[BUG] PPL gets error but looks syntax correct

What is the bug? I run a syntax correct PPL but it shows a bug. It works on 2.15 but fails on 2.17 and current main

How can one reproduce the bug? Index mappings:

{
"mappings": {
      "properties": {
        "Content": {
          "type": "text"
        },
        "Level": {
          "type": "keyword"
        },
        "OriginalLog": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword"
            }
          }
        },
        "Time": {
          "type": "date",
          "format": "EEE MMM dd HH:mm:ss yyyy||yyyy-MM-dd||epoch_millis"
        }
      }
    }
}

PPL: "source=loghub-apache-new | where Level = 'error' | eval is_mod = IF(LIKE(OriginalLog, '%mod_jk%'), 1, 0), is_dir = IF(LIKE(OriginalLog, '%directory%'), 1, 0) | stats COUNT() as sum_is_mod by span(Time, 1d)"

Some samples:

{
          "Time": "Sun Dec 04 06:19:18 2005",
          "Level": "error",
          "Content": "mod_jk child workerEnv in error state 6",
          "OriginalLog": "[Sun Dec 04 06:19:18 2005] [error] mod_jk child workerEnv in error state 6"
        }
        {
          "Time": "Sun Dec 04 06:22:48 2005",
          "Level": "notice",
          "Content": "jk2_init() Found child 32479 in scoreboard slot 6",
          "OriginalLog": "[Sun Dec 04 06:22:48 2005] [notice] jk2_init() Found child 32479 in scoreboard slot 6"
        }

What is the expected behavior? A clear and concise description of what you expected to happen.

What is your host/environment? OS 2.17

Do you have any screenshots? If applicable, add screenshots to help explain your problem.

Do you have any additional context? Add any other context about the problem.

opensearch-project / sql

[BUG] PPL gets error but looks syntax correct #3078