Description

As an engineer, I sometimes have to query a set of indices, where I'm not sure if a field exists in those indices, but I also don't care. E.g., I might want to group by service.name and service.environment in logs-*, but the user might only have service.name. I want to signal to the _query endpoint that it's OK if service.environment does not exist. Currently this fails:

FROM logs-* | STATS BY service.name, service.environment

per @not-napoleon's suggestion, we could do something like this:

FROM logs-* | STATS BY service.name, IF_EXISTS(service.environment)

I would like it to work for STATS but also things like WHERE, EVAL, etc.