README.md

PPL Language

Overview

Piped Processing Language (PPL), powered by OpenSearch, enables OpenSearch users with exploration and discovery of, and finding search patterns in data stored in OpenSearch Or S3.

The PPL query start with search command and then flowing a set of command delimited by pipe (|). for example, the following query retrieve firstname and lastname from accounts if age larger than 18.

source=accounts
| where age > 18
| fields firstname, lastname

For additional examples see the next documentation.

---

Commands Specifications

• Commands

  • comment

  • explain command

  • dedup command

  • describe command

  • fillnull command

  • flatten command

  • eval command

  • fields command

  • grok command

  • parse command

  • patterns command

  • rename command

  • search command

  • sort command

  • stats command

  • eventstats command

  • where command

  • head command

  • rare command

  • top command

  • join commands

  • lookup commands

  • subquery commands

  • correlation commands

  • trendline commands

  • expand commands

• Functions

  • Expressions

  • Math Functions

  • Date and Time Functions

  • String Functions

  • JSON Functions

  • Condition Functions

  • Type Conversion Functions

  • Cryptographic Functions

  • IP Address Functions

  • Collection Functions

---

PPL On Spark

Running PPL On Spark gives a basic overview of the PPL language an how it functions on top of Spark

---

Example PPL Queries

See samples of PPL queries

---

Experiment PPL locally using Spark-Cluster

See ppl usage sample on local spark clusterPPL on local spark

---

TPC-H PPL Query Rewriting

See samples of TPC-H PPL query rewriting

---

Planned PPL Commands

• FillNull

---

PPL Project Roadmap

PPL Github Project Roadmap