ESQL: some more test for FROM

[alex-spies]

• Let's add some yaml/csv tests that demonstrate how FROM behaves with wildcards. Esp., when an index is missing, when is a FROM query still correct? E.g. if there's an index index1 but no index2, then FROM index* is correct, FROM index1 as well, FROM index1, index2* probably as well, but FROM index1, index2 as well as FROM index2* probably are not.
• While we're at it, let's make the examples in from.asciidoc use actual csv tests instead of being just written text; this way we'll be sure they are and remain valid.

[elasticsearchmachine]

Pinging @elastic/es-analytical-engine (Team:Analytics)

[alex-spies]

Related: #104987

[calamont]

I'm going to have a crack at this. I'm keen to help out with the code base :)

[calamont]

@alex-spies is it actually correct/expected that a wild card pattern for a nonexistent index prefix won't throw an error?

Using your examples, if only index1 exists, ES will throw an error for FROM index1, index2. Testing locally it won't throw an error for FROM index1, index2*. But, given index2 isn't a valid prefix, why doesn't ES throw an error for this situation as well?

Is this behaviour explicitly documented anywhere? All I could find was this doc page, which doesn't describe behaviour for querying missing indices.

[alex-spies]

Thanks a lot @calamont !

Testing locally it won't throw an error for FROM index1, index2*

This is indeed intended. The rationale being that if you ask for a specific index, you probably really wanted it, but for an index pattern, it's okay if it doesn't match anything. This behavior is (mostly) consistent with _search, where you can ask for index1,index2*/_search and it's okay that index2* doesn't match anything. _search is even fine with a single pattern not matching any index at all, which ES|QL considers invalid, however, because we need at least 1 index to determine if the rest of the query makes sense.

I agree that we should document this. Since we'll be making changes to the docs anyway (to link actual examples from the csv tests), I think we can also add a note to the doc page you linked.

[jonny5203]

Hi @calamont, are you still working on this? Else I would really love to take over or collaborate with you

[calamont]

I foolishly picked this up the week before I started a new job and moved apartment 😞 Things are getting quiet(er) now but I probably won't get back to this for another few weeks. So if you want to take it, go ahead @jonny5203 :)