Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EQL: Sequence improvements #56768

Closed
2 tasks done
costin opened this issue May 14, 2020 · 2 comments
Closed
2 tasks done

EQL: Sequence improvements #56768

costin opened this issue May 14, 2020 · 2 comments
Labels
:Analytics/EQL EQL querying >enhancement Team:QL (Deprecated) Meta label for query languages team

Comments

@costin
Copy link
Member

costin commented May 14, 2020

This is a meta ticket for must-have improvements now that EQL supports sequences.

  • tie-breaker support
    Due to the distributed nature of ingestion it is quite possible for events to occur at the same time which does require a user-defined tie-breaker to establish serialization, separate from the document-based one in Elasticsearch (_doc).
    Further more this is used by the existing EQL test suite - without it some fails will surely fail.

  • internal pagination
    In order to find X results, the sequence runtime must go through multiple internal pages before sending out the current results. Regardless of the client pagination, the algorithm needs to be able to handle its own pagination which is the norm for large datasets.

@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-ql (:Query Languages/EQL)

@elasticmachine elasticmachine added the Team:QL (Deprecated) Meta label for query languages team label May 14, 2020
@costin
Copy link
Member Author

costin commented Jul 2, 2020

Completed by #58859 (internal pagination) and #57787 (tiebreaker support).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
:Analytics/EQL EQL querying >enhancement Team:QL (Deprecated) Meta label for query languages team
Projects
None yet
Development

No branches or pull requests

2 participants