Rule to fix at least some of this

Author: not-napoleon

x-pack/plugin/esql/qa/testFixtures/src/main/resources/k8s-timeseries.csv-spec

@@ -561,6 +561,8 @@ cnt:long | cluster:keyword | pod:keyword
 ;
 
 Max of Rate with Bucket
+required_capability: ts_command_v0
+
 TS k8s
 | STATS maxRate = max(rate(network.total_cost))  BY tbucket = bucket(@timestamp, 1hour) 
 ;
@@ -570,6 +572,8 @@ maxRate:double | tbucket:datetime
 ;
 
 Max of Rate with Bucket, Rename Timestamp
+required_capability: ts_command_v0
+
 TS k8s
 | RENAME `@timestamp` AS newTs
 | STATS maxRate = max(rate(network.total_cost))  BY tbucket = bucket(newTs, 1hour) 

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/analysis/Analyzer.java

@@ -488,10 +488,15 @@ protected LogicalPlan rule(LogicalPlan plan, AnalyzerContext context) {
             // Gather all the children's output in case of non-unary plans; even for unaries, we need to copy because we may mutate this to
             // simplify resolution of e.g. RENAME.
             for (LogicalPlan child : plan.children()) {
-                var output = child.output();
+                List<Attribute> output = child.output();
                 childrenOutput.addAll(output);
             }
 
+            if (plan instanceof TimeSeriesAggregate tsAggregate) {
+                // NOTE: This MUST be checked before the Aggregate version, since TimeSeriesAggregate is a subclass of Aggregate
+                return resolveTimeSeriesAggregate(tsAggregate, childrenOutput);
+            }
+
             if (plan instanceof Aggregate aggregate) {
                 return resolveAggregate(aggregate, childrenOutput);
             }
@@ -551,6 +556,51 @@ protected LogicalPlan rule(LogicalPlan plan, AnalyzerContext context) {
             return plan.transformExpressionsOnly(UnresolvedAttribute.class, ua -> maybeResolveAttribute(ua, childrenOutput));
         }
 
+        /**
+         * This function is meant to deal with the implicit timestamp fields that some TS functions use.
+         */
+        private TimeSeriesAggregate resolveTimeSeriesAggregate(TimeSeriesAggregate timeSeriesAggregate, List<Attribute> childrenOutput) {
+            if (childrenOutput.stream().noneMatch(attr -> attr.name().equals(MetadataAttribute.TIMESTAMP_FIELD))) {
+                // We only need to do something if there isn't a timestamp field in our output
+                Holder<String> tsAttributeName = new Holder<>(MetadataAttribute.TIMESTAMP_FIELD);
+                timeSeriesAggregate.forEachExpressionUp(Alias.class, a -> {
+                    if (a.child() instanceof Attribute c) {
+                        // will this ever not be true?
+                        if (c.name().equals(tsAttributeName.get())) {
+                            tsAttributeName.set(a.name());
+                        }
+                    }
+                });
+
+                // Now we know what timestamp is going to be called, replace our UnresolvedAttributes referencing timestamp with that name
+                List<Expression> newGroupings = new ArrayList<>(timeSeriesAggregate.groupings().size());
+                List<NamedExpression> newAggregates = new ArrayList<>(timeSeriesAggregate.aggregates().size());
+                for (int i = 0; i < timeSeriesAggregate.groupings().size(); i++) {
+                    newGroupings.add(timeSeriesAggregate.groupings().get(i).transformUp(UnresolvedAttribute.class, ua -> {
+                        if (ua.name().equals(MetadataAttribute.TIMESTAMP_FIELD)) {
+                            return new UnresolvedAttribute(ua.source(), tsAttributeName.get());
+                        }
+                        return ua;
+                    }));
+                }
+
+                for (int i = 0; i < timeSeriesAggregate.aggregates().size(); i++) {
+                    newAggregates.add(
+                        (NamedExpression) timeSeriesAggregate.aggregates().get(i).transformUp(UnresolvedAttribute.class, ua -> {
+                            if (ua.name().equals(MetadataAttribute.TIMESTAMP_FIELD)) {
+                                return new UnresolvedAttribute(ua.source(), tsAttributeName.get());
+                            }
+                            return ua;
+                        })
+                    );
+                }
+                timeSeriesAggregate = (TimeSeriesAggregate) timeSeriesAggregate.with(newGroupings, newAggregates);
+            }
+
+            // After correcting the timestamps, we still need to resolve the node as normal, so delegate to resolveAggregate
+            return (TimeSeriesAggregate) resolveAggregate(timeSeriesAggregate, childrenOutput);
+        }
+
         private Aggregate resolveAggregate(Aggregate aggregate, List<Attribute> childrenOutput) {
             // if the grouping is resolved but the aggs are not, use the former to resolve the latter
             // e.g. STATS a ... GROUP BY a = x + 1
@@ -1083,7 +1133,7 @@ private Attribute resolveAttribute(UnresolvedAttribute ua, List<Attribute> child
 
         private static Attribute resolveAttribute(UnresolvedAttribute ua, List<Attribute> childrenOutput, Logger logger) {
             Attribute resolved = ua;
-            var named = resolveAgainstList(ua, childrenOutput);
+            List<Attribute> named = resolveAgainstList(ua, childrenOutput);
             // if resolved, return it; otherwise keep it in place to be resolved later
             if (named.size() == 1) {
                 resolved = named.get(0);
@@ -1253,9 +1303,9 @@ public static List<NamedExpression> projectionsForRename(Rename rename, List<Att
                     projections.removeIf(x -> x.name().equals(alias.name()));
                     childrenOutput.removeIf(x -> x.name().equals(alias.name()));
 
-                    var resolved = maybeResolveAttribute(ua, childrenOutput, logger);
+                    Attribute resolved = maybeResolveAttribute(ua, childrenOutput, logger);
                     if (resolved instanceof UnsupportedAttribute || resolved.resolved()) {
-                        var realiased = (NamedExpression) alias.replaceChildren(List.of(resolved));
+                        NamedExpression realiased = alias.replaceChildren(List.of(resolved));
                         projections.replaceAll(x -> x.equals(resolved) ? realiased : x);
                         childrenOutput.removeIf(x -> x.equals(resolved));
                         reverseAliasing.put(resolved.name(), alias.name());
@@ -1356,7 +1406,7 @@ private static List<Attribute> resolveAgainstList(UnresolvedNamePattern up, Coll
     }
 
     private static List<Attribute> resolveAgainstList(UnresolvedAttribute ua, Collection<Attribute> attrList) {
-        var matches = AnalyzerRules.maybeResolveAgainstList(ua, attrList, a -> Analyzer.handleSpecialFields(ua, a));
+        List<Attribute> matches = AnalyzerRules.maybeResolveAgainstList(ua, attrList, a -> Analyzer.handleSpecialFields(ua, a));
         return potentialCandidatesIfNoMatchesFound(ua, matches, attrList, list -> UnresolvedAttribute.errorMessage(ua.name(), list));
     }
 

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/optimizer/rules/RuleUtils.java

@@ -87,7 +87,7 @@ public static AttributeMap<Expression> foldableReferences(LogicalPlan plan, Logi
 
         // collect aliases bottom-up
         plan.forEachExpressionUp(Alias.class, a -> {
-            var c = a.child();
+            Expression c = a.child();
             boolean shouldCollect = c.foldable();
             // try to resolve the expression based on an existing foldables
             if (shouldCollect == false) {

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/plan/QueryPlan.java

@@ -203,6 +203,15 @@ public <E extends Expression> void forEachExpressionDown(Class<? extends E> type
         forEachPropertyDown(Object.class, e -> doForEachExpression(e, exp -> exp.forEachDown(typeToken, rule)));
     }
 
+    /**
+     * This traverses all {@link Expression} nodes for all children of the current node, applying the given function to each of them.
+     * It does not transform (i.e. replace) those nodes, it just hands them to the consumer, which can read but not modify (since the
+     * nodes are immutable)
+     *
+     * @param typeToken Only process expressions matching the given type
+     * @param rule a non-modifying consumer which operates on the given token type
+     * @param <E> the type of expression this pass will process
+     */
     public <E extends Expression> void forEachExpressionUp(Class<E> typeToken, Consumer<? super E> rule) {
         forEachPropertyUp(Object.class, e -> doForEachExpression(e, exp -> exp.forEachUp(typeToken, rule)));
     }

x-pack/plugin/esql/src/test/java/org/elasticsearch/xpack/esql/optimizer/rules/logical/TranslateTimeSeriesAggregateTests.java

@@ -143,7 +143,7 @@ public void testAvgOfAvgOverTime() {
         EsRelation relation = as(bucketEval.child(), EsRelation.class);
     }
 
-    public void testRenameTimestampWithRate() {
+    public void testRateWithRename() {
         assumeTrue("requires metrics command", EsqlCapabilities.Cap.TS_COMMAND_V0.isEnabled());
         LogicalPlan plan = planK8s("""
             TS k8s
@@ -152,7 +152,7 @@ public void testRenameTimestampWithRate() {
             """);
     }
 
-    public void testRenameTimestampWithOverTimeFunction() {
+    public void testOverTimeFunctionWithRename() {
         assumeTrue("requires metrics command", EsqlCapabilities.Cap.TS_COMMAND_V0.isEnabled());
         LogicalPlan plan = planK8s("""
             TS k8s
@@ -161,7 +161,7 @@ public void testRenameTimestampWithOverTimeFunction() {
             """);
     }
 
-    public void testRenameTimestampWithOverTimeFunctionWithTbucket() {
+    public void testTbucketWithRename() {
         assumeTrue("requires metrics command", EsqlCapabilities.Cap.TS_COMMAND_V0.isEnabled());
         LogicalPlan plan = planK8s("""
             TS k8s