OpenSearch/x-pack/plugin/eql
Costin Leau 9cc80621c3 EQL: Fix matching of tail/desc queries (#59827)
When dealing with tail queries, data is returned descending for the base
criterion yet the rest of the queries are ascending. This caused a
problem during insertion since while in a page, the data is ASC, between
pages the blocks of data is DESC.
This caused incorrectly sorting inside a SequenceGroup which led to
incorrect results.

Further more in case of limit, since the data in a page is ASC, early
return is not possible neither is desc matching. Thus the page needs to
be consumed first before finding the final results.
A future improvement could be to keep only the top N results dropping
the rest during insertion time.

(cherry picked from commit 77c88da054a1ce662a264f72cde5986d4ce37e3a)
2020-07-19 00:49:16 +03:00
..
qa EQL: Fix matching of tail/desc queries (#59827) 2020-07-19 00:49:16 +03:00
src EQL: Fix matching of tail/desc queries (#59827) 2020-07-19 00:49:16 +03:00
build.gradle EQL: Prepare for release (#59331) (#59426) 2020-07-13 11:54:32 -04:00