11standard aggs
2- required_capability: categorize_v3
2+ required_capability: categorize_v4
33
44FROM sample_data
55 | STATS count=COUNT(),
@@ -17,7 +17,7 @@ count:long | sum:long | avg:double | count_distinct:long | category:keyw
1717;
1818
1919values aggs
20- required_capability: categorize_v3
20+ required_capability: categorize_v4
2121
2222FROM sample_data
2323 | STATS values=MV_SORT(VALUES(message)),
@@ -33,7 +33,7 @@ values:keyword | top
3333;
3434
3535mv
36- required_capability: categorize_v3
36+ required_capability: categorize_v4
3737
3838FROM mv_sample_data
3939 | STATS COUNT(), SUM(event_duration) BY category=CATEGORIZE(message)
@@ -48,7 +48,7 @@ COUNT():long | SUM(event_duration):long | category:keyword
4848;
4949
5050row mv
51- required_capability: categorize_v3
51+ required_capability: categorize_v4
5252
5353ROW message = ["connected to a", "connected to b", "disconnected"], str = ["a", "b", "c"]
5454 | STATS COUNT(), VALUES(str) BY category=CATEGORIZE(message)
@@ -61,7 +61,7 @@ COUNT():long | VALUES(str):keyword | category:keyword
6161;
6262
6363skips stopwords
64- required_capability: categorize_v2
64+ required_capability: categorize_v4
6565
6666ROW message = ["Mon Tue connected to a", "Jul Aug connected to b September ", "UTC connected GMT to c UTC"]
6767 | STATS COUNT() BY category=CATEGORIZE(message)
@@ -73,7 +73,7 @@ COUNT():long | category:keyword
7373;
7474
7575with multiple indices
76- required_capability: categorize_v3
76+ required_capability: categorize_v4
7777required_capability: union_types
7878
7979FROM sample_data*
@@ -88,7 +88,7 @@ COUNT():long | category:keyword
8888;
8989
9090mv with many values
91- required_capability: categorize_v3
91+ required_capability: categorize_v4
9292
9393FROM employees
9494 | STATS COUNT() BY category=CATEGORIZE(job_positions)
@@ -105,7 +105,7 @@ COUNT():long | category:keyword
105105;
106106
107107mv with many values and SUM
108- required_capability: categorize_v3
108+ required_capability: categorize_v4
109109
110110FROM employees
111111 | STATS SUM(languages) BY category=CATEGORIZE(job_positions)
@@ -120,7 +120,7 @@ SUM(languages):long | category:keyword
120120;
121121
122122mv with many values and nulls and SUM
123- required_capability: categorize_v3
123+ required_capability: categorize_v4
124124
125125FROM employees
126126 | STATS SUM(languages) BY category=CATEGORIZE(job_positions)
@@ -134,7 +134,7 @@ SUM(languages):long | category:keyword
134134;
135135
136136mv via eval
137- required_capability: categorize_v3
137+ required_capability: categorize_v4
138138
139139FROM sample_data
140140 | EVAL message = MV_APPEND(message, "Banana")
@@ -150,7 +150,7 @@ COUNT():long | category:keyword
150150;
151151
152152mv via eval const
153- required_capability: categorize_v3
153+ required_capability: categorize_v4
154154
155155FROM sample_data
156156 | EVAL message = ["Banana", "Bread"]
@@ -164,7 +164,7 @@ COUNT():long | category:keyword
164164;
165165
166166mv via eval const without aliases
167- required_capability: categorize_v3
167+ required_capability: categorize_v4
168168
169169FROM sample_data
170170 | EVAL message = ["Banana", "Bread"]
@@ -178,7 +178,7 @@ COUNT():long | CATEGORIZE(message):keyword
178178;
179179
180180mv const in parameter
181- required_capability: categorize_v3
181+ required_capability: categorize_v4
182182
183183FROM sample_data
184184 | STATS COUNT() BY c = CATEGORIZE(["Banana", "Bread"])
@@ -191,7 +191,7 @@ COUNT():long | c:keyword
191191;
192192
193193agg alias shadowing
194- required_capability: categorize_v3
194+ required_capability: categorize_v4
195195
196196FROM sample_data
197197 | STATS c = COUNT() BY c = CATEGORIZE(["Banana", "Bread"])
@@ -206,7 +206,7 @@ c:keyword
206206;
207207
208208chained aggregations using categorize
209- required_capability: categorize_v3
209+ required_capability: categorize_v4
210210
211211FROM sample_data
212212 | STATS COUNT() BY category=CATEGORIZE(message)
@@ -221,7 +221,7 @@ COUNT():long | category:keyword
221221;
222222
223223stats without aggs
224- required_capability: categorize_v3
224+ required_capability: categorize_v4
225225
226226FROM sample_data
227227 | STATS BY category=CATEGORIZE(message)
@@ -235,7 +235,7 @@ category:keyword
235235;
236236
237237text field
238- required_capability: categorize_v3
238+ required_capability: categorize_v4
239239
240240FROM hosts
241241 | STATS COUNT() BY category=CATEGORIZE(host_group)
@@ -250,7 +250,7 @@ COUNT():long | category:keyword
250250;
251251
252252on TO_UPPER
253- required_capability: categorize_v3
253+ required_capability: categorize_v4
254254
255255FROM sample_data
256256 | STATS COUNT() BY category=CATEGORIZE(TO_UPPER(message))
@@ -264,7 +264,7 @@ COUNT():long | category:keyword
264264;
265265
266266on CONCAT
267- required_capability: categorize_v3
267+ required_capability: categorize_v4
268268
269269FROM sample_data
270270 | STATS COUNT() BY category=CATEGORIZE(CONCAT(message, " banana"))
@@ -278,7 +278,7 @@ COUNT():long | category:keyword
278278;
279279
280280on CONCAT with unicode
281- required_capability: categorize_v3
281+ required_capability: categorize_v4
282282
283283FROM sample_data
284284 | STATS COUNT() BY category=CATEGORIZE(CONCAT(message, " 👍🏽😊"))
@@ -292,7 +292,7 @@ COUNT():long | category:keyword
292292;
293293
294294on REVERSE(CONCAT())
295- required_capability: categorize_v3
295+ required_capability: categorize_v4
296296
297297FROM sample_data
298298 | STATS COUNT() BY category=CATEGORIZE(REVERSE(CONCAT(message, " 👍🏽😊")))
@@ -306,7 +306,7 @@ COUNT():long | category:keyword
306306;
307307
308308and then TO_LOWER
309- required_capability: categorize_v3
309+ required_capability: categorize_v4
310310
311311FROM sample_data
312312 | STATS COUNT() BY category=CATEGORIZE(message)
@@ -321,7 +321,7 @@ COUNT():long | category:keyword
321321;
322322
323323on const empty string
324- required_capability: categorize_v3
324+ required_capability: categorize_v4
325325
326326FROM sample_data
327327 | STATS COUNT() BY category=CATEGORIZE("")
@@ -333,7 +333,7 @@ COUNT():long | category:keyword
333333;
334334
335335on const empty string from eval
336- required_capability: categorize_v3
336+ required_capability: categorize_v4
337337
338338FROM sample_data
339339 | EVAL x = ""
@@ -346,7 +346,7 @@ COUNT():long | category:keyword
346346;
347347
348348on null
349- required_capability: categorize_v3
349+ required_capability: categorize_v4
350350
351351FROM sample_data
352352 | EVAL x = null
@@ -359,7 +359,7 @@ COUNT():long | SUM(event_duration):long | category:keyword
359359;
360360
361361on null string
362- required_capability: categorize_v3
362+ required_capability: categorize_v4
363363
364364FROM sample_data
365365 | EVAL x = null::string
@@ -372,7 +372,7 @@ COUNT():long | category:keyword
372372;
373373
374374filtering out all data
375- required_capability: categorize_v3
375+ required_capability: categorize_v4
376376
377377FROM sample_data
378378 | WHERE @timestamp < "2023-10-23T00:00:00Z"
@@ -384,7 +384,7 @@ COUNT():long | category:keyword
384384;
385385
386386filtering out all data with constant
387- required_capability: categorize_v3
387+ required_capability: categorize_v4
388388
389389FROM sample_data
390390 | STATS COUNT() BY category=CATEGORIZE(message)
@@ -395,7 +395,7 @@ COUNT():long | category:keyword
395395;
396396
397397drop output columns
398- required_capability: categorize_v3
398+ required_capability: categorize_v4
399399
400400FROM sample_data
401401 | STATS count=COUNT() BY category=CATEGORIZE(message)
@@ -410,7 +410,7 @@ x:integer
410410;
411411
412412category value processing
413- required_capability: categorize_v3
413+ required_capability: categorize_v4
414414
415415ROW message = ["connected to a", "connected to b", "disconnected"]
416416 | STATS COUNT() BY category=CATEGORIZE(message)
@@ -424,7 +424,7 @@ COUNT():long | category:keyword
424424;
425425
426426row aliases
427- required_capability: categorize_v3
427+ required_capability: categorize_v4
428428
429429ROW message = "connected to xyz"
430430 | EVAL x = message
@@ -438,7 +438,7 @@ COUNT():long | category:keyword | y:keyword
438438;
439439
440440from aliases
441- required_capability: categorize_v3
441+ required_capability: categorize_v4
442442
443443FROM sample_data
444444 | EVAL x = message
@@ -454,7 +454,7 @@ COUNT():long | category:keyword | y:keyword
454454;
455455
456456row aliases with keep
457- required_capability: categorize_v3
457+ required_capability: categorize_v4
458458
459459ROW message = "connected to xyz"
460460 | EVAL x = message
@@ -470,7 +470,7 @@ COUNT():long | y:keyword
470470;
471471
472472from aliases with keep
473- required_capability: categorize_v3
473+ required_capability: categorize_v4
474474
475475FROM sample_data
476476 | EVAL x = message
@@ -488,7 +488,7 @@ COUNT():long | y:keyword
488488;
489489
490490row rename
491- required_capability: categorize_v3
491+ required_capability: categorize_v4
492492
493493ROW message = "connected to xyz"
494494 | RENAME message as x
@@ -502,7 +502,7 @@ COUNT():long | y:keyword
502502;
503503
504504from rename
505- required_capability: categorize_v3
505+ required_capability: categorize_v4
506506
507507FROM sample_data
508508 | RENAME message as x
@@ -518,7 +518,7 @@ COUNT():long | y:keyword
518518;
519519
520520row drop
521- required_capability: categorize_v3
521+ required_capability: categorize_v4
522522
523523ROW message = "connected to a"
524524 | STATS c = COUNT() BY category=CATEGORIZE(message)
@@ -531,7 +531,7 @@ c:long
531531;
532532
533533from drop
534- required_capability: categorize_v3
534+ required_capability: categorize_v4
535535
536536FROM sample_data
537537 | STATS c = COUNT() BY category=CATEGORIZE(message)
0 commit comments