[ES|QL] : Support INLINESTATS in autocomplete (elastic#231627)

## Summary

This PR implements the Autocomplete part for the INLINESTATS command:
elastic#189356

<img width="1015" height="263" alt="stats0"
src="https://github.com/user-attachments/assets/829916e0-e1de-46b0-bf1a-9af6306d685b"
/>
<img width="1048" height="403" alt="stats3"
src="https://github.com/user-attachments/assets/7670c900-c0fb-4a86-b8d4-84aa7b97b0b3"
/>
<img width="1002" height="216" alt="stats2"
src="https://github.com/user-attachments/assets/77b5731a-4b01-4824-9c52-c0d472b600af"
/>
<img width="2070" height="1008" alt="test2"
src="https://github.com/user-attachments/assets/dc7b548b-779a-436e-a0cb-8310030533a9"
/>
<img width="2085" height="874" alt="test1"
src="https://github.com/user-attachments/assets/65e4588b-3c49-4c58-ad8b-6be11a303bf6"
/>

---------

Co-authored-by: kibanamachine <[email protected]>

Author: 2 people

src/platform/packages/shared/kbn-esql-ast/src/commands_registry/commands/inlinestats/autocomplete.test.ts

@@ -0,0 +1,142 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+import { synth } from '../../../..';
+import type { ESQLFieldWithMetadata, ESQLUserDefinedColumn } from '../../types';
+import { columnsAfter } from './columns_after';
+
+// Test data fixtures
+const createPreviousFields = (fields: Array<[string, string]>): ESQLFieldWithMetadata[] =>
+  fields.map(([name, type]) => ({ name, type } as ESQLFieldWithMetadata));
+
+describe('INLINESTATS', () => {
+  const createUserDefinedColumn = (
+    name: string,
+    type: ESQLFieldWithMetadata['type'],
+    location = { min: 0, max: 10 }
+  ): ESQLUserDefinedColumn => ({ name, type, location });
+
+  const createContext = (userDefinedColumns: Array<[string, ESQLUserDefinedColumn[]]> = []) => ({
+    userDefinedColumns: new Map(userDefinedColumns),
+    fields: new Map<string, ESQLFieldWithMetadata>([
+      ['field1', { name: 'field1', type: 'keyword' }],
+      ['count', { name: 'count', type: 'double' }],
+    ]),
+  });
+
+  const expectColumnsAfter = (
+    command: string,
+    previousFields: ESQLFieldWithMetadata[],
+    userColumns: Array<[string, string]>,
+    expectedResult: Array<[string, string]>
+  ) => {
+    const context = createContext(
+      userColumns.map(([name, type]) => [name, [createUserDefinedColumn(name, type as 'keyword')]])
+    );
+    const result = columnsAfter(synth.cmd(command), previousFields, context);
+    const expected = createPreviousFields(expectedResult);
+    expect(result).toEqual(expected);
+  };
+  it('preserves all previous columns and adds the user defined column, when no grouping is given', () => {
+    const previousFields = createPreviousFields([
+      ['field1', 'keyword'],
+      ['field2', 'double'],
+    ]);
+
+    expectColumnsAfter(
+      'INLINESTATS var0=AVG(field2)',
+      previousFields,
+      [['var0', 'double']],
+      [
+        ['field1', 'keyword'],
+        ['field2', 'double'],
+        ['var0', 'double'],
+      ]
+    );
+  });
+
+  it('preserves all previous columns and adds the escaped column, when no grouping is given', () => {
+    const previousFields = createPreviousFields([
+      ['field1', 'keyword'],
+      ['field2', 'double'],
+    ]);
+
+    expectColumnsAfter(
+      'INLINESTATS AVG(field2)',
+      previousFields,
+      [['AVG(field2)', 'double']],
+      [
+        ['field1', 'keyword'],
+        ['field2', 'double'],
+        ['AVG(field2)', 'double'],
+      ]
+    );
+  });
+
+  it('preserves all previous columns and adds the escaped column, with grouping', () => {
+    const previousFields = createPreviousFields([
+      ['field1', 'keyword'],
+      ['field2', 'double'],
+    ]);
+
+    // Note: Unlike STATS, INLINESTATS doesn't care about BY clause for column preservation
+    expectColumnsAfter(
+      'INLINESTATS AVG(field2) BY field1',
+      previousFields,
+      [['AVG(field2)', 'double']],
+      [
+        ['field1', 'keyword'],
+        ['field2', 'double'],
+        ['AVG(field2)', 'double'],
+      ]
+    );
+  });
+
+  it('preserves all previous columns and adds user defined and grouping columns', () => {
+    const previousFields = createPreviousFields([
+      ['field1', 'keyword'],
+      ['field2', 'double'],
+      ['@timestamp', 'date'],
+    ]);
+
+    expectColumnsAfter(
+      'INLINESTATS AVG(field2) BY buckets=BUCKET(@timestamp,50,?_tstart,?_tend)',
+      previousFields,
+      [
+        ['AVG(field2)', 'double'],
+        ['buckets', 'unknown'],
+      ],
+      [
+        ['field1', 'keyword'],
+        ['field2', 'double'],
+        ['@timestamp', 'date'],
+        ['AVG(field2)', 'double'],
+        ['buckets', 'unknown'],
+      ]
+    );
+  });
+
+  it('handles duplicate column names by keeping the original column type', () => {
+    const previousFields = createPreviousFields([
+      ['field1', 'keyword'],
+      ['field2', 'double'],
+      ['avg_field', 'integer'], // This will be preserved since it comes first
+    ]);
+
+    expectColumnsAfter(
+      'INLINESTATS avg_field=AVG(field2)',
+      previousFields,
+      [['avg_field', 'double']], // This will be ignored due to duplicate name
+      [
+        ['field1', 'keyword'],
+        ['field2', 'double'],
+        ['avg_field', 'integer'],
+      ]
+    );
+  });
+});

src/platform/packages/shared/kbn-esql-ast/src/commands_registry/commands/inlinestats/autocomplete.ts

@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+import uniqBy from 'lodash/uniqBy';
+import type { ESQLCommand } from '../../../types';
+import type { ESQLFieldWithMetadata, ESQLUserDefinedColumn } from '../../types';
+import type { ICommandContext } from '../../types';
+import type { FieldType } from '../../../definitions/types';
+
+function transformMapToESQLFields(
+  inputMap: Map<string, ESQLUserDefinedColumn[]>
+): ESQLFieldWithMetadata[] {
+  const esqlFields: ESQLFieldWithMetadata[] = [];
+
+  for (const [, userDefinedColumns] of inputMap) {
+    for (const userDefinedColumn of userDefinedColumns) {
+      if (userDefinedColumn.type) {
+        esqlFields.push({
+          name: userDefinedColumn.name,
+          type: userDefinedColumn.type as FieldType,
+        });
+      }
+    }
+  }
+
+  return esqlFields;
+}
+
+export const columnsAfter = (
+  _command: ESQLCommand,
+  previousColumns: ESQLFieldWithMetadata[],
+  context?: ICommandContext
+) => {
+  const userDefinedColumns =
+    context?.userDefinedColumns ?? new Map<string, ESQLUserDefinedColumn[]>();
+
+  const arrayOfUserDefinedColumns: ESQLFieldWithMetadata[] =
+    transformMapToESQLFields(userDefinedColumns);
+
+  return uniqBy([...previousColumns, ...arrayOfUserDefinedColumns], 'name');
+};

src/platform/packages/shared/kbn-esql-ast/src/commands_registry/commands/inlinestats/columns_after.test.ts

@@ -7,14 +7,16 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 import { i18n } from '@kbn/i18n';
-import type { ICommandMethods } from '../../registry';
-import { autocomplete } from './autocomplete';
-import { validate } from './validate';
+import { columnsAfter } from './columns_after';
+import { autocomplete } from '../stats/autocomplete';
+import { validate } from '../stats/validate';
 import type { ICommandContext } from '../../types';
+import type { ICommandMethods } from '../../registry';
 
 const inlineStatsCommandMethods: ICommandMethods<ICommandContext> = {
   autocomplete,
   validate,
+  columnsAfter,
 };
 
 export const inlineStatsCommand = {
@@ -24,9 +26,16 @@ export const inlineStatsCommand = {
     hidden: true,
     description: i18n.translate('kbn-esql-ast.esql.definitions.inlineStatsDoc', {
       defaultMessage:
-        'Calculates an aggregate result and merges that result back into the stream of input data. Without the optional `BY` clause this will produce a single result which is appended to each row. With a `BY` clause this will produce one result per grouping and merge the result into the stream based on matching group keys.',
+        'Unlike STATS, INLINESTATS preserves all columns from the previous pipe and returns them together with the new aggregate columns.',
     }),
-    declaration: '',
-    examples: ['… | EVAL bar = a * b | INLINESTATS m = MAX(bar) BY b'],
+    declaration: `INLINESTATS [column1 =] expression1 [WHERE boolean_expression1][,
+      ...,
+      [columnN =] expressionN [WHERE boolean_expressionN]]
+      [BY grouping_expression1[, ..., grouping_expressionN]]`,
+    examples: [
+      '… | inlinestats avg = avg(a)',
+      '… | inlinestats sum(b) by b',
+      '… | inlinestats sum(b) by b % 2',
+    ],
   },
 };