[9.0] Split ES|QL functions/operators/commands into separate pages for similar functions and make commands examples generated (#126279)

docs/redirects.yml

@@ -0,0 +1,3 @@
+redirects:
+  'reference/query-languages/esql/esql-functions-operators.md': '!reference/query-languages/esql/functions-operators/aggregation-functions.md'
+  'reference/query-languages/esql/esql-commands.md': '!reference/query-languages/esql/commands/processing-commands.md'

docs/reference/query-languages/esql/_snippets/commands/examples/date.csv-spec/docsNowWhere.md

@@ -0,0 +1,6 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM sample_data
+| WHERE @timestamp > NOW() - 1 hour
+```

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/basicDissect.md

@@ -0,0 +1,11 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "2023-01-23T12:15:00.000Z - some text - 127.0.0.1"
+| DISSECT a """%{date} - %{msg} - %{ip}"""
+| KEEP date, msg, ip
+```
+
+| date:keyword | msg:keyword | ip:keyword |
+| --- | --- | --- |
+| 2023-01-23T12:15:00.000Z | some text | 127.0.0.1 |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/basicGrok.md

@@ -0,0 +1,11 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "2023-01-23T12:15:00.000Z 127.0.0.1 [email protected] 42"
+| GROK a """%{TIMESTAMP_ISO8601:date} %{IP:ip} %{EMAILADDRESS:email} %{NUMBER:num}"""
+| KEEP date, ip, email, num
+```
+
+| date:keyword | ip:keyword | email:keyword | num:keyword |
+| --- | --- | --- | --- |
+| 2023-01-23T12:15:00.000Z | 127.0.0.1 | [email protected] | 42 |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/dissectWithToDatetime.md

@@ -0,0 +1,12 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "2023-01-23T12:15:00.000Z - some text - 127.0.0.1"
+| DISSECT a """%{date} - %{msg} - %{ip}"""
+| KEEP date, msg, ip
+| EVAL date = TO_DATETIME(date)
+```
+
+| msg:keyword | ip:keyword | date:date |
+| --- | --- | --- |
+| some text | 127.0.0.1 | 2023-01-23T12:15:00.000Z |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/grokWithConversionSuffix.md

@@ -0,0 +1,11 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "2023-01-23T12:15:00.000Z 127.0.0.1 [email protected] 42"
+| GROK a """%{TIMESTAMP_ISO8601:date} %{IP:ip} %{EMAILADDRESS:email} %{NUMBER:num:int}"""
+| KEEP date, ip, email, num
+```
+
+| date:keyword | ip:keyword | email:keyword | num:integer |
+| --- | --- | --- | --- |
+| 2023-01-23T12:15:00.000Z | 127.0.0.1 | [email protected] | 42 |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/grokWithDuplicateFieldNames.md

@@ -0,0 +1,13 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM addresses
+| KEEP city.name, zip_code
+| GROK zip_code """%{WORD:zip_parts} %{WORD:zip_parts}"""
+```
+
+| city.name:keyword | zip_code:keyword | zip_parts:keyword |
+| --- | --- | --- |
+| Amsterdam | 1016 ED | ["1016", "ED"] |
+| San Francisco | CA 94108 | ["CA", "94108"] |
+| Tokyo | 100-7014 | null |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/grokWithToDatetime.md

@@ -0,0 +1,12 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "2023-01-23T12:15:00.000Z 127.0.0.1 [email protected] 42"
+| GROK a """%{TIMESTAMP_ISO8601:date} %{IP:ip} %{EMAILADDRESS:email} %{NUMBER:num:int}"""
+| KEEP date, ip, email, num
+| EVAL date = TO_DATETIME(date)
+```
+
+| ip:keyword | email:keyword | num:integer | date:date |
+| --- | --- | --- | --- |
+| 127.0.0.1 | [email protected] | 42 | 2023-01-23T12:15:00.000Z |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/keep.md

@@ -0,0 +1,14 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP emp_no, first_name, last_name, height
+```
+
+| emp_no:integer | first_name:keyword | last_name:keyword | height:double |
+| --- | --- | --- | --- |
+| 10001 | Georgi | Facello | 2.03 |
+| 10002 | Bezalel | Simmel | 2.08 |
+| 10003 | Parto | Bamford | 1.83 |
+| 10004 | Chirstian | Koblick | 1.78 |
+| 10005 | Kyoichi | Maliniak | 2.05 |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/keepCompleteName.md

@@ -0,0 +1,9 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name, first_name*
+```
+
+| first_name:keyword | last_name:keyword |
+| --- | --- |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/keepDoubleWildcard.md

@@ -0,0 +1,9 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP h*, *
+```
+
+| height:double | height.float:double | height.half_float:double | height.scaled_float:double | hire_date:date | avg_worked_seconds:long | birth_date:date | emp_no:integer | first_name:keyword | gender:keyword | is_rehired:boolean | job_positions:keyword | languages:integer | languages.byte:integer | languages.long:long | languages.short:integer | last_name:keyword | salary:integer | salary_change:double | salary_change.int:integer | salary_change.keyword:keyword | salary_change.long:long | still_hired:boolean |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/keepWildcard.md

@@ -0,0 +1,9 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP h*
+```
+
+| height:double | height.float:double | height.half_float:double | height.scaled_float:double | hire_date:date |
+| --- | --- | --- | --- | --- |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/keepWildcardLowest.md

@@ -0,0 +1,9 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP *, first_name
+```
+
+| avg_worked_seconds:long | birth_date:date | emp_no:integer | gender:keyword | height:double | height.float:double | height.half_float:double | height.scaled_float:double | hire_date:date | is_rehired:boolean | job_positions:keyword | languages:integer | languages.byte:integer | languages.long:long | languages.short:integer | last_name:keyword | salary:integer | salary_change:double | salary_change.int:integer | salary_change.keyword:keyword | salary_change.long:long | still_hired:boolean | first_name:keyword |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/keepWildcardPrecedence.md

@@ -0,0 +1,9 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name*, last_name, first_na*
+```
+
+| last_name:keyword | first_name:keyword |
+| --- | --- |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/rename.md

@@ -0,0 +1,7 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name, still_hired
+| RENAME  still_hired AS employed
+```

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/renameMultipleColumns.md

@@ -0,0 +1,7 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name
+| RENAME first_name AS fn, last_name AS ln
+```

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/renameMultipleColumnsDifferentCommands.md

@@ -0,0 +1,8 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name
+| RENAME first_name AS fn
+| RENAME last_name AS ln
+```

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/sort.md

@@ -0,0 +1,7 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name, height
+| SORT height
+```

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/sortDesc.md

@@ -0,0 +1,7 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name, height
+| SORT height DESC
+```

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/sortNullsFirst.md

@@ -0,0 +1,7 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name, height
+| SORT first_name ASC NULLS FIRST
+```

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/sortTie.md

@@ -0,0 +1,7 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name, height
+| SORT height DESC, first_name ASC
+```

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/where.md

@@ -0,0 +1,7 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name, still_hired
+| WHERE still_hired == true
+```

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/whereBoolean.md

@@ -0,0 +1,7 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name, still_hired
+| WHERE still_hired
+```

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/whereFunction.md

@@ -0,0 +1,7 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP first_name, last_name, height
+| WHERE LENGTH(first_name) < 4
+```

docs/reference/query-languages/esql/_snippets/commands/examples/drop.csv-spec/height.md

@@ -0,0 +1,6 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| DROP height
+```

docs/reference/query-languages/esql/_snippets/commands/examples/drop.csv-spec/heightWithWildcard.md

@@ -0,0 +1,6 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| DROP height*
+```

docs/reference/query-languages/esql/_snippets/commands/examples/enrich.csv-spec/enrich.md

@@ -0,0 +1,10 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW language_code = "1"
+| ENRICH languages_policy
+```
+
+| language_code:keyword | language_name:keyword |
+| --- | --- |
+| 1 | English |

docs/reference/query-languages/esql/_snippets/commands/examples/enrich.csv-spec/enrich_on.md

@@ -0,0 +1,10 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "1"
+| ENRICH languages_policy ON a
+```
+
+| a:keyword | language_name:keyword |
+| --- | --- |
+| 1 | English |

docs/reference/query-languages/esql/_snippets/commands/examples/enrich.csv-spec/enrich_rename.md

@@ -0,0 +1,10 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "1"
+| ENRICH languages_policy ON a WITH name = language_name
+```
+
+| a:keyword | name:keyword |
+| --- | --- |
+| 1 | English |

docs/reference/query-languages/esql/_snippets/commands/examples/enrich.csv-spec/enrich_with.md

@@ -0,0 +1,10 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "1"
+| ENRICH languages_policy ON a WITH language_name
+```
+
+| a:keyword | language_name:keyword |
+| --- | --- |
+| 1 | English |

docs/reference/query-languages/esql/_snippets/commands/examples/eval.csv-spec/eval.md

@@ -0,0 +1,14 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| SORT emp_no
+| KEEP first_name, last_name, height
+| EVAL height_feet = height * 3.281, height_cm = height * 100
+```
+
+| first_name:keyword | last_name:keyword | height:double | height_feet:double | height_cm:double |
+| --- | --- | --- | --- | --- |
+| Georgi | Facello | 2.03 | 6.66043 | 202.99999999999997 |
+| Bezalel | Simmel | 2.08 | 6.82448 | 208.0 |
+| Parto | Bamford | 1.83 | 6.004230000000001 | 183.0 |

docs/reference/query-languages/esql/_snippets/commands/examples/eval.csv-spec/evalReplace.md

@@ -0,0 +1,14 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| SORT emp_no
+| KEEP first_name, last_name, height
+| EVAL height = height * 3.281
+```
+
+| first_name:keyword | last_name:keyword | height:double |
+| --- | --- | --- |
+| Georgi | Facello | 6.66043 |
+| Bezalel | Simmel | 6.82448 |
+| Parto | Bamford | 6.004230000000001 |

docs/reference/query-languages/esql/_snippets/commands/examples/eval.csv-spec/evalUnnamedColumn.md

@@ -0,0 +1,14 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| SORT emp_no
+| KEEP first_name, last_name, height
+| EVAL height * 3.281
+```
+
+| first_name:keyword | last_name:keyword | height:double | height * 3.281:double |
+| --- | --- | --- | --- |
+| Georgi | Facello | 2.03 | 6.66043 |
+| Bezalel | Simmel | 2.08 | 6.82448 |
+| Parto | Bamford | 1.83 | 6.004230000000001 |