Description:
We propose adding a fillnull command to OpenSearch's Piped Processing Language (PPL) to provide a convenient way to handle null or missing values in query results. This feature would be similar to the fillnull command in Splunk's SPL, enhancing PPL's data cleaning and preparation capabilities.
Proposed Functionality:
The 'fillnull' command should allow users to replace null values with a specified value.
It should support filling nulls for specific fields or all fields.
The command should allow different fill values for different fields.
It should support conditional filling based on other field values or expressions.
Example Usage:
... | fillnull value=0
This would replace all null values in all fields with 0.
... | fillnull value=N/A field1, field2
This would replace null values in field1 and field2 with "N/A".
dblock
commented
1 month ago
Description: We propose adding a
fillnullcommand to OpenSearch's Piped Processing Language (PPL) to provide a convenient way to handle null or missing values in query results. This feature would be similar to thefillnullcommand in Splunk's SPL, enhancing PPL's data cleaning and preparation capabilities.Proposed Functionality:
Example Usage:
This would replace all null values in all fields with 0.
This would replace null values in field1 and field2 with "N/A".
This would fill null values in different fields with different values.
This example uses
evalto create a new field (or overwrite an existing one) based on a condition, and then usefillnullto handle the null valuesThis example uses multiple eval expressions to handle different conditions for multiple fields, followed by fillnull
implementation Considerations:
Consider type-checking or type-conversion for filled values
Support for PPL
fillnullfunctionality is required for both:OpenSearch based PPL engine
Spark based PPL engine