Span in PPL statsByClause could be specified after fields

[LantaoJin]

Description

Below PPL query fails with SyntaxCheckException

source=opensearch_dashboards_sample_data_logs | stats COUNT() as cnt by response, span(timestamp, 1d)

This PR still keep the current behavior of span as the first grouping key. But allow the span being specified after fields in statsByClause. This fixing also could help on some LLM scenarios.

Issues Resolved

#2719

Check List

• New functionality includes testing.
  • All tests pass, including unit test, integration test and doctest
• New functionality has been documented.
  • New functionality has javadoc added
  • New functionality has user manual doc added
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[dai-chen]

Is span expression mixed in field list also valid case?

[vamsi-amazon]

From the changes it looks we are missing that.

: (fieldExpression | bySpanClause) (COMMA (fieldExpression | bySpanClause))*

Something like this would actually be a good idea or define a new spanFieldList.

[dai-chen]

yeah, if this is valid, probably we should treat span expression as regular expression and do other validation outside ANTLR. Will approve now. Please check if we need to change this in future. Thanks!

[LantaoJin]

probably we should treat span expression as regular expression

The reason separating Span from field list AFAIK because that grouping by more than one time-span seems meaningless. And there is one span expression in Aggregation currently:

sql/core/src/main/java/org/opensearch/sql/ast/tree/Aggregation.java

Line 28 in b2403ca

private UnresolvedExpression span;

In general, it doesn't make sense that grouping by a 10-minutes span and 5-minutes span together.
But I tried in SPL, query group by two time span could be executed:

sourcetype=access_* status=200 action=purchase | bin span=10m _time as 10m_span | bin span=5m _time as 5m_span | stats count by 10m_span, 5m_span, clientip

Yes, we could refactor in future.