README.md

PPL Language

Overview

Piped Processing Language (PPL), powered by OpenSearch, enables OpenSearch users with exploration and discovery of, and finding search patterns in data stored in OpenSearch Or S3.

The PPL query start with search command and then flowing a set of command delimited by pipe (|). for example, the following query retrieve firstname and lastname from accounts if age larger than 18.

source=accounts
| where age > 18
| fields firstname, lastname

For additional examples see the next documentation.

---

Commands Specifications

• Commands

  • explain command

  • dedup command

  • describe command

  • fillnull command

  • eval command

  • fields command

  • grok command

  • parse command

  • patterns command

  • rename command

  • search command

  • sort command

  • stats command

  • where command

  • head command

  • rare command

  • top command

  • join commands

  • lookup commands

  • subquery commands

  • correlation commands

• Functions

  • Expressions

  • Math Functions

  • Date and Time Functions

  • String Functions

  • Condition Functions

  • Type Conversion Functions

  • Cryptographic Functions

---

PPL On Spark

Running PPL On Spark gives a basic overview of the PPL language an how it functions on top of Spark

---

Example PPL Queries

See samples of PPL queries

---

Planned PPL Commands

• FillNull

---

PPL Project Roadmap

PPL Github Project Roadmap