generated from amazon-archives/__template_Custom
-
Notifications
You must be signed in to change notification settings - Fork 181
Closed
Labels
PPLPiped processing languagePiped processing languagebugSomething isn't workingSomething isn't working
Description
What is the bug?
When calcite engine is enabled, the patterns command does not return all the tokens.
For example, when running the query:
source = opensearch_dashboards_sample_data_logs | patterns `message` method=brain mode=aggregation
or the query
source = opensearch_dashboards_sample_data_logs | patterns `message` method=brain | stats count() by patterns_field
I get a result like this:
"datarows": [
[
"<token1> - - [<token2>] \"GET <token3> HTTP/<token4><token5>\" 200 <token6> \"-\" \"Mozilla/<token7><token8> (<token9>; Linux <token10>_<token11>; rv:<token12><token13><token14>) Gecko/<token15> Firefox/<token16><token17><token18>\"",
4935,
{
"<token1>": [
"223.87.60.27",
"130.246.123.197",
"6.138.148.165",
"218.148.135.12",
"12.132.31.17",
"129.138.185.193",
"159.64.35.129",
"78.142.163.191",
"54.190.60.72",
"221.0.214.157"
],
"<token3>": [
"/opensearch/opensearch-1.0.0.deb_1",
"/beats/metricbeat_1",
"/beats/metricbeat/metricbeat-6.3.2-amd64.deb_1",
"/beats/filebeat/filebeat-6.3.2-linux-x86_64.tar.gz_1",
"/opensearch/opensearch-1.0.0.tar.gz_1",
"/beats_1",
"/opensearch_dashboards/opensearch_dashboards-1.0.0-linux-x86_64.tar.gz_1",
"/beats_1",
"/beats/metricbeat/metricbeat-6.3.2-amd64.deb_1",
"/opensearch_1"
],
"<token2>": [
"2018-07-22T00:39:02.912Z",
"2018-07-22T03:26:21.326Z",
"2018-07-22T03:57:39.612Z",
"2018-07-22T04:18:12.345Z",
"2018-07-22T05:36:25.812Z",
"2018-07-22T05:39:39.668Z",
"2018-07-22T06:06:42.742Z",
"2018-07-22T06:10:08.359Z",
"2018-07-22T06:15:34.660Z",
"2018-07-22T06:21:08.365Z"
]
}
]
],
Only values for the first three tokens are provided. This only seems to be an isue when method=brain, for simple patterns it gives all tokens.
How can one reproduce the bug?
Steps to reproduce the behavior:
- Go to '...'
- Click on '....'
- Scroll down to '....'
- See error
What is the expected behavior?
A clear and concise description of what you expected to happen.
What is your host/environment?
- OS: [e.g. iOS]
- Version [e.g. 22]
- Plugins
Do you have any screenshots?
If applicable, add screenshots to help explain your problem.
Do you have any additional context?
Add any other context about the problem.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
PPLPiped processing languagePiped processing languagebugSomething isn't workingSomething isn't working
Type
Projects
Status
Done