="M239 0H289V36H239V0Z"/>
+</mask>
+<path d="M239 0H289V36H239V0Z" fill="white" fill-opacity="0.01"/>
+<path d="M239 0V-1H237V0H239ZM239 1H289V-1H239V1ZM241 36V0H237V36H241Z" fill="black" mask="url(#path-3-inside-1_1_517)"/>
+<mask id="path-5-inside-2_1_517" fill="white">
+<path d="M289 0H339V36H289V0Z"/>
+</mask>
+<path d="M289 0H339V36H289V0Z" fill="white" fill-opacity="0.01"/>
+<path d="M289 0V-1H288V0H289ZM289 1H339V-1H289V1ZM290 36V0H288V36H290Z" fill="black" mask="url(#path-5-inside-2_1_517)"/>
+<mask id="path-7-inside-3_1_517" fill="white">
+<path d="M339 0H389V36H339V0Z"/>
+</mask>
+<path d="M339 0H389V36H339V0Z" fill="white" fill-opacity="0.01"/>
+<path d="M339 0V-1H338V0H339ZM339 1H389V-1H339V1ZM340 36V0H338V36H340Z" fill="black" mask="url(#path-7-inside-3_1_517)"/>
+</g>
+<g clip-path="url(#clip2_1_517)">
+<rect width="150" height="36" transform="translate(239 36)" fill="white" fill-opacity="0.01"/>
+<mask id="path-9-inside-4_1_517" fill="white">
+<path d="M239 36H289V72H239V36Z"/>
+</mask>
+<path d="M239 36H289V72H239V36Z" fill="white" fill-opacity="0.01"/>
+<path d="M239 36V35H237V36H239ZM239 37H289V35H239V37ZM241 72V36H237V72H241Z" fill="black" mask="url(#path-9-inside-4_1_517)"/>
+<mask id="path-11-inside-5_1_517" fill="white">
+<path d="M289 36H339V72H289V36Z"/>
+</mask>
+<path d="M289 36H339V72H289V36Z" fill="white" fill-opacity="0.01"/>
+<path d="M289 36V35H288V36H289ZM289 37H339V35H289V37ZM290 72V36H288V72H290Z" fill="black" mask="url(#path-11-inside-5_1_517)"/>
+<mask id="path-13-inside-6_1_517" fill="white">
+<path d="M339 36H389V72H339V36Z"/>
+</mask>
+<path d="M339 36H389V72H339V36Z" fill="white" fill-opacity="0.01"/>
+<path d="M339 36V35H338V36H339ZM339 37H389V35H339V37ZM340 72V36H338V72H340Z" fill="black" mask="url(#path-13-inside-6_1_517)"/>
+</g>
+<g clip-path="url(#clip3_1_517)">
+<rect width="150" height="36" transform="translate(239 72)" fill="white" fill-opacity="0.01"/>
+<mask id="path-15-inside-7_1_517" fill="white">
+<path d="M239 72H289V108H239V72Z"/>
+</mask>
+<path d="M239 72H289V108H239V72Z" fill="white" fill-opacity="0.01"/>
+<path d="M239 72V71H237V72H239ZM239 73H289V71H239V73ZM241 108V72H237V108H241Z" fill="black" mask="url(#path-15-inside-7_1_517)"/>
+<mask id="path-17-inside-8_1_517" fill="white">
+<path d="M289 72H339V108H289V72Z"/>
+</mask>
+<path d="M289 72H339V108H289V72Z" fill="white" fill-opacity="0.01"/>
+<path d="M289 72V71H288V72H289ZM289 73H339V71H289V73ZM290 108V72H288V108H290Z" fill="black" mask="url(#path-17-inside-8_1_517)"/>
+<mask id="path-19-inside-9_1_517" fill="white">
+<path d="M339 72H389V108H339V72Z"/>
+</mask>
+<path d="M339 72H389V108H339V72Z" fill="white" fill-opacity="0.01"/>
+<path d="M339 72V71H338V72H339ZM339 73H389V71H339V73ZM340 108V72H338V108H340Z" fill="black" mask="url(#path-19-inside-9_1_517)"/>
+</g>
+<g clip-path="url(#clip4_1_517)">
+<rect width="150" height="36" transform="translate(239 108)" fill="white" fill-opacity="0.01"/>
+<mask id="path-21-inside-10_1_517" fill="white">
+<path d="M239 108H289V144H239V108Z"/>
+</mask>
+<path d="M239 108H289V144H239V108Z" fill="white" fill-opacity="0.01"/>
+<path d="M239 108V107H237V108H239ZM239 109H289V107H239V109ZM241 144V108H237V144H241Z" fill="black" mask="url(#path-21-inside-10_1_517)"/>
+<mask id="path-23-inside-11_1_517" fill="white">
+<path d="M289 108H339V144H289V108Z"/>
+</mask>
+<path d="M289 108H339V144H289V108Z" fill="white" fill-opacity="0.01"/>
+<path d="M289 108V107H288V108H289ZM289 109H339V107H289V109ZM290 144V108H288V144H290Z" fill="black" mask="url(#path-23-inside-11_1_517)"/>
+<mask id="path-25-inside-12_1_517" fill="white">
+<path d="M339 108H389V144H339V108Z"/>
+</mask>
+<path d="M339 108H389V144H339V108Z" fill="white" fill-opacity="0.01"/>
+<path d="M339 108V107H338V108H339ZM339 109H389V107H339V109ZM340 144V108H338V144H340Z" fill="black" mask="url(#path-25-inside-12_1_517)"/>
+</g>
+</g>
+<rect x="240.5" y="1.5" width="147" height="141" rx="6.5" stroke="#484848" stroke-width="3"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M2.5625 72.001C2.5625 75.5475 3.05962 78.9685 3.90525 82.251H53.8125C59.4731 82.251 64.0625 77.6616 64.0625 72.001C64.0625 66.3379 59.4731 61.751 53.8125 61.751H3.90525C3.05962 65.031 2.5625 68.4545 2.5625 72.001Z" fill="#343741"/>
+<mask id="mask0_1_517" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="6" y="31" width="70" height="24">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M6.77472 31.0013H75.5399V54.0638H6.77472V31.0013Z" fill="white"/>
+</mask>
+<g mask="url(#mask0_1_517)">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M71.5547 50.6326C72.9872 49.3129 74.3197 47.8958 75.542 46.3763C68.0262 37.0103 56.5026 31.0013 43.562 31.0013C27.3644 31.0013 13.4244 40.4236 6.77472 54.0638H62.8089C66.053 54.0638 69.1716 52.8312 71.5547 50.6326Z" fill="#FEC514"/>
+</g>
+<mask id="mask1_1_517" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="6" y="89" width="70" height="24">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M6.77448 89.9385H75.5399V113H6.77448V89.9385Z" fill="white"/>
+</mask>
+<g mask="url(#mask1_1_517)">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M62.8087 89.9385H6.77448C13.4267 103.576 27.3642 113.001 43.5617 113.001C56.5023 113.001 68.0259 106.989 75.5417 97.626C74.3194 96.1039 72.9869 94.6868 71.5545 93.3671C69.1714 91.166 66.0528 89.9385 62.8087 89.9385Z" fill="#00BFB3"/>
+</g>
+<path d="M220.233 74.2348C221.744 73.5536 222.416 71.7771 221.735 70.2667L210.635 45.6538C209.954 44.1435 208.177 43.4713 206.667 44.1524C205.156 44.8335 204.484 46.6101 205.165 48.1205L215.032 69.9986L193.154 79.8651C191.643 80.5463 190.971 82.3229 191.652 83.8332C192.334 85.3436 194.11 86.0158 195.62 85.3347L220.233 74.2348ZM103.202 74.2485C134.387 60.6052 181.566 60.5433 217.938 74.3059L220.062 68.6942C182.434 54.4566 133.613 54.3948 100.798 68.7515L103.202 74.2485Z" fill="#484848"/>
+<defs>
+<clipPath id="clip0_1_517">
+<rect x="239" width="150" height="144" rx="8" fill="white"/>
+</clipPath>
+<clipPath id="clip1_1_517">
+<rect width="150" height="36" fill="white" transform="translate(239)"/>
+</clipPath>
+<clipPath id="clip2_1_517">
+<rect width="150" height="36" fill="white" transform="translate(239 36)"/>
+</clipPath>
+<clipPath id="clip3_1_517">
+<rect width="150" height="36" fill="white" transform="translate(239 72)"/>
+</clipPath>
+<clipPath id="clip4_1_517">
+<rect width="150" height="36" fill="white" transform="translate(239 108)"/>
+</clipPath>
+</defs>
+</svg>