---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- requires:
    cluster_features:
    - "gte_v8.13.0"
    reason: "Exact subfields fixed in v 8.13"
    test_runner_features: "allowed_warnings_regex"
- do:
    indices.create:
      index: "test"
      body:
        settings:
          analysis:
            normalizer:
              my_normalizer:
                type: "custom"
                filter:
                - "lowercase"
                - "asciifolding"
        mappings:
          properties:
            emp_no:
              type: "long"
            text_ignore_above:
              type: "text"
              fields:
                raw:
                  type: "keyword"
                  ignore_above: 4
            text_normalizer:
              type: "text"
              fields:
                raw:
                  type: "keyword"
                  normalizer: "my_normalizer"
            non_indexed:
              type: "text"
              fields:
                raw:
                  type: "keyword"
                  index: false
                  doc_values: false
                  store: true
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      index: "test"
      refresh: true
      body:
      - index: {}
      - emp_no: 10
        text_ignore_above: "this is a long text"
        text_normalizer: "CamelCase"
        non_indexed: "foo"
      - index: {}
      - emp_no: 20
        text_ignore_above: "this"
        text_normalizer: "abc"
        non_indexed: "bar"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
extract:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | sort emp_no | keep text_ignore_above, text_ignore_above.raw,\
          \ text_normalizer, text_normalizer.raw, non_indexed, non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- match:
    values.0:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
- match:
    values.1:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
---
filter ignore above:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | where text_ignore_above == \"this\" | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 1
- match:
    values.0:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | where text_ignore_above == \"this is a long text\" | keep\
          \ text_ignore_above, text_ignore_above.raw, text_normalizer, text_normalizer.raw,\
          \ non_indexed, non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 1
- match:
    values.0:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | where text_ignore_above is null | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 0
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | where text_ignore_above is not null | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | where text_ignore_above LIKE \"*long*\" | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 1
- match:
    values.0:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
---
filter with normalizer:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | where text_normalizer == \"CamelCase\" | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 1
- match:
    values.0:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | where text_normalizer == text_normalizer.raw | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 1
- match:
    values.0:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
---
sort ignore above:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | sort text_ignore_above asc | keep text_ignore_above, text_ignore_above.raw,\
          \ text_normalizer, text_normalizer.raw, non_indexed, non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- match:
    values.0:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
- match:
    values.1:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | sort text_ignore_above desc | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- match:
    values.0:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
- match:
    values.1:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | sort text_ignore_above asc nulls first | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- match:
    values.0:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
- match:
    values.1:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | sort text_ignore_above asc nulls last | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- match:
    values.0:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
- match:
    values.1:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
---
sort normalizer:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | sort text_normalizer asc | keep text_ignore_above, text_ignore_above.raw,\
          \ text_normalizer, text_normalizer.raw, non_indexed, non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- match:
    values.0:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
- match:
    values.1:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | sort text_normalizer desc | keep text_ignore_above, text_ignore_above.raw,\
          \ text_normalizer, text_normalizer.raw, non_indexed, non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- match:
    values.0:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
- match:
    values.1:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | sort text_normalizer.raw asc | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- match:
    values.0:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
- match:
    values.1:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
---
non indexed:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | sort non_indexed asc | keep text_ignore_above, text_ignore_above.raw,\
          \ text_normalizer, text_normalizer.raw, non_indexed, non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- match:
    values.0:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
- match:
    values.1:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | sort non_indexed desc | keep text_ignore_above, text_ignore_above.raw,\
          \ text_normalizer, text_normalizer.raw, non_indexed, non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 2
- match:
    values.0:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
- match:
    values.1:
    - "this"
    - "this"
    - "abc"
    - "abc"
    - "bar"
    - "bar"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "from test | where non_indexed == \"foo\" | keep text_ignore_above,\
          \ text_ignore_above.raw, text_normalizer, text_normalizer.raw, non_indexed,\
          \ non_indexed.raw"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "text_ignore_above"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "text_ignore_above.raw"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "text_normalizer"
- match:
    columns.2.type: "text"
- match:
    columns.3.name: "text_normalizer.raw"
- match:
    columns.3.type: "keyword"
- match:
    columns.4.name: "non_indexed"
- match:
    columns.4.type: "text"
- match:
    columns.5.name: "non_indexed.raw"
- match:
    columns.5.type: "keyword"
- length:
    values: 1
- match:
    values.0:
    - "this is a long text"
    - null
    - "CamelCase"
    - "camelcase"
    - "foo"
    - "foo"
