@@ -405,6 +405,74 @@ count:long | message:keyword
405
405
2 | Connected to 10.1.0.3
406
406
;
407
407
408
+ multiIndexMissingIpToString
409
+ required_capability: union_types
410
+ required_capability: union_types_missing_field
411
+
412
+ FROM sample_data, sample_data_str, missing_ip_sample_data METADATA _index
413
+ | EVAL client_ip = TO_STRING(client_ip)
414
+ | KEEP _index, @timestamp, client_ip, event_duration, message
415
+ | SORT _index ASC, @timestamp DESC
416
+ ;
417
+
418
+ _index:keyword | @timestamp:date | client_ip:keyword | event_duration:long | message:keyword
419
+ missing_ip_sample_data | 2023-10-23T13:55:01.543Z | null | 1756467 | Connected to 10.1.0.1
420
+ missing_ip_sample_data | 2023-10-23T13:53:55.832Z | null | 5033755 | Connection error
421
+ missing_ip_sample_data | 2023-10-23T13:52:55.015Z | null | 8268153 | Connection error
422
+ missing_ip_sample_data | 2023-10-23T13:51:54.732Z | null | 725448 | Connection error
423
+ missing_ip_sample_data | 2023-10-23T13:33:34.937Z | null | 1232382 | Disconnected
424
+ missing_ip_sample_data | 2023-10-23T12:27:28.948Z | null | 2764889 | Connected to 10.1.0.2
425
+ missing_ip_sample_data | 2023-10-23T12:15:03.360Z | null | 3450233 | Connected to 10.1.0.3
426
+ sample_data | 2023-10-23T13:55:01.543Z | 172.21.3.15 | 1756467 | Connected to 10.1.0.1
427
+ sample_data | 2023-10-23T13:53:55.832Z | 172.21.3.15 | 5033755 | Connection error
428
+ sample_data | 2023-10-23T13:52:55.015Z | 172.21.3.15 | 8268153 | Connection error
429
+ sample_data | 2023-10-23T13:51:54.732Z | 172.21.3.15 | 725448 | Connection error
430
+ sample_data | 2023-10-23T13:33:34.937Z | 172.21.0.5 | 1232382 | Disconnected
431
+ sample_data | 2023-10-23T12:27:28.948Z | 172.21.2.113 | 2764889 | Connected to 10.1.0.2
432
+ sample_data | 2023-10-23T12:15:03.360Z | 172.21.2.162 | 3450233 | Connected to 10.1.0.3
433
+ sample_data_str | 2023-10-23T13:55:01.543Z | 172.21.3.15 | 1756467 | Connected to 10.1.0.1
434
+ sample_data_str | 2023-10-23T13:53:55.832Z | 172.21.3.15 | 5033755 | Connection error
435
+ sample_data_str | 2023-10-23T13:52:55.015Z | 172.21.3.15 | 8268153 | Connection error
436
+ sample_data_str | 2023-10-23T13:51:54.732Z | 172.21.3.15 | 725448 | Connection error
437
+ sample_data_str | 2023-10-23T13:33:34.937Z | 172.21.0.5 | 1232382 | Disconnected
438
+ sample_data_str | 2023-10-23T12:27:28.948Z | 172.21.2.113 | 2764889 | Connected to 10.1.0.2
439
+ sample_data_str | 2023-10-23T12:15:03.360Z | 172.21.2.162 | 3450233 | Connected to 10.1.0.3
440
+ ;
441
+
442
+ multiIndexMissingIpToIp
443
+ required_capability: union_types
444
+ required_capability: union_types_missing_field
445
+
446
+ FROM sample_data, sample_data_str, missing_ip_sample_data METADATA _index
447
+ | EVAL client_ip = TO_IP(client_ip)
448
+ | KEEP _index, @timestamp, client_ip, event_duration, message
449
+ | SORT _index ASC, @timestamp DESC
450
+ ;
451
+
452
+ _index:keyword | @timestamp:date | client_ip:ip | event_duration:long | message:keyword
453
+ missing_ip_sample_data | 2023-10-23T13:55:01.543Z | null | 1756467 | Connected to 10.1.0.1
454
+ missing_ip_sample_data | 2023-10-23T13:53:55.832Z | null | 5033755 | Connection error
455
+ missing_ip_sample_data | 2023-10-23T13:52:55.015Z | null | 8268153 | Connection error
456
+ missing_ip_sample_data | 2023-10-23T13:51:54.732Z | null | 725448 | Connection error
457
+ missing_ip_sample_data | 2023-10-23T13:33:34.937Z | null | 1232382 | Disconnected
458
+ missing_ip_sample_data | 2023-10-23T12:27:28.948Z | null | 2764889 | Connected to 10.1.0.2
459
+ missing_ip_sample_data | 2023-10-23T12:15:03.360Z | null | 3450233 | Connected to 10.1.0.3
460
+ sample_data | 2023-10-23T13:55:01.543Z | 172.21.3.15 | 1756467 | Connected to 10.1.0.1
461
+ sample_data | 2023-10-23T13:53:55.832Z | 172.21.3.15 | 5033755 | Connection error
462
+ sample_data | 2023-10-23T13:52:55.015Z | 172.21.3.15 | 8268153 | Connection error
463
+ sample_data | 2023-10-23T13:51:54.732Z | 172.21.3.15 | 725448 | Connection error
464
+ sample_data | 2023-10-23T13:33:34.937Z | 172.21.0.5 | 1232382 | Disconnected
465
+ sample_data | 2023-10-23T12:27:28.948Z | 172.21.2.113 | 2764889 | Connected to 10.1.0.2
466
+ sample_data | 2023-10-23T12:15:03.360Z | 172.21.2.162 | 3450233 | Connected to 10.1.0.3
467
+ sample_data_str | 2023-10-23T13:55:01.543Z | 172.21.3.15 | 1756467 | Connected to 10.1.0.1
468
+ sample_data_str | 2023-10-23T13:53:55.832Z | 172.21.3.15 | 5033755 | Connection error
469
+ sample_data_str | 2023-10-23T13:52:55.015Z | 172.21.3.15 | 8268153 | Connection error
470
+ sample_data_str | 2023-10-23T13:51:54.732Z | 172.21.3.15 | 725448 | Connection error
471
+ sample_data_str | 2023-10-23T13:33:34.937Z | 172.21.0.5 | 1232382 | Disconnected
472
+ sample_data_str | 2023-10-23T12:27:28.948Z | 172.21.2.113 | 2764889 | Connected to 10.1.0.2
473
+ sample_data_str | 2023-10-23T12:15:03.360Z | 172.21.2.162 | 3450233 | Connected to 10.1.0.3
474
+ ;
475
+
408
476
multiIndexTsLong
409
477
required_capability: union_types
410
478
required_capability: metadata_fields
0 commit comments