From ff05bffc9b5e5c86419531b622b9e42f88d77f58 Mon Sep 17 00:00:00 2001 From: Quynh Nguyen Date: Fri, 8 Aug 2025 18:36:58 -0500 Subject: [PATCH 1/2] Fix lookup joint --- .../inference/server/tasks/nl_to_esql/doc_base/aliases.ts | 2 +- .../server/tasks/nl_to_esql/doc_base/esql_doc_base.ts | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/x-pack/platform/plugins/shared/inference/server/tasks/nl_to_esql/doc_base/aliases.ts b/x-pack/platform/plugins/shared/inference/server/tasks/nl_to_esql/doc_base/aliases.ts index 78fe8b7f9549f..d797815012640 100644 --- a/x-pack/platform/plugins/shared/inference/server/tasks/nl_to_esql/doc_base/aliases.ts +++ b/x-pack/platform/plugins/shared/inference/server/tasks/nl_to_esql/doc_base/aliases.ts @@ -12,7 +12,7 @@ const aliases: Record = { STATS: ['STATS_BY', 'BY', 'STATS...BY', 'STATS ... BY'], OPERATORS: ['LIKE', 'RLIKE', 'IN'], - JOIN: ['LOOKUP JOIN'], + LOOKUP_JOIN: ['LOOKUPJOIN'], }; const getAliasMap = () => { diff --git a/x-pack/platform/plugins/shared/inference/server/tasks/nl_to_esql/doc_base/esql_doc_base.ts b/x-pack/platform/plugins/shared/inference/server/tasks/nl_to_esql/doc_base/esql_doc_base.ts index ce7cabcdc120e..4ce8517878da9 100644 --- a/x-pack/platform/plugins/shared/inference/server/tasks/nl_to_esql/doc_base/esql_doc_base.ts +++ b/x-pack/platform/plugins/shared/inference/server/tasks/nl_to_esql/doc_base/esql_doc_base.ts @@ -43,8 +43,7 @@ export class EsqlDocumentBase { }: GetDocsOptions = {} ) { const keywords = rawKeywords.map((raw) => { - // LOOKUP JOIN has space so we want to retain as is - let keyword = raw.toLowerCase().includes('join') ? raw : format(raw); + let keyword = format(raw); if (resolveAliases) { keyword = tryResolveAlias(keyword); } From d908399b4ff0cef6b3b66515f9f0206a45f9ba8a Mon Sep 17 00:00:00 2001 From: Quynh Nguyen Date: Tue, 12 Aug 2025 13:53:55 -0500 Subject: [PATCH 2/2] Readd tests --- .../evals/esql/esql.spec.ts | 34 +++++++++---------- .../evaluation/scenarios/esql/index.spec.ts | 6 ++-- 2 files changed, 18 insertions(+), 22 deletions(-) diff --git a/x-pack/solutions/observability/packages/kbn-evals-suite-obs-ai-assistant/evals/esql/esql.spec.ts b/x-pack/solutions/observability/packages/kbn-evals-suite-obs-ai-assistant/evals/esql/esql.spec.ts index 8b44a3503ad53..b09bc411f4a78 100644 --- a/x-pack/solutions/observability/packages/kbn-evals-suite-obs-ai-assistant/evals/esql/esql.spec.ts +++ b/x-pack/solutions/observability/packages/kbn-evals-suite-obs-ai-assistant/evals/esql/esql.spec.ts @@ -740,23 +740,21 @@ evaluate.describe('ES|QL query generation', { tag: '@svlOblt' }, () => { }, metadata: {}, }, - // This results in a timeout because the NL-to-ESQL tasks goes into a loop - // See trace: https://35-187-109-62.sslip.io/projects/UHJvamVjdDo5/traces/630f92adcb3620295794180f71ccb37a?selectedSpanNodeId=U3BhbjozODYxNTQ%3D - // { - // input: { - // question: - // "Assume user login data is logs-auth_service-*. The event action for user login is `login`. Generate an example query to fetch successful logins today and for each successful login, show the user's full name and department. The user meta data is in the users_metadata index.", - // }, - // output: { - // expected: `FROM logs-auth_service-* - // | WHERE @timestamp >= NOW() - 1 day AND event.action == "login" - // | LOOKUP JOIN users_metadata ON user.id - // | KEEP @timestamp, user.id, full_name, department - // | LIMIT 20`, - // execute: false, - // }, - // metadata: {}, - // }, + { + input: { + question: + "Assume user login data is logs-auth_service-*. The event action for user login is `login`. Generate an example query to fetch successful logins today and for each successful login, show the user's full name and department. The user meta data is in the users_metadata index.", + }, + output: { + expected: `FROM logs-auth_service-* + | WHERE @timestamp >= NOW() - 1 day AND event.action == "login" + | LOOKUP JOIN users_metadata ON user.id + | KEEP @timestamp, user.id, full_name, department + | LIMIT 20`, + execute: false, + }, + metadata: {}, + }, ], }, }); @@ -979,7 +977,7 @@ evaluate.describe('ES|QL query generation', { tag: '@svlOblt' }, () => { expected: [ `FROM main | WHERE user_id IN (FROM suspicious_users | KEEP user_id)`, - `FROM main + `FROM main | LOOKUP JOIN suspicious_users ON user_id`, ], execute: false, diff --git a/x-pack/solutions/observability/plugins/observability_ai_assistant_app/scripts/evaluation/scenarios/esql/index.spec.ts b/x-pack/solutions/observability/plugins/observability_ai_assistant_app/scripts/evaluation/scenarios/esql/index.spec.ts index cebbd607727d4..3801b3873e8a8 100644 --- a/x-pack/solutions/observability/plugins/observability_ai_assistant_app/scripts/evaluation/scenarios/esql/index.spec.ts +++ b/x-pack/solutions/observability/plugins/observability_ai_assistant_app/scripts/evaluation/scenarios/esql/index.spec.ts @@ -667,9 +667,7 @@ describe('ES|QL query generation', () => { }); }); - // This works on the Kibana UI but times out via the /chat/complete API - // See trace: https://35-187-109-62.sslip.io/projects/UHJvamVjdDo5/traces/630f92adcb3620295794180f71ccb37a?selectedSpanNodeId=U3BhbjozODYxNTQ%3D - it.skip('enriches login logs with user metadata using a lookup join', async () => { + it('enriches login logs with user metadata using a lookup join', async () => { await evaluateEsqlQuery({ question: "Assume user login data is logs-auth_service-*. The event action for user login is `login`. Generate an example query to fetch successful logins today and for each successful login, show the user's full name and department. The user meta data is in the users_metadata index.", @@ -868,7 +866,7 @@ describe('ES|QL query generation', () => { expected: [ `FROM main | WHERE user_id IN (FROM suspicious_users | KEEP user_id)`, - `FROM main + `FROM main | LOOKUP JOIN suspicious_users ON user_id`, ], execute: false,