Open
Description
Description
Right now named params in ES|QL support only one value. So if you want to support somehow multivalues in named params you can't.
You can have atm something like
WHERE field IN (?param1, ?param2)
but you can't have something like
WHERE field IN (?param)
where ?param takes comma separated values.
In a more real example, we would like at kibana to use named params in a query like this
FROM logst* | WHERE extension.keyword IN ("css", "jpg")
We want the user here to be able to send the "css", "jpg" in one named param. This will enable multivalues support at kibana ES|QL controls
Other use cases
Other cases would be a multifields support in the STATS ... BY where you can have something like
.... BY ?breakdown
and the user gives multiple fields, comma separated
The same for KEEP and DROP
Also I want to do
FROM ?sources
and the sources to be a comma separated list of index patterns