Skip to content

ES|QL: no matches for pattern #126418

Closed
@luigidellaquila

Description

@luigidellaquila

With CSV dataset

from addresses,cartesian_multipolygons,hosts| rename city.name as message 
| lookup join message_types_lookup on message 
| eval  card = -6013949614291505456, hOntTwnVC = null, PQAF = null, DXkxCFXyw = null, number = -7336429038807752405 
| eval  dewAwHC = -1186293612, message = null 
| sort number ASC, street ASC, ip0 DESC, name ASC NULLS FIRST, host ASC 
| drop number, host_group, *umber, `city.country.continent.name`, dewAwHC, `zip_code`, `message`, city.country.continent.planet.name, `name`, `ip1`, message, zip_code 
| drop description, *e, id 
| keep `hOntTwnVC`, city.country.continent.planet.galaxy

DROP *e seems to work fine by itself, but as soon as we add another KEEP after that, the query starts failing

{
    "error": {
        "root_cause": [
            {
                "type": "verification_exception",
                "reason": "Found 1 problem\nline 1:542: No matches found for pattern [*e]"
            }
        ],
        "type": "verification_exception",
        "reason": "Found 1 problem\nline 1:542: No matches found for pattern [*e]"
    },
    "status": 400
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions