@@ -1375,6 +1375,7 @@ client_ip:ip | event_duration:long | message:keyword | @timestamp:keywo
13751375# Once INLINESTATS supports expressions in agg functions and groups, convert the group in the inlinestats
13761376
13771377multiIndexIndirectUseOfUnionTypesInSort
1378+ required_capability: union_types
13781379FROM sample_data, sample_data_ts_long
13791380| SORT client_ip ASC
13801381| LIMIT 1
@@ -1397,6 +1398,7 @@ FROM sample_data, sample_data_ts_long
13971398;
13981399
13991400multiIndexIndirectUseOfUnionTypesInRename
1401+ required_capability: union_types
14001402required_capability: union_types_fix_rename_resolution
14011403FROM sample_data, sample_data_ts_long
14021404| RENAME message AS event_message
@@ -1409,6 +1411,7 @@ FROM sample_data, sample_data_ts_long
14091411;
14101412
14111413multiIndexIndirectUseOfUnionTypesInKeep
1414+ required_capability: union_types
14121415FROM sample_data, sample_data_ts_long
14131416| KEEP client_ip, event_duration, message
14141417| SORT client_ip ASC
@@ -1420,6 +1423,7 @@ client_ip:ip | event_duration:long | message:keyword
14201423;
14211424
14221425multiIndexIndirectUseOfUnionTypesInWildcardKeep
1426+ required_capability: union_types
14231427required_capability: union_types_fix_rename_resolution
14241428FROM sample_data, sample_data_ts_long
14251429| KEEP *
@@ -1432,6 +1436,7 @@ FROM sample_data, sample_data_ts_long
14321436;
14331437
14341438multiIndexIndirectUseOfUnionTypesInWildcardKeep2
1439+ required_capability: union_types
14351440required_capability: union_types_fix_rename_resolution
14361441FROM sample_data, sample_data_ts_long
14371442| KEEP *e*
@@ -1468,6 +1473,7 @@ client_ip:ip | event_duration:long | message:keyword
14681473;
14691474
14701475multiIndexIndirectUseOfUnionTypesInWildcardDrop
1476+ required_capability: union_types
14711477required_capability: union_types_fix_rename_resolution
14721478FROM sample_data, sample_data_ts_long
14731479| DROP *time*
@@ -1480,6 +1486,7 @@ client_ip:ip | event_duration:long | message:keyword
14801486;
14811487
14821488multiIndexIndirectUseOfUnionTypesInWhere
1489+ required_capability: union_types
14831490FROM sample_data, sample_data_ts_long
14841491| WHERE message == "Disconnected"
14851492;
@@ -1490,6 +1497,7 @@ FROM sample_data, sample_data_ts_long
14901497;
14911498
14921499multiIndexIndirectUseOfUnionTypesInDissect
1500+ required_capability: union_types
14931501FROM sample_data, sample_data_ts_long
14941502| DISSECT message "%{foo}"
14951503| SORT client_ip ASC
@@ -1501,6 +1509,7 @@ FROM sample_data, sample_data_ts_long
15011509;
15021510
15031511multiIndexIndirectUseOfUnionTypesInGrok
1512+ required_capability: union_types
15041513FROM sample_data, sample_data_ts_long
15051514| GROK message "%{WORD:foo}"
15061515| SORT client_ip ASC
@@ -1512,6 +1521,7 @@ FROM sample_data, sample_data_ts_long
15121521;
15131522
15141523multiIndexIndirectUseOfUnionTypesInEnrich
1524+ required_capability: union_types
15151525required_capability: enrich_load
15161526FROM sample_data, sample_data_ts_long
15171527| EVAL client_ip = client_ip::keyword
@@ -1525,6 +1535,7 @@ FROM sample_data, sample_data_ts_long
15251535;
15261536
15271537multiIndexIndirectUseOfUnionTypesInStats
1538+ required_capability: union_types
15281539FROM sample_data, sample_data_ts_long
15291540| STATS foo = max(event_duration) BY client_ip
15301541| SORT client_ip ASC
@@ -1538,6 +1549,7 @@ foo:long | client_ip:ip
15381549;
15391550
15401551multiIndexIndirectUseOfUnionTypesInInlineStats-Ignore
1552+ required_capability: union_types
15411553required_capability: inlinestats
15421554FROM sample_data, sample_data_ts_long
15431555| INLINESTATS foo = max(event_duration)
@@ -1550,6 +1562,7 @@ FROM sample_data, sample_data_ts_long
15501562;
15511563
15521564multiIndexIndirectUseOfUnionTypesInLookup-Ignore
1565+ required_capability: union_types
15531566required_capability: lookup_v4
15541567FROM sample_data, sample_data_ts_long
15551568| SORT client_ip ASC
@@ -1563,6 +1576,7 @@ FROM sample_data, sample_data_ts_long
15631576;
15641577
15651578multiIndexIndirectUseOfUnionTypesInMvExpand
1579+ required_capability: union_types
15661580FROM sample_data, sample_data_ts_long
15671581| EVAL foo = MV_APPEND(message, message)
15681582| SORT client_ip ASC
0 commit comments