Merge branch 'master' into feature/searchable-snapshots

Author: tlrx

CONTRIBUTING.md

@@ -166,6 +166,22 @@ Some tests related to locale testing also require the flag
 IntelliJ or Eclipse like describe above to use
 `-Djava.locale.providers=SPI,COMPAT`.
 
+### REST Endpoint Conventions
+
+Elasticsearch typically uses singular nouns rather than plurals in URLs.
+For example:
+
+    /_ingest/pipline
+    /_ingest/pipline/{id}
+
+but not:
+
+    /_ingest/piplines
+    /_ingest/piplines/{id}
+
+You may find counterexamples, but new endpoints should use the singular
+form.
+
 ### Java Language Formatting Guidelines
 
 Java files in the Elasticsearch codebase are formatted with the Eclipse JDT

client/rest-high-level/src/main/java/org/elasticsearch/client/eql/EqlSearchRequest.java

@@ -36,32 +36,32 @@ public class EqlSearchRequest implements Validatable, ToXContentObject {
     private String[] indices;
     private IndicesOptions indicesOptions = IndicesOptions.fromOptions(false, false, true, false);
 
-    private QueryBuilder query = null;
-    private String timestampField = "@timestamp";
+    private QueryBuilder filter = null;
+    private String timestampField = "timestamp";
     private String eventTypeField = "event_type";
     private String implicitJoinKeyField = "agent.id";
     private int fetchSize = 50;
     private SearchAfterBuilder searchAfterBuilder;
-    private String rule;
+    private String query;
 
-    static final String KEY_QUERY = "query";
+    static final String KEY_FILTER = "filter";
     static final String KEY_TIMESTAMP_FIELD = "timestamp_field";
     static final String KEY_EVENT_TYPE_FIELD = "event_type_field";
     static final String KEY_IMPLICIT_JOIN_KEY_FIELD = "implicit_join_key_field";
     static final String KEY_SIZE = "size";
     static final String KEY_SEARCH_AFTER = "search_after";
-    static final String KEY_RULE = "rule";
+    static final String KEY_QUERY = "query";
 
-    public EqlSearchRequest(String indices, String rule) {
+    public EqlSearchRequest(String indices, String query) {
         indices(indices);
-        rule(rule);
+        query(query);
     }
 
     @Override
     public XContentBuilder toXContent(XContentBuilder builder, ToXContent.Params params) throws IOException {
         builder.startObject();
-        if (query != null) {
-            builder.field(KEY_QUERY, query);
+        if (filter != null) {
+            builder.field(KEY_FILTER, filter);
         }
         builder.field(KEY_TIMESTAMP_FIELD, timestampField());
         builder.field(KEY_EVENT_TYPE_FIELD, eventTypeField());
@@ -74,7 +74,7 @@ public XContentBuilder toXContent(XContentBuilder builder, ToXContent.Params par
             builder.array(KEY_SEARCH_AFTER, searchAfterBuilder.getSortValues());
         }
 
-        builder.field(KEY_RULE, rule);
+        builder.field(KEY_QUERY, query);
         builder.endObject();
         return builder;
     }
@@ -88,12 +88,12 @@ public EqlSearchRequest indices(String... indices) {
         return this;
     }
 
-    public QueryBuilder query() {
-        return this.query;
+    public QueryBuilder filter() {
+        return this.filter;
     }
 
-    public EqlSearchRequest query(QueryBuilder query) {
-        this.query = query;
+    public EqlSearchRequest filter(QueryBuilder filter) {
+        this.filter = filter;
         return this;
     }
 
@@ -156,13 +156,13 @@ private EqlSearchRequest setSearchAfter(SearchAfterBuilder builder) {
         return this;
     }
 
-    public String rule() {
-        return this.rule;
+    public String query() {
+        return this.query;
     }
 
-    public EqlSearchRequest rule(String rule) {
-        Objects.requireNonNull(rule, "rule must not be null");
-        this.rule = rule;
+    public EqlSearchRequest query(String query) {
+        Objects.requireNonNull(query, "query must not be null");
+        this.query = query;
         return this;
     }
 
@@ -175,30 +175,29 @@ public boolean equals(Object o) {
             return false;
         }
         EqlSearchRequest that = (EqlSearchRequest) o;
-        return
-            fetchSize == that.fetchSize &&
+        return fetchSize == that.fetchSize &&
                 Arrays.equals(indices, that.indices) &&
                 Objects.equals(indicesOptions, that.indicesOptions) &&
-                Objects.equals(query, that.query) &&
+                Objects.equals(filter, that.filter) &&
                 Objects.equals(timestampField, that.timestampField) &&
                 Objects.equals(eventTypeField, that.eventTypeField) &&
                 Objects.equals(implicitJoinKeyField, that.implicitJoinKeyField) &&
                 Objects.equals(searchAfterBuilder, that.searchAfterBuilder) &&
-                Objects.equals(rule, that.rule);
+                Objects.equals(query, that.query);
     }
 
     @Override
     public int hashCode() {
         return Objects.hash(
             Arrays.hashCode(indices),
             indicesOptions,
-            query,
+            filter,
             fetchSize,
             timestampField,
             eventTypeField,
             implicitJoinKeyField,
             searchAfterBuilder,
-            rule);
+            query);
     }
 
     public String[] indices() {

client/rest-high-level/src/test/java/org/elasticsearch/client/EqlIT.java

@@ -79,6 +79,7 @@ public void testLargeMapping() throws Exception {
             sb.append(",");
         }
         sb.append("\"event_type\": \"process\",");
+        sb.append("\"timestamp\": \"2020-02-03T12:34:56Z\",");
         sb.append("\"serial_event_id\": 1");
         sb.append("}");
         doc1.setJsonEntity(sb.toString());

client/rest-high-level/src/test/java/org/elasticsearch/client/eql/EqlSearchRequestTests.java

@@ -46,7 +46,7 @@ protected EqlSearchRequest createClientTestInstance() {
             EqlSearchRequest.eventTypeField(randomAlphaOfLength(10));
         }
         if (randomBoolean()) {
-            EqlSearchRequest.rule(randomAlphaOfLength(10));
+            EqlSearchRequest.query(randomAlphaOfLength(10));
         }
         if (randomBoolean()) {
             EqlSearchRequest.timestampField(randomAlphaOfLength(10));
@@ -56,9 +56,9 @@ protected EqlSearchRequest createClientTestInstance() {
         }
         if (randomBoolean()) {
             if (randomBoolean()) {
-                EqlSearchRequest.query(QueryBuilders.matchAllQuery());
+                EqlSearchRequest.filter(QueryBuilders.matchAllQuery());
             } else {
-                EqlSearchRequest.query(QueryBuilders.termQuery(randomAlphaOfLength(10), randomInt(100)));
+                EqlSearchRequest.filter(QueryBuilders.termQuery(randomAlphaOfLength(10), randomInt(100)));
             }
         }
         return EqlSearchRequest;
@@ -75,8 +75,8 @@ protected void assertInstances(org.elasticsearch.xpack.eql.action.EqlSearchReque
         assertThat(serverInstance.eventTypeField(), equalTo(clientTestInstance.eventTypeField()));
         assertThat(serverInstance.implicitJoinKeyField(), equalTo(clientTestInstance.implicitJoinKeyField()));
         assertThat(serverInstance.timestampField(), equalTo(clientTestInstance.timestampField()));
+        assertThat(serverInstance.filter(), equalTo(clientTestInstance.filter()));
         assertThat(serverInstance.query(), equalTo(clientTestInstance.query()));
-        assertThat(serverInstance.rule(), equalTo(clientTestInstance.rule()));
         assertThat(serverInstance.searchAfter(), equalTo(clientTestInstance.searchAfter()));
         assertThat(serverInstance.indicesOptions(), equalTo(clientTestInstance.indicesOptions()));
         assertThat(serverInstance.indices(), equalTo(clientTestInstance.indices()));

distribution/src/bin/elasticsearch-service.bat

@@ -123,7 +123,7 @@ rem   - fourth, ergonomic JVM options are applied
 if not "%ES_JAVA_OPTS%" == "" set ES_JAVA_OPTS=%ES_JAVA_OPTS: =;%
 
 @setlocal
-for /F "usebackq delims=" %%a in (`"%JAVA% -cp "!ES_CLASSPATH!" "org.elasticsearch.tools.launchers.JvmOptionsParser" "!ES_PATH_CONF!" || echo jvm_options_parser_failed"`) do set ES_JAVA_OPTS=%%a
+for /F "usebackq delims=" %%a in (`CALL %JAVA% -cp "!ES_CLASSPATH!" "org.elasticsearch.tools.launchers.JvmOptionsParser" "!ES_PATH_CONF!" ^|^| echo jvm_options_parser_failed`) do set ES_JAVA_OPTS=%%a
 @endlocal & set "MAYBE_JVM_OPTIONS_PARSER_FAILED=%ES_JAVA_OPTS%" & set ES_JAVA_OPTS=%ES_JAVA_OPTS%
 
 if "%MAYBE_JVM_OPTIONS_PARSER_FAILED%" == "jvm_options_parser_failed" (

docs/reference/analysis/index-search-time.asciidoc

@@ -67,7 +67,7 @@ analyzer produces the following tokens:
 [ quick, fox ]
 ------
 
-To execute the serach, {es} compares these query string tokens to the tokens
+To execute the search, {es} compares these query string tokens to the tokens
 indexed in the `text` field.
 
 [options="header"]

docs/reference/analysis/tokenfilters/trim-tokenfilter.asciidoc

@@ -4,4 +4,107 @@
 <titleabbrev>Trim</titleabbrev>
 ++++
 
-The `trim` token filter trims the whitespace surrounding a token.
+Removes leading and trailing whitespace from each token in a stream.
+
+The `trim` filter uses Lucene's
+https://lucene.apache.org/core/{lucene_version_path}/analyzers-common/org/apache/lucene/analysis/miscellaneous/TrimFilter.html[TrimFilter].
+
+[TIP]
+====
+Many commonly used tokenizers, such as the
+<<analysis-standard-tokenizer,`standard`>> or
+<<analysis-whitespace-tokenizer,`whitespace`>> tokenizer, remove whitespace by
+default. When using these tokenizers, you don't need to add a separate `trim`
+filter.
+====
+
+[[analysis-trim-tokenfilter-analyze-ex]]
+==== Example
+
+To see how the `trim` filter works, you first need to produce a token
+containing whitespace.
+
+The following <<indices-analyze,analyze API>> request uses the
+<<analysis-keyword-tokenizer,`keyword`>> tokenizer to produce a token for 
+`" fox "`.
+
+[source,console]
+----
+GET _analyze
+{
+  "tokenizer" : "keyword",
+  "text" : " fox "
+}
+----
+
+The API returns the following response. Note the `" fox "` token contains
+the original text's whitespace.
+
+[source,console-result]
+----
+{
+  "tokens": [
+    {
+      "token": " fox ",
+      "start_offset": 0,
+      "end_offset": 5,
+      "type": "word",
+      "position": 0
+    }
+  ]
+}
+----
+
+To remove the whitespace, add the `trim` filter to the previous analyze API
+request.
+
+[source,console]
+----
+GET _analyze
+{
+  "tokenizer" : "keyword",
+  "filter" : ["trim"],
+  "text" : " fox "
+}
+----
+
+The API returns the following response. The returned `fox` token does not
+include any leading or trailing whitespace.
+
+[source,console-result]
+----
+{
+  "tokens": [
+    {
+      "token": "fox",
+      "start_offset": 0,
+      "end_offset": 5,
+      "type": "word",
+      "position": 0
+    }
+  ]
+}
+----
+
+[[analysis-trim-tokenfilter-analyzer-ex]]
+==== Add to an analyzer
+
+The following <<indices-create-index,create index API>> request uses the `trim`
+filter to configure a new <<analysis-custom-analyzer,custom analyzer>>.
+
+[source,console]
+----
+PUT trim_example
+{
+  "settings": {
+    "analysis": {
+      "analyzer": {
+        "keyword_trim": {
+          "tokenizer": "keyword",
+          "filter": [ "trim" ]
+        }
+      }
+    }
+  }
+}
+----