Skip to content

Commit 5058180

Browse files
EC2 Default Userclaude
EC2 Default User
and
claude
committed
Add OpenTelemetry logs-based PPL doctests
Migrate PPL doctest cases from accounts/people indexes to otellogs dataset. Commands migrated (37 files): - search, where, sort, stats, fields, head, rename, eval, dedup, top - rare, fillnull, parse, grok, join, lookup, append, table, reverse - regex, replace, rex, trendline, eventstats, bin, streamstats - addcoltotals, addtotals, appendcol, appendpipe, transpose, timechart - subquery, patterns, multisearch, chart, describe, explain Functions migrated (14 files): - string, math, condition, datetime, conversion, aggregations, ip, json - collection, cryptographic, expressions, relevance, statistical, system Test results: All ~280 test cases pass Run tests: ./gradlew doctest -Pdocs=otel -DignorePrometheus Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent 0a4495b commit 5058180

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+7848
-0
lines changed

‎docs/user/ppl/otel/cmd/addcoltotals.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# addcoltotals (otellogs)
2+
3+
The `addcoltotals` command computes the sum of each column and adds a summary row showing the total.
4+
5+
## Example 1: Basic example
6+
7+
```ppl
8+
source=otellogs
9+
| sort @timestamp
10+
| fields severityText, severityNumber, flags
11+
| head 3
12+
| addcoltotals labelfield='severityText'
13+
```
14+
15+
The query returns the following results:
16+
17+
```text
18+
fetched rows / total rows = 4/4
19+
+--------------+----------------+-------+
20+
| severityText | severityNumber | flags |
21+
|--------------+----------------+-------|
22+
| INFO | 9 | 1 |
23+
| ERROR | 17 | 1 |
24+
| WARN | 13 | 0 |
25+
| Total | 39 | 2 |
26+
+--------------+----------------+-------+
27+
```
28+
29+
30+
## Example 2: Adding column totals with custom label
31+
32+
```ppl
33+
source=otellogs
34+
| stats count() by flags
35+
| addcoltotals `count()` label='Sum' labelfield='Total'
36+
```
37+
38+
The query returns the following results:
39+
40+
```text
41+
fetched rows / total rows = 3/3
42+
+---------+-------+-------+
43+
| count() | flags | Total |
44+
|---------+-------+-------|
45+
| 2 | 1 | null |
46+
| 30 | 0 | null |
47+
| 32 | null | Sum |
48+
+---------+-------+-------+
49+
```
50+
51+
52+
## Example 3: Using all options with stats
53+
54+
```ppl
55+
source=otellogs
56+
| where severityNumber > 10
57+
| stats avg(severityNumber) as avg_sev, count() as count by flags
58+
| head 3
59+
| addcoltotals avg_sev, count label='Sum' labelfield='Column Total'
60+
```
61+
62+
The query returns the following results:
63+
64+
```text
65+
fetched rows / total rows = 3/3
66+
+---------+-------+-------+--------------+
67+
| avg_sev | count | flags | Column Total |
68+
|---------+-------+-------+--------------|
69+
| 17.0 | 1 | 1 | null |
70+
| 16.0 | 15 | 0 | null |
71+
| 33.0 | 16 | null | Sum |
72+
+---------+-------+-------+--------------+
73+
```
74+

‎docs/user/ppl/otel/cmd/addtotals.md‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# addtotals (otellogs)
2+
3+
The `addtotals` command computes the sum of numeric fields and can create both column totals (summary row) and row totals (new field).
4+
5+
## Example 1: Basic example with column totals
6+
7+
```ppl
8+
source=otellogs
9+
| sort @timestamp
10+
| head 3
11+
| fields severityText, severityNumber, flags
12+
| addtotals col=true labelfield='severityText' label='Total'
13+
```
14+
15+
The query returns the following results:
16+
17+
```text
18+
fetched rows / total rows = 4/4
19+
+--------------+----------------+-------+-------+
20+
| severityText | severityNumber | flags | Total |
21+
|--------------+----------------+-------+-------|
22+
| INFO | 9 | 1 | 10 |
23+
| ERROR | 17 | 1 | 18 |
24+
| WARN | 13 | 0 | 13 |
25+
| Total | 39 | 2 | null |
26+
+--------------+----------------+-------+-------+
27+
```
28+
29+
30+
## Example 2: Column totals without row totals
31+
32+
```ppl
33+
source=otellogs
34+
| sort @timestamp
35+
| fields severityText, severityNumber, flags
36+
| head 4
37+
| addtotals col=true row=false label='Sum' labelfield='Total'
38+
```
39+
40+
The query returns the following results:
41+
42+
```text
43+
fetched rows / total rows = 5/5
44+
+--------------+----------------+-------+-------+
45+
| severityText | severityNumber | flags | Total |
46+
|--------------+----------------+-------+-------|
47+
| INFO | 9 | 1 | null |
48+
| ERROR | 17 | 1 | null |
49+
| WARN | 13 | 0 | null |
50+
| DEBUG | 5 | 0 | null |
51+
| null | 44 | 2 | Sum |
52+
+--------------+----------------+-------+-------+
53+
```
54+
55+
56+
## Example 3: Using all options
57+
58+
```ppl
59+
source=otellogs
60+
| where severityNumber > 10
61+
| stats avg(severityNumber) as avg_sev, count() as count by flags
62+
| head 3
63+
| addtotals avg_sev, count row=true col=true fieldname='Row Total' label='Sum' labelfield='Column Total'
64+
```
65+
66+
The query returns the following results:
67+
68+
```text
69+
fetched rows / total rows = 3/3
70+
+---------+-------+-------+-----------+--------------+
71+
| avg_sev | count | flags | Row Total | Column Total |
72+
|---------+-------+-------+-----------+--------------|
73+
| 17.0 | 1 | 1 | 18.0 | null |
74+
| 16.0 | 15 | 0 | 31.0 | null |
75+
| 33.0 | 16 | null | null | Sum |
76+
+---------+-------+-------+-----------+--------------+
77+
```
78+

‎docs/user/ppl/otel/cmd/append.md‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# append (otellogs)
2+
3+
The `append` command appends the results of a subsearch as additional rows to the end of the input search results.
4+
5+
## Example 1: Append rows from a count aggregation
6+
7+
The following query appends count by severityText to sum by severityText and flags:
8+
9+
```ppl
10+
source=otellogs
11+
| stats sum(severityNumber) by severityText, flags
12+
| sort - `sum(severityNumber)`
13+
| head 3
14+
| append [ source=otellogs | stats count(severityNumber) by severityText | sort - `count(severityNumber)` | head 3 ]
15+
```
16+
17+
The query returns the following results:
18+
19+
```text
20+
fetched rows / total rows = 6/6
21+
+---------------------+--------------+-------+-----------------------+
22+
| sum(severityNumber) | severityText | flags | count(severityNumber) |
23+
|---------------------+--------------+-------+-----------------------|
24+
| 24 | FATAL4 | 0 | null |
25+
| 23 | FATAL3 | 0 | null |
26+
| 22 | FATAL2 | 0 | null |
27+
| null | INFO | null | 7 |
28+
| null | ERROR | null | 2 |
29+
| null | WARN | null | 2 |
30+
+---------------------+--------------+-------+-----------------------+
31+
```
32+
33+
34+
## Example 2: Append rows with merged column names
35+
36+
The following query appends rows from sum by severityText to sum by severityText and flags, merging columns with the same field name:
37+
38+
```ppl
39+
source=otellogs
40+
| stats sum(severityNumber) as total by severityText, flags
41+
| sort - total
42+
| head 3
43+
| append [ source=otellogs | stats sum(severityNumber) as total by severityText | sort - total | head 3 ]
44+
```
45+
46+
The query returns the following results:
47+
48+
```text
49+
fetched rows / total rows = 6/6
50+
+-------+--------------+-------+
51+
| total | severityText | flags |
52+
|-------+--------------+-------|
53+
| 24 | FATAL4 | 0 |
54+
| 23 | FATAL3 | 0 |
55+
| 22 | FATAL2 | 0 |
56+
| 63 | INFO | null |
57+
| 34 | ERROR | null |
58+
| 26 | WARN | null |
59+
+-------+--------------+-------+
60+
```
61+
62+
63+
## Example 3: Append different aggregations
64+
65+
The following query appends average severity numbers to maximum severity numbers:
66+
67+
```ppl
68+
source=otellogs
69+
| stats max(severityNumber) as severity by flags
70+
| append [ source=otellogs | stats avg(severityNumber) as severity by flags ]
71+
| sort flags, severity
72+
```
73+
74+
The query returns the following results:
75+
76+
```text
77+
fetched rows / total rows = 4/4
78+
+--------------------+-------+
79+
| severity | flags |
80+
|--------------------+-------|
81+
| 12.466666666666667 | 0 |
82+
| 24 | 0 |
83+
| 13.0 | 1 |
84+
| 17 | 1 |
85+
+--------------------+-------+
86+
```

‎docs/user/ppl/otel/cmd/appendcol.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# appendcol (otellogs)
2+
3+
The `appendcol` command appends the result of a subsearch as additional columns to the input search results.
4+
5+
## Example 1: Append count aggregation to existing results
6+
7+
```ppl
8+
source=otellogs
9+
| stats sum(severityNumber) by flags, severityText
10+
| appendcol [ stats count(severityNumber) by flags ]
11+
| head 10
12+
```
13+
14+
The query returns the following results:
15+
16+
```text
17+
fetched rows / total rows = 10/10
18+
+-------+--------------+---------------------+----------------------+
19+
| flags | severityText | sum(severityNumber) | count(severityNumber) |
20+
|-------+--------------+---------------------+----------------------|
21+
| 0 | DEBUG | 5 | 30 |
22+
| 0 | DEBUG2 | 6 | 2 |
23+
| 0 | DEBUG3 | 7 | null |
24+
| 0 | DEBUG4 | 8 | null |
25+
| 0 | ERROR | 17 | null |
26+
| 0 | ERROR2 | 18 | null |
27+
| 0 | ERROR3 | 19 | null |
28+
| 0 | ERROR4 | 20 | null |
29+
| 0 | FATAL | 21 | null |
30+
| 0 | FATAL2 | 22 | null |
31+
+-------+--------------+---------------------+----------------------+
32+
```
33+
34+
35+
## Example 2: Append count with override
36+
37+
```ppl
38+
source=otellogs
39+
| stats sum(severityNumber) by flags, severityText
40+
| appendcol override=true [ stats count(severityNumber) by flags ]
41+
| head 10
42+
```
43+
44+
The query returns the following results:
45+
46+
```text
47+
fetched rows / total rows = 10/10
48+
+-------+--------------+---------------------+----------------------+
49+
| flags | severityText | sum(severityNumber) | count(severityNumber) |
50+
|-------+--------------+---------------------+----------------------|
51+
| 0 | DEBUG | 5 | 30 |
52+
| 1 | DEBUG2 | 6 | 2 |
53+
| 0 | DEBUG3 | 7 | null |
54+
| 0 | DEBUG4 | 8 | null |
55+
| 0 | ERROR | 17 | null |
56+
| 0 | ERROR2 | 18 | null |
57+
| 0 | ERROR3 | 19 | null |
58+
| 0 | ERROR4 | 20 | null |
59+
| 0 | FATAL | 21 | null |
60+
| 0 | FATAL2 | 22 | null |
61+
+-------+--------------+---------------------+----------------------+
62+
```
63+
64+
65+
## Example 3: Append multiple subsearch results
66+
67+
```ppl
68+
source=otellogs
69+
| sort @timestamp
70+
| fields severityText, severityNumber, flags
71+
| head 5
72+
| appendcol [ stats avg(severityNumber) as avg_sev ]
73+
| appendcol [ stats max(severityNumber) as max_sev ]
74+
```
75+
76+
The query returns the following results:
77+
78+
```text
79+
fetched rows / total rows = 5/5
80+
+--------------+----------------+-------+--------------------+---------+
81+
| severityText | severityNumber | flags | avg_sev | max_sev |
82+
|--------------+----------------+-------+--------------------+---------|
83+
| INFO | 9 | 1 | 12.5 | 24 |
84+
| ERROR | 17 | 1 | null | null |
85+
| WARN | 13 | 0 | null | null |
86+
| DEBUG | 5 | 0 | null | null |
87+
| INFO | 9 | 0 | null | null |
88+
+--------------+----------------+-------+--------------------+---------+
89+
```
90+

‎docs/user/ppl/otel/cmd/appendpipe.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# appendpipe (otellogs)
2+
3+
The `appendpipe` command appends the results of a subpipeline to the search results.
4+
5+
## Example 1: Append rows from total count to existing results
6+
7+
```ppl
8+
source=otellogs
9+
| stats sum(severityNumber) as part by flags, severityText
10+
| sort -part
11+
| head 5
12+
| appendpipe [ stats sum(part) as total by flags ]
13+
```
14+
15+
The query returns the following results:
16+
17+
```text
18+
fetched rows / total rows = 7/7
19+
+------+-------+--------------+-------+
20+
| part | flags | severityText | total |
21+
|------+-------+--------------+-------|
22+
| 24 | 0 | FATAL4 | null |
23+
| 23 | 0 | FATAL3 | null |
24+
| 22 | 0 | FATAL2 | null |
25+
| 21 | 0 | FATAL | null |
26+
| 20 | 0 | ERROR4 | null |
27+
| null | 0 | null | 110 |
28+
| null | 1 | null | null |
29+
+------+-------+--------------+-------+
30+
```
31+
32+
33+
## Example 2: Append rows with merged column names
34+
35+
```ppl
36+
source=otellogs
37+
| stats sum(severityNumber) as total by flags, severityText
38+
| sort -total
39+
| head 5
40+
| appendpipe [ stats sum(total) as total by flags ]
41+
```
42+
43+
The query returns the following results:
44+
45+
```text
46+
fetched rows / total rows = 7/7
47+
+-------+-------+--------------+
48+
| total | flags | severityText |
49+
|-------+-------+--------------|
50+
| 24 | 0 | FATAL4 |
51+
| 23 | 0 | FATAL3 |
52+
| 22 | 0 | FATAL2 |
53+
| 21 | 0 | FATAL |
54+
| 20 | 0 | ERROR4 |
55+
| 110 | 0 | null |
56+
| null | 1 | null |
57+
+-------+-------+--------------+
58+
```
59+

0 commit comments

Comments
 (0)