sql icon indicating copy to clipboard operation
sql copied to clipboard

Highlight Support in PPL

Open forestmvey opened this issue 3 years ago • 1 comments

Is your feature request related to a problem? Highlight in the SQL plugin is currently supported in SQL but not PPL. What is the front-end use-case for highlight in PPL?

What solution would you like? Potential implementations include:

Highlight as a function argument to all relevance-based search functions e.g. match("message", "access denied", "highlight"="*") or multi_match(["message", "status"], "access denied", "highlight"=["message"])

Splunk-like command for highlight without fields e.g. highlight "access denied" which is equivalent to match("", "access denied", "highlight"=["*"])

Splunk-like command for highlight with fields e.g. highlight "access denied" fields=("message", "status")

Highlight as a function in the fields command (breaking change, 3.x only) e.g. ... | fields highlight("*")

What alternatives have you considered? We have not considered alternatives past those listed above. Input is welcome from anyone!

Additional context? Highlight as a function in the fields command has an implementation ready for a PR here. Demo video for highlight as a function in the fields command can be found here.

forestmvey avatar Oct 13 '22 21:10 forestmvey

A PPL query without a fields command returns all fields by default. If highlight is NOT implemented as a function in the fields command, what would be the expected output.

highlight used without a fields command:

  • All fields are returned plus the added highlight field(s)?

If an end-user wants to return only the highlight field(s), how would they accomplish this and what would be specified in the fields command. The eval command accomplishes this by creating an additional field which can be specified in the fields command. The end-user interaction with the fields command is relevant in both the Relevance Query and Splunk-like Command syntax options.

forestmvey avatar Oct 13 '22 22:10 forestmvey