[ES|QL] `values` function does not return _all_ values as it dedupes them

[BenB196]

Elasticsearch Version

8.18.1

Installed Plugins

No response

Java Version

bundled

OS Version

Container

Problem Description

The values aggregation states that it returns all values as a multi-valued field:

Returns all values in a group as a multivalued field.

However, if 2 or more values are the same, the returned result will only include the value once, instead of having all values.

Steps to Reproduce

1. Create an index
2. Index some docs, and have a field that you want to use values against

POST example-index/_doc
{
  "vc": "vc0001",
  "share": 1
}

POST example-index/_doc
{
  "vc": "vc0002",
  "share": 1
}

POST example-index/_doc
{
  "vc": "vc0003",
  "share": 3,
}

3. Run an ES|QL query like:

FROM example-index
| STATS shares = VALUES(share)

4. Get the response

shares = [1, 3]

5. Expected (based on the wording of the docs) to get

shares = [1, 1, 3]

Logs (if relevant)

No response

[elasticsearchmachine]

Pinging @elastic/es-analytical-engine (Team:Analytics)

[nik9000]

Yeah, it's supposed to deduplicate them. I'll update the docs.

[BenB196]

Thanks @nik9000, question, should it be a feature request to have values not dedup (possibly via an parameter)? There are some use-cases I've hit where it'd be valuable to have all values returned.

[nik9000]

I'd use the TOP function in that case. There you have to manually limit how many to return, but that helps it not grow uncontrollably.