Skip to content

Commit 5ea90dd

Browse files
committed
Update doc
Signed-off-by: Kai Huang <ahkcs@amazon.com>
1 parent 39aecf6 commit 5ea90dd

2 files changed

Lines changed: 64 additions & 27 deletions

File tree

docs/category.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
"user/ppl/cmd/rename.rst",
4343
"user/ppl/cmd/multisearch.rst",
4444
"user/ppl/cmd/replace.rst",
45+
"user/ppl/cmd/reverse.rst",
4546
"user/ppl/cmd/rex.rst",
4647
"user/ppl/cmd/search.rst",
4748
"user/ppl/cmd/showdatasources.rst",

docs/user/ppl/cmd/reverse.rst

Lines changed: 63 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,21 @@ reverse
1111

1212
Description
1313
============
14-
| Using ``reverse`` command to reverse the display order of search results. The same results are returned, but in reverse order.
14+
| Using ``reverse`` command to reverse the display order of search results. The behavior depends on the query context:
15+
|
16+
| **1. With existing sort**: Reverses the sort direction(s)
17+
| **2. With @timestamp field (no explicit sort)**: Sorts by @timestamp in descending order
18+
| **3. Without sort or @timestamp**: The command is ignored (no effect)
19+
20+
Behavior
21+
========
22+
The ``reverse`` command follows a three-tier logic:
23+
24+
1. **If there's an explicit sort command before reverse**: The reverse command flips all sort directions (ASC ↔ DESC)
25+
2. **If no explicit sort but the index has an @timestamp field**: The reverse command sorts by @timestamp in descending order (most recent first)
26+
3. **If neither condition is met**: The reverse command is ignored and has no effect on the result order
27+
28+
This design optimizes performance by avoiding expensive operations when reverse has no meaningful semantic interpretation.
1529

1630
Version
1731
=======
@@ -26,16 +40,16 @@ reverse
2640

2741
Note
2842
=====
29-
The `reverse` command processes the entire dataset. If applied directly to millions of records, it will consume significant memory resources on the coordinating node. Users should only apply the `reverse` command to smaller datasets, typically after aggregation operations.
43+
The ``reverse`` command is optimized to avoid unnecessary memory consumption. When applied without an explicit sort or @timestamp field, it is ignored. When used with an explicit sort, it efficiently reverses the sort direction(s) without materializing the entire dataset.
3044

31-
Example 1: Basic reverse operation
32-
==================================
45+
Example 1: Reverse with explicit sort
46+
======================================
3347

34-
The example shows reversing the order of all documents.
48+
The example shows reversing results after sorting by age in ascending order, effectively giving descending order.
3549

3650
PPL query::
3751

38-
os> source=accounts | fields account_number, age | reverse;
52+
os> source=accounts | sort age | fields account_number, age | reverse;
3953
fetched rows / total rows = 4/4
4054
+----------------+-----+
4155
| account_number | age |
@@ -47,33 +61,52 @@ PPL query::
4761
+----------------+-----+
4862

4963

50-
Example 2: Reverse with sort
51-
============================
64+
Example 2: Reverse with @timestamp field
65+
=========================================
5266

53-
The example shows reversing results after sorting by age in ascending order, effectively giving descending order.
67+
The example shows reverse on a time-series index automatically sorts by @timestamp in descending order (most recent first).
5468

5569
PPL query::
5670

57-
os> source=accounts | sort age | fields account_number, age | reverse;
58-
fetched rows / total rows = 4/4
71+
os> source=time_test | fields value, @timestamp | reverse | head 3;
72+
fetched rows / total rows = 3/3
73+
+-------+---------------------+
74+
| value | @timestamp |
75+
|-------+---------------------|
76+
| 9243 | 2025-07-28 09:41:29 |
77+
| 7654 | 2025-07-28 08:22:11 |
78+
| 8321 | 2025-07-28 07:05:33 |
79+
+-------+---------------------+
80+
81+
Note: When the index contains an @timestamp field and no explicit sort is specified, reverse will sort by @timestamp DESC to show the most recent events first. This is particularly useful for log analysis and time-series data.
82+
83+
Example 3: Reverse ignored (no sort, no @timestamp)
84+
===================================================
85+
86+
The example shows that reverse is ignored when there's no explicit sort and no @timestamp field.
87+
88+
PPL query::
89+
90+
os> source=accounts | fields account_number, age | reverse | head 2;
91+
fetched rows / total rows = 2/2
5992
+----------------+-----+
6093
| account_number | age |
6194
|----------------+-----|
62-
| 6 | 36 |
63-
| 18 | 33 |
6495
| 1 | 32 |
65-
| 13 | 28 |
96+
| 6 | 36 |
6697
+----------------+-----+
6798

99+
Note: Results appear in natural order (same as without reverse) because accounts index has no @timestamp field and no explicit sort was specified.
100+
68101

69-
Example 3: Reverse with head
70-
============================
102+
Example 4: Reverse with sort and head
103+
=====================================
71104

72-
The example shows using reverse with head to get the last 2 records from the original order.
105+
The example shows using reverse with sort and head to get the top 2 records by age.
73106

74107
PPL query::
75108

76-
os> source=accounts | reverse | head 2 | fields account_number, age;
109+
os> source=accounts | sort age | reverse | head 2 | fields account_number, age;
77110
fetched rows / total rows = 2/2
78111
+----------------+-----+
79112
| account_number | age |
@@ -83,14 +116,14 @@ PPL query::
83116
+----------------+-----+
84117

85118

86-
Example 4: Double reverse
87-
=========================
119+
Example 5: Double reverse with sort
120+
===================================
88121

89-
The example shows that applying reverse twice returns to the original order.
122+
The example shows that applying reverse twice with an explicit sort returns to the original sort order.
90123

91124
PPL query::
92125

93-
os> source=accounts | reverse | reverse | fields account_number, age;
126+
os> source=accounts | sort age | reverse | reverse | fields account_number, age;
94127
fetched rows / total rows = 4/4
95128
+----------------+-----+
96129
| account_number | age |
@@ -102,19 +135,22 @@ PPL query::
102135
+----------------+-----+
103136

104137

105-
Example 5: Reverse with complex pipeline
106-
=======================================
138+
Example 6: Reverse with multiple sort fields
139+
============================================
107140

108-
The example shows reverse working with filtering and field selection.
141+
The example shows reverse flipping all sort directions when multiple fields are sorted.
109142

110143
PPL query::
111144

112-
os> source=accounts | where age > 30 | fields account_number, age | reverse;
113-
fetched rows / total rows = 3/3
145+
os> source=accounts | sort +age, -account_number | reverse | fields account_number, age;
146+
fetched rows / total rows = 4/4
114147
+----------------+-----+
115148
| account_number | age |
116149
|----------------+-----|
117150
| 6 | 36 |
118151
| 18 | 33 |
119152
| 1 | 32 |
153+
| 13 | 28 |
120154
+----------------+-----+
155+
156+
Note: Original sort is ASC age, DESC account_number. After reverse, it becomes DESC age, ASC account_number.

0 commit comments

Comments
 (0)