[9.0] Split ES|QL functions/operators/commands into separate pages for similar functions and make commands examples generated (elastic#126279) (elastic#126624)

* Split ES|QL functions/operators/commands into separate pages for similar functions and make commands examples generated (elastic#126279)

While the internal structure of the docs is already split into many (over 1000) sub-pages, the final display for the `Functions and Operators` page is a single giant page, making navigation harder. This PR splits it into separate pages, one for each group of similar functions and one for the operators. Twelve new pages.

This PR also bundles a few other related changes. In total what is done is:
* Split functions/operators into 12 pages, one for each group, maintaining the existing split of each function/operator into a snippet with dynamically generated examples
* Split esql-commands.md into source-commands.md and processing-commands.md, each of which is split into individual snippets, one for each command
* Each command snippet has it's examples split out into separate files, if they were examples that were dynamically generated in the older asciidoc system
* The examples files are overwritten by the ES|QL unit tests, using a similar mechanism to the examples written for functions and operators)
* Some additional refinements to the Kibana definition and markdown files (nicer operator headings, and display text)

* After re-running tests to ensure we get 9.0 behaviour only

Author: craigtaverner

docs/redirects.yml

@@ -0,0 +1,3 @@
+redirects:
+  'reference/query-languages/esql/esql-functions-operators.md': '!reference/query-languages/esql/functions-operators/aggregation-functions.md'
+  'reference/query-languages/esql/esql-commands.md': '!reference/query-languages/esql/commands/processing-commands.md'

docs/reference/query-languages/esql/_snippets/aggregation-functions.md

@@ -0,0 +1,6 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM sample_data
+| WHERE @timestamp > NOW() - 1 hour
+```

docs/reference/query-languages/esql/_snippets/commands/examples/date.csv-spec/docsNowWhere.md

@@ -0,0 +1,11 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "2023-01-23T12:15:00.000Z - some text - 127.0.0.1"
+| DISSECT a """%{date} - %{msg} - %{ip}"""
+| KEEP date, msg, ip
+```
+
+| date:keyword | msg:keyword | ip:keyword |
+| --- | --- | --- |
+| 2023-01-23T12:15:00.000Z | some text | 127.0.0.1 |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/basicDissect.md

@@ -0,0 +1,11 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "2023-01-23T12:15:00.000Z 127.0.0.1 [email protected] 42"
+| GROK a """%{TIMESTAMP_ISO8601:date} %{IP:ip} %{EMAILADDRESS:email} %{NUMBER:num}"""
+| KEEP date, ip, email, num
+```
+
+| date:keyword | ip:keyword | email:keyword | num:keyword |
+| --- | --- | --- | --- |
+| 2023-01-23T12:15:00.000Z | 127.0.0.1 | [email protected] | 42 |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/basicGrok.md

@@ -0,0 +1,12 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "2023-01-23T12:15:00.000Z - some text - 127.0.0.1"
+| DISSECT a """%{date} - %{msg} - %{ip}"""
+| KEEP date, msg, ip
+| EVAL date = TO_DATETIME(date)
+```
+
+| msg:keyword | ip:keyword | date:date |
+| --- | --- | --- |
+| some text | 127.0.0.1 | 2023-01-23T12:15:00.000Z |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/dissectWithToDatetime.md

@@ -0,0 +1,11 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "2023-01-23T12:15:00.000Z 127.0.0.1 [email protected] 42"
+| GROK a """%{TIMESTAMP_ISO8601:date} %{IP:ip} %{EMAILADDRESS:email} %{NUMBER:num:int}"""
+| KEEP date, ip, email, num
+```
+
+| date:keyword | ip:keyword | email:keyword | num:integer |
+| --- | --- | --- | --- |
+| 2023-01-23T12:15:00.000Z | 127.0.0.1 | [email protected] | 42 |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/grokWithConversionSuffix.md

@@ -0,0 +1,13 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM addresses
+| KEEP city.name, zip_code
+| GROK zip_code """%{WORD:zip_parts} %{WORD:zip_parts}"""
+```
+
+| city.name:keyword | zip_code:keyword | zip_parts:keyword |
+| --- | --- | --- |
+| Amsterdam | 1016 ED | ["1016", "ED"] |
+| San Francisco | CA 94108 | ["CA", "94108"] |
+| Tokyo | 100-7014 | null |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/grokWithDuplicateFieldNames.md

@@ -0,0 +1,12 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+ROW a = "2023-01-23T12:15:00.000Z 127.0.0.1 [email protected] 42"
+| GROK a """%{TIMESTAMP_ISO8601:date} %{IP:ip} %{EMAILADDRESS:email} %{NUMBER:num:int}"""
+| KEEP date, ip, email, num
+| EVAL date = TO_DATETIME(date)
+```
+
+| ip:keyword | email:keyword | num:integer | date:date |
+| --- | --- | --- | --- |
+| 127.0.0.1 | [email protected] | 42 | 2023-01-23T12:15:00.000Z |

docs/reference/query-languages/esql/_snippets/commands/examples/docs.csv-spec/grokWithToDatetime.md

@@ -0,0 +1,14 @@
+% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
+
+```esql
+FROM employees
+| KEEP emp_no, first_name, last_name, height
+```
+
+| emp_no:integer | first_name:keyword | last_name:keyword | height:double |
+| --- | --- | --- | --- |
+| 10001 | Georgi | Facello | 2.03 |
+| 10002 | Bezalel | Simmel | 2.08 |
+| 10003 | Parto | Bamford | 1.83 |
+| 10004 | Chirstian | Koblick | 1.78 |
+| 10005 | Kyoichi | Maliniak | 2.05 |