Hello everybody, I am new in Opensearch and I didn’t know where to place this post, I put in the SQL because I haven’t seen the PPL category and this topic is quite related with SQL too. I also searched in this forum and the web but I haven’t found anything related.
I come from Splunk so PPL is much easier to me at the beginning. I know I can “translate” the queries from SQL to DSL but I don’t know if there is a way to translate from PPL to DSL.
For example. I did this request:
POST /_opensearch/_ppl/_explain
{
“query”: “source=accounts | fields firstname,lastname,age,gender”
}
I got this reply:
{
“root”: {
“name”: “ProjectOperator”,
“description”: {
“fields”: “[firstname, lastname, age, gender]”
},
“children”: [
{
“name”: “OpenSearchIndexScan”,
“description”: {
“request”: “”“OpenSearchQueryRequest(indexName=accounts, sourceBuilder={“from”:0,“size”:200,“timeout”:“1m”,”_source":{“includes”:[“firstname”,“gender”,“age”,“lastname”],“excludes”:}}, searchDone=false)“”"
},
“children”:
}
]
}
}
If I use that reply in the _search endpoint it just does not work
{
“error” : {
“root_cause” : [
{
“type” : “parsing_exception”,
“reason” : “Unknown key for a START_OBJECT in [root].”,
“line” : 2,
“col” : 11
}
],
“type” : “parsing_exception”,
“reason” : “Unknown key for a START_OBJECT in [root].”,
“line” : 2,
“col” : 11
},
“status” : 400
}
With the SQL happens exactly the same if I use the “/_sql/_explain” but If I use the “_sql/_explain?format=json” I have a proper DSL query. The thing is there is nothing similar in the PPL endpoint.
Maybe this is an intentional behaviour and I am using the wrong endpoints but I don’t know how to deal with this problem. Could you help me?
