---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- requires:
    capabilities:
    - method: "POST"
      path: "/_query"
      parameters:
      - "method"
      - "path"
      - "parameters"
      - "capabilities"
      capabilities:
      - "union_types"
      - "union_types_remove_fields"
      - "casting_operator"
    reason: "Union types and casting operator introduced in 8.15.0"
    test_runner_features:
    - "capabilities"
    - "allowed_warnings_regex"
    - "warnings_regex"
- do:
    indices.create:
      index: "events_ip_long"
      body:
        mappings:
          properties:
            '@timestamp':
              type: "date"
            client_ip:
              type: "ip"
            event_duration:
              type: "long"
            message:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      refresh: true
      index: "events_ip_long"
      body:
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:55:01.543Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": 1756467, \"message\": \"Connected to 10.1.0.1\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:53:55.832Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": 5033755, \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:52:55.015Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": 8268153, \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:51:54.732Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": 725448, \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:33:34.937Z\", \"client_ip\": \"172.21.0.5\"\
        , \"event_duration\": 1232382, \"message\": \"Disconnected\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T12:27:28.948Z\", \"client_ip\": \"172.21.2.113\"\
        , \"event_duration\": 2764889, \"message\": \"Connected to 10.1.0.2\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T12:15:03.360Z\", \"client_ip\": \"172.21.2.162\"\
        , \"event_duration\": 3450233, \"message\": \"Connected to 10.1.0.3\"}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "events_keyword_long"
      body:
        mappings:
          properties:
            '@timestamp':
              type: "date"
            client_ip:
              type: "keyword"
            event_duration:
              type: "long"
            message:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      refresh: true
      index: "events_keyword_long"
      body:
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:55:01.543Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": 1756467, \"message\": \"Connected to 10.1.0.1\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:53:55.832Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": 5033755, \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:52:55.015Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": 8268153, \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:51:54.732Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": 725448, \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:33:34.937Z\", \"client_ip\": \"172.21.0.5\"\
        , \"event_duration\": 1232382, \"message\": \"Disconnected\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T12:27:28.948Z\", \"client_ip\": \"172.21.2.113\"\
        , \"event_duration\": 2764889, \"message\": \"Connected to 10.1.0.2\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T12:15:03.360Z\", \"client_ip\": \"172.21.2.162\"\
        , \"event_duration\": 3450233, \"message\": \"Connected to 10.1.0.3\"}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "events_ip_keyword"
      body:
        mappings:
          properties:
            '@timestamp':
              type: "date"
            client_ip:
              type: "ip"
            event_duration:
              type: "keyword"
            message:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      refresh: true
      index: "events_ip_keyword"
      body:
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:55:01.543Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": \"1756467\", \"message\": \"Connected to 10.1.0.1\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:53:55.832Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": \"5033755\", \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:52:55.015Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": \"8268153\", \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:51:54.732Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": \"725448\", \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:33:34.937Z\", \"client_ip\": \"172.21.0.5\"\
        , \"event_duration\": \"1232382\", \"message\": \"Disconnected\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T12:27:28.948Z\", \"client_ip\": \"172.21.2.113\"\
        , \"event_duration\": \"2764889\", \"message\": \"Connected to 10.1.0.2\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T12:15:03.360Z\", \"client_ip\": \"172.21.2.162\"\
        , \"event_duration\": \"3450233\", \"message\": \"Connected to 10.1.0.3\"}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "events_keyword_keyword"
      body:
        mappings:
          properties:
            '@timestamp':
              type: "date"
            client_ip:
              type: "keyword"
            event_duration:
              type: "keyword"
            message:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      refresh: true
      index: "events_keyword_keyword"
      body:
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:55:01.543Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": \"1756467\", \"message\": \"Connected to 10.1.0.1\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:53:55.832Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": \"5033755\", \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:52:55.015Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": \"8268153\", \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:51:54.732Z\", \"client_ip\": \"172.21.3.15\"\
        , \"event_duration\": \"725448\", \"message\": \"Connection error\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T13:33:34.937Z\", \"client_ip\": \"172.21.0.5\"\
        , \"event_duration\": \"1232382\", \"message\": \"Disconnected\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T12:27:28.948Z\", \"client_ip\": \"172.21.2.113\"\
        , \"event_duration\": \"2764889\", \"message\": \"Connected to 10.1.0.2\"}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2023-10-23T12:15:03.360Z\", \"client_ip\": \"172.21.2.162\"\
        , \"event_duration\": \"3450233\", \"message\": \"Connected to 10.1.0.3\"}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
load single index ip_long:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_ip_long METADATA _index | KEEP _index, @timestamp, client_ip,\
          \ event_duration, message | SORT _index ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "_index"
- match:
    columns.0.type: "keyword"
- match:
    columns.1.name: "@timestamp"
- match:
    columns.1.type: "date"
- match:
    columns.2.name: "client_ip"
- match:
    columns.2.type: "ip"
- match:
    columns.3.name: "event_duration"
- match:
    columns.3.type: "long"
- match:
    columns.4.name: "message"
- match:
    columns.4.type: "keyword"
- length:
    values: 7
- match:
    values.0.0: "events_ip_long"
- match:
    values.0.1: "2023-10-23T13:55:01.543Z"
- match:
    values.0.2: "172.21.3.15"
- match:
    values.0.3: 1756467
- match:
    values.0.4: "Connected to 10.1.0.1"
---
load single index keyword_keyword:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_keyword_keyword METADATA _index | KEEP _index, @timestamp,\
          \ client_ip, event_duration, message | SORT _index ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "_index"
- match:
    columns.0.type: "keyword"
- match:
    columns.1.name: "@timestamp"
- match:
    columns.1.type: "date"
- match:
    columns.2.name: "client_ip"
- match:
    columns.2.type: "keyword"
- match:
    columns.3.name: "event_duration"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "message"
- match:
    columns.4.type: "keyword"
- length:
    values: 7
- match:
    values.0.0: "events_keyword_keyword"
- match:
    values.0.1: "2023-10-23T13:55:01.543Z"
- match:
    values.0.2: "172.21.3.15"
- match:
    values.0.3: "1756467"
- match:
    values.0.4: "Connected to 10.1.0.1"
---
load single index ip_long and aggregate by client_ip:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_ip_long | STATS count = COUNT(*) BY client_ip::ip | SORT\
          \ count DESC, `client_ip::ip` ASC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "count"
- match:
    columns.0.type: "long"
- match:
    columns.1.name: "client_ip::ip"
- match:
    columns.1.type: "ip"
- length:
    values: 4
- match:
    values.0.0: 4
- match:
    values.0.1: "172.21.3.15"
- match:
    values.1.0: 1
- match:
    values.1.1: "172.21.0.5"
- match:
    values.2.0: 1
- match:
    values.2.1: "172.21.2.113"
- match:
    values.3.0: 1
- match:
    values.3.1: "172.21.2.162"
---
load single index ip_long and aggregate client_ip my message:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_ip_long | STATS count = COUNT(client_ip::ip) BY message\
          \ | SORT count DESC, message ASC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "count"
- match:
    columns.0.type: "long"
- match:
    columns.1.name: "message"
- match:
    columns.1.type: "keyword"
- length:
    values: 5
- match:
    values.0.0: 3
- match:
    values.0.1: "Connection error"
- match:
    values.1.0: 1
- match:
    values.1.1: "Connected to 10.1.0.1"
- match:
    values.2.0: 1
- match:
    values.2.1: "Connected to 10.1.0.2"
- match:
    values.3.0: 1
- match:
    values.3.1: "Connected to 10.1.0.3"
- match:
    values.4.0: 1
- match:
    values.4.1: "Disconnected"
---
load single index ip_long stats invalid grouping:
- do:
    catch: "/Unknown column \\[x\\]/"
    esql.query:
      body:
        query: "FROM events_ip_long | STATS count = COUNT(client_ip::ip) BY x"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
load two indices, showing unsupported type and null value for event_duration:
- requires:
    test_runner_features:
    - "capabilities"
    capabilities:
    - method: "POST"
      path: "/_query"
      parameters: []
      capabilities:
      - "REPORT_ORIGINAL_TYPES"
    reason: "Uses original_types"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_ip_* METADATA _index | SORT _index ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- length:
    values: 14
- match:
    columns.0.name: "@timestamp"
- match:
    columns.0.type: "date"
- match:
    columns.1.name: "client_ip"
- match:
    columns.1.type: "ip"
- is_false: "columns.1.original_types"
- match:
    columns.2.name: "event_duration"
- match:
    columns.2.type: "unsupported"
- match:
    columns.2.original_types:
    - "keyword"
    - "long"
- match:
    columns.3.name: "message"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "_index"
- match:
    columns.4.type: "keyword"
- length:
    values: 14
- match:
    values.0.0: "2023-10-23T13:55:01.543Z"
- match:
    values.0.1: "172.21.3.15"
- match:
    values.0.2: null
- match:
    values.0.3: "Connected to 10.1.0.1"
- match:
    values.0.4: "events_ip_keyword"
- match:
    values.7.0: "2023-10-23T13:55:01.543Z"
- match:
    values.7.1: "172.21.3.15"
- match:
    values.7.2: null
- match:
    values.7.3: "Connected to 10.1.0.1"
- match:
    values.7.4: "events_ip_long"
---
load two indices with no conversion function, but needs TO_LONG conversion:
- requires:
    test_runner_features:
    - "capabilities"
    capabilities:
    - method: "POST"
      path: "/_query"
      parameters: []
      capabilities:
      - "REPORT_ORIGINAL_TYPES"
    reason: "Uses original_types"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_ip_* METADATA _index | KEEP _index, @timestamp, client_ip,\
          \ event_duration, message | SORT _index ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "_index"
- match:
    columns.0.type: "keyword"
- match:
    columns.1.name: "@timestamp"
- match:
    columns.1.type: "date"
- match:
    columns.2.name: "client_ip"
- match:
    columns.2.type: "ip"
- is_false: "columns.2.original_types"
- match:
    columns.3.name: "event_duration"
- match:
    columns.3.original_types:
    - "keyword"
    - "long"
- match:
    columns.3.type: "unsupported"
- match:
    columns.4.name: "message"
- match:
    columns.4.type: "keyword"
- length:
    values: 14
- match:
    values.0.0: "events_ip_keyword"
- match:
    values.0.1: "2023-10-23T13:55:01.543Z"
- match:
    values.0.2: "172.21.3.15"
- match:
    values.0.3: null
- match:
    values.0.4: "Connected to 10.1.0.1"
- match:
    values.7.0: "events_ip_long"
- match:
    values.7.1: "2023-10-23T13:55:01.543Z"
- match:
    values.7.2: "172.21.3.15"
- match:
    values.7.3: null
- match:
    values.7.4: "Connected to 10.1.0.1"
---
load two indices with incorrect conversion function, TO_IP instead of TO_LONG:
- do:
    catch: "/Cannot use field \\[event_duration\\] due to ambiguities being mapped\
      \ as \\[2\\] incompatible types: \\[keyword\\] in \\[events_ip_keyword\\], \\\
      [long\\] in \\[events_ip_long\\]/"
    esql.query:
      body:
        query: "FROM events_ip_* METADATA _index | EVAL event_duration = TO_IP(event_duration)\
          \ | KEEP _index, @timestamp, client_ip, event_duration, message | SORT _index\
          \ ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
load two indices with single conversion function TO_LONG:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_ip_* METADATA _index | EVAL event_duration = TO_LONG(event_duration)\
          \ | KEEP _index, @timestamp, client_ip, event_duration, message | SORT _index\
          \ ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "_index"
- match:
    columns.0.type: "keyword"
- match:
    columns.1.name: "@timestamp"
- match:
    columns.1.type: "date"
- match:
    columns.2.name: "client_ip"
- match:
    columns.2.type: "ip"
- match:
    columns.3.name: "event_duration"
- match:
    columns.3.type: "long"
- match:
    columns.4.name: "message"
- match:
    columns.4.type: "keyword"
- length:
    values: 14
- match:
    values.0.0: "events_ip_keyword"
- match:
    values.0.1: "2023-10-23T13:55:01.543Z"
- match:
    values.0.2: "172.21.3.15"
- match:
    values.0.3: 1756467
- match:
    values.0.4: "Connected to 10.1.0.1"
- match:
    values.7.0: "events_ip_long"
- match:
    values.7.1: "2023-10-23T13:55:01.543Z"
- match:
    values.7.2: "172.21.3.15"
- match:
    values.7.3: 1756467
- match:
    values.7.4: "Connected to 10.1.0.1"
---
load two indices and drop ambiguous field event_duration:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_ip_* | DROP event_duration"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- length:
    values: 14
---
load two indices, convert and then drop ambiguous field event_duration:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_ip_* | EVAL event_duration = TO_LONG(event_duration) |\
          \ DROP event_duration"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- length:
    values: 14
---
load two indices, convert, rename and then drop ambiguous field event_duration:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_ip_* | EVAL x = TO_LONG(event_duration) | DROP event_duration"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- length:
    values: 14
---
load two indices, convert, rename but not drop ambiguous field event_duration:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_ip_* | EVAL x = TO_LONG(event_duration), y = TO_STRING(event_duration),\
          \ z = TO_LONG(event_duration) | SORT @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "@timestamp"
- match:
    columns.0.type: "date"
- match:
    columns.1.name: "client_ip"
- match:
    columns.1.type: "ip"
- match:
    columns.2.name: "event_duration"
- match:
    columns.2.type: "unsupported"
- match:
    columns.3.name: "message"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "x"
- match:
    columns.4.type: "long"
- match:
    columns.5.name: "y"
- match:
    columns.5.type: "keyword"
- match:
    columns.6.name: "z"
- match:
    columns.6.type: "long"
- length:
    values: 14
- match:
    values.0.0: "2023-10-23T13:55:01.543Z"
- match:
    values.0.1: "172.21.3.15"
- match:
    values.0.2: null
- match:
    values.0.3: "Connected to 10.1.0.1"
- match:
    values.0.4: 1756467
- match:
    values.0.5: "1756467"
- match:
    values.0.6: 1756467
- match:
    values.1.0: "2023-10-23T13:55:01.543Z"
- match:
    values.1.1: "172.21.3.15"
- match:
    values.1.2: null
- match:
    values.1.3: "Connected to 10.1.0.1"
- match:
    values.1.4: 1756467
- match:
    values.1.5: "1756467"
- match:
    values.1.6: 1756467
---
load two indices, showing unsupported type and null value for client_ip:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_*_long METADATA _index | SORT _index ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "@timestamp"
- match:
    columns.0.type: "date"
- match:
    columns.1.name: "client_ip"
- match:
    columns.1.type: "unsupported"
- match:
    columns.2.name: "event_duration"
- match:
    columns.2.type: "long"
- match:
    columns.3.name: "message"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "_index"
- match:
    columns.4.type: "keyword"
- length:
    values: 14
- match:
    values.0.0: "2023-10-23T13:55:01.543Z"
- match:
    values.0.1: null
- match:
    values.0.2: 1756467
- match:
    values.0.3: "Connected to 10.1.0.1"
- match:
    values.0.4: "events_ip_long"
- match:
    values.7.0: "2023-10-23T13:55:01.543Z"
- match:
    values.7.1: null
- match:
    values.7.2: 1756467
- match:
    values.7.3: "Connected to 10.1.0.1"
- match:
    values.7.4: "events_keyword_long"
---
load two indices with no conversion function, but needs TO_IP conversion:
- requires:
    test_runner_features:
    - "capabilities"
    capabilities:
    - method: "POST"
      path: "/_query"
      parameters: []
      capabilities:
      - "union_types_fix_rename_resolution"
    reason: "Union type resolution fix for rename also allows direct usage of unsupported\
      \ fields in KEEP"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_*_long METADATA _index | KEEP _index, @timestamp, client_ip,\
          \ event_duration, message | SORT _index ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "_index"
- match:
    columns.0.type: "keyword"
- match:
    columns.1.name: "@timestamp"
- match:
    columns.1.type: "date"
- match:
    columns.2.name: "client_ip"
- match:
    columns.2.type: "unsupported"
- match:
    columns.3.name: "event_duration"
- match:
    columns.3.type: "long"
- match:
    columns.4.name: "message"
- match:
    columns.4.type: "keyword"
- length:
    values: 14
- match:
    values.0.0: "events_ip_long"
- match:
    values.0.1: "2023-10-23T13:55:01.543Z"
- match:
    values.0.2: null
- match:
    values.0.3: 1756467
- match:
    values.0.4: "Connected to 10.1.0.1"
- match:
    values.7.0: "events_keyword_long"
- match:
    values.7.1: "2023-10-23T13:55:01.543Z"
- match:
    values.7.2: null
- match:
    values.7.3: 1756467
- match:
    values.7.4: "Connected to 10.1.0.1"
---
load two indices with incorrect conversion function, TO_LONG instead of TO_IP:
- do:
    catch: "/Cannot use field \\[client_ip\\] due to ambiguities being mapped as \\\
      [2\\] incompatible types: \\[ip\\] in \\[events_ip_long\\], \\[keyword\\] in\
      \ \\[events_keyword_long\\]/"
    esql.query:
      body:
        query: "FROM events_*_long METADATA _index | EVAL client_ip = TO_LONG(client_ip)\
          \ | KEEP _index, @timestamp, client_ip, event_duration, message | SORT _index\
          \ ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
load two indices with single conversion function TO_IP:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_*_long METADATA _index | EVAL client_ip = TO_IP(client_ip)\
          \ | KEEP _index, @timestamp, client_ip, event_duration, message | SORT _index\
          \ ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "_index"
- match:
    columns.0.type: "keyword"
- match:
    columns.1.name: "@timestamp"
- match:
    columns.1.type: "date"
- match:
    columns.2.name: "client_ip"
- match:
    columns.2.type: "ip"
- match:
    columns.3.name: "event_duration"
- match:
    columns.3.type: "long"
- match:
    columns.4.name: "message"
- match:
    columns.4.type: "keyword"
- length:
    values: 14
- match:
    values.0.0: "events_ip_long"
- match:
    values.0.1: "2023-10-23T13:55:01.543Z"
- match:
    values.0.2: "172.21.3.15"
- match:
    values.0.3: 1756467
- match:
    values.0.4: "Connected to 10.1.0.1"
- match:
    values.7.0: "events_keyword_long"
- match:
    values.7.1: "2023-10-23T13:55:01.543Z"
- match:
    values.7.2: "172.21.3.15"
- match:
    values.7.3: 1756467
- match:
    values.7.4: "Connected to 10.1.0.1"
---
load two indices and drop ambiguous field client_ip:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_*_long | DROP client_ip"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- length:
    values: 14
---
load two indices, convert and then drop ambiguous field client_ip:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_*_long | EVAL client_ip = TO_IP(client_ip) | DROP client_ip"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- length:
    values: 14
---
load two indices, convert, rename and then drop ambiguous field client_ip:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_*_long | EVAL x = TO_IP(client_ip) | DROP client_ip"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- length:
    values: 14
---
load two indices, convert, rename but not drop ambiguous field client_ip:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_*_long | EVAL x = TO_IP(client_ip), y = TO_STRING(client_ip),\
          \ z = TO_IP(client_ip) | SORT @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "@timestamp"
- match:
    columns.0.type: "date"
- match:
    columns.1.name: "client_ip"
- match:
    columns.1.type: "unsupported"
- match:
    columns.2.name: "event_duration"
- match:
    columns.2.type: "long"
- match:
    columns.3.name: "message"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "x"
- match:
    columns.4.type: "ip"
- match:
    columns.5.name: "y"
- match:
    columns.5.type: "keyword"
- match:
    columns.6.name: "z"
- match:
    columns.6.type: "ip"
- length:
    values: 14
- match:
    values.0.0: "2023-10-23T13:55:01.543Z"
- match:
    values.0.1: null
- match:
    values.0.2: 1756467
- match:
    values.0.3: "Connected to 10.1.0.1"
- match:
    values.0.4: "172.21.3.15"
- match:
    values.0.5: "172.21.3.15"
- match:
    values.0.6: "172.21.3.15"
- match:
    values.1.0: "2023-10-23T13:55:01.543Z"
- match:
    values.1.1: null
- match:
    values.1.2: 1756467
- match:
    values.1.3: "Connected to 10.1.0.1"
- match:
    values.1.4: "172.21.3.15"
- match:
    values.1.5: "172.21.3.15"
- match:
    values.1.6: "172.21.3.15"
---
load two indexes and group by converted client_ip:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_*_long | STATS count = COUNT(*) BY client_ip::ip | SORT\
          \ count DESC, `client_ip::ip` ASC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "count"
- match:
    columns.0.type: "long"
- match:
    columns.1.name: "client_ip::ip"
- match:
    columns.1.type: "ip"
- length:
    values: 4
- match:
    values.0.0: 8
- match:
    values.0.1: "172.21.3.15"
- match:
    values.1.0: 2
- match:
    values.1.1: "172.21.0.5"
- match:
    values.2.0: 2
- match:
    values.2.1: "172.21.2.113"
- match:
    values.3.0: 2
- match:
    values.3.1: "172.21.2.162"
---
load two indexes and aggregate converted client_ip:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_*_long | STATS count = COUNT(client_ip::ip) BY message\
          \ | SORT count DESC, message ASC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "count"
- match:
    columns.0.type: "long"
- match:
    columns.1.name: "message"
- match:
    columns.1.type: "keyword"
- length:
    values: 5
- match:
    values.0.0: 6
- match:
    values.0.1: "Connection error"
- match:
    values.1.0: 2
- match:
    values.1.1: "Connected to 10.1.0.1"
- match:
    values.2.0: 2
- match:
    values.2.1: "Connected to 10.1.0.2"
- match:
    values.3.0: 2
- match:
    values.3.1: "Connected to 10.1.0.3"
- match:
    values.4.0: 2
- match:
    values.4.1: "Disconnected"
---
load two indexes, convert client_ip and group by something invalid:
- do:
    catch: "/Unknown column \\[x\\]/"
    esql.query:
      body:
        query: "FROM events_*_long | STATS count = COUNT(client_ip::ip) BY x"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
load four indices with single conversion function TO_LONG:
- requires:
    test_runner_features:
    - "capabilities"
    capabilities:
    - method: "POST"
      path: "/_query"
      parameters: []
      capabilities:
      - "union_types_fix_rename_resolution"
    reason: "Union type resolution fix for rename also allows direct usage of unsupported\
      \ fields in KEEP"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_* METADATA _index | EVAL event_duration = TO_LONG(event_duration)\
          \ | KEEP _index, @timestamp, client_ip, event_duration, message | SORT _index\
          \ ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "_index"
- match:
    columns.0.type: "keyword"
- match:
    columns.1.name: "@timestamp"
- match:
    columns.1.type: "date"
- match:
    columns.2.name: "client_ip"
- match:
    columns.2.type: "unsupported"
- match:
    columns.3.name: "event_duration"
- match:
    columns.3.type: "long"
- match:
    columns.4.name: "message"
- match:
    columns.4.type: "keyword"
- length:
    values: 28
- match:
    values.0.0: "events_ip_keyword"
- match:
    values.0.1: "2023-10-23T13:55:01.543Z"
- match:
    values.0.2: null
- match:
    values.0.3: 1756467
- match:
    values.0.4: "Connected to 10.1.0.1"
- match:
    values.7.0: "events_ip_long"
- match:
    values.7.1: "2023-10-23T13:55:01.543Z"
- match:
    values.7.2: null
- match:
    values.7.3: 1756467
- match:
    values.7.4: "Connected to 10.1.0.1"
- match:
    values.14.0: "events_keyword_keyword"
- match:
    values.14.1: "2023-10-23T13:55:01.543Z"
- match:
    values.14.2: null
- match:
    values.14.3: 1756467
- match:
    values.14.4: "Connected to 10.1.0.1"
- match:
    values.21.0: "events_keyword_long"
- match:
    values.21.1: "2023-10-23T13:55:01.543Z"
- match:
    values.21.2: null
- match:
    values.21.3: 1756467
- match:
    values.21.4: "Connected to 10.1.0.1"
---
load four indices with single conversion function TO_IP:
- requires:
    test_runner_features:
    - "capabilities"
    capabilities:
    - method: "POST"
      path: "/_query"
      parameters: []
      capabilities:
      - "union_types_fix_rename_resolution"
    reason: "Union type resolution fix for rename also allows direct usage of unsupported\
      \ fields in KEEP"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_* METADATA _index | EVAL client_ip = TO_IP(client_ip)\
          \ | KEEP _index, @timestamp, client_ip, event_duration, message | SORT _index\
          \ ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "_index"
- match:
    columns.0.type: "keyword"
- match:
    columns.1.name: "@timestamp"
- match:
    columns.1.type: "date"
- match:
    columns.2.name: "client_ip"
- match:
    columns.2.type: "ip"
- match:
    columns.3.name: "event_duration"
- match:
    columns.3.type: "unsupported"
- match:
    columns.4.name: "message"
- match:
    columns.4.type: "keyword"
- length:
    values: 28
- match:
    values.0.0: "events_ip_keyword"
- match:
    values.0.1: "2023-10-23T13:55:01.543Z"
- match:
    values.0.2: "172.21.3.15"
- match:
    values.0.3: null
- match:
    values.0.4: "Connected to 10.1.0.1"
- match:
    values.7.0: "events_ip_long"
- match:
    values.7.1: "2023-10-23T13:55:01.543Z"
- match:
    values.7.2: "172.21.3.15"
- match:
    values.7.3: null
- match:
    values.7.4: "Connected to 10.1.0.1"
- match:
    values.14.0: "events_keyword_keyword"
- match:
    values.14.1: "2023-10-23T13:55:01.543Z"
- match:
    values.14.2: "172.21.3.15"
- match:
    values.14.3: null
- match:
    values.14.4: "Connected to 10.1.0.1"
- match:
    values.21.0: "events_keyword_long"
- match:
    values.21.1: "2023-10-23T13:55:01.543Z"
- match:
    values.21.2: "172.21.3.15"
- match:
    values.21.3: null
- match:
    values.21.4: "Connected to 10.1.0.1"
---
load four indices with multiple conversion functions TO_LONG and TO_IP:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_* METADATA _index | EVAL event_duration = TO_LONG(event_duration),\
          \ client_ip = TO_IP(client_ip) | KEEP _index, @timestamp, client_ip, event_duration,\
          \ message | SORT _index ASC, @timestamp DESC"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "_index"
- match:
    columns.0.type: "keyword"
- match:
    columns.1.name: "@timestamp"
- match:
    columns.1.type: "date"
- match:
    columns.2.name: "client_ip"
- match:
    columns.2.type: "ip"
- match:
    columns.3.name: "event_duration"
- match:
    columns.3.type: "long"
- match:
    columns.4.name: "message"
- match:
    columns.4.type: "keyword"
- length:
    values: 28
- match:
    values.0.0: "events_ip_keyword"
- match:
    values.0.1: "2023-10-23T13:55:01.543Z"
- match:
    values.0.2: "172.21.3.15"
- match:
    values.0.3: 1756467
- match:
    values.0.4: "Connected to 10.1.0.1"
- match:
    values.7.0: "events_ip_long"
- match:
    values.7.1: "2023-10-23T13:55:01.543Z"
- match:
    values.7.2: "172.21.3.15"
- match:
    values.7.3: 1756467
- match:
    values.7.4: "Connected to 10.1.0.1"
- match:
    values.14.0: "events_keyword_keyword"
- match:
    values.14.1: "2023-10-23T13:55:01.543Z"
- match:
    values.14.2: "172.21.3.15"
- match:
    values.14.3: 1756467
- match:
    values.14.4: "Connected to 10.1.0.1"
- match:
    values.21.0: "events_keyword_long"
- match:
    values.21.1: "2023-10-23T13:55:01.543Z"
- match:
    values.21.2: "172.21.3.15"
- match:
    values.21.3: 1756467
- match:
    values.21.4: "Connected to 10.1.0.1"
---
CASE:
- requires:
    capabilities:
    - method: "POST"
      path: "/_query"
      parameters:
      - "method"
      - "path"
      - "parameters"
      - "capabilities"
      capabilities:
      - "case_mv"
    reason: "CASE support for multivalue conditions introduced in 8.16.0"
- do:
    indices.create:
      index: "b1"
      body:
        mappings:
          properties:
            f:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "b2"
      body:
        mappings:
          properties:
            f:
              type: "boolean"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      refresh: true
      body:
      - "{\"index\": {\"_index\": \"b1\"}}"
      - "{\"a\": 1, \"f\": false}"
      - "{\"index\": {\"_index\": \"b1\"}}"
      - "{\"a\": 2, \"f\": [true, false]}"
      - "{\"index\": {\"_index\": \"b2\"}}"
      - "{\"a\": 3, \"f\": true}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    warnings_regex:
    - ".+evaluation of \\[f?\\] failed, treating result as false. Only first 20 failures\
      \ recorded."
    - ".+java.lang.IllegalArgumentException: CASE expects a single-valued boolean"
    esql.query:
      body:
        query: "FROM b* | EVAL c = CASE(f::BOOLEAN, \"a\", \"b\") | SORT a ASC | LIMIT\
          \ 10"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    columns.0.name: "a"
- match:
    columns.0.type: "long"
- match:
    columns.1.name: "f"
- match:
    columns.1.type: "unsupported"
- match:
    columns.2.name: "c"
- match:
    columns.2.type: "keyword"
- length:
    values: 3
- match:
    values.0.0: 1
- match:
    values.0.1: null
- match:
    values.0.2: "b"
- match:
    values.1.0: 2
- match:
    values.1.1: null
- match:
    values.1.2: "b"
- match:
    values.2.0: 3
- match:
    values.2.1: null
- match:
    values.2.2: "a"
