Resolve simple OpenSearch date-math values at plan time in visitSearch

The Lucene-secondary engine on a composite parquet/lucene shard does not
evaluate date-math tokens like {@code now} or {@code now-1h} inside a
{@code query_string} filter, so the previous fallback path returned zero
rows for every {@code earliest=}/{@code latest=} predicate the visitor
left in query_string form.

Resolve the subset we can handle without snap-to-unit math at plan time:

- {@code "now"} / {@code "now()"} → current UTC instant
- {@code "now+/-Nunit"} (units {@code s m h d w M y q}) → simple arithmetic
- 12+-digit numeric strings → epoch-millis (PPL pre-converts
  {@code earliest=1754020060.123} / {@code latest=1754020061} to ms
  strings in {@code visitTimeModifierValue})

Emit the result as a {@code TIMESTAMP} literal so the comparison lowers
natively via DataFusion against the parquet primary, bypassing Lucene
entirely. Anchored expressions ({@code "2024-01-15||+1d"}),
snap-to-unit rounding ({@code "now/h"}, {@code "now+1mon/q"}), week
alignment ({@code "now/w-1d"}), and other shapes we don't model still
fall through to the existing {@code query_string} fallback.

Surfaced by `CalciteSearchCommandIT.testSearchWithAbsoluteEarliestAndNow`
and similar time-modifier tests in the analytics-engine route.

Signed-off-by: Kai Huang <ahkcs@amazon.com>

Author: ahkcs

core/src/main/java/org/opensearch/sql/calcite/CalciteRelNodeVisitor.java

@@ -384,19 +384,29 @@ private Optional<UnresolvedExpression> lowerSearchExpression(
       if (!isLowerableField(comp.getField(), knownFields)) {
         return Optional.empty();
       }
-      if (isOpenSearchDateMath(comp.getValue().getLiteral())) {
-        return Optional.empty();
+      UnresolvedExpression value = comp.getValue().getLiteral();
+      if (isOpenSearchDateMath(value)) {
+        // Lucene's composite-secondary engine does NOT evaluate date-math tokens like
+        // {@code now} inside a {@code query_string}, so a fallback would return zero rows on
+        // parquet-backed shards. Resolve the simple cases ({@code now}, {@code now+/-Nunit},
+        // epoch-millis) at plan time and emit a {@code TIMESTAMP} literal instead. Complex
+        // forms (snap {@code /unit}, anchored {@code ||}, etc.) still fall through to
+        // {@code query_string}.
+        Optional<UnresolvedExpression> resolved = tryResolveOpenSearchDateMath(value);
+        if (resolved.isEmpty()) {
+          return Optional.empty();
+        }
+        value = resolved.get();
       }
-      if (containsLuceneWildcard(comp.getValue().getLiteral())) {
+      if (containsLuceneWildcard(value)) {
         // `severityText=ERR*` / `field=foo?` / `name=*-service` — Lucene-style wildcards in
         // the right-hand value. A native `=` lowering would compare literally and drop every
         // matching document. Keep the query in query_string form so Lucene evaluates the
         // wildcard.
         return Optional.empty();
       }
       return Optional.of(
-          AstDSL.compare(
-              comp.getOperator().getSymbol(), comp.getField(), comp.getValue().getLiteral()));
+          AstDSL.compare(comp.getOperator().getSymbol(), comp.getField(), value));
     }
     if (e instanceof SearchIn) {
       SearchIn in = (SearchIn) e;
@@ -455,6 +465,140 @@ private static boolean isOpenSearchDateMath(UnresolvedExpression value) {
     return false;
   }
 
+  /**
+   * Resolves the subset of OpenSearch date-math values we can evaluate at plan time:
+   *
+   * <ul>
+   *   <li>{@code "now"} / {@code "now()"} — current UTC instant.
+   *   <li>{@code "now+/-Nunit"} (units {@code s m h d w M y q}) — current instant with simple
+   *       arithmetic applied.
+   *   <li>Bare 12+-digit numeric strings — epoch-millis (PPL's
+   *       {@code earliest=<seconds>} / {@code latest=<decimal>} forms are pre-converted to
+   *       milliseconds by {@code visitTimeModifierValue}).
+   * </ul>
+   *
+   * <p>Returns empty for anchored expressions ({@code "2024-01-15||+1d"}), snap-to-unit
+   * rounding ({@code "now/h"}, {@code "now+1mon/q"}), week alignment ({@code "now/w-1d"}),
+   * and any other shape we don't model. Those continue to fall through to the
+   * {@code query_string} fallback in {@link #lowerSearchExpression}.
+   */
+  private static Optional<UnresolvedExpression> tryResolveOpenSearchDateMath(
+      UnresolvedExpression value) {
+    if (!(value instanceof Literal)) {
+      return Optional.empty();
+    }
+    Object raw = ((Literal) value).getValue();
+    if (!(raw instanceof String s)) {
+      return Optional.empty();
+    }
+    s = s.trim();
+    if (s.isEmpty()) {
+      return Optional.empty();
+    }
+    java.time.Instant result;
+    String lower = s.toLowerCase(java.util.Locale.ROOT);
+    if (lower.startsWith("now")) {
+      String rest = lower.substring(3);
+      if (rest.startsWith("()")) {
+        rest = rest.substring(2);
+      }
+      result = applyDateMath(java.time.Instant.now(), rest);
+      if (result == null) {
+        return Optional.empty();
+      }
+    } else if (isAllDigits(s)) {
+      try {
+        result = java.time.Instant.ofEpochMilli(Long.parseLong(s));
+      } catch (NumberFormatException e) {
+        return Optional.empty();
+      }
+    } else {
+      return Optional.empty();
+    }
+    // PPL TIMESTAMP literals downstream are parsed by Calcite, which accepts
+    // {@code yyyy-MM-dd HH:mm:ss} or {@code yyyy-MM-dd HH:mm:ss.SSS}. Round at
+    // millisecond precision; emit a fractional component only when non-zero so a
+    // whole-second value matches the canonical PPL form (the analyzer rejects
+    // {@code yyyy-MM-dd HH:mm:ss.000}-shape literals with a trailing-zero parse
+    // error).
+    long millis = result.getEpochSecond() * 1000 + result.getNano() / 1_000_000;
+    String pattern = (millis % 1000 == 0) ? "yyyy-MM-dd HH:mm:ss" : "yyyy-MM-dd HH:mm:ss.SSS";
+    String formatted =
+        java.time.format.DateTimeFormatter.ofPattern(pattern)
+            .withZone(java.time.ZoneOffset.UTC)
+            .format(result);
+    return Optional.of(AstDSL.timestampLiteral(formatted));
+  }
+
+  private static boolean isAllDigits(String s) {
+    if (s.length() < 12) {
+      return false;
+    }
+    for (int i = 0; i < s.length(); i++) {
+      char c = s.charAt(i);
+      if (c < '0' || c > '9') {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  /**
+   * Applies a sequence of {@code +/-Nunit} adjustments to a base instant. Returns {@code null}
+   * on any character we don't model (unknown unit, snap-to-unit {@code /}, gap between
+   * matches), letting the caller fall through to {@code query_string}.
+   */
+  private static java.time.Instant applyDateMath(java.time.Instant base, String math) {
+    if (math.isEmpty()) {
+      return base;
+    }
+    java.util.regex.Matcher m =
+        java.util.regex.Pattern.compile("([+-])(\\d+)([smhdwMyq])").matcher(math);
+    java.time.Instant result = base;
+    int lastEnd = 0;
+    while (m.find()) {
+      if (m.start() != lastEnd) {
+        return null;
+      }
+      long sign = m.group(1).equals("+") ? 1 : -1;
+      long n = Long.parseLong(m.group(2));
+      java.time.ZonedDateTime zdt = result.atZone(java.time.ZoneOffset.UTC);
+      switch (m.group(3)) {
+        case "s":
+          result = result.plus(sign * n, java.time.temporal.ChronoUnit.SECONDS);
+          break;
+        case "m":
+          result = result.plus(sign * n, java.time.temporal.ChronoUnit.MINUTES);
+          break;
+        case "h":
+          result = result.plus(sign * n, java.time.temporal.ChronoUnit.HOURS);
+          break;
+        case "d":
+          result = result.plus(sign * n, java.time.temporal.ChronoUnit.DAYS);
+          break;
+        case "w":
+          result = result.plus(sign * n * 7, java.time.temporal.ChronoUnit.DAYS);
+          break;
+        case "M":
+          result = zdt.plusMonths(sign * n).toInstant();
+          break;
+        case "y":
+          result = zdt.plusYears(sign * n).toInstant();
+          break;
+        case "q":
+          result = zdt.plusMonths(sign * n * 3).toInstant();
+          break;
+        default:
+          return null;
+      }
+      lastEnd = m.end();
+    }
+    if (lastEnd != math.length()) {
+      return null;
+    }
+    return result;
+  }
+
   /**
    * Detects an unescaped Lucene wildcard ({@code *} or {@code ?}) in a string literal. A preceding
    * odd run of backslashes means the wildcard is already escaped (literal star / question mark in
@@ -739,9 +883,6 @@ private List<RexNode> expandProjectFields(
               .filter(addedFields::add)
               .forEach(field -> expandedFields.add(context.relBuilder.field(field)));
         }
-        case Alias alias -> {
-          expandedFields.add(rexVisitor.analyze(alias, context));
-        }
         default ->
             throw new IllegalStateException(
                 "Unexpected expression type in project list: " + expr.getClass().getSimpleName());