From bf9b0a10a6a8adf3b8c135f4ba356dc50d050693 Mon Sep 17 00:00:00 2001
From: Abdon Pijpelink <abdon.pijpelink@elastic.co>
Date: Tue, 2 May 2023 10:43:19 +0200
Subject: [PATCH 1/3] Add LIKE and RLIKE operators

---
 .../esql_documentation_sections.tsx           | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx b/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx
index a3984d37814c5..5eabd3a91d094 100644
--- a/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx
+++ b/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx
@@ -482,6 +482,26 @@ These comparison operators are supported:
   * larger than: \`>\`
   * larger than or equal: \`>=\`
 
+For string comparison using wildcards or regular expressions, use \`LIKE\` or \`RLIKE\`:
+
+* Use \`LIKE\` to match strings using wildcards. The following wildcard characters are supported:
+  * \`*\` matches zero or more characters. 
+  * \`?\` matches one character. 
+
+  \`\`\`
+  FROM employees 
+  | WHERE first_name LIKE "?b*" 
+  | PROJECT first_name, last_name
+  \`\`\`
+
+* Use \`RLIKE\` to match strings using regular expressions:
+
+  \`\`\`
+  FROM employees 
+  | WHERE first_name RLIKE ".leja.*" 
+  | PROJECT first_name, last_name
+  \`\`\`
+
 You can use the following boolean operators:
 
 * \`AND\`

From a60fbc11aee275277a4e6d6a5240778fbf44befb Mon Sep 17 00:00:00 2001
From: Abdon Pijpelink <abdon.pijpelink@elastic.co>
Date: Tue, 2 May 2023 11:39:44 +0200
Subject: [PATCH 2/3] Add CASE, CIDR_MATCH, IS_FINITE, IS_INFINITE, IS_NAN, and
 POW functions

---
 .../esql_documentation_sections.tsx           | 172 +++++++++++++++++-
 1 file changed, 170 insertions(+), 2 deletions(-)

diff --git a/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx b/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx
index 5eabd3a91d094..b42666637daca 100644
--- a/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx
+++ b/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx
@@ -557,6 +557,66 @@ Returns the absolute value.
 FROM employees
 | PROJECT first_name, last_name, height
 | EVAL abs_height = ABS(0.0 - height)
+\`\`\`
+              `,
+              description:
+                'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)',
+            }
+          )}
+        />
+      ),
+    },
+    {
+      label: i18n.translate(
+        'unifiedSearch.query.textBasedLanguagesEditor.documentationESQL.caseFunction',
+        {
+          defaultMessage: 'CASE',
+        }
+      ),
+      description: (
+        <Markdown
+          markdown={i18n.translate(
+            'unifiedSearch.query.textBasedLanguagesEditor.documentationESQL.caseFunction.markdown',
+            {
+              defaultMessage: `### CASE
+Accepts pairs of conditions and values. The function returns the value that belongs to the first condition that evaluates to \`true\`. If the number of arguments is odd, the last argument is the default value which is returned when no condition matches.
+
+\`\`\`
+FROM employees
+| EVAL type = CASE(
+    languages <= 1, "monolingual",
+    languages <= 2, "bilingual",
+     "polyglot")
+| PROJECT first_name, last_name, type
+\`\`\`
+              `,
+              description:
+                'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)',
+            }
+          )}
+        />
+      ),
+    },
+    {
+      label: i18n.translate(
+        'unifiedSearch.query.textBasedLanguagesEditor.documentationESQL.cidrMatchFunction',
+        {
+          defaultMessage: 'CIDR_MATCH',
+        }
+      ),
+      description: (
+        <Markdown
+          markdown={i18n.translate(
+            'unifiedSearch.query.textBasedLanguagesEditor.documentationESQL.cidrMatchFunction.markdown',
+            {
+              defaultMessage: `### CIDR_MATCH
+Returns \`true\` if the provided IP is contained in one of the provided CIDR blocks. 
+
+\`CIDR_MATCH\` accepts two or more arguments. The first argument is the IP address of type \`ip\` (both IPv4 and IPv6 are supported). Subsequent arguments are the CIDR blocks to test the IP against.
+
+\`\`\`
+FROM hosts
+| WHERE CIDR_MATCH(ip, "127.0.0.2/32", "127.0.0.3/32")
 \`\`\`
               `,
               description:
@@ -668,6 +728,87 @@ Timespan literals are not whitespace sensitive. These expressions are all valid:
         />
       ),
     },
+    {
+      label: i18n.translate(
+        'unifiedSearch.query.textBasedLanguagesEditor.documentationESQL.isFiniteFunction',
+        {
+          defaultMessage: 'IS_FINITE',
+        }
+      ),
+      description: (
+        <Markdown
+          markdown={i18n.translate(
+            'unifiedSearch.query.textBasedLanguagesEditor.documentationESQL.isFiniteFunction.markdown',
+            {
+              defaultMessage: `### IS_FINITE
+Returns a boolean that indicates whether its input is a finite number.
+
+\`\`\`
+ROW d = 1.0 
+| EVAL s = IS_FINITE(d/0)
+\`\`\`
+              `,
+              description:
+                'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)',
+            }
+          )}
+        />
+      ),
+    },
+    {
+      label: i18n.translate(
+        'unifiedSearch.query.textBasedLanguagesEditor.documentationESQL.isInfiniteFunction',
+        {
+          defaultMessage: 'IS_INFINITE',
+        }
+      ),
+      description: (
+        <Markdown
+          markdown={i18n.translate(
+            'unifiedSearch.query.textBasedLanguagesEditor.documentationESQL.isInfiniteFunction.markdown',
+            {
+              defaultMessage: `### IS_INFINITE
+Returns a boolean that indicates whether its input is infinite.
+
+\`\`\`
+ROW d = 1.0 
+| EVAL s = IS_INFINITE(d/0)
+\`\`\`
+              `,
+              description:
+                'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)',
+            }
+          )}
+        />
+      ),
+    },
+    {
+      label: i18n.translate(
+        'unifiedSearch.query.textBasedLanguagesEditor.documentation.isNanFunction',
+        {
+          defaultMessage: 'IS_NAN',
+        }
+      ),
+      description: (
+        <Markdown
+          markdown={i18n.translate(
+            'unifiedSearch.query.textBasedLanguagesEditor.documentation.isNanFunction.markdown',
+            {
+              defaultMessage: `### IS_NAN
+Returns a boolean that indicates whether its input is not a number.
+
+\`\`\`
+ROW d = 1.0 
+| EVAL s = IS_NAN(d)
+\`\`\`
+              `,
+              description:
+                'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)',
+            }
+          )}
+        />
+      ),
+    },
     {
       label: i18n.translate(
         'unifiedSearch.query.textBasedLanguagesEditor.documentation.isNullFunction',
@@ -685,14 +826,41 @@ Returns a boolean than indicates whether its input is \`null\`.
 
 \`\`\`
 FROM employees
-| WHERE is_null(first_name)
+| WHERE IS_NULL(first_name)
 \`\`\`
 
 Combine this function with \`NOT\` to filter out any \`null\` data:
 
 \`\`\`
 FROM employees
-| WHERE NOT is_null(first_name)
+| WHERE NOT IS_NULL(first_name)
+\`\`\`
+              `,
+              description:
+                'Text is in markdown. Do not translate function names, special characters, or field names like sum(bytes)',
+            }
+          )}
+        />
+      ),
+    },
+    {
+      label: i18n.translate(
+        'unifiedSearch.query.textBasedLanguagesEditor.documentation.powFunction',
+        {
+          defaultMessage: 'POW',
+        }
+      ),
+      description: (
+        <Markdown
+          markdown={i18n.translate(
+            'unifiedSearch.query.textBasedLanguagesEditor.documentation.powFunction.markdown',
+            {
+              defaultMessage: `### POW
+Returns the the value of a base (first argument) raised to a power (second argument).
+
+\`\`\`
+ROW base = 2.0, exponent = 2.0 
+| EVAL s = POW(base, exponent)
 \`\`\`
               `,
               description:

From 4a09e070e20dd3008f1947b802bacace4b35f465 Mon Sep 17 00:00:00 2001
From: Abdon Pijpelink <abdon.pijpelink@elastic.co>
Date: Tue, 2 May 2023 11:40:59 +0200
Subject: [PATCH 3/3] Link to regex documentation for RLIKE operator

---
 .../text_based_languages_editor/esql_documentation_sections.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx b/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx
index b42666637daca..783d1bcc9002d 100644
--- a/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx
+++ b/src/plugins/unified_search/public/query_string_input/text_based_languages_editor/esql_documentation_sections.tsx
@@ -494,7 +494,7 @@ For string comparison using wildcards or regular expressions, use \`LIKE\` or \`
   | PROJECT first_name, last_name
   \`\`\`
 
-* Use \`RLIKE\` to match strings using regular expressions:
+* Use \`RLIKE\` to match strings using [regular expressions](https://www.elastic.co/guide/en/elasticsearch/reference/current/regexp-syntax.html):
 
   \`\`\`
   FROM employees