Skip to content

Update PPL examples to use otel sample data#12199

Open
ritvibhatt wants to merge 9 commits intoopensearch-project:mainfrom
ritvibhatt:update-ppl-examples
Open

Update PPL examples to use otel sample data#12199
ritvibhatt wants to merge 9 commits intoopensearch-project:mainfrom
ritvibhatt:update-ppl-examples

Conversation

@ritvibhatt
Copy link
Copy Markdown
Contributor

@ritvibhatt ritvibhatt commented Apr 6, 2026

Description

  • Updates the PPL command documentation examples to use otel data instead of accounts/bank data

  • Adds try in playground button for PPL examples and link to observability playground website with example queries

Screenshot 2026-04-08 at 11 29 39 AM

Issues Resolved

Closes #[Replace this text, including the brackets, with the issue number. Leave "Closes #" so the issue is closed properly.]

Version

3.6.0+

Frontend features

If you're submitting documentation for an OpenSearch Dashboards feature, add a video that shows how a user will interact with the UI step by step. A voiceover is optional.

Checklist

  • By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
    For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Ritvi Bhatt <ribhatt@amazon.com>
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 6, 2026

Thank you for submitting your PR. The PR states are In progress (or Draft) -> Tech review -> Doc review -> Merged.

Before you submit your PR for doc review, make sure the content is technically accurate. If you need help finding a tech reviewer, tag a maintainer.

When you're ready for doc review, tag the assignee of this PR. The doc reviewer may push edits to the PR directly or leave comments and editorial suggestions for you to address (let us know in a comment if you have a preference).

@kolchfa-aws kolchfa-aws added the In progress Issue/PR: The issue or PR is in progress. label Apr 6, 2026
Signed-off-by: Ritvi Bhatt <ribhatt@amazon.com>
Signed-off-by: Ritvi Bhatt <ribhatt@amazon.com>
Signed-off-by: Ritvi Bhatt <ribhatt@amazon.com>
Signed-off-by: Ritvi Bhatt <ribhatt@amazon.com>
@ritvibhatt ritvibhatt marked this pull request as ready for review April 8, 2026 18:31
@kolchfa-aws kolchfa-aws added Tech review PR: Tech review in progress backport 3.6 and removed In progress Issue/PR: The issue or PR is in progress. labels Apr 9, 2026
{% include copy.html %}
{% include try-in-playground.html %}

The query returns the following results:
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ERR?R wildcard example: "The query returns the following results:" with no results table.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated query to use quotes around the wildcard phrase so there is an output table now


```
{% include copy.html %}
Parentheses > NOT > OR > AND
Copy link
Copy Markdown

@mengweieric mengweieric Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The prose says "AND binds tighter than OR" but the precedence list reads Parentheses > NOT > OR > AND. One of them is wrong. Also, query_string docs state that conventional Boolean operators don't follow precedence rules and require explicit parentheses — worth clarifying which behavior applies here.

Formatting: {% include copy.html %} is inside the fenced code block (unlike every other example on the page).

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for catching this! The prose was incorrect, OR > AND is correct so updated to match the precedence list. Also removed the copy button as it should not have been added there

source=otellogs
| rex field=body "response_time=(?<duration>\d+ms)"
| convert auto(duration)
| where NOT ISNULL(duration)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Examples 1–3 are incomplete:

  • Example 1 (this line): "The query returns the following results:" with no output table.
  • Example 2 (line 71): Same — no results table.
  • Example 3 (line 73): Only a heading with no content before Example 4.

Examples 4–8 have proper tables, so this looks like an incomplete edit.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated to change queries to get results and added example 3 back in thanks!

Signed-off-by: Ritvi Bhatt <ribhatt@amazon.com>
Signed-off-by: Ritvi Bhatt <ribhatt@amazon.com>
Signed-off-by: Ritvi Bhatt <ribhatt@amazon.com>
Copy link
Copy Markdown

@RyanL1997 RyanL1997 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @ritvibhatt , thanks for the change. I took a look of rex, regex, and where and I think it looks good to me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport 3.6 Tech review PR: Tech review in progress

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants