Description
from message_types
| rename type AS id
| where match_phrase(id, "world hello")
results in
[MatchPhrase] function cannot operate on [id], which is not a field from an index mapping
but the simplified query
from message_types
| where match_phrase(type, "world hello")
doesn't throw any verification errors.
Description
results in
but the simplified query
doesn't throw any verification errors.