[RFC] xyseries command implementation in PPL

[asifabashar]

Problem Statement
xyseries command is missing in PPL which is part of todo in roadmap

This RFC proposes adding a new PPL transforming command, xyseries, with syntax and behavior aligned with SPL .

xyseries converts row-oriented grouped results into a wide table where:

• One field is the X axis (x-field) and stays as a row key.
• One field provides series names (y-name-field) and becomes dynamic output columns.
• One or more value fields (y-data-field) populate the pivoted cells.

OpenSearch PPL already supports stats, chart, and timechart, but there is no direct equivalent for SPL xyseries.

Adding xyseries improves:

• Query readability for pivot-style result shaping.
• Dashboard interoperability for charts requiring wide-table series layout.

Current State
There is no xyseries compatiable command.

Long-Term Goals
Provide xyseries functionality.

Proposal
Summarizes the suggested solution or improvement.

Approach

User Syntax

xyseries  [sep=<string>] [format=<string>] <x-field> <y-name-field> <y-data-field>...

Arguments

• x-field (required): row key in output.
• y-name-field (required): value used to generate output series column names.
• y-data-field... (required, at least one): value field(s) used to fill cells.

Options

Option	Default	Behavior
sep	"_"	Separator between Y-name and Y-data parts when multiple y-data-field values are provided.
format	None	Naming template for output series columns. Supports placeholders $VAL$ (y-name-field value) and $AGG$ (y-data-field name).

If format is omitted:

• Single y-data-field: output column is $VAL$.
• Multiple y-data-field: output column is $VAL$<sep>$AGG$.

Examples

source=weblogs
| stats count(host)  count(method) by response, url 
| xyseries response url count(host) , count(method) 

Semantics

Input shape and type rules

• x-field and y-name-field must exist in input schema.
• Every y-data-field must exist and be numeric.
• y-name-field values are converted to string for output column naming.

Null handling

• Rows with null in a given y-data-field do not contribute a value for that generated series column.

Implementation Plan

Validate required fields/options and defaults.
Project to x, y_name, and selected y_data fields.
Build generated series column name using format or default naming with sep.
Pivot to wide schema: x + dynamic series columns.

out of scope

grouping option which does not apply for multifile input in OpenSearch.
Alternative
chart , timeseries can be used for similar use cases but not exactly same.