|
|
@@ -8,40 +8,67 @@
|
|
|
|
|
|
preview::[]
|
|
|
|
|
|
-The {es} Query Language ({esql}) provides a powerful way to filter, transform, and analyze data stored in {es}, and in the future in other runtimes.
|
|
|
-It is designed to be easy to learn and use, by end users, SRE teams, application developers, and administrators.
|
|
|
+The {es} Query Language ({esql}) provides a powerful way to filter, transform,
|
|
|
+and analyze data stored in {es}, and in the future in other runtimes. It is
|
|
|
+designed to be easy to learn and use, by end users, SRE teams, application
|
|
|
+developers, and administrators.
|
|
|
|
|
|
-Users can author {esql} queries to find specific events, perform statistical analysis, and generate visualizations.
|
|
|
-It supports a wide range of commands and functions that enable users to perform various data operations,
|
|
|
-such as filtering, aggregation, time-series analysis, and more.
|
|
|
+Users can author {esql} queries to find specific events, perform statistical
|
|
|
+analysis, and generate visualizations. It supports a wide range of commands and
|
|
|
+functions that enable users to perform various data operations, such as
|
|
|
+filtering, aggregation, time-series analysis, and more.
|
|
|
|
|
|
-The {es} Query Language ({esql}) makes use of "pipes" (|) to manipulate and transform data in a step-by-step fashion.
|
|
|
-This approach allows users to compose a series of operations, where the output of one operation becomes the input for the next,
|
|
|
-enabling complex data transformations and analysis.
|
|
|
+The {es} Query Language ({esql}) makes use of "pipes" (|) to manipulate and
|
|
|
+transform data in a step-by-step fashion. This approach allows users to compose
|
|
|
+a series of operations, where the output of one operation becomes the input for
|
|
|
+the next, enabling complex data transformations and analysis.
|
|
|
|
|
|
[discrete]
|
|
|
=== The {esql} Compute Engine
|
|
|
|
|
|
-{esql} is more than a language: it represents a significant investment in new compute capabilities within {es}.
|
|
|
-To achieve both the functional and performance requirements for {esql}, it was necessary to build an entirely new
|
|
|
-compute architecture. {esql} search, aggregation, and transformation functions are directly executed within Elasticsearch
|
|
|
-itself. Query expressions are not transpiled to Query DSL for execution. This approach allows {esql} to be extremely performant and versatile.
|
|
|
+{esql} is more than a language: it represents a significant investment in new
|
|
|
+compute capabilities within {es}. To achieve both the functional and performance
|
|
|
+requirements for {esql}, it was necessary to build an entirely new compute
|
|
|
+architecture. {esql} search, aggregation, and transformation functions are
|
|
|
+directly executed within Elasticsearch itself. Query expressions are not
|
|
|
+transpiled to Query DSL for execution. This approach allows {esql} to be
|
|
|
+extremely performant and versatile.
|
|
|
|
|
|
-The new {esql} execution engine was designed with performance in mind — it operates on blocks at a time instead of per row, targets vectorization and cache locality, and embraces specialization and multi-threading. It is a separate component from the existing Elasticsearch aggregation framework with different performance characteristics.
|
|
|
+The new {esql} execution engine was designed with performance in mind — it
|
|
|
+operates on blocks at a time instead of per row, targets vectorization and cache
|
|
|
+locality, and embraces specialization and multi-threading. It is a separate
|
|
|
+component from the existing Elasticsearch aggregation framework with different
|
|
|
+performance characteristics.
|
|
|
|
|
|
-include::esql-get-started.asciidoc[]
|
|
|
+The {esql} documentation is organized in these sections:
|
|
|
|
|
|
-include::esql-language.asciidoc[]
|
|
|
+<<esql-getting-started>>::
|
|
|
+A tutorial to help you get started with {esql}.
|
|
|
+
|
|
|
+<<esql-language>>::
|
|
|
+
|
|
|
+Reference documentation for the <<esql-syntax,{esql} syntax>>,
|
|
|
+<<esql-commands,commands>>, and <<esql-functions-operators,functions and
|
|
|
+operators>>. Information about working with <<esql-metadata-fields,metadata
|
|
|
+fields>> and <<esql-multivalued-fields,multivalued fields>>. And guidance for
|
|
|
+<<esql-process-data-with-dissect-and-grok,data processing with DISSECT and
|
|
|
+GROK>> and <<esql-enrich-data,data enrichment with ENRICH>>.
|
|
|
|
|
|
-include::esql-rest.asciidoc[]
|
|
|
+<<esql-using>>::
|
|
|
+An overview of using the <<esql-rest>>, <<esql-kibana>>, and
|
|
|
+<<esql-task-management>>.
|
|
|
|
|
|
-include::metadata-fields.asciidoc[]
|
|
|
+<<esql-limitations>>::
|
|
|
+The current limitations of {esql}.
|
|
|
|
|
|
-include::esql-kibana.asciidoc[]
|
|
|
+<<esql-examples>>::
|
|
|
+A few examples of what you can with {esql}.
|
|
|
|
|
|
-include::task-management.asciidoc[]
|
|
|
+include::esql-get-started.asciidoc[]
|
|
|
+
|
|
|
+include::esql-language.asciidoc[]
|
|
|
|
|
|
-include::esql-enrich-data.asciidoc[]
|
|
|
+include::esql-using.asciidoc[]
|
|
|
|
|
|
include::esql-limitations.asciidoc[]
|
|
|
|
Abdon Pijpelink