Description

Currently, ES|QL supports positional parameters, which allows the query author to inject variables into the query. This is useful for dashboards, where there are often global parameters, like a time range filter, or a KQL string. However, there's no way to use positional parameters for this, as the dashboard doesn't know with what intent the queries were written.

Named parameters can solve this:

FROM traces-apm*
	| WHERE @timestamp >= ${earliest} AND @timestamp < ${latest}
	| EVAL date_bucket = DATE_TRUNC(${bucketSize}, @timestamp)
	| STATS AVG(transaction.duration.us) BY ${groupingField}

One issue here is that in some cases the variable might be null. Consider groupingField being optional. If it were empty, it would lead to a syntactically invalid query:

FROM traces-apm*
	| WHERE @timestamp >= NOW()-24 hours AND @timestamp < NOW()
	| EVAL date_bucket = DATE_TRUNC(1 hour, @timestamp)
	| STATS AVG(transaction.duration.us) BY

Possibly we can solve this by allowing some kind of syntax for conditional templating:

FROM traces-apm*
	| WHERE @timestamp >= ${earliest} AND @timestamp < ${latest}
	| EVAL date_bucket = DATE_TRUNC(${bucketSize}, @timestamp)
	| STATS AVG(transaction.duration.us) ${groupingField ? "BY " + groupingField : ""}