aws-elasticsearchelasticsearch-opendistro

Is SQL and PPL fully supported?


I tried a few queries and found that some of the SQL queries are working while some are not.

I uploaded test data using dev tools. I have uploaded a few hundred documents (crwaler) as well.

PUT /library/book/_bulk?refresh&pretty
{"index":{"_id": "Leviathan Wakes"}}
{"name": "Leviathan Wakes", "author": "James S.A. Corey", "release_date": "2011-06-02", "page_count": 561}
{"index":{"_id": "Hyperion"}}
{"name": "Hyperion", "author": "Dan Simmons", "release_date": "1989-05-26", "page_count": 482}
{"index":{"_id": "Dune"}}
{"name": "Dune", "author": "Frank Herbert", "release_date": "1965-06-01", "page_count": 604}
  1. This works correctly and shows the indices.
SHOW tables LIKE %;

.kibana_1
cwl-2021.01.05
library
  1. This works as well. Shows 42 records.
select * from .kibana_1;

This works as expected:

select * from library where page_count > 500 and name = 'Dune'
  1. This does not work:
select * from cwl-2021.01.05

Getting an error "no response"

  1. This works but shows only 200 records out of 400:
select * from cwl*
  1. This works only if the ID is within the first 200 records:
select * from cwl* where requestID = '3FB4131539FD4403'

The pipe query language works as expected only with library index.

search source=library page_count > 500 and name = 'Dune'

It does not work with other indices like .kibana_1 or cwl-2021.01.05

I am not sure how SQL and PPL is supported in AWS elasticsearch instance.


Solution

  • You can always use backtick for this user case. e.g.

    POST /_opendistro/_ppl
    {
      "query": """
        source=`filebeat-7.10.0-2020.11.28`
      """
    }