Add take() aggregation function in PPL

[joshuali925]

Description

take(field) returns some documents of a field per each stats response. It is implemented using top hits metrics aggregation when pushed down to opensearch. In memory it works similar to head command.

A sample use case would be aggregating logs by a category, take allows user to see a sample log per each category: stats take(log_string, 1) by category.

This returns a list of patterns with the count and one sample message.

Currently take only supports text fields. it's not very useful on other types, and array implementation might need to be improved. Support for other types can be extended in the future if needed.

Issues Resolved

Linking issue: opensearch-project/observability#1172

Check List

• New functionality includes testing.
  • All tests pass, including unit test, integration test and doctest
• New functionality has been documented.
  • New functionality has javadoc added
  • New functionality has user manual doc added
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[joshuali925]

just realized from doesn't make much sense without sort, will remove it for now

[codecov-commenter]

Codecov Report

Merging #949 (45f7116) into 2.x (0699baa) will decrease coverage by 32.44%.
The diff coverage is n/a.

@@              Coverage Diff              @@
##                2.x     #949       +/-   ##
=============================================
- Coverage     95.21%   62.76%   -32.45%     
=============================================
  Files           313       10      -303     
  Lines          8441      658     -7783     
  Branches        620      119      -501     
=============================================
- Hits           8037      413     -7624     
+ Misses          350      192      -158     
+ Partials         54       53        -1     

Flag	Coverage Δ
query-workbench	62.76% <ø> (ø)
sql-engine	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
...rg/opensearch/sql/analysis/ExpressionAnalyzer.java
...c/main/java/org/opensearch/sql/expression/DSL.java
...sql/expression/aggregation/AggregatorFunction.java
...h/sql/expression/function/BuiltinFunctionName.java
...nsearch/data/value/OpenSearchExprValueFactory.java
...ript/aggregation/dsl/MetricAggregationBuilder.java
...pensearch/sql/ppl/parser/AstExpressionBuilder.java
...search/sql/planner/optimizer/pattern/Patterns.java
...ript/aggregation/dsl/BucketAggregationBuilder.java
...ensearch/sql/ppl/utils/PPLQueryDataAnonymizer.java
... and 293 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[Yury-Fridlyand]

Currently take only supports text fields

Do you have a test for non-text fields?
A test on field which doesn't exit?

[joshuali925]

Currently take only supports text fields

Do you have a test for non-text fields? A test on field which doesn't exit?

That should be responsibilities of function resolver and expression analyzer? i didn't modify those logic, i think UT already covers those. If it happens error will say

take function expected {[STRING,INTEGER]}, but get [LONG,INTEGER]

or

can't resolve Symbol(namespace=FIELD_NAME, name=nonexist) in type env

[vamsi-amazon]

Would you consider adding more examples with groupBy, size and may be patterns if possible?
or add a complex Example which covers all.
will you be including ITs in this PR or other PR?

[joshuali925]

will add one with groupBy and ITs. I don't know if we should put patterns here since this is the stats doc

[joshuali925]

added example 10 https://github.com/opensearch-project/sql/blob/2ad0f5eab9609cc6ced106a06ce7303ac396d425/docs/user/ppl/cmd/stats.rst#example-10-calculate-the-count-and-get-email-list-by-a-gender-and-span

[vamsi-amazon]

When we push down to OS, what is the default sort applied? Will it be consistent with our in-memory implementation?

[joshuali925]

When we push down to OS, what is the default sort applied? Will it be consistent with our in-memory implementation?

take command doesn't guarantee on order