Nevertheless as of now, it does not seem possible to perform min and max aggregation on this type:
ROW version = ["1.2.0", "3.5.0"]
| mv_expand version
| eval version = to_version(version)
| stats max(version)
The aggregation does not work, because:
argument of [max(version)] must be [numeric or datetime], found value [max(version)] type [version]
Screenshot:
Use-Case
Find the biggest/smallest package version in a dataset (e.g., to verify which is the smallest version of a package in-use and check whether we have superseeded a given problem).
Description
As documented ES|QL supports the version type. With this type, we can perform semantic versions comparisons like:
Nevertheless as of now, it does not seem possible to perform min and max aggregation on this type:
The aggregation does not work, because:
Screenshot:
Use-Case Find the biggest/smallest package version in a dataset (e.g., to verify which is the smallest version of a package in-use and check whether we have superseeded a given problem).