Merge branch 'main' into cache-metrics-online-prewarming-type

Author: andreidan

docs/reference/elasticsearch/rest-apis/sort-search-results.md

@@ -36,16 +36,27 @@ GET /my-index-000001/_search
 {
   "sort" : [
     { "post_date" : {"order" : "asc", "format": "strict_date_optional_time_nanos"}},
-    "user",
     { "name" : "desc" },
     { "age" : "desc" },
+    "user",
     "_score"
   ],
   "query" : {
     "term" : { "user" : "kimchy" }
   }
 }
 ```
+Order matters when defining multiple sort fields, because {{es}} attempts to sort on the first field in the array. Each subsequent field in the array is only used if the previous fields result in a tie. If documents have identical values across all specified sort fields, {{es}} uses the document ID as the final tie-breaker.
+
+Here's how the example query attempts to sort results:
+
+- First by `post_date` 
+- If `post_date` values are identical, sorts by `name` 
+- If both `post_date` and `name` are identical, sorts by `age`
+- If the first three fields are identical, sorts by `user` 
+- If all previous fields are identical, sorts by `_score`
+
+By default, Elasticsearch sorts `numeric` fields in descending order and `string` fields in ascending order unless you explicitly specify otherwise. All three formats shown in the example above are valid. Some make the sort order explicit, while others rely on Elasticsearch’s default behavior.
 
 ::::{note}
 `_doc` has no real use-case besides being the most efficient sort order. So if you don’t care about the order in which documents are returned, then you should sort by `_doc`. This especially helps when [scrolling](/reference/elasticsearch/rest-apis/paginate-search-results.md#scroll-search-results).

muted-tests.yml

@@ -417,6 +417,9 @@ tests:
 - class: org.elasticsearch.xpack.test.rest.XPackRestIT
   method: test {p0=transform/transforms_start_stop/Test start/stop/start continuous transform}
   issue: https://github.com/elastic/elasticsearch/issues/126755
+- class: org.elasticsearch.xpack.esql.qa.mixed.MixedClusterEsqlSpecIT
+  method: test {keep.StatsBySubFieldSortedByKey SYNC}
+  issue: https://github.com/elastic/elasticsearch/issues/126765
 
 # Examples:
 #

x-pack/plugin/src/yamlRestTest/resources/rest-api-spec/test/esql/180_match_operator.yml

@@ -125,7 +125,7 @@ setup:
 
   - match: { status: 400 }
   - match: { error.type: verification_exception }
-  - match: { error.reason: "Found 1 problem\nline 1:19: Unknown column [something]" }
+  - match: { error.reason: "/Unknown.column.\\[something\\]/" }
 
 ---
 "match on eval column":
@@ -139,7 +139,7 @@ setup:
 
   - match: { status: 400 }
   - match: { error.type: verification_exception }
-  - match: { error.reason: "Found 1 problem\nline 1:60: [:] operator cannot operate on [upper_content], which is not a field from an index mapping" }
+  - match: { error.reason: "/operator.cannot.operate.on.\\[upper_content\\],.which.is.not.a.field.from.an.index.mapping/" }
 
 ---
 "match on overwritten column":
@@ -153,7 +153,7 @@ setup:
 
   - match: { status: 400 }
   - match: { error.type: verification_exception }
-  - match: { error.reason: "Found 1 problem\nline 1:78: [:] operator cannot operate on [content], which is not a field from an index mapping" }
+  - match: { error.reason: "/operator.cannot.operate.on.\\[content\\],.which.is.not.a.field.from.an.index.mapping/" }
 
 ---
 "match after stats":
@@ -167,7 +167,7 @@ setup:
 
   - match: { status: 400 }
   - match: { error.type: verification_exception }
-  - match: { error.reason: "Found 1 problem\nline 1:36: Unknown column [content], did you mean [count(*)]?" }
+  - match: { error.reason: "/Unknown.column.\\[content\\]/" }
 
 ---
 "match with disjunctions":
@@ -199,4 +199,4 @@ setup:
 
   - match: { status: 400 }
   - match: { error.type: verification_exception }
-  - match: { error.reason: "Found 1 problem\nline 1:34: [:] operator is only supported in WHERE commands" }
+  - match: { error.reason: "/operator.is.only.supported.in.WHERE.commands/" }