ES|QL: fix validation of SORT by aggregate functions (elastic#117316)

Author: luigidellaquila

docs/changelog/117316.yaml

@@ -0,0 +1,5 @@
+pr: 117316
+summary: Fix validation of SORT by aggregate functions
+area: ES|QL
+type: bug
+issues: []

docs/reference/esql/functions/kibana/definition/match_operator.json

@@ -215,6 +215,7 @@ else if (p instanceof Lookup lookup) {
             checkOperationsOnUnsignedLong(p, failures);
             checkBinaryComparison(p, failures);
             checkForSortableDataTypes(p, failures);
+            checkSort(p, failures);
 
             checkFullTextQueryFunctions(p, failures);
         });
@@ -232,6 +233,18 @@ else if (p instanceof Lookup lookup) {
         return failures;
     }
 
+    private void checkSort(LogicalPlan p, Set<Failure> failures) {
+        if (p instanceof OrderBy ob) {
+            ob.order().forEach(o -> {
+                o.forEachDown(Function.class, f -> {
+                    if (f instanceof AggregateFunction) {
+                        failures.add(fail(f, "Aggregate functions are not allowed in SORT [{}]", f.functionName()));
+                    }
+                });
+            });
+        }
+    }
+
     private static void checkFilterConditionType(LogicalPlan p, Set<Failure> localFailures) {
         if (p instanceof Filter f) {
             Expression condition = f.condition();

docs/reference/esql/functions/types/match_operator.asciidoc

@@ -1791,6 +1791,13 @@ public void testCategorizeWithinAggregations() {
         );
     }
 
+    public void testSortByAggregate() {
+        assertEquals("1:18: Aggregate functions are not allowed in SORT [COUNT]", error("ROW a = 1 | SORT count(*)"));
+        assertEquals("1:28: Aggregate functions are not allowed in SORT [COUNT]", error("ROW a = 1 | SORT to_string(count(*))"));
+        assertEquals("1:22: Aggregate functions are not allowed in SORT [MAX]", error("ROW a = 1 | SORT 1 + max(a)"));
+        assertEquals("1:18: Aggregate functions are not allowed in SORT [COUNT]", error("FROM test | SORT count(*)"));
+    }
+
     private void query(String query) {
         defaultAnalyzer.analyze(parser.createStatement(query));
     }