- Notifications
You must be signed in to change notification settings - Fork 25.7k
Closed
Labels
:Analytics/ES|QLAKA ESQLAKA ESQLbug"" muted="" aria-describedby="MDU6TGFiZWwyMzE3Mw==-tooltip :R1aqdb:">>bugTeam:AnalyticsMeta label for analytical engine team (ESQL/Aggs/Geo)Meta label for analytical engine team (ESQL/Aggs/Geo)medium-riskAn open issue or test failure that is a medium risk to future releasesAn open issue or test failure that is a medium risk to future releases
Description
With CSV dataset
from multivalue_points,h*,messa* | eval `card` = true, PbehoQUqKSF = "VLGjhcgNkQiEVyCLo", DsxMWtGL = true, qSxTIvUorMim = true, `location` = 8593178066470220111, type = -446161601, FSkGQkgmS = false | eval PbehoQUqKSF = 753987034, HLNMQfQj = true, `within` = true, `id` = "JDKKkYwhhh", lk = null, aecuvjTkgZza = 510616700, aDAMpuVtNX = null, qCopgNZPt = "AjhJUtZefqKdJYH", BxHHlFoA = "isBrmhKLc" | rename message as message | lookup join message_types_lookup on message | sort PbehoQUqKSF DESC, ip1 DESC NULLS LAST | limit 5845 | drop `subset`, ip*, `card`, `within`, host.v*, description, `aecuvjTkgZza`, host.version, `ip0`, height_range, DsxMWtGL, host_group, `aDAMpuVtNX`, PbehoQUqKSF, `intersects`, `host.os`, aDAMpuVtNX, *ight_range, HLNMQfQj, `FSkGQkgmS`, BxHHlFoA, card | grok type "%{WORD:GknCxQFo}" | eval `location` = null, ZjWUUvGusyyz = null, HeeKIpzgh = false, `id` = 4325287503714500302, host = false, `lk` = null, HvTQdOqFajpH = false, fKNlsYoT = true, `location` = -1158449473, `qCopgNZPt` = 1219986202615280617 | drop HeeKIpzg*, `ZjWUUvGusyyz`, `message`, `type`, `lk` | grok GknCxQFo "%{WORD:location} %{WORD:HvTQdOqFajpH}" | drop HvTQdOqFajpH, `location`, centroid | mv_expand GknCxQFo | limit 410 | limit 3815 | rename `id` AS `GknCxQFo` | grok host.name "%{WORD:oGQQZHxQHj} %{WORD:qCopgNZPt} %{WORD:vHKOmmocPcTO}" | stats BkQXJRMeAM = min(GknCxQFo) | keep `BkQXJRMeAM` verification_exception�reason Found 1 problem | line 1:787: Grok only supports KEYWORD or TEXT values, found expression [type] type [INTEGER] Metadata
Metadata
Assignees
Labels
:Analytics/ES|QLAKA ESQLAKA ESQLbug"" muted="" aria-describedby="MDU6TGFiZWwyMzE3Mw==-tooltip :R2hehb:">>bugTeam:AnalyticsMeta label for analytical engine team (ESQL/Aggs/Geo)Meta label for analytical engine team (ESQL/Aggs/Geo)medium-riskAn open issue or test failure that is a medium risk to future releasesAn open issue or test failure that is a medium risk to future releases