Align big5 ppl queries to dsl

[noCharger]

Description

Align source ppl query to big5 dsl used for benchmark. Verified query results are the same between PPL and DSL on modified queries in this PR, besides issues identified:

• multi_terms_keyword query returns different results from dsl because it converts to composite agg instead of multi_terms agg. Track [FEATURE] PPL should support terms aggregation with multiple buckets #4208
• auto_date_histogram queries return different results from dsl because it converts to composite agg instead of auto_date_histogram agg. Track [FEATURE] Span() / bin should support auto_date_histogram aggregation #4210
• Big5 range queries always returns 0 hits for both PPL and DSL. Track: [BUG] Big5 range queries returns 0 hits opensearch-benchmark-workloads#692

DSL https://github.com/opensearch-project/opensearch-benchmark-workloads/blob/main/big5/operations/default.json

Related Issues

opensearch-project/opensearch-benchmark-workloads#691

Check List

• New functionality includes testing.
  - [ ] New functionality has been documented.
  - [ ] New functionality has javadoc added.
  - [ ] New functionality has a user manual doc added.
  - [ ] New PPL command checklist all confirmed.
  - [ ] API changes companion pull request created.
• Commits are signed per the DCO using --signoff or -s.
  - [ ] Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[penghuo]

{
  "size": 0,
  "query": {
    "range": {
      "@timestamp": {
        "gte": "2022-12-30T00:00:00",
        "lt": "2023-01-01T03:00:00"
      }
    }
  },
  "aggs": {
    "important_terms": {
      "multi_terms": {
        "terms": [
          {
            "field": "process.name"
          },
          {
            "field": "event.id"
          },
          {
            "field": "cloud.region"
          }
        ]
      }
    }
  }
}

This correspond DSL query to PPL. Why change timerange?

[penghuo]

https://github.com/opensearch-project/opensearch-benchmark-workloads/blob/main/big5/queries/range_field_conjunction_big_range_big_term_query.json

[LantaoJin]

Looks like there are difference sources of Big5 DSL. The original PPL was translated from the DSL listed above. But @noCharger seems find another source of Big5 DSL.

[noCharger]

@penghuo @LantaoJin The actual benchmark queries are defined https://github.com/opensearch-project/opensearch-benchmark-workloads/blob/main/big5/operations/default.json, and invoked here https://github.com/opensearch-project/opensearch-benchmark-workloads/blob/main/big5/test_procedures/default.json#L8. Hence we need to align the queries.

[LantaoJin]

Fix https://github.com/opensearch-project/opensearch-benchmark-workloads/blob/2fbd2c7a96a3844bf41c12799e28bc539739d609/big5/operations/ppl.json#L178?

[LantaoJin]

@noCharger can you call out the true source of DSL in the description? Seems there are some different in benchmark repo. So we should call out the source we aligned.

[noCharger]

@noCharger can you call out the true source of DSL in the description? Seems there are some different in benchmark repo. So we should call out the source we aligned.

Yes it's already in description.

[opensearch-trigger-bot]

This PR is stalled because it has been open for 30 days with no activity.

[penghuo]

@noCharger resolve conflict

[noCharger]

@noCharger resolve conflict

@penghuo 7ee09ce

[opensearch-trigger-bot]

This PR is stalled because it has been open for 2 weeks with no activity.

[RyanL1997]

closiing due to #4668