ESQL: Support for String and IP and boolean in the `TOP` aggregate function

[nik9000]

The ESQL aggregate function TOP supports numerics and dates. We'd love to get support for ip, boolean, and keyword/text fields. These are all unique and different.

• ip fields are a fixed length string type. We could use exactly the same technique to support ip.
• boolean fields are single bit fields and their sorting is funky. In this case I think having a small a small counter for the number of falses and the number of trues you've seen is probably fine. That's kind of how VALUES works for booleans - though it deduplicates so instead of a counter it's just two boolean values.
• text/keyword fields have a variable length. They are super useful to support, but they are probably the most difficult. Maybe we'd store "ordinal" values in the min heap and we'd use a side car structure to assign ordinals. Or something. ESQL: TOP support for strings #113183

[elasticsearchmachine]

Pinging @elastic/es-analytical-engine (Team:Analytics)

[nik9000]

An example of how keyword would be useful is,

FROM logs
| STATS TOP(hostname, 10, "desc") BY service

This gets you a list of which hosts are hosting what service. Except if there are more than 10 hosts with the service, then it just gets you the first 10. Which is probably good for a UI that'll display a bunch of services. It can just say host1, host2, host3, ..... Then if you need all the hosts for that service it can run a second query.

In this case we really don't care too much about the sorting aspect of TOP, if there were an aggregate function that just gave us the 10 values that it ran into the fastest, that'd be even better. But we don't have that. So we'd use TOP.