Open
Description
ESQL's case is lazy and so quite slow. We run it eagerly in a few cases, but not enough. I've encountered a query like:
FROM foo
| EVAL action = CASE(
a IN ("a", "b", "c"), "a",
a == "d", "d"
)
| WHERE action == "d"
Where we do not optimize the CASE statement here. There are two "obvious" optimizations for this:
- Run CASE in non-lazy mode - maybe even a
switch
style mode. - Push the filter
a == "d"
into the index transitively.