---
setup:
- requires:
    cluster_features: "gte_v8.2.0"
    reason: "_tsid hashing introduced in 8.13"
- skip:
    known_issues:
    - cluster_feature: "gte_v8.7.0"
      fixed_by: "gte_v8.13.0"
    reason: "_tsid hashing introduced in 8.13"
    features:
    - "headers"
    - "allowed_warnings_regex"
    - "allowed_warnings_regex"
- do:
    indices.create:
      index: "test"
      body:
        settings:
          index:
            mode: "time_series"
            routing_path:
            - "metricset"
            - "k8s.pod.uid"
            time_series:
              start_time: "2021-04-28T00:00:00Z"
              end_time: "2021-04-29T00:00:00Z"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            metricset:
              type: "keyword"
              time_series_dimension: true
            k8s:
              properties:
                pod:
                  properties:
                    uid:
                      type: "keyword"
                      time_series_dimension: true
                    name:
                      type: "keyword"
                    ip:
                      type: "ip"
                    network:
                      properties:
                        tx:
                          type: "long"
                        rx:
                          type: "long"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    bulk:
      refresh: true
      index: "test"
      body:
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2021-04-28T18:50:04.467Z\", \"metricset\": \"pod\", \"\
        k8s\": {\"pod\": {\"name\": \"cat\", \"uid\":\"947e4ced-1786-4e53-9e0c-5c447e959507\"\
        , \"ip\": \"10.10.55.1\", \"network\": {\"tx\": 2001818691, \"rx\": 802133794}}}}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2021-04-28T18:50:24.467Z\", \"metricset\": \"pod\", \"\
        k8s\": {\"pod\": {\"name\": \"cat\", \"uid\":\"947e4ced-1786-4e53-9e0c-5c447e959507\"\
        , \"ip\": \"10.10.55.1\", \"network\": {\"tx\": 2005177954, \"rx\": 801479970}}}}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2021-04-28T18:50:44.467Z\", \"metricset\": \"pod\", \"\
        k8s\": {\"pod\": {\"name\": \"cat\", \"uid\":\"947e4ced-1786-4e53-9e0c-5c447e959507\"\
        , \"ip\": \"10.10.55.1\", \"network\": {\"tx\": 2006223737, \"rx\": 802337279}}}}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2021-04-28T18:51:04.467Z\", \"metricset\": \"pod\", \"\
        k8s\": {\"pod\": {\"name\": \"cat\", \"uid\":\"947e4ced-1786-4e53-9e0c-5c447e959507\"\
        , \"ip\": \"10.10.55.2\", \"network\": {\"tx\": 2012916202, \"rx\": 803685721}}}}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2021-04-28T18:50:03.142Z\", \"metricset\": \"pod\", \"\
        k8s\": {\"pod\": {\"name\": \"dog\", \"uid\":\"df3145b3-0563-4d3b-a0f7-897eb2876ea9\"\
        , \"ip\": \"10.10.55.3\", \"network\": {\"tx\": 1434521831, \"rx\": 530575198}}}}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2021-04-28T18:50:23.142Z\", \"metricset\": \"pod\", \"\
        k8s\": {\"pod\": {\"name\": \"dog\", \"uid\":\"df3145b3-0563-4d3b-a0f7-897eb2876ea9\"\
        , \"ip\": \"10.10.55.3\", \"network\": {\"tx\": 1434577921, \"rx\": 530600088}}}}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2021-04-28T18:50:53.142Z\", \"metricset\": \"pod\", \"\
        k8s\": {\"pod\": {\"name\": \"dog\", \"uid\":\"df3145b3-0563-4d3b-a0f7-897eb2876ea9\"\
        , \"ip\": \"10.10.55.3\", \"network\": {\"tx\": 1434587694, \"rx\": 530604797}}}}"
      - "{\"index\": {}}"
      - "{\"@timestamp\": \"2021-04-28T18:51:03.142Z\", \"metricset\": \"pod\", \"\
        k8s\": {\"pod\": {\"name\": \"dog\", \"uid\":\"df3145b3-0563-4d3b-a0f7-897eb2876ea9\"\
        , \"ip\": \"10.10.55.3\", \"network\": {\"tx\": 1434595272, \"rx\": 530605511}}}}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
---
query a dimension:
- requires:
    cluster_features:
    - "gte_v8.2.0"
    reason: "tsdb indexing changed in 8.2.0"
- do:
    search:
      index: "test"
      body:
        query:
          match:
            k8s.pod.uid: "947e4ced-1786-4e53-9e0c-5c447e959507"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 4
---
query a metric:
- requires:
    cluster_features:
    - "gte_v8.2.0"
    reason: "tsdb indexing changed in 8.2.0"
- do:
    search:
      index: "test"
      body:
        query:
          range:
            k8s.pod.network.tx:
              gt: 2006223737
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 1
---
query tsid fails:
- requires:
    cluster_features:
    - "gte_v8.2.0"
    reason: "tsdb indexing changed in 8.2.0"
- do:
    catch: "/\\[_tsid\\] is not searchable/"
    search:
      index: "test"
      body:
        query:
          term:
            _tsid: "wont't work"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
---
fetch a dimension:
- requires:
    cluster_features:
    - "gte_v8.2.0"
    reason: "tsdb indexing changed in 8.2.0"
- do:
    search:
      index: "test"
      body:
        fields:
        - field: "k8s.pod.uid"
        query:
          query_string:
            query: "+@timestamp:\"2021-04-28T18:51:04.467Z\" +k8s.pod.name:cat"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 1
- match:
    hits.hits.0.fields.k8s\.pod\.uid:
    - "947e4ced-1786-4e53-9e0c-5c447e959507"
---
fetch a metric:
- requires:
    cluster_features:
    - "gte_v8.2.0"
    reason: "tsdb indexing changed in 8.2.0"
- do:
    search:
      index: "test"
      body:
        fields:
        - field: "k8s.pod.network.tx"
        query:
          query_string:
            query: "+@timestamp:\"2021-04-28T18:51:04.467Z\" +k8s.pod.name:cat"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 1
- match:
    hits.hits.0.fields.k8s\.pod\.network\.tx:
    - 2012916202
- is_false: "hits.hits.0.fields._tsid"
---
fetch a tag:
- requires:
    cluster_features:
    - "gte_v8.2.0"
    reason: "tsdb indexing changed in 8.2.0"
- do:
    search:
      index: "test"
      body:
        fields:
        - field: "k8s.pod.ip"
        query:
          query_string:
            query: "+@timestamp:\"2021-04-28T18:51:04.467Z\" +k8s.pod.name:cat"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 1
- match:
    hits.hits.0.fields.k8s\.pod\.ip:
    - "10.10.55.2"
- is_false: "hits.hits.0.fields._tsid"
---
fetch the tsid:
- requires:
    cluster_features:
    - "gte_v8.13.0"
    reason: "_tsid hashing introduced in 8.13"
- do:
    search:
      index: "test"
      body:
        fields:
        - field: "_tsid"
        query:
          query_string:
            query: "+@timestamp:\"2021-04-28T18:51:04.467Z\" +k8s.pod.name:cat"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 1
- match:
    hits.hits.0.fields._tsid:
    - "KCjEJ9R_BgO8TRX2QOd6dpR12oDh--qoyNZRQPy43y34Qdy2dpsyG0o"
---
aggregate a dimension:
- requires:
    cluster_features:
    - "gte_v8.2.0"
    reason: "tsdb indexing changed in 8.2.0"
- do:
    search:
      index: "test"
      body:
        size: 0
        aggs:
          uids:
            terms:
              field: "k8s.pod.uid"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 8
- match:
    aggregations.uids.buckets.0.key: "947e4ced-1786-4e53-9e0c-5c447e959507"
- match:
    aggregations.uids.buckets.0.doc_count: 4
- match:
    aggregations.uids.buckets.1.key: "df3145b3-0563-4d3b-a0f7-897eb2876ea9"
- match:
    aggregations.uids.buckets.1.doc_count: 4
---
aggregate a metric:
- requires:
    cluster_features:
    - "gte_v8.2.0"
    reason: "tsdb indexing changed in 8.2.0"
- do:
    search:
      index: "test"
      body:
        size: 0
        aggs:
          uids:
            terms:
              field: "k8s.pod.uid"
            aggs:
              max_rx:
                max:
                  field: "k8s.pod.network.rx"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 8
- match:
    aggregations.uids.buckets.0.key: "947e4ced-1786-4e53-9e0c-5c447e959507"
- match:
    aggregations.uids.buckets.0.doc_count: 4
- match:
    aggregations.uids.buckets.0.max_rx.value: 803685721
- match:
    aggregations.uids.buckets.1.key: "df3145b3-0563-4d3b-a0f7-897eb2876ea9"
- match:
    aggregations.uids.buckets.1.doc_count: 4
- match:
    aggregations.uids.buckets.1.max_rx.value: 530605511
---
aggregate a tag:
- requires:
    cluster_features:
    - "gte_v8.2.0"
    reason: "tsdb indexing changed in 8.2.0"
- do:
    search:
      index: "test"
      body:
        size: 0
        aggs:
          ips:
            terms:
              field: "k8s.pod.ip"
              order:
                _key: "asc"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 8
- match:
    aggregations.ips.buckets.0.key: "10.10.55.1"
- match:
    aggregations.ips.buckets.0.doc_count: 3
- match:
    aggregations.ips.buckets.1.key: "10.10.55.2"
- match:
    aggregations.ips.buckets.1.doc_count: 1
- match:
    aggregations.ips.buckets.2.key: "10.10.55.3"
- match:
    aggregations.ips.buckets.2.doc_count: 4
---
aggregate the tsid:
- requires:
    cluster_features:
    - "gte_v8.13.0"
    reason: "_tsid hashing introduced in 8.13"
- do:
    search:
      index: "test"
      body:
        size: 0
        aggs:
          tsids:
            terms:
              field: "_tsid"
              order:
                _key: "asc"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 8
- match:
    aggregations.tsids.buckets.0.key: "KCjEJ9R_BgO8TRX2QOd6dpQ5ihHD--qoyLTiOy0pmP6_RAIE-e0-dKQ"
- match:
    aggregations.tsids.buckets.0.doc_count: 4
- match:
    aggregations.tsids.buckets.1.key: "KCjEJ9R_BgO8TRX2QOd6dpR12oDh--qoyNZRQPy43y34Qdy2dpsyG0o"
- match:
    aggregations.tsids.buckets.1.doc_count: 4
---
aggregate filter the tsid fails:
- requires:
    cluster_features:
    - "gte_v8.2.0"
    reason: "tsdb indexing changed in 8.2.0"
- do:
    catch: "/\\[_tsid\\] is not searchable/"
    search:
      index: "test"
      body:
        size: 0
        aggs:
          tsids:
            filter:
              term:
                _tsid: "wont't work"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
---
sort by tsid:
- requires:
    cluster_features:
    - "gte_v8.13.0"
    reason: "_tsid hashing introduced in 8.13"
- do:
    search:
      index: "test"
      body:
        fields:
        - "_tsid"
        sort:
        - "_tsid"
        - "@timestamp"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 8
- match:
    hits.hits.0.sort:
    - "KCjEJ9R_BgO8TRX2QOd6dpQ5ihHD--qoyLTiOy0pmP6_RAIE-e0-dKQ"
    - 1619635803142
- match:
    hits.hits.0.fields._tsid:
    - "KCjEJ9R_BgO8TRX2QOd6dpQ5ihHD--qoyLTiOy0pmP6_RAIE-e0-dKQ"
- match:
    hits.hits.1.sort:
    - "KCjEJ9R_BgO8TRX2QOd6dpQ5ihHD--qoyLTiOy0pmP6_RAIE-e0-dKQ"
    - 1619635823142
- match:
    hits.hits.1.fields._tsid:
    - "KCjEJ9R_BgO8TRX2QOd6dpQ5ihHD--qoyLTiOy0pmP6_RAIE-e0-dKQ"
- match:
    hits.hits.4.sort:
    - "KCjEJ9R_BgO8TRX2QOd6dpR12oDh--qoyNZRQPy43y34Qdy2dpsyG0o"
    - 1619635804467
- match:
    hits.hits.4.fields._tsid:
    - "KCjEJ9R_BgO8TRX2QOd6dpR12oDh--qoyNZRQPy43y34Qdy2dpsyG0o"
- match:
    hits.hits.7.sort:
    - "KCjEJ9R_BgO8TRX2QOd6dpR12oDh--qoyNZRQPy43y34Qdy2dpsyG0o"
    - 1619635864467
- match:
    hits.hits.7.fields._tsid:
    - "KCjEJ9R_BgO8TRX2QOd6dpR12oDh--qoyNZRQPy43y34Qdy2dpsyG0o"
---
aggs by index_mode:
- requires:
    cluster_features:
    - "mapper.query_index_mode"
    reason: "require _index_mode metadata field"
- do:
    search:
      index: "test"
      body:
        aggs:
          modes:
            terms:
              field: "_index_mode"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    aggregations.modes.buckets.0.key: "time_series"
- match:
    aggregations.modes.buckets.0.doc_count: 8
