OpenSearch/x-pack/plugin/eql/qa/common
Costin Leau 9cc80621c3 EQL: Fix matching of tail/desc queries (#59827)
When dealing with tail queries, data is returned descending for the base
criterion yet the rest of the queries are ascending. This caused a
problem during insertion since while in a page, the data is ASC, between
pages the blocks of data is DESC.
This caused incorrectly sorting inside a SequenceGroup which led to
incorrect results.

Further more in case of limit, since the data in a page is ASC, early
return is not possible neither is desc matching. Thus the page needs to
be consumed first before finding the final results.
A future improvement could be to keep only the top N results dropping
the rest during insertion time.

(cherry picked from commit 77c88da054a1ce662a264f72cde5986d4ce37e3a)
2020-07-19 00:49:16 +03:00
..
licenses EQL: EqlActionIT improvements (#53780) (#53888) 2020-03-20 17:28:15 -04:00
src/main EQL: Fix matching of tail/desc queries (#59827) 2020-07-19 00:49:16 +03:00
build.gradle Replace compile configuration usage with api (7.x backport) (#58721) 2020-06-30 15:57:41 +02:00