elastic-esql 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d509f46ee96d9ce934b04bdf01c14589e77a0e7130bbf86386e3050668865f10
-  data.tar.gz: 1631dc08bc5cb8a83175a1e3ab226d27093906751babf9fe220f0d61b54e669b
+  metadata.gz: ee4efdbcbcfd0ced3cc7d373b9fe58719f3434c995a75112ce5c2740509b8840
+  data.tar.gz: 4c11d6fd4dfd95b27e34bd189904c83abf469ac06c06a3672d170bac1ae1e30f
 SHA512:
-  metadata.gz: fd106b0e92d4e951b3b6f685e926f538e79d727634e3f805554cbf021b8c4e92c8eb12ae2be25372e0fcfaf669ef11d372ba6c2bc53a253c2fe177e33adf14e9
-  data.tar.gz: 490df5f4fc2fae7d0505ce7a411db8a85fa32f93e6609844bbe6c0270638e7c17e58c0ba815549de28acb6fbc09cbe07fd5bc47c4604ca68408ff778a4b6594e
+  metadata.gz: 3fa05ddee1fceb1f300e3c16ca6b8ab32fead629bf20e50d6f406694cdc97400d8bef450e0ef050dd86a95bbd9c1bf69b2384ca641b0605e2048eb86e66b549d
+  data.tar.gz: cb732b90ceb859d05872705bf777886d9b8a844bd82d7cbf5351203516b78e304f427ed727d1a8576966f87f999447fae9a880b6d7a5ea6d4b7efe3d60cd0cc5

data/lib/elastic/esql.rb

@@ -21,19 +21,25 @@ require_relative 'dissect'
 require_relative 'drop'
 require_relative 'enrich'
 require_relative 'eval'
+require_relative 'functions'
 require_relative 'grok'
-require_relative 'limit'
 require_relative 'keep'
+require_relative 'limit'
+require_relative 'lookup_join'
+require_relative 'metadata'
 require_relative 'rename'
 require_relative 'row'
 require_relative 'show'
 require_relative 'sort'
+require_relative 'stats'
+require_relative 'ts'
 require_relative 'where'
 
 module Elastic
   # @example
   #    Elastic::ESQL.from('sample_data').sort_descending('@timestamp').limit(3).to_s
   #    # => FROM 'sample_data' | SORT @timestamp desc | LIMIT 3
+  # rubocop:disable Metrics/ClassLength
   class ESQL
     include ChangePoint
     include Custom
@@ -43,16 +49,23 @@ module Elastic
     include Grok
     include Keep
     include Limit
+    include LookupJoin
+    include Metadata
     include Rename
     include Row
     include Show
     include Sort
+    include Stats
+    include TS
     include Where
-    SOURCE_COMMANDS = [:from, :row, :show].freeze
+
+    SOURCE_COMMANDS = [:from, :row, :show, :ts].freeze
 
     def initialize
       @query = {}
       @custom = []
+      @metadata = []
+      @lookup_joins = []
     end
 
     # Function to build the ES|QL formatted query and return it as a String.
@@ -62,16 +75,14 @@ module Elastic
       raise ArgumentError, 'No source command found' unless source_command_present?
 
       @query[:enrich] = @enriches.join('| ') if @enriches
-      string_query = @query.map do |k, v|
-        "#{k.upcase} #{v}"
-      end.join(' | ')
-
+      string_query = build_string_query
+      string_query.concat(build_lookup_joins) unless @lookup_joins.empty?
       string_query.concat(" #{@custom.join(' ')}") unless @custom.empty?
       string_query
     end
 
-    # Creates a new Enrich object to chain with +on+ and +with+. If other methods are chained to the
-    # Enrich object, it returns calls it upon the ESQL object that instantiated it, and returns it.
+    # Creates a new Enrich object to chain with +on+ and +with+. If other method is chained to the
+    # Enrich object, it calls it upon the ESQL object that instantiated it, and returns it.
     # @return [Elastic::Enrich]
     def enrich(policy)
       @enriches ||= []
@@ -105,6 +116,10 @@ module Elastic
       new.row(*params)
     end
 
+    def self.ts(*params)
+      new.ts(*params)
+    end
+
     # Instance method to allow to update +from+ with +esql.from('different_source')+.
     # @param [String] index_pattern A list of indices, data streams or aliases. Supports wildcards and date math.
     def from(index_pattern)
@@ -118,6 +133,22 @@ module Elastic
       query
     end
 
+    # rubocop:disable Naming/MethodName, Naming/BinaryOperatorParameterName
+    def self.🐔(message)
+      "ROW CHICKEN(\"#{message}\")"
+    end
+
+    def 🐔(message)
+      self.class.🐔(message)
+    end
+
+    alias chicken 🐔
+
+    class << self
+      alias chicken 🐔
+    end
+    # rubocop:enable Naming/MethodName, Naming/BinaryOperatorParameterName
+
     private
 
     # Function for eval, row, and other functions that have one or more columns with values specified
@@ -134,7 +165,7 @@ module Elastic
     # Error raised when a function expects a Hash and something else is passed in, with explanation
     def raise_hash_error(name)
       raise ArgumentError, "#{name.to_s.upcase} needs a Hash as a parameter where the keys are the " \
-                          'column names and the value is the function or expression to calculate.'
+                           'column names and the value is the function or expression to calculate.'
     end
 
     # Used when building the query from hash params function
@@ -157,5 +188,26 @@ module Elastic
       esql.send("#{name}!", *params)
       esql
     end
+
+    # Helper to build the LOOKUP JOIN part of the query.
+    def build_lookup_joins
+      joins = @lookup_joins.map { |a| a.map { |k, v| "LOOKUP JOIN #{k} ON #{v}" } }.flatten.join(' | ')
+      " | #{joins}"
+    end
+
+    # Helper to build the String for the simpler functions.
+    # These are of the form 'key.upcase value' like 'DROP value'
+    # If metadata has been set, it needs to be added to FROM. There's a possibility there'll be more
+    # special cases like this in the future, they can be added here.
+    def build_string_query
+      @query.map do |k, v|
+        if k == :from && !@metadata.empty?
+          "#{k.upcase} #{v} METADATA #{@metadata.join(', ')}"
+        else
+          "#{k.upcase} #{v}"
+        end
+      end.join(' | ')
+    end
   end
+  # rubocop:enable Metrics/ClassLength
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: elastic-esql
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Fernando Briano
@@ -104,7 +104,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Elastic ES|QL Query builder
 test_files: []