opensearch-project / opensearch-spark

Spark Accelerator framework ; It enables secondary indices to remote data stores.
Apache License 2.0
14 stars 23 forks source link

[FEATURE]Add PPL eval CASE funcitonality support #645

Open YANG-DB opened 1 week ago

YANG-DB commented 1 week ago

Is your feature request related to a problem? Current CASE functionality syntax is only available in SQL query, this functionality is important for actual use cases for Observability and in addition more general cases where eval CASE add helpful functionality to the query.

What solution would you like? The case command will be constructed using a list of predicates and an optional ELSE default value.

CASE(<predicate1>, <value1>, [<predicate2>, <value2>, ...] [ELSE] <default>)

ELSE could be optional, removing it will save an additional keyword in PPL. It is also more like a function than a clause.

An example:

source = my_index
| eval status_category =
    case(status_code >= 200 AND status_code < 300, 'Success',
         status_code >= 300 AND status_code < 400, 'Redirection'
         status_code >= 400 AND status_code < 500, 'Client Error'
         status_code >= 500, 'Server Error',
         'Unknown')
| stats count() by status_category

Do you have any additional context?

YANG-DB commented 2 days ago

@lukasz-soszynski-eliatra can you please continue the work from the previous isEmpty task and implement the CASE support as well ? thanks