AWS opensearch-service documentation change
Summary
Updated support status for multiple PPL commands/functions in CloudWatch Logs Insights, changing several from 'Not supported' to 'Supported'
Security assessment
Changes reflect feature availability updates for query capabilities. No security vulnerabilities or security-specific enhancements are mentioned in the diff.
Diff
diff --git a/opensearch-service/latest/developerguide/supported-ppl.md b/opensearch-service/latest/developerguide/supported-ppl.md index 17a6cb32d..72945944b 100644 --- a//opensearch-service/latest/developerguide/supported-ppl.md +++ b//opensearch-service/latest/developerguide/supported-ppl.md @@ -116 +116 @@ dedup command | Removes duplicate entries based on the fields that you specify -join command | Joins two datasets together. | Not supported | Supported | Supported | +join command | Joins two datasets together. | Supported | Supported | Supported | @@ -132 +132 @@ lookup command | Enriches your search data by adding or replacing data from a l -subquery command | Performs complex, nested queries within your Piped Processing Language (PPL) statements. | Not supported | Supported | Supported | +subquery command | Performs complex, nested queries within your Piped Processing Language (PPL) statements. | Supported | Supported | Supported | @@ -160 +160 @@ eventstats command | Enriches your event data with calculated summary statistics -flatten command | Flattens a field, The field must be of this type: `struct<?,?> or array<struct<?,?>>` | Not supported | Supported | Supported | +flatten command | Flattens a field, The field must be of this type: `struct<?,?> or array<struct<?,?>>` | Supported | Supported | Supported | @@ -171 +171 @@ field summary | Calculates basic statistics for each field (count, distinct coun -fillnull command | Fills null fields with the value that you provide. It can be used in one or more fields. | Not supported | Supported | Supported | +fillnull command | Fills null fields with the value that you provide. It can be used in one or more fields. | Supported | Supported | Supported | @@ -178 +178 @@ fillnull command | Fills null fields with the value that you provide. It can be -expand command | Breaks down a field containing multiple values into separate rows, creating a new row for each value in the specified field. | Not supported | Supported | Supported | +expand command | Breaks down a field containing multiple values into separate rows, creating a new row for each value in the specified field. | Supported | Supported | Supported | @@ -224 +224 @@ PPL expressions (Arithmetic operators (`+`, `-`, `*`), Predicate operators (`>. -PPL IP address functions (`CIDRMATCH`) | Built-in functions for handling IP addresses such as CIDR. | Not supported | Supported | Supported | +PPL IP address functions (`CIDRMATCH`) | Built-in functions for handling IP addresses such as CIDR. | Supported | Supported | Supported | @@ -230 +230 @@ PPL IP address functions (`CIDRMATCH`) | Built-in functions for handling IP add -PPL JSON functions (`ARRAY_LENGTH`, `ARRAY_LENGTH`, `JSON`, `JSON_ARRAY`, `JSON_EXTRACT`, `JSON_KEYS`, `JSON_OBJECT`, `JSON_VALID`, `TO_JSON_STRING`) | Built-in functions for handling JSON including arrays, extracting, and validation. | Not supported | Supported | Supported | +PPL JSON functions (`ARRAY_LENGTH`, `ARRAY_LENGTH`, `JSON`, `JSON_ARRAY`, `JSON_EXTRACT`, `JSON_KEYS`, `JSON_OBJECT`, `JSON_VALID`, `TO_JSON_STRING`) | Built-in functions for handling JSON including arrays, extracting, and validation. | Supported | Supported | Supported | @@ -250 +250 @@ PPL cryptographic hash functions (`MD5`, `SHA1`, `SHA2`) | Built-in functions t -Although CloudWatch Logs Insights supports most OpenSearch PPL commands and functions, some commands and functions aren't currently supported. For example, it doesn't currently support JOIN, Lookup, or sub-queries in PPL. For a complete list of supported query commands and functions, see the Amazon CloudWatch Logs columns in the above tables. +Although CloudWatch Logs Insights supports most OpenSearch PPL commands and functions, some commands and functions aren't currently supported. For example, it doesn't currently support Lookup commands in PPL. As of June 2, 2025, CloudWatch Logs Insights now supports JOIN, subqueries, Flatten, Fillnull, Expand, Cidrmatch, and JSON functions in PPL. For a complete list of supported query commands and functions, see the Amazon CloudWatch Logs columns in the above tables.