chen - limit offset field only in extraction mode

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

Author: RyanL1997

docs/user/ppl/cmd/rex.rst

@@ -35,7 +35,7 @@ rex [mode=<mode>] field=<field> <pattern> [max_match=<int>] [offset_field=<strin
     - Backreferences: ``\1``, ``\2``, etc. reference captured groups in replacement
 
 * max_match: optional integer (default=1). Maximum number of matches to extract. If greater than 1, extracted fields become arrays. The value 0 means unlimited matches, but is automatically capped to the configured limit (default: 10, configurable via ``plugins.ppl.rex.max_match.limit``).
-* offset_field: optional string. Field name to store the character offset positions of matches.
+* offset_field: optional string. Field name to store the character offset positions of matches. Only available in extract mode.
 
 Example 1: Basic Field Extraction
 ==================================

ppl/src/main/java/org/opensearch/sql/ppl/parser/AstBuilder.java

@@ -1014,6 +1014,12 @@ public UnresolvedPlan visitRexCommand(OpenSearchPPLParser.RexCommandContext ctx)
       }
     }
 
+    if (mode == Rex.RexMode.SED && offsetField.isPresent()) {
+      throw new IllegalArgumentException(
+          "Rex command: offset_field cannot be used with mode=sed. "
+              + "The offset_field option is only supported in extract mode.");
+    }
+
     int maxMatchLimit =
         (settings != null) ? settings.getSettingValue(Settings.Key.PPL_REX_MAX_MATCH_LIMIT) : 10;
 

ppl/src/test/java/org/opensearch/sql/ppl/parser/AstBuilderTest.java

@@ -1090,4 +1090,10 @@ public void testBinCommandDuplicateParameter() {
     // Test that duplicate parameters throw an exception
     plan("search source=test | bin index_field span=10 span=20");
   }
+
+  @Test(expected = IllegalArgumentException.class)
+  public void testRexSedModeWithOffsetFieldThrowsException() {
+    // Test that SED mode and offset_field cannot be used together (align with Splunk behavior)
+    plan("source=test | rex field=email mode=sed offset_field=matchpos \"s/@.*/@company.com/\"");
+  }
 }