* Merge pull request #1 from Yury-Fridlyand/dev-update-sql-relevance-docs Update SQL plugin relevance functions documentation. Co-authored-by: MaxKsyunz <[email protected]> Signed-off-by: Yury Fridlyand <[email protected]> * Address PR feedback. Signed-off-by: Yury Fridlyand <[email protected]> * Address PR feedback by @joshuali925. Signed-off-by: Yury Fridlyand <[email protected]> * Remove PPL page from Observability Plugin. Add link to Observability page. Make some simple formatting changes Signed-off-by: Naarcha-AWS <[email protected]> * Reword paragraph Signed-off-by: Naarcha-AWS <[email protected]> * Adds SQL and PPL API and other SQL plugin changes Signed-off-by: Fanit Kolchina <[email protected]> * Formatting changes Signed-off-by: Fanit Kolchina <[email protected]> * Incorporates editorial comments Signed-off-by: Fanit Kolchina <[email protected]> Signed-off-by: Yury Fridlyand <[email protected]> Signed-off-by: Naarcha-AWS <[email protected]> Signed-off-by: Fanit Kolchina <[email protected]> Co-authored-by: Yury Fridlyand <[email protected]> Co-authored-by: MaxKsyunz <[email protected]> Co-authored-by: Fanit Kolchina <[email protected]>
2.6 KiB
layout, title, parent, grand_parent, nav_order
| layout | title | parent | grand_parent | nav_order |
|---|---|---|---|---|
| default | Syntax | PPL - Piped Processing Language | SQL and PPL | 1 |
PPL syntax
Every PPL query starts with the search command. It specifies the index to search and retrieve documents from. Subsequent commands can follow in any order.
Currently, PPL supports only one search command, which can be omitted to simplify the query.
{ : .note}
Syntax
search source=<index> [boolean-expression]
source=<index> [boolean-expression]
| Field | Description | Required |
|---|---|---|
search |
Specifies search keywords. | Yes |
index |
Specifies which index to query from. | No |
bool-expression |
Specifies an expression that evaluates to a Boolean value. | No |
Examples
Example 1: Search through accounts index
In the following example, the search command refers to an accounts index as the source and uses fields and where commands for the conditions:
search source=accounts
| where age > 18
| fields firstname, lastname
In the following examples, angle brackets < > enclose required arguments and square brackets [ ] enclose optional arguments.
{: .note }
Example 2: Get all documents
To get all documents from the accounts index, specify it as the source:
search source=accounts;
| account_number | firstname | address | balance | gender | city | employer | state | age | lastname | |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Amber | 880 Holmes Lane | 39225 | M | Brogan | Pyrami | IL | 32 | [email protected] | Duke |
| 6 | Hattie | 671 Bristol Street | 5686 | M | Dante | Netagy | TN | 36 | [email protected] | Bond |
| 13 | Nanette | 789 Madison Street | 32838 | F | Nogal | Quility | VA | 28 | null | Bates |
| 18 | Dale | 467 Hutchinson Court | 4180 | M | Orick | null | MD | 33 | [email protected] | Adams |
Example 3: Get documents that match a condition
To get all documents from the accounts index that either have account_number equal to 1 or have gender as F, use the following query:
search source=accounts account_number=1 or gender=\"F\";
| account_number | firstname | address | balance | gender | city | employer | state | age | lastname | |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Amber | 880 Holmes Lane | 39225 | M | Brogan | Pyrami | IL | 32 | [email protected] | Duke |
| 13 | Nanette | 789 Madison Street | 32838 | F | Nogal | Quility | VA | 28 | null | Bates |