j ddlZddlZddlmZmZddlmZmZmZm Z m Z m Z m Z ddl mZmZmZe eefZe e eefZeZGddeZGdd eZGd d eZGd d eZGddeZGddeZGddeZGddeZGddeZGddeZGddeZGddeZ GddeZ!Gd d!eZ"Gd"d#eZ#Gd$d%eZ$Gd&d'eZ%Gd(d)eZ&Gd*d+eZ'Gd,d-eZ(Gd.d/eZ)Gd0d1eZ*Gd2d3eZ+Gd4d5eZ,Gd6d7eZ-Gd8d9eZ.Gd:d;eZ/Gd<d=eZ0Gd>d?eZ1Gd@dAe1Z2GdBdCeZ3GdDdEeZ4GdFdGeZ5GdHdIeZ6dJedKdLfdMZ7dJedKdLfdNZ8dOedKdLfdPZ9y)QN)ABCabstractmethod)AnyDictListOptionalTupleTypeUnion) DocumentBaseInstrumentedExpressionInstrumentedFieldceZdZdZededdfdZededdfdZed e dd fd Z ededd fd Z eddZ y)ESQLzThe static methods of the ``ESQL`` class provide access to the ES|QL source commands, used to create ES|QL queries. These methods return an instance of class ``ESQLBase``, which provides access to the ES|QL processing commands. indicesreturnFromct|S)a#The ``FROM`` source command returns a table with data from a data stream, index, or alias. :param indices: A list of indices, data streams or aliases. Supports wildcards and date math. Examples:: query1 = ESQL.from_("employees") query2 = ESQL.from_("") query3 = ESQL.from_("employees-00001", "other-employees-*") query4 = ESQL.from_("cluster_one:employees-00001", "cluster_two:other-employees-*") query5 = ESQL.from_("employees").metadata("_id") )rrs v/var/www/internaltesting/Shamanth/prverification/HIS_auto/venv/lib/python3.12/site-packages/elasticsearch/esql/esql.pyfrom_z ESQL.from_&sW~paramsRowc tdi|S)aThe ``ROW`` source command produces a row with one or more columns with values that you specify. This can be useful for testing. :param params: the column values to produce, given as keyword arguments. Examples:: query1 = ESQL.row(a=1, b="two", c=None) query2 = ESQL.row(a=[1, 2]) query3 = ESQL.row(a=functions.round(1.23, 0)) )r)rs rrowzESQL.row6s}V}ritemShowct|S)zThe ``SHOW`` source command returns information about the deployment and its capabilities. :param item: Can only be ``INFO``. Examples:: query = ESQL.show("INFO") )r )rs rshowz ESQL.showEsDzrTSct|S)aThe ``TS`` source command is similar to ``FROM``, but for time series indices. :param indices: A list of indices, data streams or aliases. Supports wildcards and date math. Examples:: query = ( ESQL.ts("metrics") .where("@timestamp >= now() - 1 day") .stats("SUM(AVG_OVER_TIME(memory_usage)").by("host", "TBUCKET(1 hour)") ) )r#rs rtszESQL.tsQs7|rctS)aThis method can only be used inside a ``FORK`` command to create each branch. Examples:: query = ESQL.from_("employees").fork( ESQL.branch().where("emp_no == 10001"), ESQL.branch().where("emp_no == 10002"), ) )Branchrrrbranchz ESQL.branchas xrN)rr') __name__ __module__ __qualname____doc__ staticmethod IndexTyperExpressionTyperstrr"r%r(rrrrrs  f   n    3 6   Y 4    rrceZdZdZdbdedfdZdefdZdefdZe defdZ e d e defd Z e dcd ed edefd Ze dedefdZdefdZdddZdeddfdZdeddfdZdededdfdZdededdfdZdedd fd!Zd"edd#fd$Zded%edd&fd'Z ded(d)d*ed)d+ed)d,ed)d-ed)d.ed)d/ed)d0ed)dd1fd2Zdbd3eedd4fd5Zdededd6fd7Zd8ed9edd:fd;Zdedde!dd?fd@Z"dAe ddBfdCZ#dfdDZ$dbdEedFeddGfdHZ%dIeddJfdKZ&dLeddMfdNZ'deddOfdPZ(dQedReddSfdTZ)dUe*ddVfdWZ+deddXfdYZ,d8ed9edd:fdZZ-dgd[Z.dLedd\fd]Z/dLedd^fd_Z0d8edd`fdaZ1y)hESQLBasez|The methods of the ``ESQLBase`` class provide access to the ES|QL processing commands, used to build ES|QL queries. Nparentc ||_g|_yN)_parent _directives)selfr3s r__init__zESQLBase.__init__ts -/rrc"|jSr5)renderr8s r__repr__zESQLBase.__repr__xs{{}rc|jr|jjdz}n>dj|jDcgc]}|j c}}|r|dz }||j zScc}w)Nz | z; )r6r;joinr7_render_internal)r8rds rr;zESQLBase.render{sn << ##%.A $:J:JKQA..0KLAU 4((***LsA<cyr5rr<s rr@zESQLBase._render_internals rindexc\t|dr|jjSt|S)N_index)hasattrrF_namer0)rDs r _format_indexzESQLBase._format_indexs$%,UH%=u||!!M3u:Mridallow_patternsct|}|rd|vr|Stjd|r|S|jdd}d|dS)N*z[a-zA-Z_@][a-zA-Z0-9_\.]*`z``)r0re fullmatchreplace)rJrKss r _format_idzESQLBase._format_idsJ G cQhH <<4a 8H IIc4 1#Qxrexprcnt|ttfstj|St|Sr5) isinstancer0rjsondumps)rTs r _format_exprzESQLBase._format_exprs5dS*@$AB JJt  T rc|jjdk(ry|jr|jjSy)NForkTF) __class__r)r6 _is_forkedr<s rr]zESQLBase._is_forkeds4 >> " "f , <<<<**, ,rc|jr|jj|y|jj|yr5)r6_add_directiver7append)r8 directives rr_zESQLBase._add_directives/ << LL ' ' 2    # #I .rrc :|jtdi||S)aThe ``SET`` directive can be used to specify query settings that modify the behavior of an ES|QL query. Examples:: query1 = ( ESQL.from_("many_numbers") .stats(sum="SUM(sv)") .set(approximation=True) ) query2 = ( ESQL.from_("many_numbers") .stats(median="MEDIAN(sv)") .set(approximation={"rows": 10000}) ) r)r_Set)r8rs rsetz ESQLBase.sets" CM&M* rvalue ChangePointct||S)a``CHANGE_POINT`` detects spikes, dips, and change points in a metric. :param value: The column with the metric in which you want to detect a change point. Examples:: query = ( ESQL.row(key=list(range(1, 26))) .mv_expand("key") .eval(value=functions.case("key<13", 0, 42)) .change_point("value").on("key") .where("type IS NOT NULL") ) )rf)r8res r change_pointzESQLBase.change_points4''rprompt named_prompt Completionc t|g|i|S)aEThe ``COMPLETION`` command allows you to send prompts and context to a Large Language Model (LLM) directly within your ES|QL queries, to perform text generation tasks. :param prompt: The input text or expression used to prompt the LLM. This can be a string literal or a reference to a column containing text. :param named_prompt: The input text or expresion, given as a keyword argument. The argument name is used for the column name. If the prompt is given as a positional argument, the results will be stored in a column named ``completion``. If the specified column already exists, it will be overwritten with the new results. Examples:: query1 = ( ESQL.row(question="What is Elasticsearch?") .completion("question").with_("test_completion_model") .keep("question", "completion") ) query2 = ( ESQL.row(question="What is Elasticsearch?") .completion(answer="question").with_("test_completion_model") .keep("question", "answer") ) query3 = ( ESQL.from_("movies") .sort("rating DESC") .limit(10) .eval(prompt="""CONCAT( "Summarize this movie using the following information: \n", "Title: ", title, "\n", "Synopsis: ", synopsis, "\n", "Actors: ", MV_CONCAT(actors, ", "), "\n", )""") .completion(summary="prompt").with_("test_completion_model") .keep("title", "summary", "rating") ) )rk)r8rirjs r completionzESQLBase.completionsT$88<88rinputpatternDissectct|||S)a``DISSECT`` enables you to extract structured data out of a string. :param input: The column that contains the string you want to structure. If the column has multiple values, ``DISSECT`` will process each value. :param pattern: A dissect pattern. If a field name conflicts with an existing column, the existing column is dropped. If a field name is used more than once, only the rightmost duplicate creates a column. Examples:: query = ( ESQL.row(a="2023-01-23T12:15:00.000Z - some text - 127.0.0.1") .dissect("a", "%{date} - %{msg} - %{ip}") .keep("date", "msg", "ip") .eval(date="TO_DATETIME(date)") ) )rpr8rnros rdissectzESQLBase.dissects$tUG,,rcolumnsDropct|g|S)a4The ``DROP`` processing command removes one or more columns. :param columns: The columns to drop, given as positional arguments. Supports wildcards. Examples:: query1 = ESQL.from_("employees").drop("height") query2 = ESQL.from_("employees").drop("height*") )rur8rts rdropz ESQLBase.dropsD#7##rpolicyEnrichct||S)a0``ENRICH`` enables you to add data from existing indices as new columns using an enrich policy. :param policy: The name of the enrich policy. You need to create and execute the enrich policy first. Examples:: query1 = ( ESQL.row(a="1") .enrich("languages_policy").on("a").with_("language_name") ) query2 = ( ESQL.row(a="1") .enrich("languages_policy").on("a").with_(name="language_name") ) )rz)r8rys renrichzESQLBase.enrichs$dF##r named_columnsEvalc t|g|i|S)a{The ``EVAL`` processing command enables you to append new columns with calculated values. :param columns: The values for the columns, given as positional arguments. Can be literals, expressions, or functions. Can use columns defined left of this one. :param named_columns: The values for the new columns, given as keyword arguments. The name of the arguments is used as column name. If a column with the same name already exists, the existing column is dropped. If a column name is used more than once, only the rightmost duplicate creates a column. Examples:: query1 = ( ESQL.from_("employees") .sort("emp_no") .keep("first_name", "last_name", "height") .eval(height_feet="height * 3.281", height_cm="height * 100") ) query2 = ( ESQL.from_("employees") .eval("height * 3.281") .stats(avg_height_feet=functions.avg("`height * 3.281`")) ) )r~)r8rtr}s revalz ESQLBase.eval1s0D474m44rfork1r'fork2fork3fork4fork5fork6fork7fork8r[c ^|jr tdt||||||||| S)aTThe ``FORK`` processing command creates multiple execution branches to operate on the same input data and combines the results in a single output table. :param fork: Up to 8 execution branches, created with the ``ESQL.branch()`` method. Examples:: query = ( ESQL.from_("employees") .fork( ESQL.branch().where("emp_no == 10001"), ESQL.branch().where("emp_no == 10002"), ) .keep("emp_no", "_fork") .sort("emp_no") ) za query can only have one fork)r] ValueErrorr[) r8rrrrrrrrs rforkz ESQLBase.forkKs58 ?? => >D%ueUE5QQrmethodFusect||S)aVThe ``FUSE`` processing command merges rows from multiple result sets and assigns new relevance scores. :param method: Defaults to ``RRF``. Can be one of ``RRF`` (for Reciprocal Rank Fusion) or ``LINEAR`` (for linear combination of scores). Designates which method to use to assign new relevance scores. Examples:: query1 = ( ESQL.from_("books").metadata("_id", "_index", "_score") .fork( ESQL.branch().where('title:"Shakespeare"').sort("_score DESC"), ESQL.branch().where('semantic_title:"Shakespeare"').sort("_score DESC"), ) .fuse() ) query2 = ( ESQL.from_("books").metadata("_id", "_index", "_score") .fork( ESQL.branch().where('title:"Shakespeare"').sort("_score DESC"), ESQL.branch().where('semantic_title:"Shakespeare"').sort("_score DESC"), ) .fuse("linear") ) query3 = ( ESQL.from_("books").metadata("_id", "_index", "_score") .fork( ESQL.branch().where('title:"Shakespeare"').sort("_score DESC"), ESQL.branch().where('semantic_title:"Shakespeare"').sort("_score DESC"), ) .fuse("linear").by("title", "description") ) query4 = ( ESQL.from_("books").metadata("_id", "_index", "_score") .fork( ESQL.branch().where('title:"Shakespeare"').sort("_score DESC"), ESQL.branch().where('semantic_title:"Shakespeare"').sort("_score DESC"), ) .fuse("linear").with_(normalizer="minmax") ) )r)r8rs rfusez ESQLBase.fuseksVD&!!rGrokct|||S)a``GROK`` enables you to extract structured data out of a string. :param input: The column that contains the string you want to structure. If the column has multiple values, ``GROK`` will process each value. :param pattern: A grok pattern. If a field name conflicts with an existing column, the existing column is discarded. If a field name is used more than once, a multi-valued column will be created with one value per each occurrence of the field name. Examples:: query1 = ( ESQL.row(a="2023-01-23T12:15:00.000Z 127.0.0.1 some.email@foo.com 42") .grok("a", "%{TIMESTAMP_ISO8601:date} %{IP:ip} %{EMAILADDRESS:email} %{NUMBER:num}") .keep("date", "ip", "email", "num") ) query2 = ( ESQL.row(a="2023-01-23T12:15:00.000Z 127.0.0.1 some.email@foo.com 42") .grok( "a", "%{TIMESTAMP_ISO8601:date} %{IP:ip} %{EMAILADDRESS:email} %{NUMBER:num:int}", ) .keep("date", "ip", "email", "num") .eval(date=functions.to_datetime("date")) ) query3 = ( ESQL.from_("addresses") .keep("city.name", "zip_code") .grok("zip_code", "%{WORD:zip_parts} %{WORD:zip_parts}") ) )rrrs rgrokz ESQLBase.groks@D%))r expressionsnamed_expressionsStatsc t|g|i|S)a-The ``INLINE STATS`` processing command groups rows according to a common value and calculates one or more aggregated values over the grouped rows. The command is identical to ``STATS`` except that it preserves all the columns from the input table. :param expressions: A list of expressions, given as positional arguments. :param named_expressions: A list of expressions, given as keyword arguments. The argument names are used for the returned aggregated values. Note that only one of ``expressions`` and ``named_expressions`` must be provided. Examples:: query1 = ( ESQL.from_("employees") .keep("emp_no", "languages", "salary") .inline_stats(max_salary=functions.max(E("salary"))).by("languages") ) query2 = ( ESQL.from_("employees") .keep("emp_no", "languages", "salary") .inline_stats(max_salary=functions.max(E("salary"))) ) query3 = ( ESQL.from_("employees") .where("still_hired") .keep("emp_no", "languages", "salary", "hire_date") .eval(tenure=functions.date_diff("year", E("hire_date"), "2025-09-18T00:00:00")) .drop("hire_date") .inline_stats( avg_salary=functions.avg(E("salary")), count=functions.count(E("*")), ) .by("languages", "tenure") ) query4 = ( ESQL.from_("employees") .keep("emp_no", "salary") .inline_stats( avg_lt_50=functions.round(functions.avg(E("salary"))).where(E("salary") < 50000), avg_lt_60=functions.round(functions.avg(E("salary"))).where(E("salary") >= 50000, E("salary") < 60000), avg_gt_60=functions.round(functions.avg(E("salary"))).where(E("salary") >= 60000), ) ) ) InlineStatsr8rrs r inline_statszESQLBase.inline_statssd4C+C1BCCrKeepct|g|S)aThe ``KEEP`` processing command enables you to specify what columns are returned and the order in which they are returned. :param columns: The columns to keep, given as positional arguments. Supports wildcards. Examples:: query1 = ESQL.from_("employees").keep("emp_no", "first_name", "last_name", "height") query2 = ESQL.from_("employees").keep("h*") query3 = ESQL.from_("employees").keep("h*", "*") )rrws rkeepz ESQLBase.keepsD#7##rmax_number_of_rowsLimitct||S)avThe ``LIMIT`` processing command enables you to limit the number of rows that are returned. :param max_number_of_rows: The maximum number of rows to return. Examples:: query1 = ESQL.from_("employees").sort("emp_no ASC").limit(5) query2 = ESQL.from_("index").stats(functions.avg("field1")).by("field2").limit(20000) )rr8rs rlimitzESQLBase.limitsT-..r lookup_index LookupJoinct||S)a%``LOOKUP JOIN`` enables you to add data from another index, AKA a 'lookup' index, to your ES|QL query results, simplifying data enrichment and analysis workflows. :param lookup_index: The name of the lookup index. This must be a specific index name - wildcards, aliases, and remote cluster references are not supported. Indices used for lookups must be configured with the lookup index mode. Examples:: query1 = ( ESQL.from_("firewall_logs") .lookup_join("threat_list").on("source.IP") .where("threat_level IS NOT NULL") ) query2 = ( ESQL.from_("system_metrics") .lookup_join("host_inventory").on("host.name") .lookup_join("ownerships").on("host.name") ) query3 = ( ESQL.from_("app_logs") .lookup_join("service_owners").on("service_id") ) query4 = ( ESQL.from_("employees") .eval(language_code="languages") .where("emp_no >= 10091 AND emp_no < 10094") .lookup_join("languages_lookup").on("language_code") ) )r)r8rs r lookup_joinzESQLBase.lookup_join s@$ --rct|S)aThe ``METRICS_INFO`` processing command retrieves information about the metrics available in time series data streams, along with their applicable dimensions and other metadata. Examples:: query1 = ( ESQL.ts("k8s") .metrics_info() .sort("metric_name") ) query2 = ( ESQL.ts("k8s") .where("cluster == "prod"") .metrics_info() .sort("metric_name") ) ) MetricsInfor<s r metrics_infozESQLBase.metrics_info,s&4  rfield query_vectorMmrct|||S)a;The ``MMR`` command reduces the result set from a set of input rows by applying a diversification strategy to the return rows. :param field: The name of the field that will use its values for the diversification process. The field must be a dense_vector type. :param query_vector: The query vector to use as part of the diversification algorithm for comparison. Must have the same number of dimensions as the vector field you are searching against. Examples:: query1 = ( ESQL.from_("mmr_text_vector_keyword") .sort("keyword_field") .limit(10) .mmr("text_vector").mmr_limit(3) .drop("text_vector", "byte_vector", "bit_vector") ) query2 = ( ESQL.from_("mmr_text_vector_keyword") .sort("keyword_field") .limit(10) .mmr("text_vector", [0.1, 0.2, 0.3]).mmr_limit(3).with_(lambda_=0.1) .drop("text_vector", "byte_vector", "bit_vector") ) query3 = ( ESQL.from_("dense_vector_text").metadata("_score") .eval(query_embedding=functions.text_embedding("be excellent to each other", "test_dense_inference")) .where(functions.knn("text_embedding_field", "query_embedding")) .sort("_score DESC") .limit(10) .mmr( "text_embedding_field", functions.text_embedding("be excellent to each other", "test_dense_inference") ).mmr_limit(3).with_(lambda_=0.2) .keep("text_field", "query_embedding") ) )r)r8rrs rmmrz ESQLBase.mmrAsR4 --rcolumnMvExpandct||S)a!The ``MV_EXPAND`` processing command expands multivalued columns into one row per value, duplicating other columns. :param column: The multivalued column to expand. Examples:: query = ESQL.row(a=[1, 2, 3], b="b", j=["a", "b"]).mv_expand("a") )r)r8rs r mv_expandzESQLBase.mv_expandlsf%%rprefixRegisteredDomainc t|fi|S)aThe ``REGISTERED_DOMAIN`` processing command parses a fully qualified domain name (FQDN) string and extracts its parts (domain, registered domain, top-level domain, subdomain) into new columns using the public suffix list. :param prefix: A keyword argument, where the argument name is the prefix for the output columns, and the value is the string expression containing the FQDN to parse. Examples:: query1 = ( ESQL.row(fqdn="www.example.co.uk") .registered_domain(rd="fqdn") .keep("rd.*") ) query2 = ( ESQL.from_("web_logs") .registered_domain(rd="domain") .where("rd.registered_domain == "elastic.co"") .stats(functions.count(E("*"))).by("rd.subdomain") ) )rr8rs rregistered_domainzESQLBase.registered_domainxs0 ///rRenamec t|fi|S)a}The ``RENAME`` processing command renames one or more columns. :param columns: The old and new column name pairs, given as keyword arguments. If a name conflicts with an existing column name, the existing column is dropped. If multiple columns are renamed to the same name, all but the rightmost column with the same new name are dropped. Examples:: query = ( ESQL.from_("employees") .keep("first_name", "last_name", "still_hired") .rename(still_hired="employed") ) )rrws rrenamezESQLBase.renames d&g&&rquery named_queryRerankc t|g|i|S)aThe ``RERANK`` command uses an inference model to compute a new relevance score for an initial set of documents, directly within your ES|QL queries. :param query: The query text used to rerank the documents. This is typically the same query used in the initial search. :param named_query: The query text used to rerank the documents, given as a keyword argument. The argument name is used for the column name. If the query is given as a positional argument, the results will be stored in a column named ``_score``. If the specified column already exists, it will be overwritten with the new results. Examples:: query1 = ( ESQL.from_("books").metadata("_score") .where('MATCH(description, "hobbit")') .sort("_score DESC") .limit(100) .rerank("hobbit").on("description").with_(inference_id="test_reranker") .limit(3) .keep("title", "_score") ) query2 = ( ESQL.from_("books").metadata("_score") .where('MATCH(description, "hobbit") OR MATCH(author, "Tolkien")') .sort("_score DESC") .limit(100) .rerank(rerank_score="hobbit").on("description", "author").with_(inference_id="test_reranker") .sort("rerank_score") .limit(3) .keep("title", "_score", "rerank_score") ) query3 = ( ESQL.from_("books").metadata("_score") .where('MATCH(description, "hobbit") OR MATCH(author, "Tolkien")') .sort("_score DESC") .limit(100) .rerank(rerank_score="hobbit").on("description", "author").with_(inference_id="test_reranker") .eval(original_score="_score", _score="rerank_score + original_score") .sort("_score") .limit(3) .keep("title", "original_score", "rerank_score", "_score") ) )r)r8rrs rrerankzESQLBase.reranks\d2U2k22r probabilitySamplect||S)a?The ``SAMPLE`` command samples a fraction of the table rows. :param probability: The probability that a row is included in the sample. The value must be between 0 and 1, exclusive. Examples:: query = ESQL.from_("employees").keep("emp_no").sample(0.05) )r)r8rs rsamplezESQLBase.samplesdK((rSortct|g|S)aeThe ``SORT`` processing command sorts a table on one or more columns. :param columns: The columns to sort on. Examples:: query1 = ( ESQL.from_("employees") .keep("first_name", "last_name", "height") .sort("height") ) query2 = ( ESQL.from_("employees") .keep("first_name", "last_name", "height") .sort("height DESC") ) query3 = ( ESQL.from_("employees") .keep("first_name", "last_name", "height") .sort("height DESC", "first_name ASC") ) query4 = ( ESQL.from_("employees") .keep("first_name", "last_name", "height") .sort("first_name ASC NULLS FIRST") ) )rrws rsortz ESQLBase.sorts8D#7##rc t|g|i|S)aF The ``STATS`` processing command groups rows according to a common value and calculates one or more aggregated values over the grouped rows. :param expressions: A list of expressions, given as positional arguments. :param named_expressions: A list of expressions, given as keyword arguments. The argument names are used for the returned aggregated values. Note that only one of ``expressions`` and ``named_expressions`` must be provided. Examples:: query1 = ( ESQL.from_("employees") .stats(count=functions.count("emp_no")).by("languages") .sort("languages") ) query2 = ( ESQL.from_("employees") .stats(avg_lang=functions.avg("languages")) ) query3 = ( ESQL.from_("employees") .stats( avg_lang=functions.avg("languages"), max_lang=functions.max("languages") ) ) query4 = ( ESQL.from_("employees") .stats( avg50s=functions.avg("salary").where('birth_date < "1960-01-01"'), avg60s=functions.avg("salary").where('birth_date >= "1960-01-01"'), ).by("gender") .sort("gender") ) query5 = ( ESQL.from_("employees") .eval(Ks="salary / 1000") .stats( under_40K=functions.count(E("*")).where("Ks < 40"), inbetween=functions.count(E("*")).where("40 <= Ks AND Ks < 60"), over_60K=functions.count(E("*")).where("60 <= Ks"), total=f.count(E("*")) ) ) query6 = ( ESQL.row(i=1, a=["a", "b"]) .stats(functions.min("i")).by("a") .sort("a ASC") ) query7 = ( ESQL.from_("employees") .eval(hired=functions.date_format("hire_date", "yyyy")) .stats(avg_salary=functions.avg("salary")).by("hired", "languages.long") .eval(avg_salary=functions.round("avg_salary")) .sort("hired", "languages.long") ) )rrs rstatszESQLBase.statss|T=K=+<==rct|S)a5The ``TS_INFO`` processing command retrieves information about individual time series available in time series data streams, along with the dimension values that identify each series. Examples:: query1 = ( ESQL.ts("k8s") .ts_info() .sort("metric_name", "dimensions") ) query2 = ( ESQL.ts("k8s") .where("cluster == "prod"") .ts_info() .sort("metric_name", "dimensions") ) )TsInfor<s rts_infozESQLBase.ts_info>s&d|rUriPartsc t|fi|S)aNThe ``URI_PARTS`` processing command parses a Uniform Resource Identifier (URI) string and extracts its components into new columns. :param prefix: A keyword argument, where the argument name is the prefix for the output columns, and the value is the string expression containing the URI to parse. Examples:: query1 = ( ESQL.row(uri="http://myusername:mypassword@www.example.com:80/foo.gif?key1=val1&key2=val2#fragment") .uri_parts(parts="uri") .keep("parts.*") ) query2 = ( ESQL.from_("web_logs") .uri_parts(p="uri") .where("p.domain == "www.example.com"") .stats(functions.count(E("*"))).by("p.path") ) )rrs r uri_partszESQLBase.uri_partsSs,'''r UserAgentc t|fi|S)aThe ``USER_AGENT`` processing command parses a user-agent string and extracts its components (name, version, OS, device) into new columns. :param prefix: A keyword argument, where the argument name is the prefix for the output columns, and the value is the string expression containing the user agent string to parse. Examples:: query1 = ( ESQL.row(input="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.149 Safari/537.36") .user_agent(ua="input").with_(extract_device_type=True) .keep("ua.*") ) query2 = ( ESQL.row(input="Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15") .user_agent(ua="input").with_( properties=["name", "version", "device"], extract_device_type=True ) .keep("ua.*") ) )rrs r user_agentzESQLBase.user_agentks0(((rWherect|g|S)apThe ``WHERE`` processing command produces a table that contains all the rows from the input table for which the provided condition evaluates to ``true``. :param expressions: A list of boolean expressions, given as positional arguments. These expressions are combined with an ``AND`` logical operator. Examples:: query1 = ( ESQL.from_("employees") .keep("first_name", "last_name", "still_hired") .where("still_hired == true") ) query2 = ( ESQL.from_("sample_data") .where("@timestamp > NOW() - 1 hour") ) query3 = ( ESQL.from_("employees") .keep("first_name", "last_name", "height") .where("LENGTH(first_name) < 4") ) )r)r8rs rwherezESQLBase.wheres0T(K((rr5)F)rar2rNNNNNNNN)rr)rr)2r)r*r+r,rr9r0r=r;rr@r-r.rI FieldTypeboolrSr/rYr]r_rdrhrmrsrxr|rrrrrrintrrrrrrrrfloatrrrrrrrrrrr2r2os0x 30#++ #  NYN3NNy$3 > c  D/ Nz(()( ("*9%*97E*9 *9X-Y---( $Y $6 $$S$X$(5^5n5QW5:%)$($($($($($(RR!R! R ! R ! R!R!R!R R@+"8C=+"F+"Z *) *c *f *D2D*2DAO2D 2Dh $Y $6 $ / / / . .l .D!*).)..).E).V & &j &0.0=O04' 'h'$.3^.3N.3x.3` )% )H )$^$$<>>*>>AO>> >>@*(.(Z(0)>)k)4).)W)rr2cHeZdZdZdZdeffd ZdeddfdZde fdZ xZ S) rzImplementation of the ``FROM`` source command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. FROMrcNt|||_t|_yr5)superr9_indicestuple_metadata_fields)r8rr\s rr9z From.__init__s  7|jDcgc]}|j|}}|jddj|}|jr>|ddj|jDcgc]}|j |c}z}|Scc}wcc}w)N , z METADATA )rrI command_namer?rrS)r8rDrrRrs rr@zFrom._render_internals:>--H4%%e,HH  !499W#5"6 7  tyydNcNc)dU$//%*@)defgh I *es B0B ) r)r*r+r,rr.r9rrr0r@ __classcell__r\s@rrrs:L??  f#rrc4eZdZdZdeffd ZdefdZxZS)rzImplementation of the ``ROW`` source command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. rc t||jDcic]K\}}|j|t |t st j|n|j|Mc}}|_ ycc}}wr5) rr9itemsrSrVrrWrXrY_paramsr8rkvr\s rr9z Row.__init__so    1 OOA !!%;< 1 &&q) *   sAA=rc ddj|jjDcgc] \}}|d|c}}zScc}}w)NzROW r = r?rrr8rrs rr@zRow._render_internal? DLL`, which makes it possible to chain all the commands that belong to an ES|QL query in a single expression. rc0t|||_yr5)rr9_item)r8rr\s rr9z Show.__init__s  rrc>d|j|jS)NzSHOW )rSrr<s rr@zShow._render_internalsttzz2344r)r)r*r+r,r0r9r@rrs@rr r s S5#5rr ceZdZdZdZy)r#zImplementation of the ``TS`` source command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. Nr)r*r+r,rrrrr#r#sLrr#ceZdZdZdefdZy)r'aImplementation of a branch inside a ``FORK`` processing command. This class inherits from :class:`ESQLBase `, which makes it possible to chain all the commands that belong to the branch in a single expression. rcy)Nrr<s rr@zBranch._render_internalsrN)r)r*r+r,r0r@rrrr'r's#rr'c4eZdZdZdeffd ZdefdZxZS)rczImplementation of the ``SET`` query directive. This class inherits from :class:`ESQL `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. rc t||jDcic]O\}}|j|t |t st j|ntj|Qc}}|_ ycc}}wr5) rr9rrSrVrrWrXr2rYrrs rr9z Set.__init__so    1 OOA !!%;< 1 **1- .   sABrc ddj|jjDcgc] \}}|d|c}}zScc}}w)NzSET rrrrs rr@zSet._render_internalrrrrs@rrcrcrrrcc\eZdZdZdedeffd ZdeddfdZded eddfd Z defd Z xZ S) rfzImplementation of the ``CHANGE POINT`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rec\t||||_d|_d|_d|_yr5)rr9_value_key _type_name _pvalue_name)r8r3rer\s rr9zChangePoint.__init__s-   )- )-+/rkeyrc||_|S)zContinuation of the ``CHANGE_POINT`` command. :param key: The column with the key to order the values by. If not specified, ``@timestamp`` is used. )r)r8r s ronzChangePoint.on&s   r type_name pvalue_namec"||_||_|S)aContinuation of the ``CHANGE_POINT`` command. :param type_name: The name of the output column with the change point type. If not specified, ``type`` is used. :param pvalue_name: The name of the output column with the p-value that indicates how extreme the change point is. If not specified, ``pvalue`` is used. )r r )r8rrs ras_zChangePoint.as_/s$' rc8|jsdnd|j|j}|js|jsdnAd|j|jxsdd|j|jxsd}d|j||S)Nr ON  AS typerpvaluez CHANGE_POINT )rrSr r r)r8r namess rr@zChangePoint._render_internal<s bdoodii.H-I'J??4+<+< (A6BC2dooVZVgVgVsksFtEuv  t{{mC588r) r)r*r+r,r2rr9r r0rr@rrs@rrfrfsT0x0 0iM S s } 9#9rrfcLeZdZdZdededeffd ZdeddfdZdefd Z xZ S) rkzImplementation of the ``COMPLETION`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rirjct|t|zdkDr tdt| |||_||_d|_yNzGthis method requires either one positional or one keyword argument only)lenrrr9_prompt _named_prompt _inference_id)r8r3rirjr\s rr9zCompletion.__init__NsQ v;\* *Q .Y    ),0r inference_idrc||_|S)aContinuation of the ``COMPLETION`` command. :param inference_id: The ID of the inference endpoint to use for the task. The inference endpoint must be configured with the ``completion`` task type. rr8r s rwith_zCompletion.with_Z* rc|j tdd|ji}|jrt|jj d}t|jj d}d|j |d|j |dtj|Sd|j |jddtj|S)N/The completion command requires an inference IDr rz COMPLETION r WITH ) rrrlistkeysvaluesrSrWrXr)r8r$rris rr@zCompletion._render_internalds    %NO O!3!34   $,,1134Q7F$,,3356q9F !8 9T__V=T`, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rnrocNt||||_||_d|_yr5)rr9_input_pattern _separatorr8r3rnror\s rr9zDissect.__init__xs%    )-r separatorrc||_|S)zContinuation of the ``DISSECT`` command. :param separator: A string used as the separator between appended values, when using the append modifier. )r1)r8r3s rappend_separatorzDissect.append_separator~s $ rc|jdn!dtj|j}d|j|jdtj|j |S)Nrz APPEND_SEPARATOR=zDISSECT r)r1rWrXrSr/r0)r8seps rr@zDissect._render_internalsi& %djj&A%BC tt{{34Adjj6O5PQTPU V r) r)r*r+r,r2rr0r9r5r@rrs@rrprppsA.x. .C. #) # rrpc8eZdZdZdedeffd ZdefdZxZ S)ruzImplementation of the ``DROP`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rtc2t||||_yr5rr9_columnsr8r3rtr\s rr9z Drop.__init__   rrc ddj|jDcgc]}|j|dc}Scc}w)NzDROP rTrKr?r;rSr8cols rr@zDrop._render_internals<tyyW[WdWd!ePS$//#d/"K!efghh!es> r)r*r+r,r2rr9r0r@rrs@rrurus) x 9 i#irruc\eZdZdZdedeffd ZdeddfdZded eddfd Z defd Z xZ S) rzzImplementation of the ``ENRICH`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3ryc\t||||_d|_d|_d|_yr5)rr9_policy _match_field_fields _named_fields)r8r3ryr\s rr9zEnrich.__init__s.   158< =Ar match_fieldrc||_|S)ayContinuation of the ``ENRICH`` command. :param match_field: The match field. ``ENRICH`` uses its value to look for records in the enrich index. If not specified, the match will be performed on the column with the same name as the ``match_field`` defined in the enrich policy. )rG)r8rJs rr z Enrich.ons( rr named_fieldsc@|r |r td||_||_|S)a`Continuation of the ``ENRICH`` command. :param fields: The enrich fields from the enrich index that are added to the result as new columns, given as positional arguments. If a column with the same name as the enrich field already exists, the existing column will be replaced by the new column. If not specified, each of the enrich fields defined in the policy is added. A column with the same name as the enrich field will be dropped unless the enrich field is renamed. :param named_fields: The enrich fields from the enrich index that are added to the result as new columns, given as keyword arguments. The name of the keyword arguments are used as column names. If a column has the same name as the new name, it will be discarded. If a name (new or original) occurs more than once, only the rightmost duplicate creates a new column. Athis method supports positional or keyword arguments but not both)rrHrI)r8rrLs rr$z Enrich.with_s/ lS  ) rc |jdnd|j|j}d}|jrcddj|jj Dcgc]*\}}|j|d|j|,c}}}nG|j ;ddj|j Dcgc]}|j|c}}d|j ||Scc}}wcc}w)Nrrr(rrzENRICH )rGrSrIr?rrHrF)r8r r$namers rr@zEnrich._render_internals!  ( (9(9:;<    TYYqurDrDrJrJrL(Mbmbfhm4??4+@*AT__UZE[D\(](MNOPE \\ % #UuDOOE$:#UVWX rd5'22 (M$Vs $/C8 C> ) r)r*r+r,r2r0r9rr r$r@rrs@rrzrzsWBxBB i H Y h0 3# 3rrzc<eZdZdZdededeffd ZdefdZxZ S)r~zImplementation of the ``EVAL`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rtr}cX|r |r tdt| ||xs||_yNrN)rrr9r;)r8r3rtr}r\s rr9z Eval.__init__s5 }S   0= rrc t|jtr`dj|jj Dcgc]*\}}|j |d|j |,c}}}n9dj|jDcgc]}|j |c}}d|Scc}}wcc}w)NrrzEVAL )rVr;dictr?rrSrY)r8rPrecolsrBs rr@zEval._render_internals dmmT *99(,}}':':'<#et,-S1B1B51I0JKD99T]]Sc!2!23!7 89STDtf~ Ts /B9 B? r)r*r+r,r2r/r9r0r@rrs@rr~r~s5 1 1! 1( 1 # rr~ceZdZdZ ddedddeddeddeddedd edd edd edffd Zd efdZxZ S)r[zImplementation of the ``FORK`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rr'rrrrrrrc Bt |||||||||| g|_yr5)rr9 _branches) r8r3rrrrrrrrr\s rr9z Fork.__init__s*  ueUE5Qrrcd}|jD]=}|s|jddjdd}|dk(rd|d}5|d|dz }?d|S) Nr rz( z )z ( zFORK )rZr;rQ)r8cmdsr(cmds rr@zFork._render_internalsqnn 2Fmmoab)11$<2:uB`, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rcNt||||_g|_i|_yr5)rr9r by_columnsoptions)r8r3rr\s rr9z Fuse.__init__1s%   +-') rrtrcB|xjt|z c_|Sr5)rbr)rws rbyzFuse.by7s 4=( rrcc ||_|Sr5)rcr8rcs rr$z Fuse.with_;s  rcN|jrd|jjnd}|jr/ddj|jDcgc]}d| c}znd}|jr"dt j |jznd}d|||Scc}w)NrrBY r(FUSE)rupperrbr?rcrWrX)r8rrrer$s rr@zFuse._render_internal?s.2kk1T[[&&()*r #((Ivc&NIJ J 8<||4::dll33fXbT%)) Js B" r5)r)r*r+r,r2rr0r9rrerr$r@rrs@rrr)sQ*x*#* 9sv*#*rrc<eZdZdZdededeffd ZdefdZxZ S)rzImplementation of the ``GROK`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rnroc@t||||_||_yr5)rr9r/r0r2s rr9z Grok.__init__Rs    rrc~d|j|jdtj|jS)NzGROK r)rSr/rWrXr0r<s rr@zGrok._render_internalWs1tt{{34Adjj6O5PQQr) r)r*r+r,r2rr0r9r@rrs@rrrJs0 x  C R#Rrrc8eZdZdZdedeffd ZdefdZxZ S)rzImplementation of the ``KEEP`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rtc2t||||_yr5r:r<s rr9z Keep.__init__cr=rrc ddj|jDcgc]}|j|dc}Scc}w)NzKEEP rTr?r@rAs rr@zKeep._render_internalgsBtyy\`\i\i!jUXT__S_%N$O"P!jklmm!js? rCrs@rrr[s) x 9 n#nrrc8eZdZdZdedeffd ZdefdZxZ S)rzImplementation of the ``LIMIT`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rc2t||||_yr5)rr9_max_number_of_rows)r8r3rr\s rr9zLimit.__init__ss  #5 rrcFdtj|jS)NzLIMIT )rWrXrtr<s rr@zLimit._render_internalws 4#;#;<=>>r) r)r*r+r,r2rr9r0r@rrs@rrrks'6x6S6?#?rrcHeZdZdZdedeffd ZdeddfdZde fdZ xZ S) rzImplementation of the ``LOOKUP JOIN`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rc@t||||_d|_yr5)rr9 _lookup_index_field)r8r3rr\s rr9zLookupJoin.__init__s  )+/ rrrc||_|S)a}Continuation of the ``LOOKUP JOIN`` command. :param field: The field to join on. This field must exist in both your current query results and in the lookup index. If the field contains multi-valued entries, those entries will not match anything (the added fields will contain null for those rows). )ry)r8rs rr z LookupJoin.ons  rc|j tdt|jtr |jn|jj j }d|j|d|j|jS)Nz!Joins require a field to join on.z LOOKUP JOIN r) ryrrVrxr0rFrHrIrS)r8rDs rr@zLookupJoin._render_internals ;; @A A$,,c2   ##**00  4--e45T$//$++:V9W X r) r)r*r+r,r2r.r9rr r0r@rrs@rrr{s:0x0y0  l   #  rrc4eZdZdZdeffd ZdefdZxZS)rzImplementation of the ``METRICS_INFO`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3c$t||yr5rr9r8r3r\s rr9zMetricsInfo.__init__  rrcy)N METRICS_INFOrr<s rr@zMetricsInfo._render_internalsr r)r*r+r,r2r9r0r@rrs@rrrs !x!#rrc\eZdZdZdededeffd ZdeddfdZ d e ddfd Z de fd Z xZS) rzImplementation of the ``MMR`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rrc\t||||_||_d|_d|_yr5)rr9ry _query_vectorrt_lambda)r8r3rrr\s rr9z Mmr.__init__s0   )26 (, rrrc||_|S)zContinuation of the ``MMR`` command. :param max_number_of_rows: The maximum number of rows to return after diversification. )rtrs r mmr_limitz Mmr.mmr_limits $6  rlambda_c||_|S)a{Continuation of the ``MMR`` command. :param lambda_: A value between 0.0 and 1.0 that controls how similarity is calculated during diversification. Higher values weight the similarity to the query_vector more heavily, lower values weight the diversity more heavily. )r)r8rs rr$z Mmr.with_s  rcRd}|j!||j|jdz }|d|j|jz }d}|jd|j}|j $dt jd|j iznd}d|||S)NrrzON z LIMIT r(lambdazMMR )rrYrSryrtrrWrX)r8r rr$s rr@zMmr._render_internals     ) T&&t'9'9:;1= =B DOODKK0122  # # /d6678E||' tzz8T\\":; ;  bT%((r)r)r*r+r,r2rr/r9rrrr$r0r@rrs@rrrsW--'0-@N-CE U u  )# )rrc8eZdZdZdedeffd ZdefdZxZ S)rzImplementation of the ``MV_EXPAND`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rc2t||||_yr5)rr9_column)r8r3rr\s rr9zMvExpand.__init__s   rrc>d|j|jS)Nz MV_EXPAND )rSrr<s rr@zMvExpand._render_internalsDOODLL9:;;rrCrs@rrrs'x<#`, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rc dt||t|dk7r td||_yNrz1this method requires exactly one keyword argumentrr9rr_prefixr8r3rr\s rr9zRegisteredDomain.__init__/  v;! PQ Q rrct|jjd}t|jjd}d|j |d|j |S)NrzREGISTERED_DOMAIN rr)rr*r+rSrYr8rrTs rr@z!RegisteredDomain._render_internalsdT\\&&()!,DLL'')*1-#DOOE$:#;3t?P?PQU?V>WXXrrWrs@rrrs)x> Y#Yrrc8eZdZdZdedeffd ZdefdZxZ S)rzImplementation of the ``RENAME`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rtc 2t||||_yr5r:r<s rr9zRename.__init__r=rrc ddj|jjDcgc]*\}}|j|d|j|,c}}Scc}}w)NzRENAME rr)r?r;rrS)r8old_namenew_names rr@zRename._render_internals}A}J}J}P}P}R$Sfxfnpxtx'@&AdooV^F_E`$a$STUV V$Ss/A# rCrs@rrr s) x I V#Vrrc\eZdZdZdededeffd ZdeddfdZd eddfd Z defd Z xZ S) rzImplementation of the ``RERANK`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rrct|t|zdkDr tdt| |||_||_d|_d|_yr)rrrr9_query _named_queryrHr)r8r3rrr\s rr9zRerank.__init__!sX u:K( (1 ,Y    '26 ,0rrrc||_|S)zContinuation of the ``RERANK`` command. :param fields: One or more fields to use for reranking. These fields should contain the text that the reranking model will evaluate. )rHrs rr z Rerank.on.s   rr c||_|S)aContinuation of the ``RERANK`` command. :param inference_id: The ID of the inference endpoint to use for the task. The inference endpoint must be configured with the ``rerank`` task type. r"r#s rr$z Rerank.with_7r%rc t|j td|j tdd|ji}|jrvt |jj d}t |jj d}|j|dtj|}n"tj|jd}d|ddj|jDcgc]}|j|c}d tj|Scc}w) Nz;The rerank command requires one or more fields to rerank onr'r rrzRERANK rrr() rHrrrr)r*r+rSrWrXrr?)r8r$rrrs rr@zRerank._render_internalAs << M     %NO O!3!34   $++0023A6F**1134Q7Ev./s4::e3D2EFEJJt{{1~.EeW))NT__U3NOPQJJu%& ( Ns>D5) r)r*r+r,r2r/r9r0r r$r@rrs@rrrsW 1 1(6 1GU 1#(#( # rrc8eZdZdZdedeffd ZdefdZxZ S)rzImplementation of the ``SAMPLE`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rc2t||||_yr5)rr9 _probability)r8r3rr\s rr9zSample.__init__^  'rrcFdtj|jS)NzSAMPLE )rWrXrr<s rr@zSample._render_internalbsD$5$56788r) r)r*r+r,r2rr9r0r@rrs@rrrVs'(x(e(9#9rrc8eZdZdZdedeffd ZdefdZxZ S)rzImplementation of the ``SORT`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rtc2t||||_yr5r:r<s rr9z Sort.__init__nr=rrc &|jDcgc]H}djt|jdDcgc]}|j |c}J}}}ddj|Dcgc]}|c}Scc}wcc}}wcc}w)NrzSORT r)r;r?r0splitrS)r8rBtermsortsrs rr@zSort._render_internalrs}}  HHCs8KLdood+L M  tyy!>TF)!>?@AAM "?s,BB B0 B BrWrs@rrrfs) x > B#BrrcPeZdZdZdZdededeffd Zdeddfd Zde fd Z xZ S) rzImplementation of the ``STATS`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. STATSr3rrcf|r |r tdt| ||xs||_d|_yrS)rrr9 _expressions_grouping_expressions)r8r3rrr\s rr9zStats.__init__s@ ,S   '<+<KO"rgrouping_expressionsrc||_|S)a<Continuation of the ``STATS`` and ``INLINE STATS`` commands. :param grouping_expressions: Expressions that output the values to group by. If their names coincide with one of the computed columns, that column will be ignored. )r)r8rs rrezStats.bys&:" rc t|jtrP|jjDcgc]*\}}|j |d|j |,}}}n)|jDcgc]}|j |}}dt |jdzz}d|}|jdn>d|ddj|jDcgc]}|j |c}}|jd|j|Dcgc]}|c}|Scc}}wcc}wcc}wcc}w) Nrrr\z, rr]rir) rVrrUrrSrYrrrr?)r8r reexprsrTindentexpression_separatorres rr@zStats._render_internals^ d'' .#'"3"3"9"9";C??3'(D,=,=e,D+EFE ?C>O>OPd))$/01PEPD--.23!$VH~))1 fXSUYUoUo+pTt/@/@/F.G,H+p!q rs ##$A&:&?&?W\@]tD6@]&^%_`b_cdd Q ,q@]s/D29D8D= E ) r)r*r+r,rr2r/r9rer0r@rrs@rrrzsUL P P% P, P7e#errceZdZdZdZy)rzImplementation of the ``INLINE STATS`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. z INLINE STATSNrrrrrrs"Lrrc4eZdZdZdeffd ZdefdZxZS)rzImplementation of the ``TS_INFO`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3c$t||yr5r~rs rr9zTsInfo.__init__rrrcy)NTS_INFOrr<s rr@zTsInfo._render_internalsrrrs@rrrs !x!#rrc8eZdZdZdedeffd ZdefdZxZ S)rzImplementation of the ``URI_PARTS`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rc dt||t|dk7r td||_yrrrs rr9zUriParts.__init__rrrct|jjd}t|jjd}d|j |d|j |S)Nrz URI_PARTS rrrs rr@zUriParts._render_internalscT\\&&()!,DLL'')*1-DOOE233t7H7H7N6OPPrrWrs@rrrs)x> Q#QrrcHeZdZdZdedeffd ZdeddfdZdefdZ xZ S) rzImplementation of the ``USER_AGENT`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rc rt||t|dk7r td||_d|_yr)rr9rrr_optionsrs rr9zUserAgent.__init__s6  v;! PQ Q 26 rrcrc ||_|Sr5)rrgs rr$zUserAgent.with_s  rcBt|jjd}t|jjd}d}|jrd|j |j}d|j |d|j ||S)Nrrr(z USER_AGENT r)r)rr*r+rrYrS)r8rrTr$s rr@zUserAgent._render_internalsT\\&&()!,DLL'')*1- ==T..t}}=>?ET__U34C8I8I$8O7PQVPWXXrr,rs@rrrs<7x7>7s{Y#Yrrc8eZdZdZdedeffd ZdefdZxZ S)rzImplementation of the ``WHERE`` processing command. This class inherits from :class:`ESQLBase `, to make it possible to chain all the commands that belong to an ES|QL query in a single expression. r3rc2t||||_yr5)rr9r)r8r3rr\s rr9zWhere.__init__rrrc ddj|jDcgc]}|j|c}Scc}w)NzWHERE  AND )r?rrY)r8rTs rr@zWhere._render_internals> tO`O`%at):):4)@(A&B%abcdd%as= rWrs@rrrs)(x(~(e#errrrrc dtdj|Dcgc]}d|d c}Scc}w)z6Combine two or more expressions with the AND operator.r()rr?rrTs rand_rs, !',, /T!D6 /T"U VV/T - c dtdj|Dcgc]}d|d c}Scc}w)z5Combine two or more expressions with the OR operator.z OR rrrrs ror_r s, !&++{.St4&{.S"T UU.Sr expressionc td|dS)zNegate an expression.zNOT (r)r)rs rnot_rs !E*Q"7 88r):rWrOabcrrtypingrrrrr r r dsl.document_baser rrr0rr.r/rr2rrr r#r'rcrfrkrprurzr~r[rrrrrrrrrrrrrrrrrrrrrrrrrrsQ$ #@@@WW #S( ) $|$c) * N3Nbn )sn )b8DS(S. 58 5  X S(S.,9(,9^']']T h D i8 i ?3X?3D8D 8 F*8*BR8R" n8 n ?H ? " " J ( 3)(3)l