diff --git a/docs/category.json b/docs/category.json index eb71a1a9576..aed8a9c8d67 100644 --- a/docs/category.json +++ b/docs/category.json @@ -7,35 +7,9 @@ "user/admin/settings.rst" ], "ppl_cli": [ - "user/ppl/cmd/ad.rst", - "user/ppl/cmd/dedup.rst", - "user/ppl/cmd/describe.rst", - "user/ppl/cmd/showdatasources.rst", - "user/ppl/cmd/eval.rst", - "user/ppl/cmd/fillnull.rst", "user/ppl/cmd/grok.rst", - "user/ppl/cmd/head.rst", "user/ppl/cmd/parse.rst", - "user/ppl/cmd/patterns.rst", - "user/ppl/cmd/rare.rst", - "user/ppl/cmd/search.rst", - "user/ppl/cmd/sort.rst", - "user/ppl/cmd/syntax.rst", - "user/ppl/cmd/trendline.rst", - "user/ppl/cmd/top.rst", - "user/ppl/cmd/where.rst", - "user/ppl/cmd/join.rst", - "user/ppl/cmd/lookup.rst", - "user/ppl/cmd/subquery.rst", - "user/ppl/general/identifiers.rst", - "user/ppl/general/datatypes.rst", - "user/ppl/functions/datetime.rst", - "user/ppl/functions/expressions.rst", - "user/ppl/functions/ip.rst", - "user/ppl/functions/json.rst", - "user/ppl/functions/math.rst", - "user/ppl/functions/relevance.rst", - "user/ppl/functions/string.rst" + "user/ppl/cmd/patterns.rst" ], "sql_cli": [ "user/dql/expressions.rst", @@ -52,16 +26,41 @@ "user/dql/metadata.rst" ], "ppl_cli_calcite": [ + "user/ppl/cmd/ad.rst", "user/ppl/cmd/append.rst", "user/ppl/cmd/bin.rst", - "user/ppl/functions/condition.rst", + "user/ppl/cmd/dedup.rst", + "user/ppl/cmd/describe.rst", "user/ppl/cmd/eventstats.rst", + "user/ppl/cmd/eval.rst", "user/ppl/cmd/fields.rst", + "user/ppl/cmd/fillnull.rst", + "user/ppl/cmd/head.rst", + "user/ppl/cmd/join.rst", + "user/ppl/cmd/lookup.rst", + "user/ppl/cmd/rare.rst", "user/ppl/cmd/regex.rst", "user/ppl/cmd/rename.rst", "user/ppl/cmd/rex.rst", + "user/ppl/cmd/search.rst", + "user/ppl/cmd/showdatasources.rst", + "user/ppl/cmd/sort.rst", "user/ppl/cmd/stats.rst", + "user/ppl/cmd/subquery.rst", + "user/ppl/cmd/syntax.rst", "user/ppl/cmd/timechart.rst", - "user/ppl/cmd/search.rst" + "user/ppl/cmd/top.rst", + "user/ppl/cmd/trendline.rst", + "user/ppl/cmd/where.rst", + "user/ppl/functions/condition.rst", + "user/ppl/functions/datetime.rst", + "user/ppl/functions/expressions.rst", + "user/ppl/functions/ip.rst", + "user/ppl/functions/json.rst", + "user/ppl/functions/math.rst", + "user/ppl/functions/relevance.rst", + "user/ppl/functions/string.rst", + "user/ppl/general/datatypes.rst", + "user/ppl/general/identifiers.rst" ] } diff --git a/docs/user/ppl/cmd/dedup.rst b/docs/user/ppl/cmd/dedup.rst index d897c6dcdad..264d3b3c9b8 100644 --- a/docs/user/ppl/cmd/dedup.rst +++ b/docs/user/ppl/cmd/dedup.rst @@ -32,7 +32,7 @@ The example show dedup the document with gender field. PPL query:: - os> source=accounts | dedup gender | fields account_number, gender; + os> source=accounts | dedup gender | fields account_number, gender | sort account_number; fetched rows / total rows = 2/2 +----------------+--------+ | account_number | gender | @@ -48,7 +48,7 @@ The example show dedup the document with gender field keep 2 duplication. PPL query:: - os> source=accounts | dedup 2 gender | fields account_number, gender; + os> source=accounts | dedup 2 gender | fields account_number, gender | sort account_number; fetched rows / total rows = 3/3 +----------------+--------+ | account_number | gender | @@ -65,7 +65,7 @@ The example show dedup the document by keep null value field. PPL query:: - os> source=accounts | dedup email keepempty=true | fields account_number, email; + os> source=accounts | dedup email keepempty=true | fields account_number, email | sort account_number; fetched rows / total rows = 4/4 +----------------+-----------------------+ | account_number | email | @@ -81,7 +81,7 @@ The example show dedup the document by ignore the empty value field. PPL query:: - os> source=accounts | dedup email | fields account_number, email; + os> source=accounts | dedup email | fields account_number, email | sort account_number; fetched rows / total rows = 3/3 +----------------+-----------------------+ | account_number | email | @@ -99,7 +99,7 @@ The example show dedup the consecutive document. PPL query:: - os> source=accounts | dedup gender consecutive=true | fields account_number, gender; + os> source=accounts | dedup gender consecutive=true | fields account_number, gender | sort account_number; fetched rows / total rows = 3/3 +----------------+--------+ | account_number | gender | diff --git a/docs/user/ppl/cmd/join.rst b/docs/user/ppl/cmd/join.rst index 90f978d056c..92244f97f69 100644 --- a/docs/user/ppl/cmd/join.rst +++ b/docs/user/ppl/cmd/join.rst @@ -99,7 +99,7 @@ Example 1: Two indices join PPL query:: - PPL> source = state_country | inner join left=a right=b ON a.name = b.name occupation | stats avg(salary) by span(age, 10) as age_span, b.country; + os> source = state_country | inner join left=a right=b ON a.name = b.name occupation | stats avg(salary) by span(age, 10) as age_span, b.country; fetched rows / total rows = 5/5 +-------------+----------+-----------+ | avg(salary) | age_span | b.country | @@ -116,17 +116,8 @@ Example 2: Join with subsearch PPL query:: - PPL> source = state_country as a - | where country = 'USA' OR country = 'England' - | left join ON a.name = b.name [ - source = occupation - | where salary > 0 - | fields name, country, salary - | sort salary - | head 3 - ] as b - | stats avg(salary) by span(age, 10) as age_span, b.country; - fetched rows / total rows = 5/5 + PPL> source = state_country as a | where country = 'USA' OR country = 'England' | left join ON a.name = b.name [ source = occupation | where salary > 0 | fields name, country, salary | sort salary | head 3 ] as b | stats avg(salary) by span(age, 10) as age_span, b.country; + fetched rows / total rows = 3/3 +-------------+----------+-----------+ | avg(salary) | age_span | b.country | |-------------+----------+-----------| @@ -140,32 +131,23 @@ Example 3: Join with field list PPL query:: - PPL> source = state_country - | where country = 'USA' OR country = 'England' - | join type=left overwrite=true name [ - source = occupation - | where salary > 0 - | fields name, country, salary - | sort salary - | head 3 - ] - | stats avg(salary) by span(age, 10) as age_span, country; - fetched rows / total rows = 5/5 - +-------------+----------+-----------+ - | avg(salary) | age_span | country | - |-------------+----------+-----------| - | null | 40 | null | - | 70000.0 | 30 | USA | - | 100000.0 | 70 | England | - +-------------+----------+-----------+ + PPL> source = state_country | where country = 'USA' OR country = 'England' | join type=left overwrite=true name [ source = occupation | where salary > 0 | fields name, country, salary | sort salary | head 3 ] | stats avg(salary) by span(age, 10) as age_span, country; + fetched rows / total rows = 3/3 + +-------------+----------+---------+ + | avg(salary) | age_span | country | + |-------------+----------+---------| + | null | 40 | null | + | 70000.0 | 30 | USA | + | 100000.0 | 70 | England | + +-------------+----------+---------+ Example 4: Join with options ============================ PPL query:: - PPL> source = state_country | join type=inner overwrite=false max=1 name occupation | stats avg(salary) by span(age, 10) as age_span, country; - fetched rows / total rows = 5/5 + os> source = state_country | join type=inner overwrite=false max=1 name occupation | stats avg(salary) by span(age, 10) as age_span, country; + fetched rows / total rows = 4/4 +-------------+----------+---------+ | avg(salary) | age_span | country | |-------------+----------+---------| diff --git a/docs/user/ppl/cmd/rare.rst b/docs/user/ppl/cmd/rare.rst index ad0202b8e88..8d2011cc1b2 100644 --- a/docs/user/ppl/cmd/rare.rst +++ b/docs/user/ppl/cmd/rare.rst @@ -19,7 +19,7 @@ Syntax ============ rare [by-clause] -rare [rare-options] [by-clause] ``(available from 3.1.0+)`` +rare [rare-options] [by-clause] ``(available from 3.1.0+)`` * field-list: mandatory. comma-delimited list of field names. * by-clause: optional. one or more fields to group the results by. @@ -35,7 +35,7 @@ The example finds least common gender of all the accounts. PPL query:: - os> source=accounts | rare gender; + os> source=accounts | rare showcount=false gender; fetched rows / total rows = 2/2 +--------+ | gender | @@ -52,7 +52,7 @@ The example finds least common age of all the accounts group by gender. PPL query:: - os> source=accounts | rare age by gender; + os> source=accounts | rare showcount=false age by gender; fetched rows / total rows = 4/4 +--------+-----+ | gender | age | diff --git a/docs/user/ppl/cmd/timechart.rst b/docs/user/ppl/cmd/timechart.rst index 7f4bc7a023e..a5708769035 100644 --- a/docs/user/ppl/cmd/timechart.rst +++ b/docs/user/ppl/cmd/timechart.rst @@ -94,17 +94,14 @@ This example counts events for each hour and groups them by host. PPL query:: - PPL> source=events | timechart span=1h count() by host - -Result:: - - +---------------------+--------+-------+ - | @timestamp | host | count | - +---------------------+--------+-------+ - | 2024-07-01 00:00:00 | db-01 | 1 | - | 2024-07-01 00:00:00 | web-01 | 2 | - | 2024-07-01 00:00:00 | web-02 | 2 | - +---------------------+--------+-------+ + os> source=events | timechart span=1h count() by host + fetched rows / total rows = 2/2 + +---------------------+---------+-------+ + | @timestamp | host | count | + |---------------------+---------+-------| + | 2023-01-01 10:00:00 | server1 | 4 | + | 2023-01-01 10:00:00 | server2 | 4 | + +---------------------+---------+-------+ Example 2: Count events by minute with zero-filled results ========================================================== @@ -113,29 +110,28 @@ This example counts events for each minute and groups them by host, showing zero PPL query:: - PPL> source=events | timechart span=1m count() by host - -Result:: - - +---------------------+--------+-------+ - | @timestamp | host | count | - +---------------------+--------+-------+ - | 2024-07-01 00:00:00 | web-01 | 1 | - | 2024-07-01 00:00:00 | web-02 | 0 | - | 2024-07-01 00:00:00 | db-01 | 0 | - | 2024-07-01 00:01:00 | web-01 | 0 | - | 2024-07-01 00:01:00 | web-02 | 1 | - | 2024-07-01 00:01:00 | db-01 | 0 | - | 2024-07-01 00:02:00 | web-01 | 1 | - | 2024-07-01 00:02:00 | web-02 | 0 | - | 2024-07-01 00:02:00 | db-01 | 0 | - | 2024-07-01 00:03:00 | web-01 | 0 | - | 2024-07-01 00:03:00 | web-02 | 0 | - | 2024-07-01 00:03:00 | db-01 | 1 | - | 2024-07-01 00:04:00 | web-01 | 0 | - | 2024-07-01 00:04:00 | web-02 | 1 | - | 2024-07-01 00:04:00 | db-01 | 0 | - +---------------------+--------+-------+ + os> source=events | timechart span=1m count() by host + fetched rows / total rows = 16/16 + +---------------------+---------+-------+ + | @timestamp | host | count | + |---------------------+---------+-------| + | 2023-01-01 10:00:00 | server1 | 1 | + | 2023-01-01 10:00:00 | server2 | 0 | + | 2023-01-01 10:05:00 | server1 | 0 | + | 2023-01-01 10:05:00 | server2 | 1 | + | 2023-01-01 10:10:00 | server1 | 1 | + | 2023-01-01 10:10:00 | server2 | 0 | + | 2023-01-01 10:15:00 | server1 | 0 | + | 2023-01-01 10:15:00 | server2 | 1 | + | 2023-01-01 10:20:00 | server1 | 1 | + | 2023-01-01 10:20:00 | server2 | 0 | + | 2023-01-01 10:25:00 | server1 | 0 | + | 2023-01-01 10:25:00 | server2 | 1 | + | 2023-01-01 10:30:00 | server1 | 1 | + | 2023-01-01 10:30:00 | server2 | 0 | + | 2023-01-01 10:35:00 | server1 | 0 | + | 2023-01-01 10:35:00 | server2 | 1 | + +---------------------+---------+-------+ Example 3: Calculate average CPU usage by minute ================================================ @@ -145,9 +141,7 @@ This example calculates the average CPU usage for each minute without grouping b PPL query:: PPL> source=events | timechart span=1m avg(cpu_usage) - -Result:: - + fetched rows / total rows = 5/5 +---------------------+------------------+ | @timestamp | avg(cpu_usage) | +---------------------+------------------+ @@ -166,9 +160,7 @@ This example calculates the average CPU usage for each second and groups them by PPL query:: PPL> source=events | timechart span=1s avg(cpu_usage) by region - -Result:: - + fetched rows / total rows = 5/5 +---------------------+---------+------------------+ | @timestamp | region | avg(cpu_usage) | +---------------------+---------+------------------+ @@ -187,9 +179,7 @@ This example counts events for each second and groups them by region, showing ze PPL query:: PPL> source=events | timechart span=1s count() by region - -Result:: - + fetched rows / total rows = 15/15 +---------------------+---------+-------+ | @timestamp | region | count | +---------------------+---------+-------+ @@ -218,29 +208,28 @@ This query will display the top 2 hosts with the highest count values, and group PPL query:: - PPL> source=events | timechart span=1m limit=2 count() by host - -Result:: - - +---------------------+--------+-------+ - | @timestamp | host | count | - +---------------------+--------+-------+ - | 2024-07-01 00:00:00 | web-01 | 1 | - | 2024-07-01 00:00:00 | web-02 | 0 | - | 2024-07-01 00:00:00 | OTHER | 0 | - | 2024-07-01 00:01:00 | web-01 | 0 | - | 2024-07-01 00:01:00 | web-02 | 1 | - | 2024-07-01 00:01:00 | OTHER | 0 | - | 2024-07-01 00:02:00 | web-01 | 1 | - | 2024-07-01 00:02:00 | web-02 | 0 | - | 2024-07-01 00:02:00 | OTHER | 0 | - | 2024-07-01 00:03:00 | web-01 | 0 | - | 2024-07-01 00:03:00 | web-02 | 0 | - | 2024-07-01 00:03:00 | OTHER | 1 | - | 2024-07-01 00:04:00 | web-01 | 0 | - | 2024-07-01 00:04:00 | web-02 | 1 | - | 2024-07-01 00:04:00 | OTHER | 0 | - +---------------------+--------+-------+ + os> source=events | timechart span=1m limit=2 count() by host + fetched rows / total rows = 16/16 + +---------------------+---------+-------+ + | @timestamp | host | count | + |---------------------+---------+-------| + | 2023-01-01 10:00:00 | server1 | 1 | + | 2023-01-01 10:00:00 | server2 | 0 | + | 2023-01-01 10:05:00 | server1 | 0 | + | 2023-01-01 10:05:00 | server2 | 1 | + | 2023-01-01 10:10:00 | server1 | 1 | + | 2023-01-01 10:10:00 | server2 | 0 | + | 2023-01-01 10:15:00 | server1 | 0 | + | 2023-01-01 10:15:00 | server2 | 1 | + | 2023-01-01 10:20:00 | server1 | 1 | + | 2023-01-01 10:20:00 | server2 | 0 | + | 2023-01-01 10:25:00 | server1 | 0 | + | 2023-01-01 10:25:00 | server2 | 1 | + | 2023-01-01 10:30:00 | server1 | 1 | + | 2023-01-01 10:30:00 | server2 | 0 | + | 2023-01-01 10:35:00 | server1 | 0 | + | 2023-01-01 10:35:00 | server2 | 1 | + +---------------------+---------+-------+ Example 7: Using limit=0 with count() to show all values ======================================================== @@ -250,9 +239,7 @@ To display all distinct values without any limit, set limit=0: PPL query:: PPL> source=events_many_hosts | timechart span=1h limit=0 count() by host - -Result:: - + fetched rows / total rows = 11/11 +---------------------+--------+-------+ | @timestamp | host | count | +---------------------+--------+-------+ @@ -279,9 +266,7 @@ Limit to top 10 hosts without OTHER category (useother=false): PPL query:: PPL> source=events_many_hosts | timechart span=1h useother=false count() by host - -Result:: - + fetched rows / total rows = 10/10 +---------------------+--------+-------+ | @timestamp | host | count | +---------------------+--------+-------+ @@ -305,9 +290,7 @@ Limit to top 3 hosts with OTHER category (default useother=true): PPL query:: PPL> source=events_many_hosts | timechart span=1h limit=3 avg(cpu_usage) by host - -Result:: - + fetched rows / total rows = 4/4 +---------------------+--------+------------------+ | @timestamp | host | avg(cpu_usage) | +---------------------+--------+------------------+ @@ -322,9 +305,7 @@ Limit to top 3 hosts without OTHER category (useother=false): PPL query:: PPL> source=events_many_hosts | timechart span=1h limit=3 useother=false avg(cpu_usage) by host - -Result:: - + fetched rows / total rows = 3/3 +---------------------+--------+------------------+ | @timestamp | host | avg(cpu_usage) | +---------------------+--------+------------------+ @@ -341,9 +322,7 @@ This example shows how null values in the "by" field are treated as a separate c PPL query:: PPL> source=events_null | timechart span=1h count() by host - -Result:: - + fetched rows / total rows = 4/4 +---------------------+--------+-------+ | @timestamp | host | count | +---------------------+--------+-------+ diff --git a/docs/user/ppl/cmd/top.rst b/docs/user/ppl/cmd/top.rst index ec22c9b5db9..5f4bfb9b4b6 100644 --- a/docs/user/ppl/cmd/top.rst +++ b/docs/user/ppl/cmd/top.rst @@ -18,7 +18,7 @@ Syntax ============ top [N] [by-clause] -top [N] [top-options] [by-clause] ``(available from 3.1.0+)`` +top [N] [top-options] [by-clause] ``(available from 3.1.0+)`` * N: number of results to return. **Default**: 10 * field-list: mandatory. comma-delimited list of field names. @@ -35,7 +35,7 @@ The example finds most common gender of all the accounts. PPL query:: - os> source=accounts | top gender; + os> source=accounts | top showcount=false gender; fetched rows / total rows = 2/2 +--------+ | gender | @@ -51,7 +51,7 @@ The example finds most common gender of all the accounts. PPL query:: - os> source=accounts | top 1 gender; + os> source=accounts | top 1 showcount=false gender; fetched rows / total rows = 1/1 +--------+ | gender | @@ -66,7 +66,7 @@ The example finds most common age of all the accounts group by gender. PPL query:: - os> source=accounts | top 1 age by gender; + os> source=accounts | top 1 showcount=false age by gender; fetched rows / total rows = 2/2 +--------+-----+ | gender | age | diff --git a/docs/user/ppl/functions/json.rst b/docs/user/ppl/functions/json.rst index 8357c26943a..0114cf5ef9b 100644 --- a/docs/user/ppl/functions/json.rst +++ b/docs/user/ppl/functions/json.rst @@ -51,17 +51,16 @@ Return type: STRING Example:: - > source=json_test | where json_valid(json_string) | eval json=json(json_string) | fields test_name, json_string, json - fetched rows / total rows = 5/5 - +---------------------+---------------------------------+-------------------------+ - | test_name | json_string | json | - |---------------------|---------------------------------|-------------------------| - | json nested object | {"a":"1","b":{"c":"2","d":"3"}} | {a:"1",b:{c:"2",d:"3"}} | - | json object | {"a":"1","b":"2"} | {a:"1",b:"2"} | - | json array | [1, 2, 3, 4] | [1,2,3,4] | - | json scalar string | "abc" | "abc" | - | json empty string | | null | - +---------------------+---------------------------------+-------------------------+ + os> source=json_test | where json_valid(json_string) | eval json=json(json_string) | fields test_name, json_string, json + fetched rows / total rows = 4/4 + +--------------------+---------------------------------+---------------------------------+ + | test_name | json_string | json | + |--------------------+---------------------------------+---------------------------------| + | json nested object | {"a":"1","b":{"c":"2","d":"3"}} | {"a":"1","b":{"c":"2","d":"3"}} | + | json object | {"a":"1","b":"2"} | {"a":"1","b":"2"} | + | json array | [1, 2, 3, 4] | [1, 2, 3, 4] | + | json scalar string | "abc" | "abc" | + +--------------------+---------------------------------+---------------------------------+ JSON_OBJECT ---------- @@ -81,13 +80,13 @@ Return type: STRING Example:: - > source=json_test | eval test_json = json_object('key', 123.45) | head 1 | fields test_json + os> source=json_test | eval test_json = json_object('key', 123.45) | head 1 | fields test_json fetched rows / total rows = 1/1 - +-------------------------+ - | test_json | - |-------------------------| - | {"key":123.45} | - +-------------------------+ + +----------------+ + | test_json | + |----------------| + | {"key":123.45} | + +----------------+ JSON_ARRAY ---------- @@ -107,13 +106,13 @@ Return type: STRING Example:: - > source=json_test | eval test_json_array = json_array('key', 123.45) | head 1 | fields test_json_array + os> source=json_test | eval test_json_array = json_array('key', 123.45) | head 1 | fields test_json_array fetched rows / total rows = 1/1 - +-------------------------+ - | test_json_array | - |-------------------------| - | ["key",123.45] | - +-------------------------+ + +-----------------+ + | test_json_array | + |-----------------| + | ["key",123.45] | + +-----------------+ JSON_ARRAY_LENGTH ---------- @@ -133,21 +132,21 @@ Return type: INTEGER Example:: - > source=json_test | eval array_length = json_array_length("[1,2,3]") | head 1 | fields array_length + os> source=json_test | eval array_length = json_array_length("[1,2,3]") | head 1 | fields array_length fetched rows / total rows = 1/1 - +-------------------------+ - | array_length | - |-------------------------| - | 3 | - +-------------------------+ + +--------------+ + | array_length | + |--------------| + | 3 | + +--------------+ - > source=json_test | eval array_length = json_array_length("{\"1\": 2}") | head 1 | fields array_length + os> source=json_test | eval array_length = json_array_length("{\"1\": 2}") | head 1 | fields array_length fetched rows / total rows = 1/1 - +-------------------------+ - | array_length | - |-------------------------| - | null | - +-------------------------+ + +--------------+ + | array_length | + |--------------| + | null | + +--------------+ JSON_EXTRACT ---------- @@ -167,21 +166,21 @@ Return type: STRING Example:: - > source=json_test | eval extract = json_extract('{"a": [{"b": 1}, {"b": 2}]}', 'a{}.b') | head 1 | fields extract + os> source=json_test | eval extract = json_extract('{"a": [{"b": 1}, {"b": 2}]}', 'a{}.b') | head 1 | fields extract fetched rows / total rows = 1/1 - +-------------------------+ - | test_json_array | - |-------------------------| - | [1,2] | - +-------------------------+ + +---------+ + | extract | + |---------| + | [1,2] | + +---------+ - > source=json_test | eval extract = json_extract('{"a": [{"b": 1}, {"b": 2}]}', 'a{}.b', 'a{}') | head 1 | fields extract + os> source=json_test | eval extract = json_extract('{"a": [{"b": 1}, {"b": 2}]}', 'a{}.b', 'a{}') | head 1 | fields extract fetched rows / total rows = 1/1 - +---------------------------------+ - | test_json_array | - |---------------------------------| - | [[1,2],[{"b": 1}, {"b": 2}]] | - +---------------------------------+ + +---------------------------+ + | extract | + |---------------------------| + | [[1,2],[{"b":1},{"b":2}]] | + +---------------------------+ JSON_DELETE ---------- @@ -201,30 +200,30 @@ Return type: STRING Example:: - > source=json_test | eval delete = json_delete('{"a": [{"b": 1}, {"b": 2}]}', 'a{0}.b') | head 1 | fields delete + os> source=json_test | eval delete = json_delete('{"a": [{"b": 1}, {"b": 2}]}', 'a{0}.b') | head 1 | fields delete fetched rows / total rows = 1/1 - +-------------------------+ - | delete | - |-------------------------| - | {"a": [{},{"b": 1}]} | - +-------------------------+ + +--------------------+ + | delete | + |--------------------| + | {"a":[{},{"b":2}]} | + +--------------------+ + + os> source=json_test | eval delete = json_delete('{"a": [{"b": 1}, {"b": 2}]}', 'a{0}.b', 'a{1}.b') | head 1 | fields delete + fetched rows / total rows = 1/1 + +---------------+ + | delete | + |---------------| + | {"a":[{},{}]} | + +---------------+ - > source=json_test | eval delete = json_delete('{"a": [{"b": 1}, {"b": 2}]}', 'a{0}.b', 'a{1}.b') | head 1 | fields delete + os> source=json_test | eval delete = json_delete('{"a": [{"b": 1}, {"b": 2}]}', 'a{2}.b') | head 1 | fields delete fetched rows / total rows = 1/1 +-------------------------+ | delete | |-------------------------| - | {"a": []} | + | {"a":[{"b":1},{"b":2}]} | +-------------------------+ - > source=json_test | eval delete = json_delete('{"a": [{"b": 1}, {"b": 2}]}', 'a{2}.b') | head 1 | fields delete - fetched rows / total rows = 1/1 - +------------------------------+ - | delete | - |------------------------------| - | {"a": [{"b": 1}, {"b": 2}]} | - +------------------------------+ - JSON_SET ---------- @@ -243,22 +242,22 @@ Return type: STRING Example:: - > source=json_test | eval jsonSet = json_set('{"a": [{"b": 1}]}', 'a{0}.b', 3) | head 1 | fields jsonSet + os> source=json_test | eval jsonSet = json_set('{"a": [{"b": 1}]}', 'a{0}.b', 3) | head 1 | fields jsonSet + fetched rows / total rows = 1/1 + +-----------------+ + | jsonSet | + |-----------------| + | {"a":[{"b":3}]} | + +-----------------+ + + os> source=json_test | eval jsonSet = json_set('{"a": [{"b": 1}, {"b": 2}]}', 'a{0}.b', 3, 'a{1}.b', 4) | head 1 | fields jsonSet fetched rows / total rows = 1/1 +-------------------------+ | jsonSet | |-------------------------| - | {"a": [{"b": 3}]} | + | {"a":[{"b":3},{"b":4}]} | +-------------------------+ - > source=json_test | eval jsonSet = json_set('{"a": [{"b": 1}, {"b": 2}]}', 'a{0}.b', 3, 'a{1}.b', 4) | head 1 | fields jsonSet - fetched rows / total rows = 1/1 - +-----------------------------+ - | jsonSet | - |-----------------------------| - | {"a": [{"b": 3},{"b": 4}]} | - +-----------------------------+ - JSON_APPEND ---------- @@ -277,30 +276,30 @@ Return type: STRING Example:: - > source=json_test | eval jsonAppend = json_set('{"a": [{"b": 1}]}', 'a', 3) | head 1 | fields jsonAppend + os> source=json_test | eval jsonAppend = json_set('{"a": [{"b": 1}]}', 'a', 3) | head 1 | fields jsonAppend + fetched rows / total rows = 1/1 + +------------+ + | jsonAppend | + |------------| + | {"a":3} | + +------------+ + + os> source=json_test | eval jsonAppend = json_append('{"a": [{"b": 1}, {"b": 2}]}', 'a{0}.b', 3, 'a{1}.b', 4) | head 1 | fields jsonAppend fetched rows / total rows = 1/1 +-------------------------+ | jsonAppend | |-------------------------| - | {"a": [{"b": 1}, 3]} | + | {"a":[{"b":1},{"b":2}]} | +-------------------------+ - > source=json_test | eval jsonAppend = json_append('{"a": [{"b": 1}, {"b": 2}]}', 'a{0}.b', 3, 'a{1}.b', 4) | head 1 | fields jsonAppend + os> source=json_test | eval jsonAppend = json_append('{"a": [{"b": 1}]}', 'a', '[1,2]', 'a{1}.b', 4) | head 1 | fields jsonAppend fetched rows / total rows = 1/1 +-------------------------+ | jsonAppend | |-------------------------| - | {"a": [{"b": 1}, 3]} | + | {"a":[{"b":1},"[1,2]"]} | +-------------------------+ - > source=json_test | eval jsonAppend = json_append('{"a": [{"b": 1}]}', 'a', '[1,2]', 'a{1}.b', 4) | head 1 | fields jsonAppend - fetched rows / total rows = 1/1 - +----------------------------+ - | jsonAppend | - |----------------------------| - | {"a": [{"b": 1}, "[1,2]"]} | - +----------------------------+ - JSON_EXTEND ---------- @@ -319,30 +318,30 @@ Return type: STRING Example:: - > source=json_test | eval jsonExtend = json_extend('{"a": [{"b": 1}]}', 'a', 3) | head 1 | fields jsonExtend + os> source=json_test | eval jsonExtend = json_extend('{"a": [{"b": 1}]}', 'a', 3) | head 1 | fields jsonExtend + fetched rows / total rows = 1/1 + +-------------------+ + | jsonExtend | + |-------------------| + | {"a":[{"b":1},3]} | + +-------------------+ + + os> source=json_test | eval jsonExtend = json_extend('{"a": [{"b": 1}, {"b": 2}]}', 'a{0}.b', 3, 'a{1}.b', 4) | head 1 | fields jsonExtend fetched rows / total rows = 1/1 +-------------------------+ | jsonExtend | |-------------------------| - | {"a": [{"b": 1}, 3]} | + | {"a":[{"b":1},{"b":2}]} | +-------------------------+ - > source=json_test | eval jsonExtend = json_extend('{"a": [{"b": 1}, {"b": 2}]}', 'a{0}.b', 3, 'a{1}.b', 4) | head 1 | fields jsonExtend + os> source=json_test | eval jsonExtend = json_extend('{"a": [{"b": 1}]}', 'a', '[1,2]') | head 1 | fields jsonExtend fetched rows / total rows = 1/1 +-------------------------+ | jsonExtend | |-------------------------| - | {"a": [{"b": 1}, 3]} | + | {"a":[{"b":1},1.0,2.0]} | +-------------------------+ - > source=json_test | eval jsonExtend = json_extend('{"a": [{"b": 1}]}', 'a', '[1,2]') | head 1 | fields jsonExtend - fetched rows / total rows = 1/1 - +----------------------------+ - | jsonExtend | - |----------------------------| - | {"a": [{"b": 1},1,2]} | - +----------------------------+ - JSON_KEYS ---------- @@ -361,18 +360,18 @@ Return type: STRING Example:: - > source=json_test | eval jsonKeys = json_keys('{"a": 1, "b": 2}') | head 1 | fields jsonKeys + os> source=json_test | eval jsonKeys = json_keys('{"a": 1, "b": 2}') | head 1 | fields jsonKeys fetched rows / total rows = 1/1 - +-------------------------+ - | jsonKeys | - |-------------------------| - | ["a","b"] | - +-------------------------+ + +-----------+ + | jsonKeys | + |-----------| + | ["a","b"] | + +-----------+ - > source=json_test | eval jsonKeys = json_keys('{"a": {"c": 1}, "b": 2}') | head 1 | fields jsonKeys + os> source=json_test | eval jsonKeys = json_keys('{"a": {"c": 1}, "b": 2}') | head 1 | fields jsonKeys fetched rows / total rows = 1/1 - +-------------------------+ - | jsonKeys | - |-------------------------| - | ["a","b"] | - +-------------------------+ + +-----------+ + | jsonKeys | + |-----------| + | ["a","b"] | + +-----------+ diff --git a/docs/user/ppl/functions/math.rst b/docs/user/ppl/functions/math.rst index b2b0dd47415..20029c2c6ec 100644 --- a/docs/user/ppl/functions/math.rst +++ b/docs/user/ppl/functions/math.rst @@ -322,7 +322,7 @@ Limitation: CEILING only works as expected when IEEE 754 double type displays de Argument type: INTEGER/LONG/FLOAT/DOUBLE -Return type: LONG +Return type: same type with input Example:: @@ -331,7 +331,7 @@ Example:: +------------+-------------------+--------------------+ | CEILING(0) | CEILING(50.00005) | CEILING(-50.00005) | |------------+-------------------+--------------------| - | 0 | 51 | -50 | + | 0 | 51.0 | -50.0 | +------------+-------------------+--------------------+ os> source=people | eval `CEILING(3147483647.12345)` = CEILING(3147483647.12345), `CEILING(113147483647.12345)` = CEILING(113147483647.12345), `CEILING(3147483647.00001)` = CEILING(3147483647.00001) | fields `CEILING(3147483647.12345)`, `CEILING(113147483647.12345)`, `CEILING(3147483647.00001)` @@ -339,7 +339,7 @@ Example:: +---------------------------+-----------------------------+---------------------------+ | CEILING(3147483647.12345) | CEILING(113147483647.12345) | CEILING(3147483647.00001) | |---------------------------+-----------------------------+---------------------------| - | 3147483648 | 113147483648 | 3147483648 | + | 3147483648.0 | 113147483648.0 | 3147483648.0 | +---------------------------+-----------------------------+---------------------------+ @@ -560,7 +560,7 @@ Limitation: FLOOR only works as expected when IEEE 754 double type displays deci Argument type: a: INTEGER/LONG/FLOAT/DOUBLE -Return type: LONG +Return type: same type with input Example:: @@ -569,7 +569,7 @@ Example:: +----------+-----------------+------------------+ | FLOOR(0) | FLOOR(50.00005) | FLOOR(-50.00005) | |----------+-----------------+------------------| - | 0 | 50 | -51 | + | 0 | 50.0 | -51.0 | +----------+-----------------+------------------+ os> source=people | eval `FLOOR(3147483647.12345)` = FLOOR(3147483647.12345), `FLOOR(113147483647.12345)` = FLOOR(113147483647.12345), `FLOOR(3147483647.00001)` = FLOOR(3147483647.00001) | fields `FLOOR(3147483647.12345)`, `FLOOR(113147483647.12345)`, `FLOOR(3147483647.00001)` @@ -577,7 +577,7 @@ Example:: +-------------------------+---------------------------+-------------------------+ | FLOOR(3147483647.12345) | FLOOR(113147483647.12345) | FLOOR(3147483647.00001) | |-------------------------+---------------------------+-------------------------| - | 3147483647 | 113147483647 | 3147483647 | + | 3147483647.0 | 113147483647.0 | 3147483647.0 | +-------------------------+---------------------------+-------------------------+ os> source=people | eval `FLOOR(282474973688888.022)` = FLOOR(282474973688888.022), `FLOOR(9223372036854775807.022)` = FLOOR(9223372036854775807.022), `FLOOR(9223372036854775807.0000001)` = FLOOR(9223372036854775807.0000001) | fields `FLOOR(282474973688888.022)`, `FLOOR(9223372036854775807.022)`, `FLOOR(9223372036854775807.0000001)` @@ -585,7 +585,7 @@ Example:: +----------------------------+--------------------------------+------------------------------------+ | FLOOR(282474973688888.022) | FLOOR(9223372036854775807.022) | FLOOR(9223372036854775807.0000001) | |----------------------------+--------------------------------+------------------------------------| - | 282474973688888 | 9223372036854775807 | 9223372036854775807 | + | 282474973688888.0 | 9.223372036854776e+18 | 9.223372036854776e+18 | +----------------------------+--------------------------------+------------------------------------+ @@ -843,11 +843,11 @@ Example:: os> source=people | eval `RAND(3)` = RAND(3) | fields `RAND(3)` fetched rows / total rows = 1/1 - +------------+ - | RAND(3) | - |------------| - | 0.73105735 | - +------------+ + +---------------------+ + | RAND(3) | + |---------------------| + | 0.34346429521113886 | + +---------------------+ ROUND @@ -886,7 +886,7 @@ Usage: Returns the sign of the argument as -1, 0, or 1, depending on whether the Argument type: INTEGER/LONG/FLOAT/DOUBLE -Return type: INTEGER +Return type: same type with input Example:: @@ -895,7 +895,7 @@ Example:: +---------+---------+------------+ | SIGN(1) | SIGN(0) | SIGN(-1.1) | |---------+---------+------------| - | 1 | 0 | -1 | + | 1 | 0 | -1.0 | +---------+---------+------------+ @@ -920,7 +920,7 @@ Example:: +-----------+-----------+--------------+ | SIGNUM(1) | SIGNUM(0) | SIGNUM(-1.1) | |-----------+-----------+--------------| - | 1 | 0 | -1 | + | 1 | 0 | -1.0 | +-----------+-----------+--------------+