11standard aggs
2- required_capability: categorize_v2
2+ required_capability: categorize_v3
33
44FROM sample_data
55 | STATS count=COUNT(),
@@ -17,7 +17,7 @@ count:long | sum:long | avg:double | count_distinct:long | category:keyw
1717;
1818
1919values aggs
20- required_capability: categorize_v2
20+ required_capability: categorize_v3
2121
2222FROM sample_data
2323 | STATS values=MV_SORT(VALUES(message)),
@@ -33,7 +33,7 @@ values:keyword | top
3333;
3434
3535mv
36- required_capability: categorize_v2
36+ required_capability: categorize_v3
3737
3838FROM mv_sample_data
3939 | STATS COUNT(), SUM(event_duration) BY category=CATEGORIZE(message)
@@ -48,7 +48,7 @@ COUNT():long | SUM(event_duration):long | category:keyword
4848;
4949
5050row mv
51- required_capability: categorize_v2
51+ required_capability: categorize_v3
5252
5353ROW message = ["connected to a", "connected to b", "disconnected"], str = ["a", "b", "c"]
5454 | STATS COUNT(), VALUES(str) BY category=CATEGORIZE(message)
@@ -61,7 +61,7 @@ COUNT():long | VALUES(str):keyword | category:keyword
6161;
6262
6363skips stopwords
64- required_capability: categorize_v2
64+ required_capability: categorize_v3
6565
6666ROW message = ["Mon Tue connected to a", "Jul Aug connected to b September ", "UTC connected GMT to c UTC"]
6767 | STATS COUNT() BY category=CATEGORIZE(message)
@@ -73,7 +73,7 @@ COUNT():long | category:keyword
7373;
7474
7575with multiple indices
76- required_capability: categorize_v2
76+ required_capability: categorize_v3
7777required_capability: union_types
7878
7979FROM sample_data*
@@ -88,7 +88,7 @@ COUNT():long | category:keyword
8888;
8989
9090mv with many values
91- required_capability: categorize_v2
91+ required_capability: categorize_v3
9292
9393FROM employees
9494 | STATS COUNT() BY category=CATEGORIZE(job_positions)
@@ -106,7 +106,7 @@ COUNT():long | category:keyword
106106
107107# Throws when calling AbstractCategorizeBlockHash.seenGroupIds() - Requires nulls support?
108108mv with many values-Ignore
109- required_capability: categorize_v2
109+ required_capability: categorize_v3
110110
111111FROM employees
112112 | STATS SUM(languages) BY category=CATEGORIZE(job_positions)
@@ -121,7 +121,7 @@ SUM(languages):integer | category:keyword
121121;
122122
123123mv via eval
124- required_capability: categorize_v2
124+ required_capability: categorize_v3
125125
126126FROM sample_data
127127 | EVAL message = MV_APPEND(message, "Banana")
@@ -137,7 +137,7 @@ COUNT():long | category:keyword
137137;
138138
139139mv via eval const
140- required_capability: categorize_v2
140+ required_capability: categorize_v3
141141
142142FROM sample_data
143143 | EVAL message = ["Banana", "Bread"]
@@ -151,7 +151,7 @@ COUNT():long | category:keyword
151151;
152152
153153mv via eval const without aliases
154- required_capability: categorize_v2
154+ required_capability: categorize_v3
155155
156156FROM sample_data
157157 | EVAL message = ["Banana", "Bread"]
@@ -165,7 +165,7 @@ COUNT():long | CATEGORIZE(message):keyword
165165;
166166
167167mv const in parameter
168- required_capability: categorize_v2
168+ required_capability: categorize_v3
169169
170170FROM sample_data
171171 | STATS COUNT() BY c = CATEGORIZE(["Banana", "Bread"])
@@ -178,7 +178,7 @@ COUNT():long | c:keyword
178178;
179179
180180agg alias shadowing
181- required_capability: categorize_v2
181+ required_capability: categorize_v3
182182
183183FROM sample_data
184184 | STATS c = COUNT() BY c = CATEGORIZE(["Banana", "Bread"])
@@ -193,7 +193,7 @@ c:keyword
193193;
194194
195195chained aggregations using categorize
196- required_capability: categorize_v2
196+ required_capability: categorize_v3
197197
198198FROM sample_data
199199 | STATS COUNT() BY category=CATEGORIZE(message)
@@ -208,7 +208,7 @@ COUNT():long | category:keyword
208208;
209209
210210stats without aggs
211- required_capability: categorize_v2
211+ required_capability: categorize_v3
212212
213213FROM sample_data
214214 | STATS BY category=CATEGORIZE(message)
@@ -222,7 +222,7 @@ category:keyword
222222;
223223
224224text field
225- required_capability: categorize_v2
225+ required_capability: categorize_v3
226226
227227FROM hosts
228228 | STATS COUNT() BY category=CATEGORIZE(host_group)
@@ -235,7 +235,7 @@ COUNT():long | category:keyword
235235 2 | .*?servers.*?
236236;
237237
238- required_capability: categorize_v2
238+ required_capability: categorize_v3
239239
240240FROM sample_data
241241 | STATS COUNT() BY category=CATEGORIZE(TO_UPPER(message))
@@ -249,7 +249,7 @@ COUNT():long | category:keyword
249249;
250250
251251on CONCAT
252- required_capability: categorize_v2
252+ required_capability: categorize_v3
253253
254254FROM sample_data
255255 | STATS COUNT() BY category=CATEGORIZE(CONCAT(message, " banana"))
@@ -263,7 +263,7 @@ COUNT():long | category:keyword
263263;
264264
265265on CONCAT with unicode
266- required_capability: categorize_v2
266+ required_capability: categorize_v3
267267
268268FROM sample_data
269269 | STATS COUNT() BY category=CATEGORIZE(CONCAT(message, " 👍🏽😊"))
@@ -277,7 +277,7 @@ COUNT():long | category:keyword
277277;
278278
279279on REVERSE(CONCAT())
280- required_capability: categorize_v2
280+ required_capability: categorize_v3
281281
282282FROM sample_data
283283 | STATS COUNT() BY category=CATEGORIZE(REVERSE(CONCAT(message, " 👍🏽😊")))
@@ -291,7 +291,7 @@ COUNT():long | category:keyword
291291;
292292
293293and then TO_LOWER
294- required_capability: categorize_v2
294+ required_capability: categorize_v3
295295
296296FROM sample_data
297297 | STATS COUNT() BY category=CATEGORIZE(message)
@@ -307,7 +307,7 @@ COUNT():long | category:keyword
307307
308308# Throws NPE - Requires nulls support
309309on const empty string-Ignore
310- required_capability: categorize_v2
310+ required_capability: categorize_v3
311311
312312FROM sample_data
313313 | STATS COUNT() BY category=CATEGORIZE("")
@@ -320,7 +320,7 @@ COUNT():long | category:keyword
320320
321321# Throws NPE - Requires nulls support
322322on const empty string from eval-Ignore
323- required_capability: categorize_v2
323+ required_capability: categorize_v3
324324
325325FROM sample_data
326326 | EVAL x = ""
@@ -334,7 +334,7 @@ COUNT():long | category:keyword
334334
335335# Doesn't give the correct results - Requires nulls support
336336on null-Ignore
337- required_capability: categorize_v2
337+ required_capability: categorize_v3
338338
339339FROM sample_data
340340 | EVAL x = null
@@ -348,7 +348,7 @@ COUNT():long | category:keyword
348348
349349# Doesn't give the correct results - Requires nulls support
350350on null string-Ignore
351- required_capability: categorize_v2
351+ required_capability: categorize_v3
352352
353353FROM sample_data
354354 | EVAL x = null::string
@@ -361,7 +361,7 @@ COUNT():long | category:keyword
361361;
362362
363363filtering out all data
364- required_capability: categorize_v2
364+ required_capability: categorize_v3
365365
366366FROM sample_data
367367 | WHERE @timestamp < "2023-10-23T00:00:00Z"
@@ -373,7 +373,7 @@ COUNT():long | category:keyword
373373;
374374
375375filtering out all data with constant
376- required_capability: categorize_v2
376+ required_capability: categorize_v3
377377
378378FROM sample_data
379379 | STATS COUNT() BY category=CATEGORIZE(message)
@@ -384,7 +384,7 @@ COUNT():long | category:keyword
384384;
385385
386386drop output columns
387- required_capability: categorize_v2
387+ required_capability: categorize_v3
388388
389389FROM sample_data
390390 | STATS count=COUNT() BY category=CATEGORIZE(message)
@@ -399,7 +399,7 @@ x:integer
399399;
400400
401401category value processing
402- required_capability: categorize_v2
402+ required_capability: categorize_v3
403403
404404ROW message = ["connected to a", "connected to b", "disconnected"]
405405 | STATS COUNT() BY category=CATEGORIZE(message)
@@ -413,7 +413,7 @@ COUNT():long | category:keyword
413413;
414414
415415row aliases
416- required_capability: categorize_v2
416+ required_capability: categorize_v3
417417
418418ROW message = "connected to xyz"
419419 | EVAL x = message
@@ -427,7 +427,7 @@ COUNT():long | category:keyword | y:keyword
427427;
428428
429429from aliases
430- required_capability: categorize_v2
430+ required_capability: categorize_v3
431431
432432FROM sample_data
433433 | EVAL x = message
@@ -443,7 +443,7 @@ COUNT():long | category:keyword | y:keyword
443443;
444444
445445row aliases with keep
446- required_capability: categorize_v2
446+ required_capability: categorize_v3
447447
448448ROW message = "connected to xyz"
449449 | EVAL x = message
@@ -459,7 +459,7 @@ COUNT():long | y:keyword
459459;
460460
461461from aliases with keep
462- required_capability: categorize_v2
462+ required_capability: categorize_v3
463463
464464FROM sample_data
465465 | EVAL x = message
@@ -477,7 +477,7 @@ COUNT():long | y:keyword
477477;
478478
479479row rename
480- required_capability: categorize_v2
480+ required_capability: categorize_v3
481481
482482ROW message = "connected to xyz"
483483 | RENAME message as x
@@ -491,7 +491,7 @@ COUNT():long | y:keyword
491491;
492492
493493from rename
494- required_capability: categorize_v2
494+ required_capability: categorize_v3
495495
496496FROM sample_data
497497 | RENAME message as x
@@ -507,7 +507,7 @@ COUNT():long | y:keyword
507507;
508508
509509row drop
510- required_capability: categorize_v2
510+ required_capability: categorize_v3
511511
512512ROW message = "connected to a"
513513 | STATS c = COUNT() BY category=CATEGORIZE(message)
@@ -520,7 +520,7 @@ c:long
520520;
521521
522522from drop
523- required_capability: categorize_v2
523+ required_capability: categorize_v3
524524
525525FROM sample_data
526526 | STATS c = COUNT() BY category=CATEGORIZE(message)
0 commit comments