search

opensearch-project / opensearch-spark

Spark Accelerator framework ; It enables secondary indices to remote data stores.
Apache License 2.0
14 stars 22 forks source link

[BUG] Renaming function doesn’t work in PPL #509

Open A-Gray-Cat opened 1 month ago

A-Gray-Cat commented 1 month ago

What is the bug? rename function doesn't work in PPL.

How can one reproduce the bug? Steps to reproduce the behavior:

  1. Go to Data sources -> securitylake -> query data -> open log explorer
  2. Run the follow queries: 
    source = securitylake.amazon_security_lake_glue_db_us_east_1.amazon_security_lake_table_us_east_1_vpc_flow_2_0
| where time_dt > '2024-07-31 00:00:00 ' and region = 'us-east-1'
| rename src_endpoint.ip as src_ip
| fields src_ip
| head 10

    The following error message will return:

    {"Message":"Fail to analyze query. Cause: Column 'src_ip' does not exist. Did you mean one of the following?

What is the expected behavior? src_ip will be returned as the field name

What is your host/environment?

Do you have any screenshots? If applicable, add screenshots to help explain your problem.

Do you have any additional context? Add any other context about the problem.

salyh commented 1 month ago

The 'rename' command is not yet implemented at all (not in the code and not in antlr). I am working on this now and will submit a PR soon to add this command.