ci% D ddlZddlmZddlmZddlmZmZdedefdZ dedefd Z dedefd Z dedefd Z dedefd Z d ededefdZdedefdZdedefdZdedefdZdededededef dZdedefdZdedefdZdedefdZdedefdZdedefdZded edefd!Zd"ed#edefd$Zd%edefd&Zd'edefd(Zdedefd)Zdedefd*Zded+edefd,Zded+edefd-Zdedefd.Z d/ed0ed1edefd2Z!d3ed4edefd5Z" dd4ed6edefd7Z#d8ed9edefd:Z$d;ed4edefd<Z%defd=Z&d>ed?edefd@Z'dedefdAZ(dedefdBZ)dedefdCZ*dedefdDZ+d"ed#edefdEZ,dFedGedefdHZ-dIedJedefdKZ.dedLedMedefdNZ/ ddedOedPedefdQZ0dOedefdRZ1dedefdSZ2d"ed#edefdTZ3dedUedefdVZ4dedefdWZ5dedXedYedefdZZ6d[ededefd\Z7dedefd]Z8dedefd^Z9 ddedOedPedefd_Z: ddedOedPedefd`Z;dedefdaZdedefddZ?dedefdeZ@dedefdfZAdedefdgZBddhdOediedPedefdjZCdkedledefdmZDdedefdnZEdedoedefdpZFdedefdqZGdedefdrZHdedefdsZIdedefdtZJdedefduZKdedefdvZLdedefdwZMdedefdxZNdedyedefdzZOded{edefd|ZP ddedYed}edefd~ZQdededefdZRdedefdZS ddededoedefdZTdefdZUdedyedefdZVdefdZWd[ededefdZX ddOedPedefdZYdedefdZZdededefdZ[dedededefdZ\d>edefdZ]dedUedefdZ^ ddededefdZ_dededefdZ`dedefdZadededefdZbdededefdZcdGedefdZddGedefdZededefdZfd'edefdZgdedefdZhdedefdZidedoedefdZjdedefdZkd>ededefdZldedefdZmdedefdZndededefdZodededefdZpdededefdZqdedefdZrdedefdZs dded+ededefdZtdedefdZudedefdZv dded+ededefdZwdedefdZxdedefdZy dded+ededefdZzdedefdZ{dedefdZ|dededefdZ}dededefdZ~dedefdZdedefdZdedefdZdedefdZdedefd„ZdedefdÄZ ddedYedUedefdĄZdedefdńZd'edefdƄZdedefdDŽZdefdȄZdedOedefdɄZdedededefdʄZdedefd˄Zdedefd̄Zdedefd̈́Zdedefd΄ZdedefdτZdedefdЄZdedefdфZdedefd҄ZdedefdӄZdedefdԄZdedefdՄZdedefdքZdedefdׄZ ddedPedefd؄ZdedefdلZd>edefdڄZdedefdۄZdedefd܄Zdedefd݄ZdedefdބZd>edefd߄ZdedefdZdedefdZdedefdZdededefdZdS)N)AnyInstrumentedExpression)ESQLBaseExpressionTypevreturnc|t|tstj|nt j|SN) isinstancerjsondumpsr _format_expr)rs \/var/www/html/auto_sub_bot/venv/lib/python3.11/site-packages/elasticsearch/esql/functions.py_renderrs6!344 & 1  "1 % %numbercBtdt|dS)zpReturns the absolute value. :param number: Numeric expression. If `null`, the function returns `null`. zABS()rrrs rabsr!$ "";";";"; < <zcase..s:::!71:::::rrrjoin)r8s rcaserCs? "> ::z:::;;>>>  rcBtdt|dS)zyGroups text messages into categories of similarly formatted text values. :param field: Expression to categorize z CATEGORIZE(rrr/s r categorizerFs$ ""A"A"A"A B BBrcBtdt|dS)zReturns the cube root of a number. The input can be any numeric value, the return value is always a double. Cube roots of infinities are null. :param number: Numeric expression. If `null`, the function returns `null`. zCBRT(rrrs rcbrtrHrrcBtdt|dS)z~Round a number up to the nearest integer. :param number: Numeric expression. If `null`, the function returns `null`. zCEIL(rrrs rceilrJrripblock_xcbtdt|dt|dS)zReturns true if the provided IP is contained in one of the provided CIDR blocks. :param ip: IP address of type `ip` (both IPv4 and IPv6 are supported). :param block_x: CIDR block to test the IP against. z CIDR_MATCH(r%rr)rKrLs r cidr_matchrNs4 ""R "R"Rww?O?O"R"R"R S SSrfirstrestcbtdt|dt|dS)zReturns the first of its arguments that is not null. If all arguments are null, it returns `null`. :param first: Expression to evaluate. :param rest: Other expression to evaluate. z COALESCE(r%rrrOrPs rcoalescerS2 ""Pgenn"P"P "P"P"P Q QQrstringscbtddd|DdS)z!Concatenates two or more strings.zCONCAT(r%c.g|]}t|Sr;r<)r>ss rr@zconcat..s >>> _>>>rrrA)rUs rconcatrYs= !B$))>>g>>>??BBB  ranglecBtdt|dS)zuReturns the cosine of an angle. :param angle: An angle, in radians. If `null`, the function returns `null`. zCOS(rrrZs rcosr]$ "":":":": ; ;;rcBtdt|dS)zReturns the hyperbolic cosine of a number. :param number: Numeric expression. If `null`, the function returns `null`. zCOSH(rrrs rcoshr`rrcBtdt|dS)zReturns the total number (count) of input values. :param field: Expression that outputs values to be counted. If omitted, equivalent to `COUNT(*)` (the number of rows). zCOUNT(rrrEs rcountrbs$ ""<75>>"<"<"< = ==r precisioncbtdt|dt|dS)avReturns the approximate number of distinct values. :param field: Column or literal for which to count the number of distinct values. :param precision: Precision threshold. The maximum supported value is 40000. Thresholds above this number will have the same effect as a threshold of 40000. The default value is 3000. zCOUNT_DISTINCT(r%rrr/rcs rcount_distinctrfs: "A'%..AAGI,>,>AAA  rcbtdt|dt|dS)a3The count of distinct values over time for a field. :param field: :param precision: Precision threshold. The maximum supported value is 40000. Thresholds above this number will have the same effect as a threshold of 40000. The default value is 3000. zCOUNT_DISTINCT_OVER_TIME(r%rrres rcount_distinct_over_timerhs: "KGENNKKgi6H6HKKK  rcBtdt|dS)z=The count over time value of a field. :param field: zCOUNT_OVER_TIME(rrrEs rcount_over_timerj$ ""FWU^^"F"F"F G GGrunitstart_timestamp end_timestampc tdt|dt|dt|dS)avSubtracts the `startTimestamp` from the `endTimestamp` and returns the difference in multiples of `unit`. If `startTimestamp` is later than the `endTimestamp`, negative values are returned. :param unit: Time difference unit :param start_timestamp: A string representing a start timestamp :param end_timestamp: A string representing an end timestamp z DATE_DIFF(r%rr)rlrmrns r date_diffrpsJ "[WT]][[go&>&>[['-BXBX[[[  r date_partdatecbtdt|dt|dS)aOExtracts parts of a date, like year, month, day, hour. :param date_part: Part of the date to extract. Can be: `aligned_day_of_week_in_month`, `aligned_day_of_week_in_year`, `aligned_week_of_month`, `aligned_week_of_year`, `ampm_of_day`, `clock_hour_of_ampm`, `clock_hour_of_day`, `day_of_month`, `day_of_week`, `day_of_year`, `epoch_day`, `era`, `hour_of_ampm`, `hour_of_day`, `instant_seconds`, `micro_of_day`, `micro_of_second`, `milli_of_day`, `milli_of_second`, `minute_of_day`, `minute_of_hour`, `month_of_year`, `nano_of_day`, `nano_of_second`, `offset_seconds`, `proleptic_month`, `second_of_day`, `second_of_minute`, `year`, or `year_of_era`. If `null`, the function returns `null`. :param date: Date expression. If `null`, the function returns `null`. z DATE_EXTRACT(r%rr)rqrrs r date_extractrts:" "> **>>gdmm>>>  r date_formatc|0tdt|dt|dStdt|dS)agReturns a string representation of a date, in the provided format. :param date_format: Date format (optional). If no format is specified, the `yyyy-MM-dd'T'HH:mm:ss.SSSZ` format is used. If `null`, the function returns `null`. :param date: Date expression. If `null`, the function returns `null`. Nz DATE_FORMAT(r%rr)rrrus rruru+sb% C7;// C C74== C C C   &&EWT]]&E&E&EFFFr date_pattern date_stringcbtdt|dt|dS)aCReturns a date by parsing the second argument using the format specified in the first argument. :param date_pattern: The date format. If `null`, the function returns `null`. :param date_string: Date expression as a string. If `null` or an empty string, the function returns `null`. z DATE_PARSE(r%rr)rwrxs r date_parserz>s< "Fgl++FFw{/C/CFFF  rintervalcbtdt|dt|dS)zRounds down a date to the closest interval since epoch, which starts at `0001-01-01T00:00:00Z`. :param interval: Interval; expressed using the timespan literal syntax. :param date: Date expression z DATE_TRUNC(r%rr)r{rrs r date_truncr}Ms4 ""U0A0A"U"UWT]]"U"U"U V VVrc tdS)uReturns Euler’s number).zE()rr;rrerXs !% ( ((rstrsuffixcbtdt|dt|dS)zReturns a boolean that indicates whether a keyword string ends with another string. :param str: String expression. If `null`, the function returns `null`. :param suffix: String expression. If `null`, the function returns `null`. z ENDS_WITH(r%rr)rrs r ends_withr]s2 ""Qws||"Q"Qwv"Q"Q"Q R RRrcBtdt|dS)zReturns the value of e raised to the power of the given number. :param number: Numeric expression. If `null`, the function returns `null`. zEXP(rrrs rexprgrrcBtdt|dS)znThe earliest value of a field, where recency determined by the `@timestamp` field. :param field: zFIRST_OVER_TIME(rrrEs rfirst_over_timeros$ ""FWU^^"F"F"F G GGrcBtdt|dS)zRound a number down to the nearest integer. :param number: Numeric expression. If `null`, the function returns `null`. zFLOOR(rrrs rfloorrx$ ""=76??"="="= > >>rcBtdt|dS)zADecode a base64 string. :param string: A base64 string. z FROM_BASE64(rrr-s r from_base64rr7rcbtdt|dt|dS)zReturns the maximum value from multiple columns. This is similar to `MV_MAX` except it is intended to run on multiple columns at once. :param first: First of the columns to evaluate. :param rest: The rest of the columns to evaluate. z GREATEST(r%rrrRs rgreatestrrTr algorithminputcbtdt|dt|dS)zComputes the hash of the input using various algorithms such as MD5, SHA, SHA-224, SHA-256, SHA-384, SHA-512. :param algorithm: Hash algorithm to use. :param input: Input to hash. zHASH(r%rr)rrs rhashrs4 ""Q')*<*<"Q"Q"Q"Q"Q R RRrnumber1number2c.td|d|dS)a>Returns the hypotenuse of two numbers. The input can be any numeric values, the return value is always a double. Hypotenuses of infinities are null. :param number1: Numeric expression. If `null`, the function returns `null`. :param number2: Numeric expression. If `null`, the function returns `null`. zHYPOT(r%rr)rrs rhypotrs& ""@7"@"@g"@"@"@ A AArprefix_length_v4prefix_length_v6c Ntdt|d|d|dS)zTruncates an IP to a given prefix length. :param ip: IP address of type `ip` (both IPv4 and IPv6 are supported). :param prefix_length_v4: Prefix length for IPv4 addresses. :param prefix_length_v6: Prefix length for IPv6 addresses. z IP_PREFIX(r%rr)rKrrs r ip_prefixrs< "KWR[[KK$4KK8HKKK  rqueryoptionsc |@tdt|dt|dt|dStdt|dt|dS)aFinds the k nearest vectors to a query vector, as measured by a similarity metric. knn function finds nearest vectors through approximate search on indexed dense_vectors. :param field: Field that the query will target. :param query: Vector value to find top nearest neighbours for. :param options: (Optional) kNN additional options as function named parameters. NzKNN(r%rrr/rrs rknnrs~% J75>> J JWU^^ J Jww7G7G J J J   &&PWU^^&P&Pwu~~&P&P&PQQQrcBtdt|dS)zPerforms a KQL query. Returns true if the provided KQL query string matches the row. :param query: Query string in KQL query string format. zKQL(rr)rs rkqlrs$ "":":":": ; ;;rcBtdt|dS)zlThe latest value of a field, where recency determined by the `@timestamp` field. :param field: zLAST_OVER_TIME(rrrEs rlast_over_timers$ ""EGENN"E"E"E F FFrcbtdt|dt|dS)zReturns the minimum value from multiple columns. This is similar to `MV_MIN` except it is intended to run on multiple columns at once. :param first: First of the columns to evaluate. :param rest: The rest of the columns to evaluate. zLEAST(r%rrrRs rleastrs2 ""M75>>"M"MWT]]"M"M"M N NNrlengthcbtdt|dt|dS)zReturns the substring that extracts *length* chars from *string* starting from the left. :param string: The string from which to return a substring. :param length: The number of characters to return. zLEFT(r%rrr+rs rleftrs2 ""O'&//"O"OWV__"O"O"O P PPrcBtdt|dS)z}Returns the character length of a string. :param string: String expression. If `null`, the function returns `null`. zLENGTH(rrr-s rrrs$ "">GFOO">">"> ? ??r substringstartc tdt|dt|dt|dS)aHReturns an integer that indicates the position of a keyword substring within another string. Returns `0` if the substring cannot be found. Note that string positions start from `1`. :param string: An input string :param substring: A substring to locate in the input string :param start: The start index zLOCATE(r%rr)r+rrs rlocatersH "L'&//LLWY%7%7LL75>>LLL  rbasecbtdt|dt|dS)aReturns the logarithm of a value to a base. The input can be any numeric value, the return value is always a double. Logs of zero, negative numbers, and base of one return `null` as well as a warning. :param base: Base of logarithm. If `null`, the function returns `null`. If not provided, this function returns the natural logarithm (base e) of a value. :param number: Numeric expression. If `null`, the function returns `null`. zLOG(r%rr)rrs rlogrs2 ""L"L"L'&//"L"L"L M MMrcBtdt|dS)aReturns the logarithm of a value to base 10. The input can be any numeric value, the return value is always a double. Logs of 0 and negative numbers return `null` as well as a warning. :param number: Numeric expression. If `null`, the function returns `null`. zLOG10(rrrs rlog10rs$ ""=76??"="="= > >>rcBtdt|dS)z~Removes leading whitespaces from a string. :param string: String expression. If `null`, the function returns `null`. zLTRIM(rrr-s rltrimrrrc |@tdt|dt|dt|dStdt|dt|dS)a^Use `MATCH` to perform a match query on the specified field. Using `MATCH` is equivalent to using the `match` query in the Elasticsearch Query DSL. :param field: Field that the query will target. :param query: Value to find in the provided field. :param options: (Optional) Match additional options as function named parameters. NzMATCH(r%rrrs rmatchr%s~% LWU^^ L Lwu~~ L L9I9I L L L   &&Rwu~~&R&R&R&R&RSSSrc |@tdt|dt|dt|dStdt|dt|dS)aUse `MATCH_PHRASE` to perform a `match_phrase` on the specified field. Using `MATCH_PHRASE` is equivalent to using the `match_phrase` query in the Elasticsearch Query DSL. :param field: Field that the query will target. :param query: Value to find in the provided field. :param options: (Optional) MatchPhrase additional options as function named parameters. Nz MATCH_PHRASE(r%rrrs r match_phraser7s% SGENN S Sgenn S S@P@P S S S   & ?GENN ? ?genn ? ? ?   rcBtdt|dS)z5The maximum value of a field. :param field: zMAX(rrrEs rmaxrLr^rcBtdt|dS)z?The maximum over time value of a field. :param field: zMAX_OVER_TIME(rrrEs r max_over_timerT$ ""D75>>"D"D"D E EErcBtdt|dS)zJComputes the MD5 hash of the input. :param input: Input to hash. zMD5(rrrs rmd5r\r^rcBtdt|dS)zThe value that is greater than half of all values and less than half of all values, also known as the 50% `PERCENTILE`. :param number: Expression that outputs values to calculate the median of. zMEDIAN(rrrs rmedianrd$ "">GFOO">">"> ? ??rcBtdt|dS)uReturns the median absolute deviation, a measure of variability. It is a robust statistic, meaning that it is useful for describing data that may have outliers, or may not be normally distributed. For such data it can be more descriptive than standard deviation. It is calculated as the median of each data point’s deviation from the median of the entire sample. That is, for a random variable `X`, the median absolute deviation is `median(|median(X) - X|)`. :param number: zMEDIAN_ABSOLUTE_DEVIATION(rrrs rmedian_absolute_deviationrms$ ""Qwv"Q"Q"Q R RRrcBtdt|dS)z5The minimum value of a field. :param field: zMIN(rrrEs rminr{r^rcBtdt|dS)z?The minimum over time value of a field. :param field: zMIN_OVER_TIME(rrrEs r min_over_timerrr)rfieldsc &|Ptdt|ddd|Ddt|dStdt|ddd|DdS)aUse `MULTI_MATCH` to perform a multi-match query on the specified field. The multi_match query builds on the match query to allow multi-field queries. :param query: Value to find in the provided fields. :param fields: Fields to use for matching :param options: (Optional) Additional options for MultiMatch, passed as function named parameters Nz MULTI_MATCH(r%c,g|]}t|Sr;r<r=s rr@zmulti_match..7S7S7Sq 7S7S7Srrc,g|]}t|Sr;r<r=s rr@zmulti_match..rr)rrrB)rrrs r multi_matchrs% k75>> k kTYY7S7SF7S7S7S-T-T k kX_`gXhXh k k k   & W75>> W WTYY7S7SF7S7S7S-T-T W W W   rfield1field2c.td|d|dS)zZConcatenates values of two multi-value fields. :param field1: :param field2: z MV_APPEND(r%rr)rrs r mv_appendrs& ""Bv"B"B"B"B"B C CCrcBtdt|dS)zConverts a multivalued field into a single valued field containing the average of all of the values. :param number: Multivalue expression. zMV_AVG(rrrs rmv_avgrrrdelimcbtdt|dt|dS)zConverts a multivalued string expression into a single valued column containing the concatenation of all values separated by a delimiter. :param string: Multivalue expression. :param delim: Delimiter. z MV_CONCAT(r%rrr+rs r mv_concatrs2 ""Swv"S"S'%.."S"S"S T TTrcBtdt|dS)zConverts a multivalued expression into a single valued column containing a count of the number of values. :param field: Multivalue expression. z MV_COUNT(rrrEs rmv_countrs$ ""?genn"?"?"? @ @@rcBtdt|dS)z`Remove duplicate values from a multivalued field. :param field: Multivalue expression. z MV_DEDUPE(rrrEs r mv_dedupers$ ""@wu~~"@"@"@ A AArcBtdt|dS)zConverts a multivalued expression into a single valued column containing the first value. This is most useful when reading from a function that emits multivalued columns in a known order like `SPLIT`. :param field: Multivalue expression. z MV_FIRST(rrrEs rmv_firstrs$ ""?genn"?"?"? @ @@rcBtdt|dS)zConverts a multivalue expression into a single valued column containing the last value. This is most useful when reading from a function that emits multivalued columns in a known order like `SPLIT`. :param field: Multivalue expression. zMV_LAST(rrrEs rmv_lastrs$ "">WU^^">">"> ? ??rcBtdt|dS)zConverts a multivalued expression into a single valued column containing the maximum value. :param field: Multivalue expression. zMV_MAX(rrrEs rmv_maxr$ ""=GENN"="="= > >>rcBtdt|dS)zConverts a multivalued field into a single valued field containing the median value. :param number: Multivalue expression. z MV_MEDIAN(rrrs r mv_medianrs$ ""Awv"A"A"A B BBrcBtdt|dS)udConverts a multivalued field into a single valued field containing the median absolute deviation. It is calculated as the median of each data point’s deviation from the median of the entire sample. That is, for a random variable `X`, the median absolute deviation is `median(|median(X) - X|)`. :param number: Multivalue expression. zMV_MEDIAN_ABSOLUTE_DEVIATION(rrrs rmv_median_absolute_deviationrs$ ""T'&//"T"T"T U UUrcBtdt|dS)zConverts a multivalued expression into a single valued column containing the minimum value. :param field: Multivalue expression. zMV_MIN(rrrEs rmv_minrrr percentilecbtdt|dt|dS)aXConverts a multivalued field into a single valued field containing the value at which a certain percentage of observed values occur. :param number: Multivalue expression. :param percentile: The percentile to calculate. Must be a number between 0 and 100. Numbers out of range will return a null instead. zMV_PERCENTILE(r%rrrrs r mv_percentilers: "BBBGJ,?,?BBB  rpcbtdt|dt|dS)uConverts a multivalued expression into a single-valued column by multiplying every element on the input list by its corresponding term in P-Series and computing the sum. :param number: Multivalue expression. :param p: It is a constant number that represents the *p* parameter in the P-Series. It impacts every element’s contribution to the weighted sum. zMV_PSERIES_WEIGHTED_SUM(r%rr)rrs rmv_pseries_weighted_sumrs8 "C76??CCgajjCCC  rendc |@tdt|dt|dt|dStdt|dt|dS)aReturns a subset of the multivalued field using the start and end index values. This is most useful when reading from a function that emits multivalued columns in a known order like `SPLIT` or `MV_SORT`. :param field: Multivalue expression. If `null`, the function returns `null`. :param start: Start position. If `null`, the function returns `null`. The start argument can be negative. An index of -1 is used to specify the last value in the list. :param end: End position(included). Optional; if omitted, the position at `start` is returned. The end argument can be negative. An index of -1 is used to specify the last value in the list. Nz MV_SLICE(r%rr)r/rrs rmv_slicer&s{ % K K K'%.. K KGCLL K K K   &&U'%..&U&UGENN&U&U&UVVVrordercbtdt|dt|dS)zSorts a multivalued field in lexicographical order. :param field: Multivalue expression. If `null`, the function returns `null`. :param order: Sort order. The valid options are ASC and DESC, the default is ASC. zMV_SORT(r%rr)r/rs rmv_sortr=s2 ""PWU^^"P"Pwu~~"P"P"P Q QQrcBtdt|dS)zConverts a multivalued field into a single valued field containing the sum of all of the values. :param number: Multivalue expression. zMV_SUM(rrrs rmv_sumrFrrstring1string2c ~|&td|d|dt|dStd|d|dS)aCombines the values from two multivalued fields with a delimiter that joins them together. :param string1: Multivalue expression. :param string2: Multivalue expression. :param delim: Delimiter. Optional; if omitted, `,` is used as a default delimiter. NzMV_ZIP(r%rr)rrrs rmv_ziprOs\ %&W&W&W7&W&Wgenn&W&W&WXXX%&E&E&E7&E&E&EFFFrc tdS)zReturns current date and time.zNOW()rr;rrnowr_ !' * **rcbtdt|dt|dS)a Returns the value at which a certain percentage of observed values occur. For example, the 95th percentile is the value which is greater than 95% of the observed values and the 50th percentile is the `MEDIAN`. :param number: :param percentile: z PERCENTILE(r%rrrs rrrds: "?gfoo??)<)<???  rc tdS)uDReturns Pi, the ratio of a circle’s circumference to its diameter.zPI()rr;rrpirss !& ) ))rexponentcbtdt|dt|dS)aReturns the value of `base` raised to the power of `exponent`. :param base: Numeric expression for the base. If `null`, the function returns `null`. :param exponent: Numeric expression for the exponent. If `null`, the function returns `null`. zPOW(r%rr)rrs rpowrxs4 ""N"N"N'(:K:K"N"N"N O OOrc|0tdt|dt|dStdt|dS)aPerforms a query string query. Returns true if the provided query string matches the row. :param query: Query string in Lucene query string format. :param options: (Optional) Additional options for Query String as function named parameters. NzQSTR(r%rr)rrs rqstrr sZ%&Sgenn&S&S@P@P&S&S&STTT%&?genn&?&?&?@@@rcBtdt|dS)z4The rate of a counter field. :param field: zRATE(rrrEs rrater $ "";'%..";";"; < < >>rcBtdt|dS)zReturns the sign of the given number. It returns `-1` for negative numbers, `0` for `0` and `1` for positive numbers. :param number: Numeric expression. If `null`, the function returns `null`. zSIGNUM(rrrs rsignumr, rrcBtdt|dS)zsReturns the sine of an angle. :param angle: An angle, in radians. If `null`, the function returns `null`. zSIN(rrr\s rsinr.r^rcBtdt|dS)z}Returns the hyperbolic sine of a number. :param number: Numeric expression. If `null`, the function returns `null`. zSINH(rrrs rsinhr0rrcBtdt|dS)z^Returns a string made of `number` spaces. :param number: Number of spaces in result. zSPACE(rrrs rspacer2%rrcbtdt|dt|dS)zSplit a single valued string into multiple strings. :param string: String expression. If `null`, the function returns `null`. :param delim: Delimiter. Only single byte delimiters are currently supported. zSPLIT(r%rrrs rsplitr4-s2 ""O76??"O"Ogenn"O"O"O P PPrcBtdt|dS)aReturns the square root of a number. The input can be any numeric value, the return value is always a double. Square roots of negative numbers and infinities are null. :param number: Numeric expression. If `null`, the function returns `null`. zSQRT(rrrs rsqrtr66s$ ""<'&//"<"<"< = ==rprefixcbtdt|dt|dS)zReturns a boolean that indicates whether a keyword string starts with another string. :param str: String expression. If `null`, the function returns `null`. :param prefix: String expression. If `null`, the function returns `null`. z STARTS_WITH(r%rr)rr7s r starts_withr9@s2 ""S"S"S"S"S"S T TTrcBtdt|dS)zNThe population standard deviation of a numeric field. :param number: zSTD_DEV(rrrs rstd_devr;Js$ ""?WV__"?"?"? @ @@rcBtdt|dS)zeCalculate the spatial centroid over a field with spatial point geometry type. :param field: zST_CENTROID_AGG(rrrEs rst_centroid_aggr=Rrkrgeom_ageom_bcbtdt|dt|dS)aReturns whether the first geometry contains the second geometry. This is the inverse of the ST_WITHIN function. :param geom_a: Expression of type `geo_point`, `cartesian_point`, `geo_shape` or `cartesian_shape`. If `null`, the function returns `null`. :param geom_b: Expression of type `geo_point`, `cartesian_point`, `geo_shape` or `cartesian_shape`. If `null`, the function returns `null`. The second parameter must also have the same coordinate system as the first. This means it is not possible to combine `geo_*` and `cartesian_*` parameters. z ST_CONTAINS(r%rrr>r?s r st_containsrBZ2 ""V"V"VGFOO"V"V"V W WWrcbtdt|dt|dS)uReturns whether the two geometries or geometry columns are disjoint. This is the inverse of the ST_INTERSECTS function. In mathematical terms: ST_Disjoint(A, B) ⇔ A ⋂ B = ∅ :param geom_a: Expression of type `geo_point`, `cartesian_point`, `geo_shape` or `cartesian_shape`. If `null`, the function returns `null`. :param geom_b: Expression of type `geo_point`, `cartesian_point`, `geo_shape` or `cartesian_shape`. If `null`, the function returns `null`. The second parameter must also have the same coordinate system as the first. This means it is not possible to combine `geo_*` and `cartesian_*` parameters. z ST_DISJOINT(r%rrrAs r st_disjointrEls2 ""V"V"VGFOO"V"V"V W WWrcbtdt|dt|dS)aComputes the distance between two points. For cartesian geometries, this is the pythagorean distance in the same units as the original coordinates. For geographic geometries, this is the circular distance along the great circle in meters. :param geom_a: Expression of type `geo_point` or `cartesian_point`. If `null`, the function returns `null`. :param geom_b: Expression of type `geo_point` or `cartesian_point`. If `null`, the function returns `null`. The second parameter must also have the same coordinate system as the first. This means it is not possible to combine `geo_point` and `cartesian_point` parameters. z ST_DISTANCE(r%rrrAs r st_distancerGrCrgeometrycBtdt|dS)zDetermines the minimum bounding box of the supplied geometry. :param geometry: Expression of type `geo_point`, `geo_shape`, `cartesian_point` or `cartesian_shape`. If `null`, the function returns `null`. z ST_ENVELOPE(rr)rHs r st_enveloperJs& ""E1B1B"E"E"E F FFrcBtdt|dS)zCalculate the spatial extent over a field with geometry type. Returns a bounding box for all values of the field. :param field: zST_EXTENT_AGG(rrrEs r st_extent_aggrL$ ""D75>>"D"D"D E EErboundsc |@tdt|dt|dt|dStdt|dt|dS)aCalculates the `geohash` of the supplied geo_point at the specified precision. The result is long encoded. Use ST_GEOHASH_TO_STRING to convert the result to a string. These functions are related to the `geo_grid` query and the `geohash_grid` aggregation. :param geometry: Expression of type `geo_point`. If `null`, the function returns `null`. :param precision: Expression of type `integer`. If `null`, the function returns `null`. Valid values are between 1 and 12. :param bounds: Optional bounds to filter the grid tiles, a `geo_shape` of type `BBOX`. Use `ST_ENVELOPE` if the `geo_shape` is of any other type. Nz ST_GEOHASH(r%rrrHrcrNs r st_geohashrQ % W'(++ W Wwy/A/A W WWV__ W W W   & D'(++ D Dwy/A/A D D D   rgrid_idcBtdt|dS)zConverts an input value representing a geohash grid-ID in string format into a long. :param grid_id: Input geohash grid-id. The input can be a single- or multi-valued column or an expression. zST_GEOHASH_TO_LONG(rrrSs rst_geohash_to_longrV& ""K8H8H"K"K"K L LLrcBtdt|dS)zConverts an input value representing a geohash grid-ID in long format into a string. :param grid_id: Input geohash grid-id. The input can be a single- or multi-valued column or an expression. zST_GEOHASH_TO_STRING(rrrUs rst_geohash_to_stringrY& ""M'':J:J"M"M"M N NNrc |@tdt|dt|dt|dStdt|dt|dS)aCalculates the `geohex`, the H3 cell-id, of the supplied geo_point at the specified precision. The result is long encoded. Use ST_GEOHEX_TO_STRING to convert the result to a string. These functions are related to the `geo_grid` query and the `geohex_grid` aggregation. :param geometry: Expression of type `geo_point`. If `null`, the function returns `null`. :param precision: Expression of type `integer`. If `null`, the function returns `null`. Valid values are between 0 and 15. :param bounds: Optional bounds to filter the grid tiles, a `geo_shape` of type `BBOX`. Use `ST_ENVELOPE` if the `geo_shape` is of any other type. Nz ST_GEOHEX(r%rrrPs r st_geohexr\s % V** V Vgi.@.@ V VGFOO V V V   & C** C Cgi.@.@ C C C   rcBtdt|dS)zConverts an input value representing a geohex grid-ID in string format into a long. :param grid_id: Input geohex grid-id. The input can be a single- or multi-valued column or an expression. zST_GEOHEX_TO_LONG(rrrUs rst_geohex_to_longr^s& ""Jww7G7G"J"J"J K KKrcBtdt|dS)zConverts an input value representing a Geohex grid-ID in long format into a string. :param grid_id: Input Geohex grid-id. The input can be a single- or multi-valued column or an expression. zST_GEOHEX_TO_STRING(rrrUs rst_geohex_to_stringr`s& ""L9I9I"L"L"L M MMrc |@tdt|dt|dt|dStdt|dt|dS)aCalculates the `geotile` of the supplied geo_point at the specified precision. The result is long encoded. Use ST_GEOTILE_TO_STRING to convert the result to a string. These functions are related to the `geo_grid` query and the `geotile_grid` aggregation. :param geometry: Expression of type `geo_point`. If `null`, the function returns `null`. :param precision: Expression of type `integer`. If `null`, the function returns `null`. Valid values are between 0 and 29. :param bounds: Optional bounds to filter the grid tiles, a `geo_shape` of type `BBOX`. Use `ST_ENVELOPE` if the `geo_shape` is of any other type. Nz ST_GEOTILE(r%rrrPs r st_geotilerbrRrcBtdt|dS)zConverts an input value representing a geotile grid-ID in string format into a long. :param grid_id: Input geotile grid-id. The input can be a single- or multi-valued column or an expression. zST_GEOTILE_TO_LONG(rrrUs rst_geotile_to_longrdrWrcBtdt|dS)zConverts an input value representing a geotile grid-ID in long format into a string. :param grid_id: Input geotile grid-id. The input can be a single- or multi-valued column or an expression. zST_GEOTILE_TO_STRING(rrrUs rst_geotile_to_stringrf$rZrcbtdt|dt|dS)uSReturns true if two geometries intersect. They intersect if they have any point in common, including their interior points (points along lines or within polygons). This is the inverse of the ST_DISJOINT function. In mathematical terms: ST_Intersects(A, B) ⇔ A ⋂ B ≠ ∅ :param geom_a: Expression of type `geo_point`, `cartesian_point`, `geo_shape` or `cartesian_shape`. If `null`, the function returns `null`. :param geom_b: Expression of type `geo_point`, `cartesian_point`, `geo_shape` or `cartesian_shape`. If `null`, the function returns `null`. The second parameter must also have the same coordinate system as the first. This means it is not possible to combine `geo_*` and `cartesian_*` parameters. zST_INTERSECTS(r%rrrAs r st_intersectsrh.s8" ">>>GFOO>>>  rcbtdt|dt|dS)aReturns whether the first geometry is within the second geometry. This is the inverse of the ST_CONTAINS function. :param geom_a: Expression of type `geo_point`, `cartesian_point`, `geo_shape` or `cartesian_shape`. If `null`, the function returns `null`. :param geom_b: Expression of type `geo_point`, `cartesian_point`, `geo_shape` or `cartesian_shape`. If `null`, the function returns `null`. The second parameter must also have the same coordinate system as the first. This means it is not possible to combine `geo_*` and `cartesian_*` parameters. z ST_WITHIN(r%rrrAs r st_withinrjDs2 ""Twv"T"T'&//"T"T"T U UUrpointcBtdt|dS)aExtracts the `x` coordinate from the supplied point. If the points is of type `geo_point` this is equivalent to extracting the `longitude` value. :param point: Expression of type `geo_point` or `cartesian_point`. If `null`, the function returns `null`. zST_X(rrrks rst_xrnT$ "";'%..";";"; < <WU^^">">"> ? ??rcBtdt|dS)arExtracts the minimum value of the `x` coordinates from the supplied geometry. If the geometry is of type `geo_point` or `geo_shape` this is equivalent to extracting the minimum `longitude` value. :param point: Expression of type `geo_point`, `geo_shape`, `cartesian_point` or `cartesian_shape`. If `null`, the function returns `null`. zST_XMIN(rrrms rst_xminrtirrrcBtdt|dS)aExtracts the `y` coordinate from the supplied point. If the points is of type `geo_point` this is equivalent to extracting the `latitude` value. :param point: Expression of type `geo_point` or `cartesian_point`. If `null`, the function returns `null`. zST_Y(rrrms rst_yrvtrorcBtdt|dS)aqExtracts the maximum value of the `y` coordinates from the supplied geometry. If the geometry is of type `geo_point` or `geo_shape` this is equivalent to extracting the maximum `latitude` value. :param point: Expression of type `geo_point`, `geo_shape`, `cartesian_point` or `cartesian_shape`. If `null`, the function returns `null`. zST_YMAX(rrrms rst_ymaxrx~rrrcBtdt|dS)aqExtracts the minimum value of the `y` coordinates from the supplied geometry. If the geometry is of type `geo_point` or `geo_shape` this is equivalent to extracting the minimum `latitude` value. :param point: Expression of type `geo_point`, `geo_shape`, `cartesian_point` or `cartesian_shape`. If `null`, the function returns `null`. zST_YMIN(rrrms rst_yminrzrrrc |@tdt|dt|dt|dStdt|dt|dS)agReturns a substring of a string, specified by a start position and an optional length. :param string: String expression. If `null`, the function returns `null`. :param start: Start position. :param length: Length of the substring from the start position. Optional; if omitted, all positions after `start` are returned. Nz SUBSTRING(r%rr)r+rrs rrrs|% P P PGENN P Pgfoo P P P   &&W76??&W&Wgenn&W&W&WXXXrcBtdt|dS)z9The sum of a numeric expression. :param number: zSUM(rrrs rsumr}rrcBtdt|dS)zvReturns the tangent of an angle. :param angle: An angle, in radians. If `null`, the function returns `null`. zTAN(rrr\s rtanrr^rcBtdt|dS)zReturns the hyperbolic tangent of a number. :param number: Numeric expression. If `null`, the function returns `null`. zTANH(rrrs rtanhrrrc tdS)u>Returns the ratio of a circle’s circumference to its radius.zTAU()rr;rrtaurrrcbtdt|dt|dS)zPerforms a Term query on the specified field. Returns true if the provided term matches the row. :param field: Field that the query will target. :param query: Term you wish to find in the provided field. zTERM(r%rr)r/rs rtermrs2 ""M'%.."M"MGENN"M"M"M N NNrc tdt|dt|dt|dS)a Collects the top values for a field. Includes repeated values. :param field: The field to collect the top values for. :param limit: The maximum number of values to collect. :param order: The order to calculate the top values. Either `asc` or `desc`. zTOP(r%rr)r/r rs rtoprsF "Dwu~~DDDD75>>DDD  rcBtdt|dS)zEncode a numeric to an aggregate_metric_double. :param number: Input value. The input can be a single- or multi-valued column or an expression. zTO_AGGREGATE_METRIC_DOUBLE(rrrs rto_aggregate_metric_doublers$ ""R"R"R"R S SSrcBtdt|dS)zFEncode a string to a base64 string. :param string: A string. z TO_BASE64(rrr-s r to_base64rs$ ""Awv"A"A"A B BBrcBtdt|dS)aConverts an input value to a boolean value. A string value of `true` will be case-insensitive converted to the Boolean `true`. For anything else, including the empty string, the function will return `false`. The numerical value of `0` will be converted to `false`, anything else will be converted to `true`. :param field: Input value. The input can be a single- or multi-valued column or an expression. z TO_BOOLEAN(rrrEs r to_booleanrs$ ""A"A"A"A B BBrcBtdt|dS)aConverts an input value to a `cartesian_point` value. A string will only be successfully converted if it respects the WKT Point format. :param field: Input value. The input can be a single- or multi-valued column or an expression. zTO_CARTESIANPOINT(rrrEs rto_cartesianpointr$ ""Hwu~~"H"H"H I IIrcBtdt|dS)aConverts an input value to a `cartesian_shape` value. A string will only be successfully converted if it respects the WKT format. :param field: Input value. The input can be a single- or multi-valued column or an expression. zTO_CARTESIANSHAPE(rrrEs rto_cartesianshaperrrcBtdt|dS)zConverts an input value into a `date_period` value. :param field: Input value. The input is a valid constant date period expression. zTO_DATEPERIOD(rrrEs r to_dateperiodrrrcBtdt|dS)uMConverts an input value to a date value. A string will only be successfully converted if it’s respecting the format `yyyy-MM-dd'T'HH:mm:ss.SSS'Z'`. To convert dates in other formats, use `DATE_PARSE`. :param field: Input value. The input can be a single- or multi-valued column or an expression. z TO_DATETIME(rrrEs r to_datetimers$ ""B"B"B"B C CCrcBtdt|dS)zConverts an input to a nanosecond-resolution date value (aka date_nanos). :param field: Input value. The input can be a single- or multi-valued column or an expression. zTO_DATE_NANOS(rrrEs r to_date_nanosr!rMrcBtdt|dS)zConverts a number in radians to degrees). :param number: Input value. The input can be a single- or multi-valued column or an expression. z TO_DEGREES(rrrs r to_degreesr*$ ""B"B"B"B C CCrcBtdt|dS)axConverts an input value to a double value. If the input parameter is of a date type, its value will be interpreted as milliseconds since the Unix epoch, converted to double. Boolean `true` will be converted to double `1.0`, `false` to `0.0`. :param field: Input value. The input can be a single- or multi-valued column or an expression. z TO_DOUBLE(rrrEs r to_doubler3s$ ""@wu~~"@"@"@ A AArcBtdt|dS)aConverts an input value to a `geo_point` value. A string will only be successfully converted if it respects the WKT Point format. :param field: Input value. The input can be a single- or multi-valued column or an expression. z TO_GEOPOINT(rrrEs r to_geopointr?$ ""B"B"B"B C CCrcBtdt|dS)zConverts an input value to a `geo_shape` value. A string will only be successfully converted if it respects the WKT format. :param field: Input value. The input can be a single- or multi-valued column or an expression. z TO_GEOSHAPE(rrrEs r to_geoshaperIrrcBtdt|dS)axConverts an input value to an integer value. If the input parameter is of a date type, its value will be interpreted as milliseconds since the Unix epoch, converted to integer. Boolean `true` will be converted to integer `1`, `false` to `0`. :param field: Input value. The input can be a single- or multi-valued column or an expression. z TO_INTEGER(rrrEs r to_integerrSs$ ""A"A"A"A B BBrc|0tdt|dt|dStdt|dS)zConverts an input string to an IP value. :param field: Input value. The input can be a single- or multi-valued column or an expression. :param options: (Optional) Additional options. NzTO_IP(r%rr)r/rs rto_ipr_sZ%&Twu~~&T&TAQAQ&T&T&TUUU%&@wu~~&@&@&@AAArcBtdt|dS)anConverts an input value to a long value. If the input parameter is of a date type, its value will be interpreted as milliseconds since the Unix epoch, converted to long. Boolean `true` will be converted to long `1`, `false` to `0`. :param field: Input value. The input can be a single- or multi-valued column or an expression. zTO_LONG(rrrEs rto_longrns$ "">WU^^">">"> ? ??rcBtdt|dS)aReturns a new string representing the input string converted to lower case. :param str: String expression. If `null`, the function returns `null`. The input can be a single-valued column or expression, or a multi-valued column or expression. z TO_LOWER(rrrs rto_lowerrz$ ""=gcll"="="= > >>rcBtdt|dS)zConverts a number in degrees) to radians. :param number: Input value. The input can be a single- or multi-valued column or an expression. z TO_RADIANS(rrrs r to_radiansrrrcBtdt|dS)zConverts an input value into a string. :param field: Input value. The input can be a single- or multi-valued column or an expression. z TO_STRING(rrrEs r to_stringrs$ ""@wu~~"@"@"@ A AArcBtdt|dS)zConverts an input value into a `time_duration` value. :param field: Input value. The input is a valid constant time duration expression. zTO_TIMEDURATION(rrrEs rto_timedurationrrkrcBtdt|dS)aConverts an input value to an unsigned long value. If the input parameter is of a date type, its value will be interpreted as milliseconds since the Unix epoch, converted to unsigned long. Boolean `true` will be converted to unsigned long `1`, `false` to `0`. :param field: Input value. The input can be a single- or multi-valued column or an expression. zTO_UNSIGNED_LONG(rrrEs rto_unsigned_longrs$ ""Ggenn"G"G"G H HHrcBtdt|dS)aReturns a new string representing the input string converted to upper case. :param str: String expression. If `null`, the function returns `null`. The input can be a single-valued column or expression, or a multi-valued column or expression. z TO_UPPER(rrrs rto_upperrrrcBtdt|dS)zConverts an input string to a version value. :param field: Input value. The input can be a single- or multi-valued column or an expression. z TO_VERSION(rrrEs r to_versionrs$ ""A"A"A"A B BBrcBtdt|dS)zRemoves leading and trailing whitespaces from a string. :param string: String expression. If `null`, the function returns `null`. zTRIM(rrr-s rtrimrrrcBtdt|dS)uReturns unique values as a multivalued field. The order of the returned values isn’t guaranteed. If you need the values returned in order use `MV_SORT`. :param field: zVALUES(rrrEs rvaluesrrrweightcbtdt|dt|dS)z|The weighted average of a numeric expression. :param number: A numeric value. :param weight: A numeric weight. z WEIGHTED_AVG(r%rr)rrs r weighted_avgrs2 ""W'&//"W"WWV__"W"W"W X XXrr )r typingrelasticsearch.dsl.document_baserelasticsearch.esql.esqlrrrrrrrr!r&r(r*r.r4r6rCrFrHrJrNrSrYr]r`rbrfrhrjrprtrurzr}rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr r rrrrrrrr"r&r(r*r,r.r0r2r4r6r9r;r=rBrErGrJrLrQrVrYr\r^r`rbrdrfrhrjrnrqrtrvrxrzrr}rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr;rrrs$ BBBBBB<<<<<<<<ss==#9====>>$:>>>>>>$:>>>>>>$:>>>>   0>     ==#9====G.G-CGGGGD~D*@DDDD       ,EE+AEEEE n )?    CnC)?CCCC>>$:>>>>>>$:>>>>T>TNT?UTTTTRNR.R=SRRRR^(><~<"8<<<<>>$:>>>>>>$:>>>>   &4        &4     H>H.DHHHH   +9 JX      %30#'GG GGGGGG&   /=     WW$2WWWWW) !)))) S>S>S>TSSSS==#9====H>H.DHHHH?.?%;????EE+AEEEERNR.R=SRRRRSNS>S>TSSSSB>BNB?UBBBB  $ %     "MQRR R"0R;IRRRRR&<~<"8<<<<G.G-CGGGGOO~O:POOOOQQQ@&<@@@@   '5 >L      Nn Nn N9O N N N N?.?%;?????.?%;????MQTT T"0T;ITTTTT&MQ   "0 ;I     *<~<"8<<<<FF,BFFFF<~<"8<<<<@>@&<@@@@ Sn S9O S S S S<~<"8<<<<FF,BFFFFOS    $2 =K     *DnDnDAWDDDD@>@&<@@@@UnU^U@VUUUUANA'=AAAAB^B(>BBBBANA'=AAAA@>@&<@@@@?.?%;????CnC)?CCCCVVR.R=SRRRR@>@&<@@@@OS G G  G&4 G=K G G G G G + #++++   (6     * "**** PnPP;QPPPP6: A A  A$2 A A A A A ==#9====S>S>S>TSSSS   #1 ?M     >>$:>>>>R.R.R=SRRRR8<CC C&4CCCCC"TNTNT?UTTTT?.?%;????Q.QQ S>T S S S S==#9====?.?%;????@>@&<@@@@<~<"8<<<<>>$:>>>>?.?%;????Q.QQ>$:>>>>U^U^U@VUUUUANA'=AAAAH>H.DHHHHX X$2XXXXX$X X$2XXXXX&X X$2XXXXX$G.G-CGGGGFF,BFFFFSW   )7 AO     4MM3IMMMMO.O5KOOOOSW   )7 AO     4L~L2HLLLLNN4JNNNNSW   )7 AO     4MM3IMMMMO.O5KOOOO $2, Vn Vn VAW V V V V ==#9====@>@&<@@@@@>@&<@@@@==#9====@>@&<@@@@@>@&<@@@@MQYY Y#1Y;IYYYYY&==#9====<~<"8<<<<>>$:>>>>+ #++++ OO~O:POOOO   "0 9G     T~T:PTTTTCnC)?CCCC Cn C)? C C C CJ^J0FJJJJJ^J0FJJJJFF,BFFFFD~D*@DDDDFF,BFFFFD~D*@DDDD B^ B(> B B B BD~D*@DDDDD~D*@DDDD Cn C)? C C C C6: B B  B$2 B B B B B @> @&< @ @ @ @?.?%;????D~D*@DDDDB^B(>BBBBH>H.DHHHH IN I/E I I I I?.?%;????CnC)?CCCC>>$:>>>>?.?%;????Y Y$2YYYYYYYr