WIndow Functions


Running Elastic Search Open Distro 7.9 with SQL 1.10

I am getting the syntax error below related to this query. Looking at the error message am I correct that this functionality doesn’t yet exist in 1.10?

POST _opendistro/_sql
“query”:“SELECT user_id, app_id, COUNT() OVER ( order by app_id ) FROM ofx-commander-svb-2021.07 WHERE DATE(@timestamp) > date(‘2021-07-04’)”

“error”: {
“reason”: “Invalid SQL query”,
“details”: “Failed to parse query due to offending symbol [(] at: ‘SELECT user_id, app_id, COUNT() OVER (’ <— HERE… More details: Expecting tokens in {‘SELECT’, ‘(’}”,
“type”: “SyntaxAnalysisException”
“status”: 400

Correct - window functions are not supported in 1.10. SQL Window functions came in Open Distro 1.11.

Thanks, Kyle, I really appreciate your input.

1 Like