Skip to content

ES|QL: INLINE STATS planning leads to "Output has changed" #136797

@luigidellaquila

Description

@luigidellaquila

With CSV dataset

from host_inventory | where  NOT false AND  NOT true | eval  RJWizhZgGm = null, jTXjCBjSCkoJ = "FRtR", `description` = null, `host.name` = true, host.os = to_lower(host.os), `host.version` = "GCReYnjoKJMDLJTN", nRZBIlWvfMtH = -1454596507, EGRvyKkionRJ = null, GymRrNCBbSc = 711051951, host.name = -1411015584 | drop host.os| rename nRZBIlWvfMtH as language_code | lookup join languages_lookup on language_code | mv_expand language_name | grok jTXjCBjSCkoJ "%{WORD:EGRvyKkionRJ} %{WORD:jTXjCBjSCkoJ} %{WORD:RJWizhZgGm}" | inline stats  `RJWizhZgGm` = present(host.name) by language_code | eval  RJWizhZgGm = host.name, `description` = GymRrNCBbSc + language_code
{
    "error": {
        "root_cause": [
            {
                "type": "verification_exception",
                "reason": "Found 1 problem\nline 1:589: Output has changed from [[host.version{r}#13, GymRrNCBbSc{r}#19, host.name{r}#21, language_name{r}#55, EGRvyKkionRJ{r}#33, jTXjCBjSCkoJ{r}#35, language_code{r}#25, RJWizhZgGm{r}#42, description{r}#46]] to [[host.version{r}#13, language_code{r}#25, GymRrNCBbSc{r}#19, host.name{r}#21, language_name{r}#55, EGRvyKkionRJ{r}#33, jTXjCBjSCkoJ{r}#35, RJWizhZgGm{r}#42, description{r}#46]]. "
            }
        ],
        "type": "verification_exception",
        "reason": "Found 1 problem\nline 1:589: Output has changed from [[host.version{r}#13, GymRrNCBbSc{r}#19, host.name{r}#21, language_name{r}#55, EGRvyKkionRJ{r}#33, jTXjCBjSCkoJ{r}#35, language_code{r}#25, RJWizhZgGm{r}#42, description{r}#46]] to [[host.version{r}#13, language_code{r}#25, GymRrNCBbSc{r}#19, host.name{r}#21, language_name{r}#55, EGRvyKkionRJ{r}#33, jTXjCBjSCkoJ{r}#35, RJWizhZgGm{r}#42, description{r}#46]]. "
    },
    "status": 400
}

Metadata

Metadata

Assignees

Labels

:Analytics/ES|QLAKA ESQL>bugTeam:AnalyticsMeta label for analytical engine team (ESQL/Aggs/Geo)medium-riskAn open issue or test failure that is a medium risk to future releases

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions