[FEATURE] Cloudwatch-style `like` operator

[Swiddis]

Is your feature request related to a problem?
I quite like how Cloudwatch's log insights QL lets us easily search string fields with an inline like:

| filter @message like 'keyword'

What solution would you like?
I'd like if we supported cloudwatch-style inline like statements in where clauses.

What alternatives have you considered?
PPL already has a LIKE function:

where LIKE(message, '%keyword%')

I just find the syntax more cumbersome than the alternative.

Do you have any additional context?
N/A

[anasalkouz]

What is the suggested PPL syntax?

[ThyTran1402]

Hi @Swiddis

I can take a look and work on this issue.

[Swiddis]

What is the suggested PPL syntax?

Like CloudWatch's, just we use where instead of filter. Full docs at CWL's filter command docs. (They also use regex, but I consider that out of scope, it adds complexity & the regex command is already good-enough for this imo. String-contains searches are much more common.)

| where message like 'keyword'

If we want to be innovative we could have inline-like take patterns and have a separate inline-contains (or python-style string-in?)

| where message like '%keyword%'
| where message contains 'keyword'
| where 'keyword' in message

That'd be nice as well, and arguably easier to read at a glance if you don't know CWL. Up to @ThyTran1402's taste.

@ThyTran1402 it's yours, have fun -- let me know here or on the OpenSearch slack if you need help with anything.

[ThyTran1402]

Hi @Swiddis

Thank you for your guidance 💯 . Before I start working on the implementation, I wonder why do we need to have inline-like and inline-contains?

I think the current codebase already has where message like '%keyword%' as you mentioned above. This is also map to ilike for case insensitive. What we're missing is a contains operator that the substring match without requiring % wildcards, similar to CloudWatch behavior. That's easier for the users to read right?

Let me know what your thoughts on this.

[Swiddis]

Yeah it's not a case of "need," it's just a nice-to-have thing. I didn't actually realize we had an inline like supporting %s (I was just trying message like 'keyword' and getting no results, turns out patterns work). contains would be a nice way to get cloudwatch-like functionality without breaking the existing inline like operator.