refactor(doc): reconstruct function doc

Make all functions searchable

Signed-off-by: Jiyong Huang <huangjy@emqx.io>

docs/directory.json

@@ -588,12 +588,62 @@
 					]
 				},
 				{
-					"title": "内置函数",
-					"path": "sqls/built-in_functions"
-				},
-				{
-					"title": "预定义函数插件",
-					"path": "sqls/custom_functions"
+					"title": "函数",
+					"path": "sqls/functions/overview",
+					"children": [
+						{
+							"title": "聚合函数",
+							"path": "sqls/functions/aggregate_functions"
+						},
+						{
+							"title": "数学函数",
+							"path": "sqls/functions/mathematical_functions"
+						},
+						{
+							"title": "字符串函数",
+							"path": "sqls/functions/string_functions"
+						},
+						{
+							"title": "数组函数",
+							"path": "sqls/functions/array_functions"
+						},
+						{
+							"title": "对象函数",
+							"path": "sqls/functions/object_functions"
+						},
+						{
+							"title": "哈希函数",
+							"path": "sqls/functions/hashing_functions"
+						},
+						{
+							"title": "转换函数",
+							"path": "sqls/functions/transform_functions"
+						},
+						{
+							"title": "JSON 函数",
+							"path": "sqls/functions/json_functions"
+						},
+						{
+							"title": "其他函数",
+							"path": "sqls/functions/other_functions"
+						},
+						{
+							"title": "分析函数",
+							"path": "sqls/functions/analytic_functions"
+						},
+						{
+							"title": "多行函数",
+							"path": "sqls/functions/multi_row_functions"
+						},
+						{
+							"title": "多列函数",
+							"path": "sqls/functions/multi_column_functions"
+						},
+						{
+							"title": "预定义函数插件",
+							"path": "sqls/functions/custom_functions"
+						}
+					]
 				},
 				{
 					"title": "窗口",
@@ -1295,12 +1345,62 @@
 					]
 				},
 				{
-					"title": "Built-in Functions",
-					"path": "sqls/built-in_functions"
-				},
-				{
-					"title": "Predefined function plugins",
-					"path": "sqls/custom_functions"
+					"title": "Functions",
+					"path": "sqls/functions/overview",
+					"children": [
+						{
+							"title": "Aggregate Functions",
+							"path": "sqls/functions/aggregate_functions"
+						},
+						{
+							"title": "Mathematical Functions",
+							"path": "sqls/functions/mathematical_functions"
+						},
+						{
+							"title": "String Functions",
+							"path": "sqls/functions/string_functions"
+						},
+						{
+							"title": "Array Functions",
+							"path": "sqls/functions/array_functions"
+						},
+						{
+							"title": "Object Functions",
+							"path": "sqls/functions/object_functions"
+						},
+						{
+							"title": "Hashing Functions",
+							"path": "sqls/functions/hashing_functions"
+						},
+						{
+							"title": "Transform Functions",
+							"path": "sqls/functions/transform_functions"
+						},
+						{
+							"title": "JSON Functions",
+							"path": "sqls/functions/json_functions"
+						},
+						{
+							"title": "Other Functions",
+							"path": "sqls/functions/other_functions"
+						},
+						{
+							"title": "Analytic Functions",
+							"path": "sqls/functions/analytic_functions"
+						},
+						{
+							"title": "Multi-Row Functions",
+							"path": "sqls/functions/multi_row_functions"
+						},
+						{
+							"title": "Multi-Column Functions",
+							"path": "sqls/functions/multi_column_functions"
+						},
+						{
+							"title": "Predefined function plugins",
+							"path": "sqls/functions/custom_functions"
+						}
+					]
 				},
 				{
 					"title": "Windowing",

docs/en_US/README.md

@@ -1,6 +1,9 @@
 # LF Edge eKuiper - Lightweight data stream processing engine for IoT edge
 
-LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. The major goal for eKuiper is to provide a streaming software framework (similar to [Apache Flink](https://flink.apache.org)) in edge side.  eKuiper's  **rule engine** allows user to provide either SQL based or graph based (similar to Node-RED) rules to create IoT edge analytics applications within few minutes.
+LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge
+devices. The major goal for eKuiper is to provide a streaming software framework (similar
+to [Apache Flink](https://flink.apache.org)) in edge side. eKuiper's **rule engine** allows user to provide either
+SQL-based or graph based (similar to Node-RED) rules to create IoT edge analytics applications within few minutes.
 
 ![arch](./resources/arch.png)
 
@@ -25,17 +28,18 @@ LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine
 
 - Highly extensible
 
-  It supports to extend at `Source`, `Functions` and `Sink` with Golang or Python.
+  It supports extending at `Source`, `Functions` and `Sink` with Golang or Python.
 
-  - Source: allows users to add more data source for analytics.
-  - Sink: allows users to send analysis result to different customized systems.
+  - Source: allows users to add more data sources for analytics.
+  - Sink: allows users to send the analysis result to different customized systems.
   - UDF functions: allow users to add customized functions for data analysis (for example, AI/ML function invocation)
 
 - Management
 
   - [A free web based management dashboard](https://hub.docker.com/r/emqx/ekuiper-manager) for visualized management
   - Plugins, streams and rules management through CLI, REST API and config maps(Kubernetes)
-  - Easily be integrated with Kubernetes frameworks [KubeEdge](https://github.com/kubeedge/kubeedge), [OpenYurt](https://openyurt.io/), [K3s](https://github.com/rancher/k3s) [Baetyl](https://github.com/baetyl/baetyl)
+  - Easily be integrated with Kubernetes
+    frameworks [KubeEdge](https://github.com/kubeedge/kubeedge), [OpenYurt](https://openyurt.io/), [K3s](https://github.com/rancher/k3s) [Baetyl](https://github.com/baetyl/baetyl)
 
 - Integration with EMQX products
 
@@ -74,14 +78,14 @@ Refer to the syntax and properties.
 - [Rule Syntax](./guide/rules/overview.md)
 - [Available Sources](./guide/sources/overview.md)
 - [Available Sinks](./guide/sinks/overview.md)
-- [Available Functions](./sqls/built-in_functions.md)
+- [Available Functions](./sqls/functions/overview.md
 - [SQL Reference](./sqls/overview.md)
 
 [View Reference](./sqls/overview.md)
 
 ## Learn how to use eKuiper
 
-Learn how to create and manage rules and how to modify configurations etc.
+Learn how to create and manage rules and how to modify configurations, etc.
 
 - [Configuration](./configuration/configuration.md)
 - [Rest API](./api/restapi/overview.md)

docs/en_US/configuration/global_configurations.md

@@ -168,8 +168,9 @@ It has properties
 ### External State
 
 There is also a configuration item named `extStateType`.
-The configuration's usage is user can store some information in database in advance, when stream processing rules need these information,
-they can get them easily by [get_keyed_state](../sqls/built-in_functions.md#other-functions) function in SQL.
+The configuration's usage is user can store some information in database in advance, when stream processing rules need
+these information,
+they can get them easily by [get_keyed_state](../sqls/functions/other_functions.md#getkeyedstate) function in SQL.
 
 *Note*: `type` and `extStateType` can be configured differently.
 

docs/en_US/extension/native/develop/function.md

@@ -1,16 +1,25 @@
 # Function Extension
 
-In the eKuiper SQL syntax, [many built-in functions](../../../sqls/built-in_functions.md) are provided to server for various reusable business logic. However, the users still likely need various reusable business logic which are not covered by the built ins. The function extension is presented to customized the functions.
+In the eKuiper SQL syntax, [many built-in functions](../../../sqls/functions/overview.md) are provided to server for
+various reusable business logic. However, the users still likely need various reusable business logic which is not
+covered by the built ins. The function extension is presented to customize the functions.
 
 ## Developing
 
 ### Develop a customized function
 
-To develop a function for eKuiper is to implement [api.Function](https://github.com/lf-edge/ekuiper/blob/master/pkg/api/stream.go) interface and export it as a golang plugin.
+To develop a function for eKuiper is to
+implement [api.Function](https://github.com/lf-edge/ekuiper/blob/master/pkg/api/stream.go) interface and export it as a
+golang plugin.
 
-Before starting the development, you must [setup the environment for golang plugin](../overview.md#setup-the-plugin-developing-environment). 
+Before starting the development, you
+must [set up the environment for golang plugin](../overview.md#setup-the-plugin-developing-environment).
 
-To develop a function, the _Validate_ method is firstly to be implemented. This method will be called during SQL validation. In this method, a slice of [xsql.Expr](https://github.com/lf-edge/ekuiper/blob/master/pkg/ast/expr.go) is passed as the parameter that contains the arguments for this function in the runtime. The developer can do a validation against it to check the argument count and type etc. If validation is successful, return nil. Otherwise, return an error object.
+To develop a function, the _Validate_ method is firstly to be implemented. This method will be called during SQL
+validation. In this method, a slice of [xsql.Expr](https://github.com/lf-edge/ekuiper/blob/master/pkg/ast/expr.go) is
+passed as the parameter that contains the arguments for this function in the runtime. The developer can do a validation
+against it to check the argument count and type etc. If validation is successful, return nil. Otherwise, return an error
+object.
 
 ```go
 //The argument is a list of xsql.Expr
@@ -23,7 +32,9 @@ There are 2 types of functions: aggregate function and common function. For aggr
 IsAggregate() bool
 ```
 
-The main task for a Function is to implement _exec_ method. The method will be leverage to calculate the result of the function in the SQL. The argument is a slice of the values for the function parameters. You can use them to do the calculation. If the calculation is successful, return the result and true; otherwise, return nil and false. 
+The main task for a Function is to implement _exec_ method. The method will be leveraged to calculate the result of the
+function in the SQL. The argument is a slice of the values for the function parameters. You can use them to do the
+calculation. If the calculation is successful, return the result and true; otherwise, return nil and false.
 
 ```go
 //Execute the function, return the result and if execution is successful.If execution fails, return the error and false. 
@@ -50,7 +61,7 @@ var(
 )
 ```
 
-It is a best practice to combine all related functions in a plugin to simplify the build and deployment of functions.
+It is the best practice to combine all related functions in a plugin to simplify the build and deployment of functions.
 
 ### Package the source
 
@@ -62,10 +73,17 @@ go build -trimpath --buildmode=plugin -o plugins/functions/MyFunction.so extensi
 
 ### Register multiple functions
 
-eKuiper will load plugins in the plugin folders automatically. The auto loaded function plugin assumes there is a function named the same as the plugin name. If multiple functions are exported, users need to explicitly register them to make them available. There are two ways to register the functions.
-
-1. In development environment, we recommend to build plugin .so file directly into the plugin folder so that eKuiper can auto load it. Then call [CLI register functions command](../../../api/cli/plugins.md#register-functions) or [REST register functions API](../../../api/restapi/plugins.md#register-functions).
-2. In production environment, [package the plugin into zip file](plugins_tutorial.md#deployment), then call [CLI function plugin create command](../../../api/cli/plugins.md#create-a-plugin) or [REST function plugin create API](../../../api/restapi/plugins.md#create-a-plugin) with functions list specified.
+eKuiper will load plugins in the plugin folders automatically. The autoload function plugin assumes there is a function
+named the same as the plugin name. If multiple functions are exported, users need to explicitly register them to make
+them available. There are two ways to register the functions.
+
+1. In development environment, we recommend to build plugin .so file directly into the plugin folder so that eKuiper can
+   autoload it. Then call [CLI register functions command](../../../api/cli/plugins.md#register-functions)
+   or [REST register functions API](../../../api/restapi/plugins.md#register-functions).
+2. In production environment, [package the plugin into zip file](plugins_tutorial.md#deployment), then
+   call [CLI function plugin create command](../../../api/cli/plugins.md#create-a-plugin)
+   or [REST function plugin create API](../../../api/restapi/plugins.md#create-a-plugin) with the function list
+   specified.
 
 ## Usage
 

docs/en_US/extension/native/overview.md

@@ -2,9 +2,13 @@
 
 eKuiper allows user to customize the different kinds of extensions by the native golang plugin system. 
 
-- The source extension is used for extending different stream source, such as consuming data from other message brokers. eKuiper has built-in source support for [MQTT broker](../../guide/sources/builtin/mqtt.md).
-- Sink/Action extension is used for extending pub/push data to different targets, such as database, other message system, web interfaces or file systems. Built-in action is supported in eKuiper, see [MQTT](../../guide/sinks/builtin/mqtt.md) & [log files](../../guide/sinks/builtin/log.md).
-- Functions extension allows user to extend different functions that used in SQL. Built-in functions is supported in eKuiper, see [functions](../../sqls/built-in_functions.md).
+- The source extension is used for extending different stream sources, such as consuming data from other message
+  brokers. eKuiper has built-in source support for [MQTT broker](../../guide/sources/builtin/mqtt.md).
+- Sink/Action extension is used for extending pub/push data to different targets, such as database, another message
+  system, web interfaces or file systems. Built-in action is supported in eKuiper,
+  see [MQTT](../../guide/sinks/builtin/mqtt.md) & [log files](../../guide/sinks/builtin/log.md).
+- Functions extension allows user to extend different functions that are used in SQL. Built-in functions are supported
+  in eKuiper, see [functions](../../sqls/functions/overview.md).
 
 Please read the following to learn how to implement different extensions.
 
@@ -14,10 +18,13 @@ Please read the following to learn how to implement different extensions.
 
 ## Naming
 
-We recommend plugin name to be camel case. Notice that, there are some restrictions for the names:
+We recommend plugin name to be camel case. Notice that there are some restrictions for the names:
 
-1. The name of the export symbol of the plugin should be camel case with an **upper case first letter**. It must be the same as the plugin name except the first letter. For example, plugin name _file_ must export a export symbol name _File_ .
-2. The name of _.so_ file must be the same as the export symbol name or the plugin name. For example, _MySource.so_ or _mySink.so_.
+1. The name of the export symbol of the plugin should be camel case with an **upper case first letter**. It must be the
+   same as the plugin name except the first letter. For example, plugin name _file_ must export an export symbol name
+   _File_ .
+2. The name of _.so_ file must be the same as the export symbol name or the plugin name. For example, _MySource.so_ or
+   _mySink.so_.
 
 ### Version
 
@@ -40,23 +47,32 @@ A typical environment for developing plugins is to put the plugin and Kuiper in
 go build -trimpath --buildmode=plugin -o plugins/sources/MySource.so plugins/sources/my_source.go
 ```
 
-Notice that, the `-trimpath` build flag is required if using the prebuilte kuiper or kuiper docker image because the kuiperd is also built with the flag to improve build reproducibility.
+Notice that, the `-trimpath` build flag is required if using the prebuilt eKuiper or eKuiper docker image because the
+kuiperd is also built with the flag to improve build reproducibility.
 
 ### Plugin development
 
 The development of plugins is to implement a specific interface according to the plugin type and export the implementation with a specific name. There are two types of exported symbol supported:
 
-1. Export a constructor function: Kuiper will use the constructor function to create a new instance of the plugin implementation for each load. So each rule will have one instance of the plugin and each instance will be isolated from others. This is the recommended way.
+1. Export a constructor function: Kuiper will use the constructor function to create a new instance of the plugin
+   implementation for each load. So each rule will have one instance of the plugin, and each instance will be isolated
+   from others. This is the recommended way.
 
-2. Export an instance: Kuiper will use the instance as singleton for all plugin load. So all rules will share the same instance. For such implementation, the developer will need to handle the shared states to avoid any potential multi-thread problems. This mode is recommended where there are no shared states and the performance is critical. Especially, function extension is usually functional without internal state which is suitable for this mode.
+2. Export an instance: eKuiper will use the instance as singleton for all plugin loads. So all rules will share the same
+   instance. For such implementation, the developer will need to handle the shared states to avoid any potential
+   multi-thread problems. This mode is recommended where there are no shared states and the performance is critical.
+   Especially, a function extension is usually functional without internal state which is suitable for this mode.
 
 ## State storage
 
-eKuiper extension exposes a key value state storage interface through the context parameter, which can be used for all types of extensions, including Source/Sink/Function extensions.
+eKuiper extension exposes a key value state storage interface through the context parameter, which can be used for all
+types of extensions, including Source/Sink/Function extensions.
 
-States are key-value pairs, where the key is a string and the value is arbitrary data. Keys are scoped the to current extended instance.
+States are key-value pairs, where the key is a string, and the value is arbitrary data. Keys are scoped to the current
+extended instance.
 
-Users can access the state storage through the context object. State-related methods include putState, getState, incrCounter, getCounter and deleteState.
+Users can access the state storage through the context object. State-related methods include putState, getState,
+incrCounter, getCounter and deleteState.
 
 Below is an example of a function extension to access states. This function will count the number of words passed in and save the cumulative number in the state.
 
@@ -77,9 +93,13 @@ func (f *accumulateWordCountFunc) Exec(args []interface{}, ctx api.FunctionConte
 
 ## Runtime dependencies
 
-Some plugin may need to access dependencies in the file system. Those files is put under {{eKuiperPath}}/etc/{{pluginType}}/{{pluginName}} directory. When packaging the plugin, put those files in [etc directory](../../api/restapi/plugins.md#plugin-file-format). After installation, they will be moved to the recommended place.
+Some plugins may need to access dependencies in the file system. Those files are put under
+{{eKuiperPath}}/etc/{{pluginType}}/{{pluginName}} directory. When packaging the plugin, put those files
+in [etc directory](../../api/restapi/plugins.md#plugin-file-format). After installation, they will be moved to the
+recommended place.
 
-In the plugin source code, developers can access the dependencies of file system by getting the eKuiper root path from the context:
+In the plugin source code, developers can access the dependencies of file system by getting the eKuiper root path from
+the context:
 
 ```go
 ctx.GetRootPath()

docs/en_US/sqls/built-in_functions.md

@@ -1,506 +0,0 @@
-# Functions
-
-eKuiper has many built-in functions for performing calculations on data.
-
-## Aggregate Functions
-Aggregate functions perform a calculation on a set of values and return a single value. Aggregate functions can be used as expressions only in the following:
-* The select list of a SELECT statement (either a sub-query or an outer query).
-* A HAVING clause.
-
-| Function        | Example                          | Description                                                                                                                                                                                                                                                                                                                                                                                                                       |
-|-----------------|----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| avg             | avg(col1)                        | The average of the values in a group. The null values will be ignored.                                                                                                                                                                                                                                                                                                                                                            |
-| count           | count(*)                         | The number of items in a group. The null values will be ignored.                                                                                                                                                                                                                                                                                                                                                                  |
-| max             | max(col1)                        | The maximum value in a group. The null values will be ignored.                                                                                                                                                                                                                                                                                                                                                                    |
-| min             | min(col1)                        | The minimum value in a group. The null values will be ignored.                                                                                                                                                                                                                                                                                                                                                                    |
-| sum             | sum(col1)                        | The sum of all the values in a group. The null values will be ignored.                                                                                                                                                                                                                                                                                                                                                            |
-| collect         | collect(*), collect(col1)        | Returns an array with all column or the whole record (when the parameter is *) values from the group.                                                                                                                                                                                                                                                                                                                             |
-| deduplicate     | deduplicate(col, false)          | Returns the deduplicate results in the group, usually a window. The first argument is the column as the key to deduplicate; the second argument is whether to return all items or just the latest item which is not duplicate. If the latest item is a duplicate, the sink will receive an empty map. Set the sink property [omitIfEmpty](../guide/sinks/overview.md#common-properties) to the sink to not triggering the action. |
-| stddev          | stddev(col)                      | Returns the population standard deviation of expression in the group, usually a window. The argument is the column as the key to stddev.                                                                                                                                                                                                                                                                                          |
-| stddevs         | stddevs(col)                     | Returns the sample standard deviation of expression in the group, usually a window. The argument is the column as the key to stddevs.                                                                                                                                                                                                                                                                                             |
-| var             | var(col)                         | Returns the population variance (square of the population standard deviation) of expression in the group, usually a window. The argument is the column as the key to var.                                                                                                                                                                                                                                                         |
-| vars            | vars(col)                        | Returns the sample variance (square of the sample standard deviation) of expression in the group, usually a window. The argument is the column as the key to vars.                                                                                                                                                                                                                                                                |
-| percentile      | percentile(col, percentile)      | Returns the percentile value based on a continuous distribution of expression in the group, usually a window. The first argument is the column as the key to percentile.  The second argument is the percentile of the value that you want to find. The percentile must be a constant between 0.0 and 1.0.                                                                                                                        |
-| percentile_disc | percentile_disc(col, percentile) | Returns the percentile value based on a discrete distribution of expression in the group, usually a window. The first argument is the column as the key to percentile_disc.  The second argument is the percentile of the value that you want to find. The percentile must be a constant between 0.0 and 1.0.                                                                                                                     |
-
-### Collect() Examples
-
-- Get an array of column `a` of the current window. Assume the column `a` is of int type, the result will be like: `[{"r1":[32, 45]}]`
-    ```sql
-    SELECT collect(a) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
-    ```
-- Get the whole array of the current window. The result will be like: `[{"r1":{"a":32, "b":"hello"}, {"a":45, "b":"world"}}]`
-    ```sql
-    SELECT collect(*) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
-    ```
-  
-- Get the second element's column 'a' value within the current window. The result will be like: `[{"r1":32}]`
-    ```sql
-    SELECT collect(*)[1]->a as r1 FROM test GROUP BY TumblingWindow(ss, 10)
-    ```
-
-### Deduplicate() Examples
-
- - Get the whole array of the current window which is deduplicated by column `a`. The result will be like: `[{"r1":{"a":32, "b":"hello"}, {"a":45, "b":"world"}}]`
-     ```sql
-     SELECT deduplicate(a, true) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
-     ```
- - Get the column `a` value which is not duplicate during the last hour. The result will be like: `[{"r1":32}]`, `[{"r1":45}]` and `[{}]` if a duplicate value arrives. Use the omitIfEmpty sink property to filter out those empty results.
-      ```sql
-      SELECT deduplicate(a, false)->a as r1 FROM demo GROUP BY SlidingWindow(hh, 1)
-      ```
-
-
-## Mathematical Functions
-| Function | Example            | Description                                                                                                                                                                                     |
-|----------|--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| abs      | abs(col1)          | The absolute value of a value                                                                                                                                                                   |
-| acos     | acos(col1)         | The inverse cosine of a number in radians                                                                                                                                                       |
-| asin     | asin(col1)         | The inverse sine of a number in radians                                                                                                                                                         |
-| atan     | atan(col1)         | The inverse tangent of a number in radians                                                                                                                                                      |
-| atan2    | atan2(col1, col2)  | The angle, in radians,  between the positive x-axis and the (x, y) point defined in the two arguments                                                                                           |
-| bitand   | bitand(col1, col2) | Performs a bitwise AND on the bit representations of the two Int(-converted) arguments                                                                                                          |
-| bitor    | bitor(col1, col2)  | Performs a bitwise OR of the bit representations of the two arguments                                                                                                                           |
-| bitxor   | bitxor(col1, col2) | Performs a bitwise XOR on the bit representations of the two Int(-converted) arguments                                                                                                          |
-| bitnot   | bitnot(col1)       | Performs a bitwise NOT on the bit representations of the Int(-converted) argument                                                                                                               |
-| ceil     | ceil(col1)         | Round a value up to the nearest BIGINT value.                                                                                                                                                   |
-| cos      | cos(col1)          | Returns the cosine of a number in radians.                                                                                                                                                      |
-| cosh     | cosh(col1)         | Returns the hyperbolic cosine of a number in radians.                                                                                                                                           |
-| exp      | exp(col1)          | Returns e raised to the Decimal argument.                                                                                                                                                       |
-| ln       | ln(col1)           | Returns the natural logarithm of the argument.                                                                                                                                                  |
-| log      | log(col1)          | Returns the base 10 logarithm of the argument.                                                                                                                                                  |
-| mod      | mod(col1, col2)    | Returns the remainder of the division of the first argument by the second argument.                                                                                                             |
-| power    | power(x, y)        | Pow returns x**y, the base-x exponential of y.                                                                                                                                                  |
-| rand     | rand()             | Returns a pseudorandom, uniformly distributed double between 0.0 and 1.0.                                                                                                                       |
-| round    | round(col1)        | Round a value to the nearest BIGINT value.                                                                                                                                                      |
-| sign     | sign(col1)         | Returns the sign of the given number. When the sign of the argument is positive, 1 is returned. When the sign of the argument is negative, -1 is returned. If the argument is 0, 0 is returned. |
-| sin      | sin(col1)          | Returns the sine of a number in radians.                                                                                                                                                        |
-| sinh     | sinh(col1)         | Returns the hyperbolic sine of a number in radians.                                                                                                                                             |
-| sqrt     | sqrt(col1)         | Returns the square root of a number.                                                                                                                                                            |
-| tan      | tan(col1)          | Returns the tangent of a number in radians.                                                                                                                                                     |
-| tanh     | tanh(col1)         | Returns the hyperbolic tangent of a number in radians.                                                                                                                                          |
-
-## String Functions
-
-| Function       | Example                                | Description                                                                                                                                                                                                                                                                                                                                      |
-|----------------|----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| concat         | concat(col1...)                        | Concatenates arrays or strings. This function accepts any number of arguments and returns a String or an Array                                                                                                                                                                                                                                   |
-| endswith       | endswith(col1, col2)                   | Returns a Boolean indicating whether the first String argument ends with the second String argument.                                                                                                                                                                                                                                             |
-| format_time    | format_time(col1, format)              | Format a datetime to string. The 'col1' will be [casted to datetime type](#cast-to-datetime) if it is bigint, float or string type before formatting. Please check [format patterns](#formattime-patterns) for how to compose the format.                                                                                                        |
-| indexof        | indexof(col1, col2)                    | Returns the first index (0-based) of the second argument as a substring in the first argument.                                                                                                                                                                                                                                                   |
-| length         | length(col1)                           | Returns the number of characters in the provided string.                                                                                                                                                                                                                                                                                         |
-| lower          | lower(col1)                            | Returns the lowercase version of the given String.                                                                                                                                                                                                                                                                                               |
-| lpad           | lpad(col1, 2)                          | Returns the String argument, padded on the left side with the number of spaces specified by the second argument.                                                                                                                                                                                                                                 |
-| ltrim          | ltrim(col1)                            | Removes all leading whitespace (tabs and spaces) from the provided String.                                                                                                                                                                                                                                                                       |
-| numbytes       | numbytes(col1)                         | Returns the number of bytes in the UTF-8 encoding of the provided string.                                                                                                                                                                                                                                                                        |
-| regexp_matches | regexp_matches(col1, regex)            | Returns true if the string (first argument) contains a match for the regular expression.                                                                                                                                                                                                                                                         |
-| regexp_replace | regexp_replace(col1, regex, str)       | Replaces all occurrences of the second argument (regular expression) in the first argument with the third argument.                                                                                                                                                                                                                              |
-| regexp_substr  | regexp_substr(col1, regex)             | Finds the first match of the 2nd parameter (regex) in the first parameter.                                                                                                                                                                                                                                                                       |
-| rpad           | rpad(col1, 2)                          | Returns the String argument, padded on the right side with the number of spaces specified by the second argument.                                                                                                                                                                                                                                |
-| rtrim          | rtrim(col1)                            | Removes all trailing whitespace (tabs and spaces) from the provided String.                                                                                                                                                                                                                                                                      |
-| substring      | substring(col1, start, end)            | returns the substring of the provided String from the provided Int index (0-based, inclusive) to the end of the String.                                                                                                                                                                                                                          |
-| startswith     | startswith(col1, str)                  | Returns Boolean, whether the first string argument starts with the second string argument.                                                                                                                                                                                                                                                       |
-| split_value    | split_value(col1, str_splitter, index) | Split the value of the 1st parameter with the 2nd parameter, and return the value of split array that indexed with the 3rd parameter.<br />`split_value("/test/device001/message","/",0) AS a`, the returned value of function is empty; <br />`split_value("/test/device001/message","/",3) AS a`, the returned value of function is `message`; |
-| trim           | trim(col1)                             | Removes all leading and trailing whitespace (tabs and spaces) from the provided String.                                                                                                                                                                                                                                                          |
-| upper          | upper(col1)                            | Returns the uppercase version of the given String.                                                                                                                                                                                                                                                                                               |
-
-### Format_time patterns
-
-A pattern is used to create a format string. Patterns are based on a simple sequence of letters and symbols which is common in many languages like Java etc. The supported symbols in Kuiper are
-
-| Symbol | Meaning                   | Example                               |
-|--------|---------------------------|---------------------------------------|
-| G      | era                       | G(AD)                                 |
-| Y      | year                      | YYYY(2004), YY(04)                    |
-| M      | month                     | M(1), MM(01), MMM(Jan), MMMM(January) |
-| d      | day of month              | d(2), dd(02)                          |
-| E      | day of week               | EEE(Mon), EEEE(Monday)                |
-| H      | hour in 24 hours format   | HH(15)                                |
-| h      | hour in 12 hours format   | h(2), hh(03)                          |
-| a      | AM or PM                  | a(PM)                                 |
-| m      | minute                    | m(4), mm(04)                          |
-| s      | second                    | s(5), ss(05)                          |
-| S      | fraction of second        | S(.0), SS(.00), SSS(.000)             |
-| z      | time zone name            | z(MST)                                |
-| Z      | 4 digits time zone offset | Z(-0700)                              |
-| X      | time zone offset          | X(-07), XX(-0700), XXX(-07:00)        |
-
-Examples:
-
-- YYYY-MM-dd T HH:mm:ss -> 2006-01-02 T 15:04:05
-- YYYY/MM/dd HH:mm:ssSSS XXX -> 2006/01/02 15:04:05.000 -07:00
- 
-## Conversion Functions
-
-| Function         | Example                          | Description                                                                                                                                                                                                                                                                                       |
-|------------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| cast             | cast(col,  "bigint")             | Converts a value from one data type to another. The supported types includes: bigint, float, string, boolean, bytea and datetime.                                                                                                                                                                 |
-| chr              | chr(col1)                        | Returns the ASCII character that corresponds to the given Int argument                                                                                                                                                                                                                            |
-| encode           | encode(col1, "base64")           | Use the encode function to encode the payload, which potentially might be non-JSON data, into its string representation based on the encoding scheme. Currently, only "base64" encoding type is supported.                                                                                        |
-| decode           | decode(col1, "base64")           | Decode the input string with specified decoding method. Currently, only "base64" encoding type is supported.                                                                                                                                                                                      |
-| trunc            | trunc(dec, int)                  | Truncates the first argument to the number of Decimal places specified by the second argument. If the second argument is less than zero, it is set to zero. If the second argument is greater than 34, it is set to 34. Trailing zeroes are stripped from the result.                             |
-
-### Cast to datetime
-
-When casting to datetime type, the supported column type and casting rule are:
-
-1. If column is datetime type, just return the value.
-2. If column is bigint or float type, the number will be treated as the milliseconds elapsed since January 1, 1970 00:00:00 UTC and converted.
-3. If column is string, it will be parsed to datetime with the default format: `"2006-01-02T15:04:05.000Z07:00"`.
-4. Other types are not supported.
-
-## Hashing Functions
-| Function | Example      | Description                  |
-|----------|--------------|------------------------------|
-| md5      | md5(col1)    | Hashed value of the argument |
-| sha1     | sha1(col1)   | Hashed value of the argument |
-| sha256   | sha256(col1) | Hashed value of the argument |
-| sha384   | sha384(col1) | Hashed value of the argument |
-| sha512   | sha512(col1) | Hashed value of the argument |
-
-## JSON Functions
-| Function              | Example                               | Description                                                                                                                  |
-|-----------------------|---------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
-| to_json               | to_json(col1)                         | Converts a value to a string containing the JSON representation of the value. If the input is NULL, the result is also NULL. |
-| parse_json            | parse_json(col1)                      | Converts a JSON string to a value. If the input is NULL, the result is also NULL.                                            |
-| json_path_exists      | json_path_exists(col1, "$.name")      | Checks whether JSON path returns any item for the specified JSON value. Return bool value.                                   |
-| json_path_query       | json_path_query(col1, "$.name")       | Gets all items returned by JSON path for the specified JSON value.                                                           |
-| json_path_query_first | json_path_query_first(col1, "$.name") | Gets the first item returned by JSON path for the specified JSON value.                                                      |
-
-**Please refer to [json path functions](./json_expr.md#json-path-functions) for how to compose a json path.**  
-
-## Compression/Decompression Functions
-
-| Function   | Example                   | Description                                                           |
-|------------|---------------------------|-----------------------------------------------------------------------|
-| compress   | compress(input, "zlib")   | Compress the input string or binary value with a compression method   |
-| decompress | decompress(input, "zlib") | Decompress the input string or binary value with a compression method |
-
-Currently, 'zlib', 'gzip', 'flate' and 'zstd' method are supported.
-
-## Array Functions
-
-| Function            | Example                           | Description                                                                                                                                |
-|---------------------|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|
-| array_position      | array_position(array, value)      | Return a 0-based index of the first occurrence of val if it is found within array. If val does not exist within array, it returns -1       |
-| element_at          | element_at(array, index)          | Returns element of array at index val. If val < 0, this function accesses elements from the last to the first                              |
-| array_contains      | array_contains(array, value)      | Returns true if array contains the element                                                                                                 |
-| array_create        | array_create(value1, ......)      | Construct an array from literals                                                                                                           |
-| array_remove        | array_remove(array, value)        | Returns the array with all occurrences of value removed                                                                                    |
-| array_last_position | array_last_position(array, val)   | Return a 0-based index of the last occurrence of val if it is found within array. If val does not exist within array, it returns -1        |
-| array_contain_any   | array_contain_any(array1, array2) | Returns true if array1 and array2 have any elements in common                                                                              |
-| array_intersect     | array_intersect(array1, array2)   | Returns an intersection of the two arrays, with all duplicates removed                                                                     |
-| array_union         | array_union(array1, array2)       | Returns a union of the two arrays, with all duplicates removed                                                                             |
-| array_max           | array_max(array)                  | Returns an element which is greater than or equal to all other elements of the array. If an element of the array is null, it returns null  |
-| array_min           | array_min(array)                  | Returns an element which is less than or equal to all other elements of the array. If an element of the array is null, it returns null     |
-| array_except        | array_except(array1, array2)      | Returns an array of elements in array1 but not in array2, without duplicates                                                               |
-| repeat              | repeat(val, count)                | Constructs an array of val repeated count times                                                                                            |
-| sequence            | sequence(start, stop[, step])     | Constructs an array from start to stop with each value increasing or decreasing by step. If step is not provided, it defaults to 1 if start is less than stop, or -1 if start is greater than stop. Notice that step is not allowed to be 0 |
-
-
-## Object Functions
-
-| Function         | Example                          | Description                                                                                                                                                                                                                                                                                       |
-|------------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| keys             | keys(map[string]interface{})     | Return an array containing the keys of the map                                                                                                                                                                                                                                                    |
-| values           | values(map[string]interface{})   | Return an array containing the values of the map                                                                                                                                                                                                                                                  |
-| object           | object(arr1, arr2)               | Construct an object from an array of keys and an array of values. keys must be an array of strings. values must be an arbitrary array of the same length as keys.                                                                                                                                 |
-| zip              | zip([arr1, arr2], ......)        | Construct an object from an array of entries. Each entry must itself be an array of size 2: the first element is the key (and must be a string), and the second element is the value.                                                                                                             |
-| items            | items(map[string]interface{})    | Return an array containing the entries of obj. Each entry is a 2-element array; the first is the key, the second is the value.                                                                                                                                                                    |
-| object_construct | object_construct(key1, col, ...) | Return a struct type object/map constructed by the arguments. The arguments are series of key value pairs, thus the arguments count must be an odd number. The key must a string and the value can be of any type. If the value is null, the key/value pair will not present in the final object. |
-
-## Analytic Functions
-
-Analytic functions always use state to do analytic jobs. In streaming processing, analytic functions are evaluated first so that they are not affected by predicates in WHERE clause.
-
-Analytic function call format is, over is optional
-
-```
-AnalyticFuncName(<arguments>...) OVER ([PARTITION BY <partition key>] [WHEN <Expression>])
-```
-
-Analytic function computations are performed over all the input events of the current query input, optionally you can limit analytic function to only consider events that match the partition_by_clause.
-
-The syntax is like:
-
-```
-AnalyticFuncName(<arguments>...) OVER ([PARTITION BY <partition key>])
-```
-
-The analysis function can use the WHEN clause to determine whether the current event is a valid event based on whether the condition is met.
-When it is a valid event, calculate the result and update the state according to the analysis function semantics. When it is an invalid event, ignore the event value and reuse the saved state value.
-
-```
-AnalyticFuncName(<arguments>...) OVER ([WHEN <Expression>])
-```
-
-
-
-| Function    | Example                              | Description                                                                                                                                                                                                                |
-|-------------|--------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| lag         | lag(expr, [offset], [default value]) | Return the former result of expression at offset, if not found, return the default value specified , if default value not set, return nil. if offset and default value not specified, offset is 1 and default value is nil |
-| latest      | latest(expr, [default value])        | Return the lastest non null value of the expression. If not found, return the default value specified , if default value not set, return nil.                                                                              |
-| changed_col | changed_col(true, col)               | Return the column value if it has changed from the last execution.                                                                                                                                                         |
-| had_changed | had_changed(true, expr1, expr2, ...) | Return if any of the columns had changed since the last run. The expression could be * to easily detect the change status of all columns.                                                                                  |
-
-Example function call to get the previous temperature value:
-
-```text
-lag(temperature)
-```
-
-Example function call to get the previous temperature value with the same device id:
-
-```text
-lag(temperature) OVER (PARTITION BY deviceId)
-```
-
-Example function call to calculate duration of events:  ts is timestamp, and statusCode1 and statusCode2 are device status in the same event
-
-```text
-select lag(Status) as Status, ts - lag(ts, 1, ts) OVER (WHEN had_changed(true, statusCode)) as duration from demo
-```
-
-## Other Functions
-| Function        | Example                              | Description                                                                                                                                                                                                                                                                                                                                                                                       |
-|-----------------|--------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| isNull          | isNull(col1)                         | Returns true if the argument is the Null value.                                                                                                                                                                                                                                                                                                                                                   |
-| coalesce        | coalesce(expr1, expr2, ...)          | Return the first non null value. If all expr are null,return nil.                                                                                                                                                                                                                                                                                                                                 |
-| cardinality     | cardinality(col1)                    | The number of members in the group. The null value is 0.                                                                                                                                                                                                                                                                                                                                          |
-| newuuid         | newuuid()                            | Returns a random 16-byte UUID.                                                                                                                                                                                                                                                                                                                                                                    |
-| tstamp          | tstamp()                             | Returns the current timestamp in milliseconds from 00:00:00 Coordinated Universal Time (UTC), Thursday, 1 January 1970                                                                                                                                                                                                                                                                            |
-| rule_id         | rule_id()                            | Returns the ID of the currently matched rule                                                                                                                                                                                                                                                                                                                                                      |
-| mqtt            | mqtt(topic)                          | Returns the MQTT meta-data of specified key. The current supported keys<br />- topic: return the topic of message.  If there are multiple stream source, then specify the source name in parameter. Such as `mqtt(src1.topic)`<br />- messageid: return the message id of message. If there are multiple stream source, then specify the source name in parameter. Such as `mqtt(src2.messageid)` |
-| meta            | meta(topic)                          | Returns the meta-data of specified key. The key could be:<br/> - a standalone key if there is only one source in the from clause, such as `meta(device)`<br />- A qualified key to specify the stream, such as `meta(src1.device)` <br />- A key with arrow for multi level meta data, such as `meta(src1.reading->device->name)` This assumes reading is a map structure meta data.              |
-| window_start    | window_start()                       | Return the window start timestamp in int64 format. If there is no time window, it returns 0. The window time is aligned with the timestamp notion of the rule. If the rule is using processing time, then the window start timestamp is the processing timestamp. If the rule is using event time, then the window start timestamp is the event timestamp.                                        |
-| window_end      | window_end()                         | Return the window end timestamp in int64 format. If there is no time window, it returns 0. The window time is aligned with the timestamp notion of the rule. If the rule is using processing time, then the window start timestamp is the processing timestamp. If the rule is using event time, then the window start timestamp is the event timestamp.                                          |
-| get_keyed_state | get_keyed_state(expr1, expr2, expr3) | Return the keyed value in database. First parameter is the key, second is data format of the value, support bigint, float, string, boolean and datetime. third is the default value if key not exist. Default database is sqlite, users can change the database by this [configuration](../configuration/global_configurations.md#external-state).                                                |
-| delay           | delay(delayTime, returnVal)          | Delay the execution of the rule for a specified time and then return the returnVal.                                                                                                                                                                                                                                                                                                               |
-
-## Multiple Column Functions
-
-A multiple column function is a function that returns multiple columns. Contrast to normal scalar function, which returns a single column of a single row.
-
-Multiple column function can only be used in the `SELECT` clause of a query. 
-
-| Function     | Example                                      | Description                                                                                                 |
-|--------------|----------------------------------------------|-------------------------------------------------------------------------------------------------------------|
-| changed_cols | changed_cols(prefix, ignoreNull, colA, colB) | Return the changed columns whose name are prefixed. Check [changed_cols](#changedcols-function) for detail. |
-
-## Multiple Row Functions 
-
-A multiple row function is a function that returns multiple rows.
-
-Multiple row function can only be used in the `SELECT` clause of a query and only allowed 1 multiple rows function in the clause for now.
-
-| Function | Example       | Description                                                                                                                                                                                                                    |
-|----------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| unnest   | unnest(array) | The argument column must be an array. This function will expand the array into multiple rows as returned result. If the item in the array is map[string]interface object, then it will be built as columns in the result rows. |
-
-### Examples
-
-Create a stream demo and have below inputs
-
-```json lines
-{"a": [1,2], "b": 3}
-```
-
-Rule to get the unnest values:
-
-```text
-SQL: SELECT unnest(a) FROM demo
-___________________________________________________
-{"unnest":1}
-{"unnest":2}
-```
-
-Rule to get the unnest values with other columns:
-
-```text
-SQL: SELECT unnest(a), b FROM demo
-___________________________________________________
-{"unnest":1, "b":3}
-{"unnest":2, "b":3}
-```
-
-Create a stream demo and have below inputs
-
-```json lines
-{"x": [{"a": 1,"b": 2}, {"a": 3,"b": 4}], "c": 5}
-```
-
-Rule to get the unnest values with other columns:
-
-```text
-SQL: SELECT unnest(x), c FROM demo
-___________________________________________________
-{"a":1, "b":2, "c": 5}
-{"a":3, "b":4, "c": 5}
-```
-
-## Functions to detect changes
-
-### Changed_col function
-
-This function is a normal scalar function, so it can be used in any clause including SELECT and WHERE. 
-
-**Syntax**
-
-```CHANGED_COL(<ignoreNull>, <expr>)```
-
-**Arguments**
-
-**ignoreNull**: whether to ignore null values when comparing for changes. If true, the null value won’t emit a change.
-
-**expr**: An expression to be selected and monitored for the changed status.
-
-**Returns**
-
-Return the changed value or nil with column name changed_col by default like any other functions. Use `as alias` to rename the column.
-
-### Changed_cols function
-
-This function returns multiple columns, so it is only allowed in the SELECT clause.
-
-**Syntax**
-
-```CHANGED_COLS (<prefix>, <ignoreNull>, <expr> [,...,<exprN>])```
-
-**Arguments**
-
-**prefix**: The prefix of the selected column name. By default, the selected name will be the same as select the expr directly. For example, `CHANGED_COLS("", true, col1)` will return `col1` as the name. If setting a prefix, the return name will have that prefix. For example, `CHANGED_COLS("changed_", true, col1)` will return `changed_col1` as the name.
-
-**ignoreNull**: whether to ignore null values when detecting changes. If true, the null value won’t trigger a change.
-
-**expr**: An expression to be selected and monitored for the changed status. Allow any expression that can be used in select clause. The expression can be a `*` which will return multiple columns by one expression.
-
-**Returns**
-
-Return all changed values compared to the previous sink result. So if using in a scalar rule, it will compare to the previous value emit. If using in a window, it will compare to the previous window result.
-
-In the first run, all expressions will be returned because there is no previous result.
-
-In the consequent runs, if nothing changed, it can emit nothing. And if the sink has the default omitEmpty, the sink will not be triggerred.
-
-**Notice**
-
-The multiple column outputs can only be used in the select clause. Even the selected result cannot be access in WHERE or other place. If filter based on the value is needed, use CHANGED_COL or set the result of multiple column outputs as the prior rule in a rule chain.
-
-For multiple column outputs, the alias can only be set  generally with the prefix. To set alias for each column separately, try to call the changed function for each column respectively and use as to set alias. 
-
-### Had_changed function
-
-This function is a scalar function with one or more arguments.
-
-```HAD_CHANGED (<ignoreNull>, <expr> [,...,<exprN>])```
-
-**Arguments**
-
-**ignoreNull**: whether to ignore null values when detecting changes. If true, the null value won’t trigger a change.
-
-**expr**: An expression to be monitored for the changed status. Allow any expression that can be used in select clause. The expression can be a `*` to detect changes of all columns easily.
-
-**Returns**
-
-Return a bool value to indicate the changed status if any of the arguments had changed since the last run. The multiple arguments' version is a handy way to check HAD_CHANGED(expr1) OR HAD_CHANGED(expr2) ... OR HAD_CHANGED(exprN). To detect other relationship, just use separate HAD_CHANGED functions. For example, to check if all expressions are changed HAD_CHANGED(expr1) AND HAD_CHANGED(expr2) ... AND HAD_CHANGED(exprN).
-
-### Examples
-
-Create a stream demo and have below inputs
-
-```json lines
-{"ts":1, "temperature":23, "humidity":88}
-{"ts":2, "temperature":23, "humidity":88}
-{"ts":3, "temperature":23, "humidity":88}
-{"ts":4, "temperature":25, "humidity":88}
-{"ts":5, "temperature":25, "humidity":90}
-{"ts":6, "temperature":25, "humidity":91}
-{"ts":7, "temperature":25, "humidity":91}
-{"ts":8, "temperature":25, "humidity":91}
-```
-
-Rule to get the changed temperature values:
-
-```text
-SQL: SELECT CHANGED_COLS("", true, temperature) FROM demo
-___________________________________________________
-{"temperature":23}
-{"temperature":25}
-```
-
-Rule to get the changed temperature and humidity values, and rename the changed value in a unified prefix:
-
-```text
-SQL: SELECT CHANGED_COLS("c_", true, temperature, humidity) FROM demo
-_________________________________________________________
-{"c_ts":1, "c_temperature":23, "c_humidity":88}
-{"c_ts":2}
-{"c_ts":3}
-{"c_ts":4, "c_temperature":25}
-{"c_ts":5, "c_humidity":90}
-{"c_ts":6, "c_humidity":91}
-{"c_ts":7}
-{"c_ts":8}
-```
-
-Rule to get the changed values of all columns and do not ignore null:
-
-```text
-SQL: SELECT CHANGED_COLS("c_", false, *) FROM demo
-_________________________________________________________
-{"c_temperature":23,"c_humidity":88}
-{"c_temperature":25}
-{"c_humidity":90}
-{"c_humidity":91}
-```
-
-Rule to get the average value change in a window:
-
-```text
-SQL: SELECT CHANGED_COLS("t", true, avg(temperature)) FROM demo GROUP BY CountWindow(2)
-_________________________________________________________________
-{"tavg":23}
-{"tavg":24}
-{"tavg":25}
-```
-
-Rule to get the events when temperature or humidity changed:
-
-```text
-SQL: SELECT ts, temperature, humidity FROM demo
-WHERE HAD_CHANGED(true, temperature, humidity) = true
-_________________________________________________________
-{"ts":1,temperature":23,"humidity":88}
-{"ts":4,temperature":25,"humidity":88}
-{"ts":5,temperature":25,"humidity":90}
-{"ts":6,temperature":25,"humidity":91}
-```
-
-Rule to get the events when temperature has changed but humidity has NOT changed:
-
-```text
-SQL: SELECT ts, temperature, humidity FROM demo 
-WHERE HAD_CHANGED(true, temperature) = true AND HAD_CHANGED(true, humidity) = false
-_________________________________________________________
-{"ts":4,temperature":25,"humidity":88}
-```
-
-Rule to get the changed temperature and humidity value with customized names:
-
-```text
-SQL: SELECT CHANGED_COL(true, temperature) AS myTemp, CHANGED_COL(true, humidity) AS myHum FROM demo
-_________________________________________________________
-{"myTemp":23,"myHum":88}
-{"myTemp":25}
-{"myHum":90}
-{"myHum":91}
-```
-
-Rule to get the changed values when the temperature had changed to value bigger than 24:
-
-```text
-SQL: SELECT ts, temperature, humidity FROM demo 
-WHERE CHANGED_COL(true, temperature) > 24
-_________________________________________________________
-{"ts":4,temperature":25,"humidity":88}
-```

docs/en_US/sqls/data_types.md

@@ -8,22 +8,27 @@ In eKuiper, each column or an expression has a related data type. A data type de
 
 Below is the list of data types supported.
 
-| #   | Data type | Description                                                                       |
-|-----|-----------|-----------------------------------------------------------------------------------|
-| 1   | bigint    | The int type.                                                                     |
-| 2   | float     | The float type.                                                                   |
-| 3   | string    | Text values, comprised of Unicode characters.                                     |
-| 4   | datetime  | datetime type.                                                                    |
-| 5   | boolean   | The boolean type, the value could be `true` or `false`.                           |
-| 6   | bytea     | A sequence of bytes to store binary data. If the stream format is "JSON", the bytea field must be a base64 encoded string.                  |
-| 7   | array     | The array type, can be any types from simple data or struct type.                  |
-| 8   | struct    | The complex type. Set of name/value pairs. Values must be of supported data type. |
+| # | Data type | Description                                                                                                                |
+|---|-----------|----------------------------------------------------------------------------------------------------------------------------|
+| 1 | bigint    | The int type.                                                                                                              |
+| 2 | float     | The float type.                                                                                                            |
+| 3 | string    | Text values, comprised of Unicode characters.                                                                              |
+| 4 | datetime  | datetime type.                                                                                                             |
+| 5 | boolean   | The boolean type, the value could be `true` or `false`.                                                                    |
+| 6 | bytea     | A sequence of bytes to store binary data. If the stream format is "JSON", the bytea field must be a base64 encoded string. |
+| 7 | array     | The array type, can be any types from simple data or struct type.                                                          |
+| 8 | struct    | The complex type. Set of name/value pairs. Values must be of supported data type.                                          |
 
 ## Compatibility of comparison and calculation
 
-There may be binary operations in each sql clause. In this example, `Select temperature * 2 from demo where temperature > 20`, a calculation operation is used in select clause and a comparison operation is used in the where clause. In the binary operations, if incompatible data types are used, a runtime error will happen and send to the sinks.
+There may be binary operations in each sql clause. In this
+example, `Select temperature * 2 from demo where temperature > 20`, a calculation operation is used in select clause and
+a comparison operation is used in the where clause. In the binary operations, if incompatible data types are used, a
+runtime error will happen and send to the sinks.
 
-Array and struct are not supported in any binary operations. The compatibility of other data types are listed in below table. Whereas, the row header is the left operand data type and the column header is the right operand data. The value is the compatibility in which Y stands for yes and N stands for no.
+Array and struct are not supported in any binary operations. The compatibility of other data types is listed in below
+table. Whereas, the row header is the left operand data type and the column header is the right operand data. The value
+is the compatibility in which Y stands for yes and N stands for no.
 
 | #        | bigint | float | string                    | datetime | boolean |
 |----------|--------|-------|---------------------------|----------|---------|
@@ -42,4 +47,5 @@ Array and struct are not supported in any binary operations. The compatibility o
 
 ## Type conversions
 
-There is a built-in function `cast(col, targetType)` to explicitly convert from one date type to another in runtime. Please refer to [cast](./built-in_functions.md#conversion-functions) for detail.
+There is a built-in function `cast(col, targetType)` to explicitly convert from one date type to another in runtime.
+Please refer to [cast](./functions/transform_functions.md) for detail.

docs/en_US/sqls/functions/aggregate_functions.md

@@ -0,0 +1,156 @@
+# Aggregate Functions
+
+Aggregate functions perform a calculation on a set of values and return a single value. Aggregate functions can be used
+as expressions only in the following:
+
+* The select list of a SELECT statement (either a sub-query or an outer query).
+* A HAVING clause.
+
+## AVG
+
+```
+avg(col)
+```
+
+The average of the values in a group. The null values will be ignored.
+
+## COUNT
+
+```
+count(*)
+count(col)
+```
+
+The number of items in a group. The null values will be ignored.
+
+## MAX
+
+```
+max(col)
+```
+
+The maximum value in a group. The null values will be ignored.
+
+## MIN
+
+```
+min(col)
+```
+
+The minimum value in a group. The null values will be ignored.
+
+## SUM
+
+```
+sum(col)
+```
+
+The sum of all the values in a group. The null values will be ignored.
+
+## COLLECT
+
+```
+collect(*)
+collect(col1, col2 ...)
+```
+
+Returns an array with all columns or the whole record (when the parameter is *) values from the group.
+
+Examples:
+
+- Get an array of column `a` of the current window. Assume the column `a` is of an int type, the result will be
+  like: `[{"r1":[32, 45]}]`
+    ```sql
+    SELECT collect(a) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
+    ```
+- Get the whole array of the current window. The result will be
+  like: `[{"r1":{"a":32, "b":"hello"}, {"a":45, "b":"world"}}]`
+    ```sql
+    SELECT collect(*) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
+    ```
+
+- Get the second element's column 'a' value within the current window. The result will be like: `[{"r1":32}]`
+    ```sql
+    SELECT collect(*)[1]->a as r1 FROM test GROUP BY TumblingWindow(ss, 10)
+    ```
+
+## DEDUPLICATE
+
+```
+deduplicate(col, false)
+```
+
+Returns the deduplicate results in the group, usually a window. The first argument is the column as the key to
+deduplicate; the second argument is whether to return all items or just the latest item which is not duplicate. If the
+latest item is a duplicate, the sink will receive an empty map. Set the sink
+property [omitIfEmpty](../../guide/sinks/overview.md#common-properties) to the sink to not triggering the action.
+
+Examples:
+
+- Get the whole array of the current window which is deduplicated by column `a`. The result will be
+  like: `[{"r1":{"a":32, "b":"hello"}, {"a":45, "b":"world"}}]`
+    ```sql
+    SELECT deduplicate(a, true) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
+    ```
+- Get the column `a` value which is not duplicate during the last hour. The result will be
+  like: `[{"r1":32}]`, `[{"r1":45}]` and `[{}]` if a duplicate value arrives. Use the omitIfEmpty sink property to
+  filter out those empty results.
+     ```sql
+     SELECT deduplicate(a, false)->a as r1 FROM demo GROUP BY SlidingWindow(hh, 1)
+     ```
+
+## STDDEV
+
+```
+stddev(col)
+```
+
+Returns the population standard deviation of expression in the group, usually a window. The argument is the column as
+the key to stddev.
+
+## STDDEVS
+
+```
+stddevs(col)
+```
+
+Returns the sample standard deviation of expression in the group, usually a window. The argument is the column as the
+key to stddevs.
+
+## VAR
+
+```
+var(col)
+```
+
+Returns the population variance (square of the population standard deviation) of expression in the group, usually a
+window. The argument is the column as the key to var.
+
+## VARS
+
+```
+vars(col)
+```
+
+Returns the sample variance (square of the sample standard deviation) of expression in the group, usually a window. The
+argument is the column as the key to vars.
+
+## PERCENTILE
+
+```
+percentile(col, percentile)
+```
+
+Returns the percentile value based on a continuous distribution of expression in the group, usually a window. The first
+argument is the column as the key to percentile. The second argument is the percentile of the value that you want to
+find. The percentile must be a constant between 0.0 and 1.0.
+
+## PERCENTILE_DISC
+
+```
+percentile_disc(col, percentile)
+```
+
+Returns the percentile value based on a discrete distribution of expression in the group, usually a window. The first
+argument is the column as the key to percentile_disc. The second argument is the percentile of the value that you want
+to find. The percentile must be a constant between 0.0 and 1.0.

docs/en_US/sqls/functions/analytic_functions.md

@@ -0,0 +1,294 @@
+# Analytic Functions
+
+Analytic functions use state to do analytic jobs. In streaming processing, analytic functions are evaluated first so
+that they are not affected by predicates in WHERE clause.
+
+Analytic function call format is as below, where `over` clause is optional
+
+```
+AnalyticFuncName(<arguments>...) OVER ([PARTITION BY <partition key>] [WHEN <Expression>])
+```
+
+Analytic function computations are performed over all the input events of the current query input, optionally you can
+limit analytic function to only consider events that match the partition_by_clause.
+
+The syntax is like:
+
+```
+AnalyticFuncName(<arguments>...) OVER ([PARTITION BY <partition key>])
+```
+
+The analysis function can use the WHEN clause to determine whether the current event is a valid event based on whether
+the condition is met.
+When it is a valid event, calculate the result and update the state according to the analysis function semantics. When
+it is an invalid event, ignore the event value and reuse the saved state value.
+
+```
+AnalyticFuncName(<arguments>...) OVER ([WHEN <Expression>])
+```
+
+## LAG
+
+```
+lag(expr, [offset], [default value])
+```
+
+Return the former result of expression at offset, if not found, return the default value specified, if default value not
+set, return nil. If offset and default value are not specified, offset is 1 and default value is nil.
+
+Example function call to get the previous temperature value:
+
+```text
+lag(temperature)
+```
+
+Example function call to get the previous temperature value with the same device id:
+
+```text
+lag(temperature) OVER (PARTITION BY deviceId)
+```
+
+Example function call to calculate duration of events: ts is timestamp, and statusCode1 and statusCode2 are device
+status in the same event
+
+```text
+select lag(Status) as Status, ts - lag(ts, 1, ts) OVER (WHEN had_changed(true, statusCode)) as duration from demo
+```
+
+## LATEST
+
+```
+latest(expr, [default value])
+```
+
+Return the latest non-null value of the expression. If not found, return the default value specified, if default value
+not set, return nil.
+
+## CHANGED_COL
+
+```
+changed_col(true, col)
+```
+
+Return the column value if it has changed from the last execution.
+
+## HAD_CHANGED
+
+```
+had_changed(true, expr1, expr2, ...)
+```
+
+Return if any of the columns had changed since the last run. The expression could be * to easily detect the change
+status of all columns.
+
+## Functions to detect changes
+
+### Changed_col function
+
+This function is a normal scalar function, so it can be used in any clause including SELECT and WHERE.
+
+**Syntax**
+
+```CHANGED_COL(<ignoreNull>, <expr>)```
+
+**Arguments**
+
+**ignoreNull**: whether to ignore null values when comparing for changes. If true, the null value won’t emit a change.
+
+**expr**: An expression to be selected and monitored for the changed status.
+
+**Returns**
+
+Return the changed value or nil with column name changed_col by default like any other functions. Use `as alias` to
+rename the column.
+
+### Changed_cols function
+
+This function returns multiple columns, so it is only allowed in the SELECT clause.
+
+**Syntax**
+
+```CHANGED_COLS (<prefix>, <ignoreNull>, <expr> [,...,<exprN>])```
+
+**Arguments**
+
+**prefix**: The prefix of the selected column name. By default, the selected name will be the same as select the expr
+directly. For example, `CHANGED_COLS("", true, col1)` will return `col1` as the name. If setting a prefix, the return
+name will have that prefix. For example, `CHANGED_COLS("changed_", true, col1)` will return `changed_col1` as the name.
+
+**ignoreNull**: whether to ignore null values when detecting changes. If true, the null value won’t trigger a change.
+
+**expr**: An expression to be selected and monitored for the changed status. Allow any expression that can be used in
+select clause. The expression can be a `*` which will return multiple columns by one expression.
+
+**Returns**
+
+Return all changed values compared to the previous sink result. So if used in a scalar rule, it will compare to the
+previous value emitting. If used in a window, it will compare to the previous window result.
+
+In the first run, all expressions will be returned because there is no previous result.
+
+In the consequent runs, if nothing changed, it can emit nothing. And if the sink has the default omitEmpty, the sink
+will not be triggerred.
+
+**Notice**
+
+The multiple column outputs can only be used in the select clause. Even the selected result cannot be accessed in WHERE
+or other place. If a filter based on the value is needed, use CHANGED_COL or set the result of multiple column outputs
+as the prior rule in a rule chain.
+
+For multiple column outputs, the alias can only be set generally with the prefix. To set alias for each column
+separately, try to call the changed function for each column respectively and use as to set alias.
+
+### Had_changed function
+
+This function is a scalar function with one or more arguments.
+
+```HAD_CHANGED (<ignoreNull>, <expr> [,...,<exprN>])```
+
+**Arguments**
+
+**ignoreNull**: whether to ignore null values when detecting changes. If true, the null value won’t trigger a change.
+
+**expr**: An expression to be monitored for the changed status. Allow any expression that can be used in select clause.
+The expression can be a `*` to detect changes of all columns easily.
+
+**Returns**
+
+Return a bool value to indicate the changed status if any of the arguments had changed since the last run. The multiple
+arguments' version is a handy way to check HAD_CHANGED(expr1) OR HAD_CHANGED(expr2) ... OR HAD_CHANGED(exprN). To detect
+another relationship, just use separate HAD_CHANGED functions. For example, to check if all expressions are changed
+HAD_CHANGED(expr1) AND HAD_CHANGED(expr2) ... AND HAD_CHANGED(exprN).
+
+### Examples
+
+Create a stream demo and have below inputs
+
+```json lines
+{
+  "ts": 1,
+  "temperature": 23,
+  "humidity": 88
+}
+{
+  "ts": 2,
+  "temperature": 23,
+  "humidity": 88
+}
+{
+  "ts": 3,
+  "temperature": 23,
+  "humidity": 88
+}
+{
+  "ts": 4,
+  "temperature": 25,
+  "humidity": 88
+}
+{
+  "ts": 5,
+  "temperature": 25,
+  "humidity": 90
+}
+{
+  "ts": 6,
+  "temperature": 25,
+  "humidity": 91
+}
+{
+  "ts": 7,
+  "temperature": 25,
+  "humidity": 91
+}
+{
+  "ts": 8,
+  "temperature": 25,
+  "humidity": 91
+}
+```
+
+Rule to get the changed temperature values:
+
+```text
+SQL: SELECT CHANGED_COLS("", true, temperature) FROM demo
+___________________________________________________
+{"temperature":23}
+{"temperature":25}
+```
+
+Rule to get the changed temperature and humidity values, and rename the changed value in a unified prefix:
+
+```text
+SQL: SELECT CHANGED_COLS("c_", true, temperature, humidity) FROM demo
+_________________________________________________________
+{"c_ts":1, "c_temperature":23, "c_humidity":88}
+{"c_ts":2}
+{"c_ts":3}
+{"c_ts":4, "c_temperature":25}
+{"c_ts":5, "c_humidity":90}
+{"c_ts":6, "c_humidity":91}
+{"c_ts":7}
+{"c_ts":8}
+```
+
+Rule to get the changed values of all columns and do not ignore null:
+
+```text
+SQL: SELECT CHANGED_COLS("c_", false, *) FROM demo
+_________________________________________________________
+{"c_temperature":23,"c_humidity":88}
+{"c_temperature":25}
+{"c_humidity":90}
+{"c_humidity":91}
+```
+
+Rule to get the average value change in a window:
+
+```text
+SQL: SELECT CHANGED_COLS("t", true, avg(temperature)) FROM demo GROUP BY CountWindow(2)
+_________________________________________________________________
+{"tavg":23}
+{"tavg":24}
+{"tavg":25}
+```
+
+Rule to get the events when temperature or humidity changed:
+
+```text
+SQL: SELECT ts, temperature, humidity FROM demo
+WHERE HAD_CHANGED(true, temperature, humidity) = true
+_________________________________________________________
+{"ts":1,temperature":23,"humidity":88}
+{"ts":4,temperature":25,"humidity":88}
+{"ts":5,temperature":25,"humidity":90}
+{"ts":6,temperature":25,"humidity":91}
+```
+
+Rule to get the events when temperature has changed but humidity has NOT changed:
+
+```text
+SQL: SELECT ts, temperature, humidity FROM demo 
+WHERE HAD_CHANGED(true, temperature) = true AND HAD_CHANGED(true, humidity) = false
+_________________________________________________________
+{"ts":4,temperature":25,"humidity":88}
+```
+
+Rule to get the changed temperature and humidity value with customized names:
+
+```text
+SQL: SELECT CHANGED_COL(true, temperature) AS myTemp, CHANGED_COL(true, humidity) AS myHum FROM demo
+_________________________________________________________
+{"myTemp":23,"myHum":88}
+{"myTemp":25}
+{"myHum":90}
+{"myHum":91}
+```
+
+Rule to get the changed values when the temperature had changed to value bigger than 24:
+
+```text
+SQL: SELECT ts, temperature, humidity FROM demo 
+WHERE CHANGED_COL(true, temperature) > 24
+_________________________________________________________
+{"ts":4,temperature":25,"humidity":88}
+```

docs/en_US/sqls/functions/array_functions.md

@@ -0,0 +1,127 @@
+# Array Functions
+
+Array functions manipulate arrays or return information about arrays.
+
+## CARDINALITY
+
+```
+cardinality(array)
+```
+
+The number of members in the array. The null value will return 0.
+
+## ARRAY_POSITION
+
+```
+array_position(array, value)
+```
+
+Return a 0-based index of the first occurrence of val if it is found within an array. If val does not exist within the
+array, it returns -1.
+
+## ELEMENT_AT
+
+```
+element_at(array, index)
+```
+
+Returns element of the array at index val. If val < 0, this function accesses elements from the last to the first.
+
+## ARRAY_CONTAINS
+
+```
+array_contains(array, value)
+```
+
+Returns true if array contains the element.
+
+## ARRAY_CREATE
+
+```
+array_create(value1, ......)
+```
+
+Construct an array from literals.
+
+## ARRAY_REMOVE
+
+```
+array_remove(array, value)
+```
+
+Returns the array with all occurrences of value removed.
+
+## ARRAY_LAST_POSITION
+
+```
+array_last_position(array, val)
+```
+
+Return a 0-based index of the last occurrence of val if it is found within the array. If val does not exist within the
+array, it returns -1.
+
+## ARRAY_CONTAIN_ANY
+
+```
+array_contain_any(array1, array2)
+```
+
+Returns true if array1 and array2 have any elements in common.
+
+## ARRAY_INTERSECT
+
+```
+array_intersect(array1, array2)
+```
+
+Returns an intersection of the two arrays, with all duplicates removed.
+
+## ARRAY_UNION
+
+```
+array_union(array1, array2)
+```
+
+Returns a union of the two arrays, with all duplicates removed.
+
+## ARRAY_MAX
+
+```
+array_max(array)
+```
+
+Returns an element which is greater than or equal to all other elements of the array. If an element of the array is
+null, it returns null.
+
+## ARRAY_MIN
+
+```
+array_min(array)
+```
+
+Returns an element which is less than or equal to all other elements of the array. If an element of the array is null,
+it returns null.
+
+## ARRAY_EXCEPT
+
+```
+array_except(array1, array2)
+```
+
+Returns an array of elements that are in array1 but not in array2, without duplicates.
+
+## REPEAT
+
+```
+repeat(string, count)
+```
+
+Constructs an array of val repeated count times.
+
+## SEQUENCE
+
+```
+sequence(start, stop, step)
+```
+
+Returns an array of integers from start to stop, incrementing by step.

docs/en_US/sqls/custom_functions.md

@@ -1,6 +1,7 @@
 # Custom function
 
-eKuiper can customize functions. For the development, compilation and use of functions, please [see here](../extension/native/develop/function.md).
+eKuiper can customize functions.
+For the development, compilation and use of functions, please [see here](../../extension/native/develop/function.md).
 
 ## echo plugin
 
@@ -120,7 +121,7 @@ geohashDecodeInt example
 SELECT geohashDecodeInt(hash) FROM test
 ```
 
- geohashBoundingBox  example
+geohashBoundingBox example
 
 - Input: `{"hash" :"qgmpvf18h86e"} `
 - Output: `{"geohashBoundingBox":{"MinLat":-25.345457140356302,"MaxLat":-25.34545697271824,"MinLng":131.03619195520878,"MaxLng":131.0361922904849}}`
@@ -129,7 +130,7 @@ SELECT geohashDecodeInt(hash) FROM test
 SELECT geohashBoundingBox(hash) FROM test
 ```
 
- geohashBoundingBoxInt  example
+geohashBoundingBoxInt example
 
 - Input: `{"hash" :12963433097944239317}`
 - Output: `{"geohashBoundingBoxInt":{"MinLat":-25.345456302165985,"MaxLat":-25.34545626025647,"MinLng":131.0361886024475,"MaxLng":131.03618868626654}}`
@@ -176,7 +177,10 @@ SELECT geohashNeighborsInt(hash) FROM test
 
 ### LabelImage plugin
 
-This is a sample plugin(use in docker image tags with ``-slim`` suffix) to demonstrate the usage of TensorFlowLite(tflite) model interpreter. The function receives a bytea input representing an image and produce the AI label of the image by running the tflite model.
+This is a sample plugin(use in docker image tags with ``-slim`` suffix)
+to demonstrate the usage of TensorFlowLite(tflite) model interpreter.
+The function receives a bytea input representing an image
+and produces the AI label of the image by running the tflite model.
 
 Assuming the input is the byte array of peacock.jpg, the output will be "peacock".
 
@@ -186,9 +190,12 @@ SELECT labelImage(self) FROM tfdemo
 
 ### tfLite plugin
 
-This is a plugin (use in docker image tags with ``-slim`` suffix) to do the TensorFlow Lite inference. Users just need upload the `.tflite` model, call the `tfLite(model_name, input_data)` function in sql, then will receive results from the model inference.
-When uploading a model, please use the [uploads](../api/restapi/uploads.md) interface to upload the model file.
-`model_name` should be the name for the model without `.tflite` suffix.  `input_data` should be the key field in message and value should be 1D array format
+This is a plugin (use in docker image tags with ``-slim`` suffix) to do the TensorFlow Lite inference.
+Users just need to upload the `.tflite` model, call the `tfLite(model_name, input_data)` function in sql,
+then will receive results from the model inference.
+When uploading a model, please use the [uploads](../../api/restapi/uploads.md) interface to upload the model file.
+`model_name` should be the name for the model without `.tflite` suffix.
+Should be the key field in a message and value should be 1D array format
 
 ```sql
 SELECT tfLite(model_name, input_data) FROM tfdemo

docs/en_US/sqls/functions/hashing_functions.md

@@ -0,0 +1,43 @@
+# Hashing Functions
+
+Hashing functions are used to hash the input value.
+
+## MD5
+
+```
+md5(col)
+```
+
+Return md5 hashed value of the argument.
+
+## SHA1
+
+```
+sha1(col)
+```
+
+Return sha1 hashed value of the argument.
+
+## SHA256
+
+```
+sha256(col)
+```
+
+Return sha256 hashed value of the argument.
+
+## SHA384
+
+```
+sha384(col)
+```
+
+Return sha384 hashed value of the argument.
+
+## SHA512
+
+```
+sha512(col)
+```
+
+Return sha512 hashed value of the argument.

docs/en_US/sqls/functions/json_functions.md

@@ -0,0 +1,46 @@
+# JSON Functions
+
+JSON functions manipulate JSON string or return information about JSON.
+There are several json path manipulation functions. **Please refer
+to [json path functions](../json_expr.md#json-path-functions) for how to compose a json path.**
+
+## TO_JSON
+
+```
+to_json(col)
+```
+
+Converts a value to a string containing the JSON representation of the value. If the input is NULL, the result is also
+NULL.
+
+## PARSE_JSON
+
+```
+parse_json(col)
+```
+
+Converts a JSON string to a value. If the input is NULL, the result is also NULL.
+
+## JSON_PATH_EXISTS
+
+```
+json_path_exists(col, json_path)
+```
+
+Check whether JSON path returns any item for the specified JSON value. Return bool value.
+
+## JSON_PATH_QUERY
+
+```
+json_path_query(col, json_path)
+```
+
+Get all items returned by JSON path for the specified JSON value.
+
+## JSON_PATH_QUERY_FIRST
+
+```
+json_path_query_first(col, json_path)
+```
+
+Get the first item returned by JSON path for the specified JSON value.

docs/en_US/sqls/functions/mathematical_functions.md

@@ -0,0 +1,205 @@
+# Mathematical Functions
+
+Mathematical functions perform many of the common mathematical operations. They take numeric input and return numeric
+output.
+
+## ABS
+
+```
+abs(col)
+```
+
+The absolute value of a value.
+
+## ACOS
+
+```
+acos(col)
+```
+
+The inverse cosine of a number of radians.
+
+## ASIN
+
+```
+asin(col)
+```
+
+The inverse sine of a number of radians.
+
+## ATAN
+
+```
+atan(col)
+```
+
+The inverse tangent of a number of radians.
+
+## ATAN2
+
+```
+atan2(col1, col2)
+```
+
+The angle, in radians, between the positive x-axis and the (x, y) point defined in the two arguments.
+
+## BITAND
+
+```
+bitand(col1, col2)
+```
+
+Performs a bitwise AND on the bit representations of the two Int(-converted) arguments.
+
+## BITOR
+
+```
+bitor(col1, col2)
+```
+
+Performs a bitwise OR of the bit representations of the two arguments.
+
+## BITXOR
+
+```
+bitxor(col1, col2)
+```
+
+Performs a bitwise XOR on the bit representations of the two Int(-converted) arguments.
+
+## BITNOT
+
+```
+bitnot(col1)
+```
+
+Performs a bitwise NOT on the bit representations of the Int(-converted) argument.
+
+## CEIL
+
+```
+ceil(col)
+```
+
+The smallest integer value that is greater than or equal to the argument.
+
+## COS
+
+```
+cos(col)
+```
+
+The cosine of a number of radians.
+
+## COSH
+
+```
+cosh(col)
+```
+
+The hyperbolic cosine of a number.
+
+## EXP
+
+```
+exp(col)
+```
+
+Returns Euler's number e raised to the power of a double value.
+
+## LN
+
+```
+ln(col)
+```
+
+Returns the natural logarithm of a double value.
+
+## LOG
+
+```
+log(col)
+```
+
+Returns the base 10 logarithm of a double value.
+
+## MOD
+
+```
+mod(col1, col2)
+```
+
+Returns the remainder of the division of the first argument by the second argument.
+
+## POWER
+
+```
+power(col1, col2)
+```
+
+Returns the value of the first argument raised to the power of the second argument.
+
+## RAND
+
+```
+rand()
+```
+
+Returns a random number between 0.0 (inclusive) and 1.0 (exclusive).
+
+## ROUND
+
+```
+round(col)
+```
+
+Returns the closest BIGINT value to the argument.
+
+## SIGN
+
+```
+sign(col)
+```
+
+Returns the signum function of the argument. When the sign of the argument is positive, 1 is returned. When the sign of
+the argument is negative, -1 is returned. If the argument is 0, 0 is returned.
+
+## SIN
+
+```
+sin(col)
+```
+
+The sine of a numb[multi_column_functions.md](multi_column_functions.md)er in radians.
+
+## SINH
+
+```
+sinh(col)
+```
+
+The hyperbolic sine of a number.
+
+## SQRT
+
+```
+sqrt(col)
+```
+
+Returns the positive square root of a double value.
+
+## TAN
+
+```
+tan(col)
+```
+
+The tangent of a number of radians.
+
+## TANH
+
+```
+tanh(col)
+```
+
+The hyperbolic tangent of a number.

docs/en_US/sqls/functions/multi_column_functions.md

@@ -0,0 +1,15 @@
+# Multiple Column Functions
+
+A multiple column function is a function that returns multiple columns. Contrast to normal scalar function, which
+returns a single column of a single row.
+
+Multiple column function can only be used in the `SELECT` clause of a query.
+
+## CHANGED_COLS
+
+```
+changed_cols(prefix, ignoreNull, colA, colB)
+```
+
+Return the changed columns whose name is prefixed. Check [changed_cols](./analytic_functions.md#changedcols-function)
+for detail.

docs/en_US/sqls/functions/multi_row_functions.md

@@ -0,0 +1,75 @@
+# Multiple Row Functions
+
+A multiple row function is a function that returns multiple rows.
+
+Multiple row function can only be used in the `SELECT` clause of a query and only allowed 1 multiple rows function in
+the clause for now.
+
+## UNNEST
+
+```
+unnest(array)
+```
+
+The `unnest` function is used to expand an array into multiple rows.
+The argument column must be an array. This function will expand the array into multiple rows as a returned result. If
+the item in the array is map[string]interface object, then it will be built as columns in the result rows.
+
+### Examples
+
+Create a stream demo and have below inputs
+
+```json lines
+{
+  "a": [
+    1,
+    2
+  ],
+  "b": 3
+}
+```
+
+Rule to get the unnest values:
+
+```text
+SQL: SELECT unnest(a) FROM demo
+___________________________________________________
+{"unnest":1}
+{"unnest":2}
+```
+
+Rule to get the unnest values with other columns:
+
+```text
+SQL: SELECT unnest(a), b FROM demo
+___________________________________________________
+{"unnest":1, "b":3}
+{"unnest":2, "b":3}
+```
+
+Create a stream demo and have below inputs
+
+```json lines
+{
+  "x": [
+    {
+      "a": 1,
+      "b": 2
+    },
+    {
+      "a": 3,
+      "b": 4
+    }
+  ],
+  "c": 5
+}
+```
+
+Rule to get the unnest values with other columns:
+
+```text
+SQL: SELECT unnest(x), c FROM demo
+___________________________________________________
+{"a":1, "b":2, "c": 5}
+{"a":3, "b":4, "c": 5}
+```

docs/en_US/sqls/functions/object_functions.md

@@ -0,0 +1,56 @@
+# Object Functions
+
+Object functions are used to manipulate objects/maps.
+
+## KEYS
+
+```
+keys(map<string, interface{}>) -> array<string>
+```
+
+Return an array containing the keys of the map.
+
+## VALUES
+
+```
+values(map<string, interface{}>) -> array<interface{}>
+```
+
+Return an array containing the values of the map.
+
+## OBJECT
+
+```
+object(array<string>, array<interface{}>) -> map<string, interface{}>
+```
+
+Construct an object from an array of keys and an array of values. Keys must be an array of strings. Values must be an
+arbitrary array of the same length as keys.
+
+## ZIP
+
+```
+zip(array<array<string, interface{}>>) -> map<string, interface{}>
+```
+
+Construct an object from an array of entries. Each entry must itself be an array of size 2: the first element is the
+key (and must be a string), and the second element is the value.
+
+## ITEMS
+
+```
+items(map<string, interface{}>) -> array<array<string, interface{}>>
+```
+
+Return an array containing the entries of object. Each entry is a 2-element array; the first is the key, the second is
+the value.
+
+## OBJECT_CONSTRUCT
+
+```
+object_construct(key1, col1, key2, col2, ...) -> map<string, interface{}>
+```
+
+Return a struct type object/map constructed by the arguments. The arguments are a series of key value pairs, thus the
+arguments count must be an odd number. The key must be a string, and the value can be of any type. If the value is null,
+the key/value pair will not present in the final object.

docs/en_US/sqls/functions/other_functions.md

@@ -0,0 +1,105 @@
+## Other Functions
+
+The following function are built-in functions that are not included in other document pages.
+
+## ISNULL
+
+```
+isNull(col)
+```
+
+Returns true if the argument is the null value.
+
+## COALESCE
+
+```
+coalesce(expr1, expr2, ...)
+```
+
+Return the first non-null value. If all expressions are null,return null.
+
+## NEWUUID
+
+```
+newuuid()
+```
+
+Returns a random 16-byte UUID.
+
+## TSTAMP
+
+```
+tstamp()
+```
+
+Returns the current timestamp in milliseconds from 00:00:00 Coordinated Universal Time (UTC), Thursday, 1 January 1970.
+
+## RULE_ID
+
+```
+rule_id()
+```
+
+Returns the ID of the currently matched rule.
+
+## MQTT
+
+```
+mqtt(topic)
+```
+
+Returns the metadata of the MQTT message. The same as meta function but can only be used when the rule is triggered by
+MQTT message.
+
+## META
+
+```
+meta(topic)
+```
+
+Returns the meta-data of a specified key. The key could be:
+
+- A standalone key if there is only one source in the form clause, such as `meta(device)`
+- A qualified key to specify the stream, such as `meta(src1.device)`
+- A key to refer to nested field for multi level metadata, such as `meta(src1.reading.device.name)`. This assumes
+  reading is map structure metadata.
+
+## WINDOW_START
+
+```
+window_start()
+```
+
+Return the window start timestamp in int64 format. If there is no time window, it returns 0. The window time is aligned
+with the timestamp notion of the rule. If the rule is using processing time, then the window start timestamp is the
+processing timestamp. If the rule is using event time, then the window start timestamp is the event timestamp.
+
+## WINDOW_END
+
+```
+window_end()
+```
+
+Return the window end timestamp in int64 format. If there is no time window, it returns 0. The window time is aligned
+with the timestamp notion of the rule. If the rule is using processing time, then the window end timestamp is the
+processing timestamp. If the rule is using event time, then the window end timestamp is the event timestamp.
+
+## GET_KEYED_STATE
+
+```
+get_keyed_state(key, dataType, defaultValue)
+```
+
+Return the keyed value in the database. The First parameter is the key, the second is the data type of the value,
+support bigint, float, string, boolean and datetime. Third is the default value if key does not exist. Default database
+is sqlite, users can change the database by
+this [configuration](../../configuration/global_configurations.md#external-state).
+
+## DELAY
+
+```
+delay(delayTime, returnVal)
+```
+
+Delay the execution of the rule for a specified time and then return the returnVal. DelayTime is an integer in
+milliseconds.

docs/en_US/sqls/functions/overview.md

@@ -0,0 +1,22 @@
+# Functions
+
+eKuiper has many built-in functions for performing calculations on data.
+
+- [Aggregate Functions](./aggregate_functions)
+- [Math Functions](./mathematical_functions.md)
+- [String Functions](./string_functions.md)
+- [Array Functions](./array_functions.md)
+- [Object Functions](./object_functions.md)
+- [Hashing Functions](./hashing_functions.md)
+- [Transform Functions](./transform_functions.md)
+- [JSON Functions](./json_functions.md)
+- [Other Functions](./other_functions.md)
+
+
+- [Analytic Functions](./analytic_functions)
+- [Multi-Row Functions](./multi_row_functions.md
+- [Multi-Column Functions](./multi_column_functions.md)
+
+eKuiper also provides a set of functions though shipped plugins. Users need to install the plugins before using them.
+
+- [Custom Functions](./custom_functions.md)

docs/en_US/sqls/functions/string_functions.md

@@ -0,0 +1,191 @@
+# String Functions
+
+String functions are used to manipulate string data.
+
+## CONCAT
+
+```
+concat(col1, col2, ...)
+```
+
+Concatenates arrays or strings. This function accepts any number of arguments and returns a string or an array.
+
+## ENDSWITH
+
+```
+endswith(col1, col2)
+```
+
+Returns a boolean indicating whether the first string argument ends with the second string argument.
+
+## FORMAT_TIME
+
+```
+format_time(col, format)
+```
+
+Format a datetime to string. The 'col' will be [cast to datetime type](./transform_functions.md#cast-to-datetime) if it
+is
+bigint, float or string type before formatting. Please check [format patterns](#formattime-patterns) for how to compose
+the format.
+
+### Format_time patterns
+
+A pattern is used to create a format string. Patterns are based on a simple sequence of letters and symbols which is
+common in many languages like Java, etc. The supported symbols in Kuiper are
+
+| Symbol | Meaning                   | Example                               |
+|--------|---------------------------|---------------------------------------|
+| G      | era                       | G(AD)                                 |
+| Y      | year                      | YYYY(2004), YY(04)                    |
+| M      | month                     | M(1), MM(01), MMM(Jan), MMMM(January) |
+| d      | day of month              | d(2), dd(02)                          |
+| E      | day of week               | EEE(Mon), EEEE(Monday)                |
+| H      | hour in 24 hours format   | HH(15)                                |
+| h      | hour in 12 hours format   | h(2), hh(03)                          |
+| a      | AM or PM                  | a(PM)                                 |
+| m      | minute                    | m(4), mm(04)                          |
+| s      | second                    | s(5), ss(05)                          |
+| S      | fraction of second        | S(.0), SS(.00), SSS(.000)             |
+| z      | time zone name            | z(MST)                                |
+| Z      | 4 digits time zone offset | Z(-0700)                              |
+| X      | time zone offset          | X(-07), XX(-0700), XXX(-07:00)        |
+
+Examples:
+
+- YYYY-MM-dd T HH:mm:ss -> 2006-01-02 T 15:04:05
+- YYYY/MM/dd HH:mm:ssSSS XXX -> 2006/01/02 15:04:05.000 -07:00
+
+## INDEXOF
+
+```
+indexof(col1, col2)
+```
+
+Returns the first index (0-based) of the second argument as a substring in the first argument.
+
+## LENGTH
+
+```
+length(col)
+```
+
+Returns the number of characters in the provided string.
+
+## LOWER
+
+```
+lower(col)
+```
+
+Returns the lowercase version of the given string.
+
+## LPAD
+
+```
+lpad(col, 2)
+```
+
+Returns the string argument, padded on the left side with the number of spaces specified by the second argument.
+
+## LTRIM
+
+```
+ltrim(col)
+```
+
+Removes all leading whitespace (tabs and spaces) from the provided string.
+
+## NUMBYTES
+
+```
+numbytes(col)
+```
+
+Returns the number of bytes in the UTF-8 encoding of the provided string.
+
+## REGEXP_MATCHES
+
+```
+regexp_matches(col, regex)
+```
+
+Returns true if the string (first argument) contains a match for the regular expression.
+
+## REGEXP_REPLACE
+
+```
+regexp_replace(col, regex, replacement)
+```
+
+Replaces all substrings of the specified string value that matches regexp with replacement.
+
+## REGEXP_SUBSTRING
+
+```
+regexp_substring(col, regex)
+```
+
+Returns the first substring of the specified string value that matches regexp.
+
+## RPAD
+
+```
+rpad(col, 2)
+```
+
+Returns the string argument, padded on the right side with the number of spaces specified by the second argument.
+
+## RTRIM
+
+```
+rtrim(col)
+```
+
+Removes all trailing whitespace (tabs and spaces) from the provided string.
+
+## SUBSTRING
+
+```
+substring(col, start, length)
+```
+
+Returns the substring of the specified string value starting at the specified index position (0-based, inclusive) for up
+to the specified length of characters.
+
+## STARTSWITH
+
+```
+startswith(col, str)
+```
+
+Returns a boolean indicating whether the first string argument starts with the second string argument.
+
+## SPLIT_VALUE
+
+```
+split_value(col, str_splitter, index)
+```
+
+Split the value of the 1st parameter with the 2nd parameter, and return the value of split array that indexed with the
+3rd parameter.
+
+For example, `split_value("/test/device001/message","/",0) AS a`, the returned value of function is empty;
+
+`split_value("/test/device001/message","/",3) AS a`, the returned value of function is `message`.
+
+## TRIM
+
+```
+trim(col)
+```
+
+Removes all leading and trailing whitespace (tabs and spaces) from the provided string.
+
+## UPPER
+
+```
+upper(col)
+```
+
+Returns the uppercase version of the given string.

docs/en_US/sqls/functions/transform_functions.md

@@ -0,0 +1,75 @@
+# Transform Functions
+
+Transform functions manipulate data in various ways like convert types, encode with base 64 and compression.
+
+## CAST
+
+```
+cast(col, dataType)
+```
+
+Converts a value from one data type to another. The supported types include: bigint, float, string, boolean, bytea and
+datetime.
+
+### Cast to datetime
+
+When casting to a datetime type, the supported column type and casting rule are:
+
+1. If a column is datetime type, just return the value.
+2. If column is bigint or float type, the number will be treated as the milliseconds elapsed since January 1, 1970 00:
+   00:00 UTC and converted.
+3. If column is string, it will be parsed to datetime with the default format: `"2006-01-02T15:04:05.000Z07:00"`.
+4. Other types are not supported.
+
+## ENCODE
+
+```
+encode(col, encodeType)
+```
+
+Use the encode function to encode the payload, which potentially might be non-JSON data, into its string representation
+based on the encoding scheme. Currently, only "base64" encoding type is supported.
+
+## DECODE
+
+```
+decode(col, encodeType)
+```
+
+Decode the input string with specified decoding method. Currently, only "base64" encoding type is supported.
+
+## COMPRESS
+
+```
+compress(input, method)
+```
+
+Compress the input string or binary value with a compression method. Currently, 'zlib', 'gzip', 'flate' and 'zstd'
+method are supported.
+
+## DECOMPRESS
+
+```
+decompress(input, method)
+```
+
+Decompress the input string or binary value with a compression method. Currently, 'zlib', 'gzip', 'flate' and 'zstd'
+method are supported.
+
+## TRUNC
+
+```
+trunc(dec, int)
+```
+
+Truncates the first argument to the number of Decimal places specified by the second argument. If the second argument is
+less than zero, it is set to zero. If the second argument is greater than 34, it is set to 34. Trailing zeroes are
+stripped from the result.
+
+## CHR
+
+```
+chr(col)
+```
+
+Returns the ASCII character that corresponds to the given Int argument.

docs/en_US/sqls/json_expr.md

@@ -127,9 +127,10 @@ SELECT d.friends[0]->last FROM demo AS d
 
 ### Slicing
 
-Slices allow you to select a contiguous subset of an array. 
+Slices allow you to select a contiguous subset of an array.
 
-`field[from:to)`is the interval before closing and opening, excluding to. If from is not specified, then it means start from the 1st element of array; If to is not specified, then it means end with the last element of array.
+`field[from:to)`is the interval before closing and opening, excluding to. If from is not specified, then it means start
+from the 1st element of an array; If to is not specified, then it means end with the last element of array.
 
 ```
 SELECT children[0:1] FROM demo
@@ -199,7 +200,8 @@ SELECT followers->Group1[:1]->first FROM demo
 
 ## Json Path functions
 
-eKuiper provides a list of functions to allow to execute json path over struct or array columns or values. The functions are:
+eKuiper provides a list of functions to allow executing json path over struct or array columns or values. The functions
+are:
 
 ```sql
 json_path_exists(col, jsonpath)
@@ -207,9 +209,10 @@ json_path_query(col, jsonpath)
 json_path_query_first(col, jsonpath)
 ```
 
-Please refer to [json functions](./built-in_functions.md#json-functions) for detail.
+Please refer to [json functions](./functions/json_functions.md) for detail.
 
-All these functions share the same parameter signatures, among which, the second parameter is a jsonpath string. The jsonpath grammer used by eKuiper is based on [JsonPath](https://goessner.net/articles/JsonPath/).
+All these functions share the same parameter signatures, among which the second parameter is a jsonpath string. The
+jsonpath grammar used by eKuiper is based on [JsonPath](https://goessner.net/articles/JsonPath/).
 
 The basic grammar of those expressions is to use the keys part of the JSON objects combined with some elements:
 
@@ -217,7 +220,8 @@ The basic grammar of those expressions is to use the keys part of the JSON objec
 - Brackets `[]` for access to a given array member coupled with a position. It can also access to a map field.
 - Variables, with `$` representing a JSON text and `@` for result path evaluations.
 
-So for example, when applied to the previous JSON data sample we can reach the following parts of the tree with these expressions:
+So, for example, when applied to the previous JSON data sample, we can reach the following parts of the tree with these
+expressions:
 
 - `$.age` refers to 37.
 - `$.friends.first` refers to “dale”.

docs/en_US/sqls/overview.md

@@ -1,9 +1,9 @@
 eKuiper offers a SQL-like query language for performing transformations and computations over streams of events. This document describes the syntax, usage and best practices for the eKuiper query language. 
 
 - [Stream specifications](streams.md)
-- [Query languange element](query_language_elements.md)
+- [Query language element](query_language_elements.md)
 - [Windows](windows.md)
-- [Built-in functions](built-in_functions.md)
+- [Built-in functions](./functions/overview.md)
 - Extension
   - [Plugin extension](../extension/overview.md)
   - [External service extension](../extension/external/external_func.md)

docs/zh_CN/README.md

@@ -73,7 +73,7 @@ LF Edge eKuiper 是 Golang 实现的轻量级物联网边缘分析、流式处
 - [规则语法](./guide/rules/overview.md)
 - [可用源](./guide/sources/overview.md)
 - [可用动作](./guide/sinks/overview.md)
-- [可用函数](./sqls/built-in_functions.md)
+- [可用函数](./sqls/functions/overview.md)
 - [SQL 语法](./sqls/overview.md)
 
 [查看参考](./sqls/overview.md)

docs/zh_CN/configuration/global_configurations.md

@@ -166,7 +166,8 @@ GET http://localhost:9081/plugins/functions/prebuild
 
 ### 外部状态
 
-还有一个名为 `extStateType` 的配置项。 这个配置的用途是用户可以预先在数据库中存储一些信息，当流处理规则需要这些信息时，他们可以通过 SQL 中的 [get_keyed_state](../sqls/built-in_functions.md#其它函数) 函数轻松获取它们。
+还有一个名为 `extStateType` 的配置项。 这个配置的用途是用户可以预先在数据库中存储一些信息，当流处理规则需要这些信息时，他们可以通过
+SQL 中的 [get_keyed_state](../sqls/functions/other_functions.md#getkeyedstate) 函数轻松获取它们。
 *注意*：`type` 和 `extStateType` 可以使用不同的存储配置。
 
 ### 配置示例

docs/zh_CN/extension/native/develop/function.md

@@ -1,6 +1,7 @@
 # 函数扩展
 
-在 eKuiper SQL 语法中，向服务器提供了[许多内置函数](../../../sqls/built-in_functions.md)，用于各种可重用的业务逻辑。 但是，用户仍然可能需要其他未被内置插件覆盖的可重用的业务逻辑。 提供函数扩展是为了自定义函数。
+在 eKuiper SQL 语法中，向服务器提供了[许多内置函数](../../../sqls/functions/overview.md)，用于各种可重用的业务逻辑。
+但是，用户仍然可能需要其他未被内置插件覆盖的可重用的业务逻辑。 提供函数扩展是为了自定义函数。
 
 ## 开发
 

docs/zh_CN/extension/native/develop/overview.md

@@ -1,4 +1,4 @@
-eKuiper 实现了下面的插件，目前这些插件有的是用于描述插件开发过程的样例，有的是来自于社区开发者贡献的插件，在使用插件前，请仔细阅读相关文档。
+eKuiper 实现了下面的插件，目前这些插件有的是用于描述插件开发过程的样例，有的是来自社区开发者贡献的插件，在使用插件前，请仔细阅读相关文档。
 
 eKuiper 插件开发者在开发过程中，可以指定元数据文件，这些元数据主要应用于以下方面：
 
@@ -274,13 +274,13 @@ source 的大部分属性用户通过对应的配置文件指定，用户无法
 
 ## 函数 (Functions)
 
-| 名称                                                       | 描述                                                      | 备注            |
-|----------------------------------------------------------|---------------------------------------------------------|---------------|
-| [echo](../../../sqls/custom_functions.md)                | 原样输出参数值                                                 | 插件样例，不可用于生产环境 |
-| [countPlusOne](../../../sqls/custom_functions.md)        | 输出参数长度加一的值                                              | 插件样例，不可用于生产环境 |
-| [accumulateWordCount](../../../sqls/custom_functions.md) | 函数统计一共有多少个单词                                            | 插件样例，不可用于生产环境 |
-| [resize](../../../sqls/custom_functions.md)              | 创建具有新尺寸（宽度，高度）的缩放图像。如果 width 或 height 设置为0，则将其设置为长宽比保留值 | 插件样例，不可用于生产环境 |
-| [thumbnail](../../../sqls/custom_functions.md)           | 将保留宽高比的图像缩小到最大尺寸( maxWidth，maxHeight)。                  | 插件样例，不可用于生产环境 |
+| 名称                                                                 | 描述                                                      | 备注            |
+|--------------------------------------------------------------------|---------------------------------------------------------|---------------|
+| [echo](../../../sqls/functions/custom_functions.md)                | 原样输出参数值                                                 | 插件样例，不可用于生产环境 |
+| [countPlusOne](../../../sqls/functions/custom_functions.md)        | 输出参数长度加一的值                                              | 插件样例，不可用于生产环境 |
+| [accumulateWordCount](../../../sqls/functions/custom_functions.md) | 函数统计一共有多少个单词                                            | 插件样例，不可用于生产环境 |
+| [resize](../../../sqls/functions/custom_functions.md)              | 创建具有新尺寸（宽度，高度）的缩放图像。如果 width 或 height 设置为0，则将其设置为长宽比保留值 | 插件样例，不可用于生产环境 |
+| [thumbnail](../../../sqls/functions/custom_functions.md)           | 将保留宽高比的图像缩小到最大尺寸( maxWidth，maxHeight)。                  | 插件样例，不可用于生产环境 |
 
 eKuiper 具有许多内置函数，可以对数据执行计算。(具体文档参考 https://github.com/lf-edge/ekuiper/blob/master/docs/zh_CN/sqls/built-in_functions.md)
 

docs/zh_CN/extension/native/overview.md

@@ -17,8 +17,9 @@ eKuiper 允许用户自定义扩展，以支持更多的功能。用户可编写
 eKuiper 允许用户自定义不同类型的扩展。 
 
 - 源扩展用于扩展不同的流源，例如使用来自其他消息服务器的数据。eKuiper 对 [MQTT 消息服务器](../../guide/sources/builtin/mqtt.md)的内置源提供支持。
-- Sink/Action 扩展用于将发布/推送数据扩展到不同的目标，例如数据库，其他消息系统，Web 界面或文件系统。eKuiper 中提供内置动作支持，请参阅  [MQTT](../../guide/sinks/builtin/mqtt.md)  & [日志文件](../../guide/sinks/builtin/log.md).。
-- 函数扩展允许用户扩展 SQL 中使用的不同函数。 eKuiper支持内置函数，请参见 [函数](../../sqls/built-in_functions.md)。
+- Sink/Action 扩展用于将发布/推送数据扩展到不同的目标，例如数据库，其他消息系统，Web 界面或文件系统。eKuiper
+  中提供内置动作支持，请参阅  [MQTT](../../guide/sinks/builtin/mqtt.md)  & [日志文件](../../guide/sinks/builtin/log.md).。
+- 函数扩展允许用户扩展 SQL 中使用的不同函数。 eKuiper支持内置函数，请参见 [函数](../../sqls/functions/overview.md)。
 
 请阅读以下内容，了解如何实现不同的扩展。
 

docs/zh_CN/sqls/built-in_functions.md

@@ -1,504 +0,0 @@
-# 函数
-
-eKuiper 具有许多内置函数，可以对数据执行计算。
-
-## 聚合函数
-聚合函数对一组值执行计算并返回单个值。聚合函数只能用作以下表达式：
-* select 语句的 select 列表（子查询或外部查询）。
-* HAVING 子句。
-
-| 函数              | 示例                               | 说明                                                                                                                                                                          |
-|-----------------|----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| avg             | avg(col1)                        | 组中的平均值。空值不参与计算。                                                                                                                                                             |
-| count           | count(*)                         | 组中的项目数。空值不参与计算。                                                                                                                                                             |
-| max             | max(col1)                        | 组中的最大值。空值不参与计算。                                                                                                                                                             |
-| min             | min(col1)                        | 组中的最小值。空值不参与计算。                                                                                                                                                             |
-| sum             | sum(col1)                        | 组中所有值的总和。空值不参与计算。                                                                                                                                                           |
-| collect         | collect(*), collect(col1)        | 返回组中指定的列或整个消息（参数为*时）的值组成的数组。                                                                                                                                                |
-| deduplicate     | deduplicate(col, false)          | 返回当前组去重的结果，通常用在窗口中。其中，第一个参数指定用于去重的列；第二个参数指定是否返回全部结果。若为 false ，则仅返回最近的未重复的项；若最近的项有重复，则返回空数组；此时可以设置 sink 参数 [omitIfEmpty](../guide/sinks/overview.md#公共属性)，使得 sink 接到空结果后不触发。 |
-| stddev          | stddev(col)                      | 返回当前组总体标准偏差的结果，通常用在窗口中。其中，参数指定用于计算的列。                                                                                                                                       |
-| stddevs         | stddevs(col)                     | 返回当前组样本标准偏差的结果，通常用在窗口中。其中，参数指定用于计算的列。                                                                                                                                       |
-| var             | var(col)                         | 返回当前组总体标准偏差的方差的结果，通常用在窗口中。其中，参数指定用于计算的列。                                                                                                                                    |
-| vars            | vars(col)                        | 返回当前组样本标准偏差的方差的结果，通常用在窗口中。其中，参数指定用于计算的列。                                                                                                                                    |
-| percentile      | percentile(col, percentile)      | 返回当前组中表达式连续分布的百分位值，通常用在窗口中。第一个参数指定用于 percentile 的列。第二个参数是您要查找的值的百分位数。百分位数必须是介于 0.0 和 1.0 之间的常数。                                                                             |
-| percentile_disc | percentile_disc(col, percentile) | 返回当前组中表达式离散分布的百分位值，通常用在窗口中。第一个参数指定用于 percentile_disc 的列。第二个参数是您要查找的值的百分位数。百分位数必须是介于 0.0 和 1.0 之间的常数。                                                                        |
-
-### Collect() 示例
-
-- 获取当前窗口所有消息的列 a 的值组成的数组。假设列 a 的类型为 int, 则结果为: `[{"r1":[32, 45]}]`
-    ```sql
-    SELECT collect(a) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
-    ```
-- 获取当前窗口所有消息的列 a 的值组成的数组。结果为: `[{"r1":{"a":32, "b":"hello"}, {"a":45, "b":"world"}}]`
-    ```sql
-    SELECT collect(*) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
-    ```
-  
-- 获取当前窗口第二个消息的列 `a` 的值。结果为: `[{"r1":32}]`
-    ```sql
-    SELECT collect(*)[1]->a as r1 FROM test GROUP BY TumblingWindow(ss, 10)
-    ```
-
-### Deduplicate() 示例
-
- - 获取当前窗口中，列 `a` 值不重复的所有消息组成的数组。结果为: `[{"r1":{"a":32, "b":"hello"}, {"a":45, "b":"world"}}]`
-     ```sql
-     SELECT deduplicate(a, true) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
-     ```
- - 获取列 `a` 值在过去一小时中不重复的值。每收到一条新消息，都会检测列 `a` 是否重复，若不重复则输出：`[{"r1":32}]` 或者 `[{"r1":45}]`。若检测到重复值，则输出 `[{}]` 。此时，可以设置 omitIfEmpty 的 sink 参数使得检测到重复值时不触发规则。
-      ```sql
-      SELECT deduplicate(a, false)->a as r1 FROM demo GROUP BY SlidingWindow(hh, 1)
-      ```
-
-## 数学函数
-| 函数     | 示例                 | 说明                                                       |
-|--------|--------------------|----------------------------------------------------------|
-| abs    | abs(col1)          | 绝对值                                                      |
-| acos   | acos(col1)         | 弧度数的反余弦值                                                 |
-| asin   | asin(col1)         | 弧度数的反正弦值                                                 |
-| atan   | atan(col1)         | 弧度数的反正切值                                                 |
-| atan2  | atan2(col1, col2)  | 正x轴与两个自变量中定义的（x，y）点之间的弧度角                                |
-| bitand | bitand(col1, col2) | 对两个Int（-converted）参数的位表示执行按位“与”运算                        |
-| bitor  | bitor(col1, col2)  | 对两个参数的位表示进行或运算                                           |
-| bitxor | bitxor(col1, col2) | 对两个Int（-converted）参数的位表示执行逐位异或运算                         |
-| bitnot | bitnot(col1)       | 在Int（-converted）参数的位表示形式上执行按位NOT运算                       |
-| ceil   | ceil(col1)         | 将值舍入到最接近的BIGINT值。                                        |
-| cos    | cos(col1)          | 返回以弧度为单位的数字的余弦值。                                         |
-| cosh   | cosh(col1)         | 返回弧度数的双曲余弦值。                                             |
-| exp    | exp(col1)          | 返回小数点参数的e。                                               |
-| ln     | ln(col1)           | 返回参数的自然对数。                                               |
-| log    | log(col1)          | 返回参数的以10为底的对数。                                           |
-| mod    | mod(col1, col2)    | 返回第一个参数除以第二个参数的余数。                                       |
-| power  | power(x, y)        | 返回 x 的 y 次方。                                             |
-| rand   | rand()             | 返回一个伪随机数，其均匀分布在0.0和1.0之间。                                |
-| round  | round(col1)        | 将值四舍五入到最接近的 BIGINT 值。                                    |
-| sign   | sign(col1)         | 返回给定数字的符号。 当参数的符号为正时，将返回1。 当参数的符号为负数时，返回-1。 如果参数为0，则返回0。 |
-| sin    | sin(col1)          | 返回弧度数的正弦值。                                               |
-| sinh   | sinh(col1)         | 返回弧度数的双曲正弦值。                                             |
-| sqrt   | sqrt(col1)         | 返回数字的平方根。                                                |
-| tan    | tan(col1)          | 返回以弧度表示的数字的正切值。                                          |
-| tanh   | tanh(col1)         | 返回弧度数的双曲正切值。                                             |
-
-## 字符串函数
-
-| 函数             | 示例                                 | 说明                                                                                                    |
-|----------------|------------------------------------|-------------------------------------------------------------------------------------------------------|
-| concat         | concat(col1...)                    | 连接数组或字符串。 此函数接受任意数量的参数并返回 String 或 Array                                                              |
-| endswith       | endswith(col1, col2)               | 返回一个布尔值，该布尔值指示第一个 String参数是否以第二个 String 参数结尾。                                                         |
-| format_time    | format_time(col1, format)          | 将日期时间格式化为字符串。其中，若参数 col1 为兼容类型，则在格式化之前 [转换为 datetime 类型](#转换为-datetime-类型)。关于格式字符串，请参考 [时间格式](#时间格式)。 |
-| indexof        | indexof(col1, col2)                | 返回第二个参数的第一个索引（从0开始），作为第一个参数中的子字符串。                                                                    |
-| length         | length(col1)                       | 返回提供的字符串中的字符数。                                                                                        |
-| lower          | lower(col1)                        | 返回给定 String 的小写版本。                                                                                    |
-| lpad           | lpad(col1, 2)                      | 返回 String，在左侧用第二个参数指定的空格数填充。                                                                          |
-| ltrim          | ltrim(col1)                        | 从提供的字符串中删除所有前导空格（制表符和空格）。                                                                             |
-| numbytes       | numbytes(col1)                     | 以提供的字符串的 UTF-8 编码返回字节数。                                                                               |
-| regexp_matches | regexp_matches(col1, regex)        | 如果字符串（第一个参数）包含正则表达式的匹配项，则返回 true。                                                                     |
-| regexp_replace | regexp_replace(col1, regex, str)   | 将第一个参数中所有出现的第二个参数（正则表达式）替换为第三个参数。                                                                     |
-| regexp_substr  | regexp_substr(col1, regex)         | 在第一个参数中找到第二个参数（regex）的第一个匹配项。                                                                         |
-| rpad           | rpad(col1, 2)                      | 返回字符串参数，在右侧填充第二个参数指定的空格数。                                                                             |
-| rtrim          | rtrim(col1)                        | 从提供的字符串中删除所有尾随空白（制表符和空格）。                                                                             |
-| substring      | substring(col1, start, end)        | 从提供的 Int 索引（从0开始，包括0）到字符串的结尾，返回提供的String的子字符串。                                                        |
-| startswith     | startswith(col1, str)              | 返回布尔值，是否第一个字符串参数是否以第二个字符串参数开头。                                                                        |
-| split_value    | split_value(col1, splitter, index) | 将第一个字符串参数以第二个字符串参数作为分隔符切分，返回切分后的第 index（参数三）个值。                                                       |
-| trim           | trim(col1)                         | 从提供的字符串中删除所有前导和尾随空格（制表符和空格）。                                                                          |
-| upper          | upper(col1)                        | 返回给定 String 的大写版本。                                                                                    |
-
-### 时间格式
-
-时间格式为一些特定符号和字母组成的字符串。eKuiper 里支持的符号如下表所示：
-
-| 符号  | 含义       | 示例                                    |
-|-----|----------|---------------------------------------|
-| G   | 公元       | G(AD)                                 |
-| Y   | 年        | YYYY(2004), YY(04)                    |
-| M   | 月        | M(1), MM(01), MMM(Jan), MMMM(January) |
-| d   | 日期       | d(2), dd(02)                          |
-| E   | 星期几      | EEE(Mon), EEEE(Monday)                |
-| H   | 24小时制的小时 | HH(15)                                |
-| h   | 12小时制的小时 | h(2), hh(03)                          |
-| a   | AM 或 PM  | a(PM)                                 |
-| m   | 分        | m(4), mm(04)                          |
-| s   | 秒        | s(5), ss(05)                          |
-| S   | 秒的分数     | S(.0), SS(.00), SSS(.000)             |
-| z   | 时区名      | z(MST)                                |
-| Z   | 4位数的时区   | Z(-0700)                              |
-| X   | 时区       | X(-07), XX(-0700), XXX(-07:00)        |
-
-示例:
-
-- YYYY-MM-dd T HH:mm:ss -> 2006-01-02 T 15:04:05
-- YYYY/MM/dd HH:mm:ssSSS XXX -> 2006/01/02 15:04:05.000 -07:00
-
-
-## 转换函数
-
-| 函数               | 示例                               | 说明                                                                                      |
-|------------------|----------------------------------|-----------------------------------------------------------------------------------------|
-| cast             | cast(col,  "bigint")             | 将值从一种数据类型转换为另一种数据类型。 支持的类型包括：bigint，float，string，boolean，bytea 和 datetime。              |
-| chr              | chr(col1)                        | 返回与给定 Int 参数对应的 ASCII 字符                                                                |
-| encode           | encode(col1, "base64")           | 使用 encode 函数根据编码方案将负载（可能是非 JSON 数据）编码为其字符串表示形式。目前，只支持"base64" 编码类型。                     |
-| decode           | decode(col1, "base64")           | 使解码输入字符串。目前，只支持"base64" 类型。                                                             |
-| trunc            | trunc(dec, int)                  | 将第一个参数截断为第二个参数指定的小数位数。 如果第二个参数小于零，则将其设置为零。 如果第二个参数大于34，则将其设置为34。从结果中去除尾随零。              |
-
-### 转换为 datetime 类型
-
-使用 cast 函数转换到 datetime 类型时，转换规则如下：
-
-1. 如果参数为 datetime 类型，则直接返回原值。
-2. 如果参数为 bigint 或者 float 类型，则其数值会作为自 1970年1月1日0时起至今的毫秒值而转换为 datetime 类型。
-3. 如果参数为 string 类型，则会用默认格式 `"2006-01-02T15:04:05.000Z07:00"`  将其转换为 datetime类型。
-4. 其他类型的参数均不支持转换。
-
-## 哈希函数
-| 函数     | 示例           | 说明     |
-|--------|--------------|--------|
-| md5    | md5(col1)    | 参数的哈希值 |
-| sha1   | sha1(col1)   | 参数的哈希值 |
-| sha256 | sha256(col1) | 参数的哈希值 |
-| sha384 | sha384(col1) | 参数的哈希值 |
-| sha512 | sha512(col1) | 参数的哈希值 |
-
-## JSON 函数
-| 函数                    | 示例                                    | 说明                                             |
-|-----------------------|---------------------------------------|------------------------------------------------|
-| to_json               | to_json(col1)                         | 将输入值转换为包含该值 JSON 表示的字符串。如果输入为 NULL，则结果也为 NULL。 |
-| parse_json            | parse_json(col1)                      | 将输入的 JSON 字符串转换为值。如果输入为 NULL，则结果也为 NULL。       |
-| json_path_exists      | json_path_exists(col1, "$.name")      | 检查 JSON 路径是否返回指定JSON 值的任何项目。 返回布尔值。            |
-| json_path_query       | json_path_query(col1, "$.name")       | 获取 JSON 路径返回的指定 JSON值的所有项目。                    |
-| json_path_query_first | json_path_query_first(col1, "$.name") | 获取 JSON 路径返回的指定 JSON值的第一项。                     |
-
-**请参阅 [json 路径函数](./json_expr.md#Json-路径函数) 了解如何编写json路径。**
-
-## 压缩/解压函数
-
-| 函数         | 示例                        | 说明              |
-|------------|---------------------------|-----------------|
-| compress   | compress(input, "zlib")   | 压缩输入的字符串或二进制值。  |
-| decompress | decompress(input, "zlib") | 解压缩输入的字符串或二进制值。 |
-
-目前支持 'zlib', 'gzip', 'flate' 和 'zstd' 压缩算法。
-
-## 列表函数
-
-| 函数                | 示例                              | 说明                                                                                       |
-|---------------------|-----------------------------------|------------------------------------------------------------------------------------------|
-| array_position      | array_position(array, value)      | 返回第二个参数在列表参数中的索引下标位置，索引下标从 0 开始，若该元素不存在，则返回 -1                |
-| element_at          | element_at(array, index)          | 返回列表参数中在给定索引下的元素，索引下标从 0 开始，若该索引小于 0，则该元素从列表末向列表头进行计数    |
-| array_contains      | array_contains(array, value)      | 返回给定元素是否存在列表参数中，存在则返回 true，否则返回 false                                   |
-| array_create        | array_create(value1, ......)      | 将给定的元素参数们创建为一个列表元素                                                           |
-| array_remove        | array_remove(array, value)        | 返回删除了所有出现的给定元素的数组                                                             |
-| array_last_position | array_last_position(array, val)   | 返回第二个参数在列表参数中最后一次出现的下标位置，索引下标从 0 开始，若该元素不存在，则返回 -1          |
-| array_contain_any   | array_contain_any(array1, array2) | 返回两个列表参数中是否存在任何相同元素，存在则返回 true，否则返回 false                            |
-| array_intersect     | array_intersect(array1, array2)   | 返回两个列表参数的交集，且不包含重复元素                                                        |
-| array_union         | array_union(array1, array2)       | 返回两个列表参数的并集，且不包含重复元素                                                        |
-| array_max           | array_max(array)                  | 返回列表参数中的最大值，若数组元素中存在 null，则返回 null                                       |
-| array_min           | array_min(array)                  | 返回列表参数中的最小值，若数组元素中存在 null，则返回 null                                       |
-| array_except        | array_except(array1, array2)      | 返回一个包含第一个列表参数中元素，但不包含第二个列表参数中的元素列表，且不包含重复元素                 |
-| repeat              | repeat(val, count)                | 返回一个由给定元素参数重复出现指定次数的列表元素                                               |
-| sequence            | sequence(start, stop[, step])     | 返回一个从第一个开始参数到第二个结束参数的整数列表，每个元素按照给定的步长递增或递减。若未提供步长，则默认为 1（如果第一个开始参数小于第二个结束参数），或 -1（如果第一个开始参数大于第二个结束参数），且步长不允许为 0 |
-
-## 对象函数
-
-| 函数               | 示例                               | 说明                                                                                        |
-|------------------|----------------------------------|-------------------------------------------------------------------------------------------|
-| keys             | keys(map[string]interface{})     | 返回的给定的 map 参数中的所有 key 值                                                                   |
-| values           | values(map[string]interface{})   | 返回给定的 map 参数中的所有 value 值                                                                  |
-| object           | object(arr1, arr2)               | 接受两个 list 参数来构造 map 对象，第一个 list 作为 map 对象的 key，第二个 list 作为 map 对象的 value。两个 list 参数长度必须相等 |
-| zip              | zip([arr1, arr2], ......)        | 接受一组 list 对象来构造 map 对象，每个 list 元素的长度必须为 2，每个 list 元素内的第一个元素将作为 key，第二个元素将作为 value         |
-| items            | items(map[string]interface{})    | 根据给定的 map 参数构造一个 list 对象，每个元素都为一个长度为 2 的 list 对象，其中第一个元素为 key，第二个元素为 value                |
-| object_construct | object_construct(key1, col, ...) | 返回由参数构建的 object/map 。参数为一系列的键值对，因此必须为偶数个。键必须为 string 类型，值可以为任意类型。如果值为空，则该键值对不会出现在最终的对象中。  |
-
-## 分析函数
-
-分析函数会保持状态来做分析工作。在流式处理规则中，分析函数会首先被执行，这样它们就不会受到 WHERE 子句的影响而必不更新状态。
-
-分析函数完整使用格式为, over 参数可选
-
-```
-AnalyticFuncName(<arguments>...) OVER ([PARTITION BY <partition key>] [WHEN <Expression>])
-```
-
-分析函数的计算是在当前查询输入的所有输入事件上进行的，可以选择限制分析函数只考虑符合 PARTITION BY 子句的事件。
-分析函数可以使用 PARTITION BY 子句，语法如下：
-
-```
-AnalyticFuncName(<arguments>...) OVER ([PARTITION BY <partition key>])
-```
-
-分析函数可以使用 WHEN 条件判断子句，根据是否满足条件来确定当前事件是否为有效事件。
-当为有效事件时，根据分析函数语意计算结果并更新状态。当为无效事件时，忽略事件值，复用保存的状态值。
-
-```
-AnalyticFuncName(<arguments>...) OVER ([WHEN <Expression>])
-```
-
-| Function    | Example                              | Description                                                                                        |
-|-------------|--------------------------------------|----------------------------------------------------------------------------------------------------|
-| lag         | lag(expr, [offset], [default value]) | 返回表达式前一个值在偏移 offset 处的结果，如果没有找到，则返回默认值，如果没有指定默认值则返回 nil。如果除 expression 外其余参数均未指定，偏移量默认为 1，默认值为 nil |
-| latest      | latest(expr, [default value])        | 返回表达式最新的非空值。如果没有找到，则返回默认值。否则，返回 nil 。                                                              |
-| changed_col | changed_col(true, col)               | 返回列的相比上次执行后的变化值。若未变化则返回 null 。                                                                     |
-| had_changed | had_changed(true, expr1, expr2, ...) | 返回是否上次运行后列的值有变化。 其参数可以为 * 以方便地监测所有列。                                                               |
-
-示例1：获取之前温度值的函数
-
-```text
-lag(temperature)
-```
-
-示例2：获取相同设备之前温度值的函数
-
-```text
-lag(temperature) OVER (PARTITION BY deviceId)
-```
-
-示例3：ts为时间戳，获取设备状态 statusCode1 和 statusCode2 不相等持续时间
-
-```text
-select lag(Status) as Status, ts - lag(ts, 1, ts) OVER (WHEN had_changed(true, statusCode)) as duration from demo
-```
-
-## 其它函数
-| 函数              | 示例                                   | 说明                                                                                                                                                                                |
-|-----------------|--------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| isNull          | isNull(col1)                         | 如果参数为空值，则返回 true。                                                                                                                                                                 |
-| coalesce        | coalesce(expr1, expr2, ...)          | 返回第一个非空参数，如果所有参数都是null，则返回null                                                                                                                                                    |
-| cardinality     | cardinality(col1)                    | 组中成员的数量。空值为0。                                                                                                                                                                     |
-| newuuid         | newuuid()                            | 返回一个随机的16字节 UUID。                                                                                                                                                                 |
-| tstamp          | tstamp()                             | 返回当前时间戳，以1970年1月1日星期四00:00:00协调世界时（UTC）为单位。                                                                                                                                       |
-| rule_id         | rule_id()                            | 返回当前匹配到的规则的ID。                                                                                                                                                                    |
-| mqtt            | mqtt(topic)                          | 返回指定键的 MQTT 元数据。 当前支持的键包括<br />-topic：返回消息的主题。 如果有多个流源，则在参数中指定源名称。 如 `mqtt(src1.topic)`<br />- messageid：返回消息的消息ID。 如果有多个流源，则在参数中指定源名称。 如 `mqtt(src2.messageid)`                  |
-| meta            | meta(topic)                          | 返回指定键的元数据。 键可能是：<br/>-如果 from 子句中只有一个来源，则为独立键，例如`meta(device)`<br />-用于指定流的合格键，例如 `meta(src1.device)` <br />-用于多级元数据的带有箭头的键，例如 `meta(src1.reading->device->name)`。这里假定读取是地图结构元数据。 |
-| window_start    | window_start()                       | 返回窗口的开始时间戳，格式为 int64。若运行时没有时间窗口，则返回默认值0。窗口的时间与规则所用的时间系统相同。若规则采用处理时间，则窗口的时间也为处理时间；若规则采用事件事件，则窗口的时间也为事件时间。                                                                          |
-| window_end      | window_end()                         | 返回窗口的结束时间戳，格式为 int64。若运行时没有时间窗口，则返回默认值0。窗口的时间与规则所用的时间系统相同。若规则采用处理时间，则窗口的时间也为处理时间；若规则采用事件事件，则窗口的时间也为事件时间。                                                                          |
-| get_keyed_state | get_keyed_state(expr1, expr2, expr3) | 返回键在数据库中对应的值。第一个参数为 键 表达式，第二个参数为值类型，支持 bigint, float, string, boolean and datetime 格式，第三个参数为默认值。默认数据库是sqlite，用户可以通过这个[配置](../configuration/global_configurations.md#外部状态)更改数据库。   |
-| delay           | delay(delayTime, returnVal)          | 延迟执行规则一段时间后返回第二个参数作为返回值。                                                                                                                                                          |
-
-## 多列函数
-
-多列函数执行运算之后会返回多个列。相对来说，普通的标量函数只返回单列。
-
-多列函数仅可在 `SELECT` 子句中使用。
-
-| 函数           | 示例                                           | 说明                                                           |
-|--------------|----------------------------------------------|--------------------------------------------------------------|
-| changed_cols | changed_cols(prefix, ignoreNull, colA, colB) | 返回值有变化的列，列名添加指定前缀。请看 [changed_cols](#changedcols-函数) 了解更多用法。 |
-
-
-## 多行函数
-
-多列函数执行运算之后会返回多个行。
-
-多行函数仅可在 `SELECT` 子句中使用, 并且在 `SELECT` 子句中只允许使用一个多行函数。
-
-| 函数     | 示例            | 说明                                                                                                     |
-|--------|---------------|--------------------------------------------------------------------------------------------------------|
-| unnest | unnest(array) | 参数列必须是一个 array 对象。该函数将参数 array 展开成多行作为结果返回。如果 array 对象中每一个子项为 map[string]interface{} 对象，则该子项会作为列在返回的行中 |
-
-
-### 例子
-
-创建流 demo，并给与如下输入。
-
-```json lines
-{"a": [1,2], "b": 3}
-```
-
-获取 unnest 结果的规则:
-
-```text
-SQL: SELECT unnest(a) FROM demo
-___________________________________________________
-{"unnest":1}
-{"unnest":2}
-```
-
-获取 unnest 结果与其他列的规则:
-
-```text
-SQL: SELECT unnest(a), b FROM demo
-___________________________________________________
-{"unnest":1, "b":3}
-{"unnest":2, "b":3}
-```
-
-创建流 demo，并给与如下输入。
-
-```json lines
-{"x": [{"a": 1,"b": 2}, {"a": 3,"b": 4}], "c": 5}
-```
-
-获取 unnest 结果与其他列的规则:
-
-```text
-SQL: SELECT unnest(x), c FROM demo
-___________________________________________________
-{"a":1, "b":2, "c": 5}
-{"a":3, "b":4, "c": 5}
-```
-
-## 监控变化的函数
-
-### Changed_col 函数
-
-该函数为普通的标量函数，因此可在任意的子句，包括 SELECT 和 WHERE 中使用。
-
-**语法**
-
-```CHANGED_COL(<ignoreNull>, <expr>)```
-
-**参数**
-
-**ignoreNull**:  判断变化时是否忽略 null 值。若为 true，则收到 null 值或未收到值不会触发变化。
-
-**expr**: 用来监控变化状态和输出变化值的表达式。
-
-**返回值**
-
-返回变化后的值或者 null （未变化）。与所有标量函数相同，该函数默认返回的列名未函数的名字 changed_col 。可使用 `as alias` 赋别名。
-
-### Changed_cols 函数
-
-该函数返回多个列的结果，因此只能在 SELECT 子句中使用。
-
-**语法**
-
-```CHANGED_COLS (<prefix>, <ignoreNull>, <expr> [,...,<exprN>])```
-
-**参数**
-
-**prefix**: 返回的列名的前缀。默认情况下，返回的变化列名与原列名相同，例如 `CHANGED_COLS("", true, col1)` 返回 `col1`。如果设置了前缀参数，则返回的列名将加上前缀以区别于普通的列，例如 `CHANGED_COLS("changed_", true, col1)` 将返回 `changed_col1`。
-
-**ignoreNull**: 判断变化时是否忽略 null 值。若为 true，则收到 null 值或未收到值不会触发变化。
-
-**expr**: 用来监控变化状态和输出变化值的表达式。可以为任何可在 SELECT 子句中使用的表达式。若表达式为 `*` 则会返回所有列的变化。
-
-**返回值**
-
-返回所有与上一次运行的值有变化的表达式的新值。如果在普通规则中使用，则与上次事件触发时的值比较。如果在窗口规则中使用，则与上次窗口输出的值比较。
-
-首次运行时，返回所有表达式的值，因为没有前一次的运行，所有表达式都判定为有变化。
-
-在接下来的运行中，如果选择的所有表达式都没有值变化，则返回空值。
-
-**注意事项**
-
-多列函数仅可在 select 子句中使用。其选出的值不能用于 WHERE 或其他子句中。若需要根据变化值做过滤，则应使用 CHANGED_COL 函数，或者将 CHANGED_COLS 的规则作为规则流水线的前置规则。
-
-函数返回的列命别名仅能通过 prefix 参数做全局的设置。若需要给每个列设置单独的别名，则需要使用 CHANGED_COL 函数。
-
-### Had_changed 函数
-
-该函数为向量函数，支持不定长度参数。
-
-```HAD_CHANGED (<ignoreNull>, <expr> [,...,<exprN>])```
-
-**参数**
-
-**ignoreNull**: 判断变化时是否忽略 null 值。若为 true，则收到 null 值或未收到值不会触发变化。
-
-**expr**: 用来监控变化状态和输出变化值的表达式。可以为任何可在 SELECT 子句中使用的表达式。若表达式为 `*` 则监测所有列的变化。
-
-**返回值**
-
-返回一个 bool 值，表示上次运行后的变化状态。多参数版本与用或连接使用单个参数的版本相同，即 HAD_CHANGED(expr1) OR HAD_CHANGED(expr2) ... OR HAD_CHANGED(exprN) 。若需要监测别的关系，可单独使用此函数。例如，监测是否所有值都有变化，可使用 HAD_CHANGED(expr1) AND HAD_CHANGED(expr2) ... AND HAD_CHANGED(exprN) 。
-
-### 范例
-
-创建流 demo，并给与如下输入。
-
-```json lines
-{"ts":1, "temperature":23, "humidity":88}
-{"ts":2, "temperature":23, "humidity":88}
-{"ts":3, "temperature":23, "humidity":88}
-{"ts":4, "temperature":25, "humidity":88}
-{"ts":5, "temperature":25, "humidity":90}
-{"ts":6, "temperature":25, "humidity":91}
-{"ts":7, "temperature":25, "humidity":91}
-{"ts":8, "temperature":25, "humidity":91}
-```
-
-获取 temperature 变化值的规则:
-
-```text
-SQL: SELECT CHANGED_COLS("", true, temperature) FROM demo
-___________________________________________________
-{"temperature":23}
-{"temperature":25}
-```
-
-获取 temperature 或 humidity 的变化值并添加名称前缀的规则:
-
-```text
-SQL: SELECT CHANGED_COLS("c_", true, temperature, humidity) FROM demo
-_________________________________________________________
-{"c_temperature":23,"c_humidity":88}
-{"c_temperature":25}
-{"c_humidity":90}
-{"c_humidity":91}
-```
-
-获取所有列的变化值并且不忽略 null 值的规则:
-
-```text
-SQL: SELECT CHANGED_COLS("c_", false, *) FROM demo
-_________________________________________________________
-{"c_ts":1, "c_temperature":23, "c_humidity":88}
-{"c_ts":2}
-{"c_ts":3}
-{"c_ts":4, "c_temperature":25}
-{"c_ts":5, "c_humidity":90}
-{"c_ts":6, "c_humidity":91}
-{"c_ts":7}
-{"c_ts":8}
-```
-
-获取窗口中平均值变化的规则:
-
-```text
-SQL: SELECT CHANGED_COLS("t", true, avg(temperature)) FROM demo GROUP BY CountWindow(2)
-_________________________________________________________________
-{"tavg":23}
-{"tavg":24}
-{"tavg":25}
-```
-
-当 temperature 或者 humidity 变化时获取数据:
-
-```text
-SQL: SELECT ts, temperature, humidity FROM demo
-WHERE HAD_CHANGED(true, temperature, humidity) = true
-_________________________________________________________
-{"ts":1,temperature":23,"humidity":88}
-{"ts":4,temperature":25,"humidity":88}
-{"ts":5,temperature":25,"humidity":90}
-{"ts":6,temperature":25,"humidity":91}
-```
-
-当 temperature 变化且 humidity 未变化时获取数据:
-
-```text
-SQL: SELECT ts, temperature, humidity FROM demo 
-WHERE HAD_CHANGED(true, temperature) = true AND HAD_CHANGED(true, humidity) = false
-_________________________________________________________
-{"ts":4,temperature":25,"humidity":88}
-```
-
-获取 temperature 和 humidity 的变化值并赋自定义名:
-
-```text
-SQL: SELECT CHANGED_COL(true, temperature) AS myTemp, CHANGED_COL(true, humidity) AS myHum FROM demo
-_________________________________________________________
-{"myTemp":23,"myHum":88}
-{"myTemp":25}
-{"myHum":90}
-{"myHum":91}
-```
-
-当 temperature 值变化后大于 24 时获取数据:
-
-```text
-SQL: SELECT ts, temperature, humidity FROM demo 
-WHERE CHANGED_COL(true, temperature) > 24
-_________________________________________________________
-{"ts":4,temperature":25,"humidity":88}
-```

docs/zh_CN/sqls/data_types.md

@@ -8,16 +8,16 @@
 
 以下是支持的数据类型的列表。
 
-| #   | 数据类型     | 描述                            |
-|-----|----------|-------------------------------|
-| 1   | bigint   | 整数型                           |
-| 2   | float    | 浮点型                           |
-| 3   | string   | 文本值，由 Unicode 字符组成。           |
-| 4   | datetime | 日期时间类型。                       |
-| 5   | boolean  | 布尔类型，值可以是`true` 或者 `false`。   |
-| 6   | bytea    | 用于存储二进制数据的字节数组。如果在格式为 "JSON" 的流中使用此类型，则传入的数据需要为 base64 编码的字符串。       |
-| 7   | array    | 数组类型可以是简单数据或结构类型中的任何类型。       |
-| 8   | struct   | 复杂类型。 名称/值对的集合。 值必须是受支持的数据类型。 |
+| # | 数据类型     | 描述                                                             |
+|---|----------|----------------------------------------------------------------|
+| 1 | bigint   | 整数型                                                            |
+| 2 | float    | 浮点型                                                            |
+| 3 | string   | 文本值，由 Unicode 字符组成。                                            |
+| 4 | datetime | 日期时间类型。                                                        |
+| 5 | boolean  | 布尔类型，值可以是`true` 或者 `false`。                                    |
+| 6 | bytea    | 用于存储二进制数据的字节数组。如果在格式为 "JSON" 的流中使用此类型，则传入的数据需要为 base64 编码的字符串。 |
+| 7 | array    | 数组类型可以是简单数据或结构类型中的任何类型。                                        |
+| 8 | struct   | 复杂类型。 名称/值对的集合。 值必须是受支持的数据类型。                                  |
 
 ## 比较和计算的兼容性
 
@@ -42,4 +42,4 @@
 
 ## 类型转换
 
-可使用内置函数 `cast(col, targetType)` 在运行时进行显式类型转换。详情请参考 [cast](./built-in_functions.md#转换函数)。
+可使用内置函数 `cast(col, targetType)` 在运行时进行显式类型转换。详情请参考 [cast](./functions/transform_functions.md)。

docs/zh_CN/sqls/functions/aggregate_functions.md

@@ -0,0 +1,144 @@
+# 聚合函数
+
+聚合函数对一组值执行计算并返回单个值。聚合函数只能用在以下表达式中：
+
+* select 语句的 select 列表（子查询或外部查询）。
+* HAVING 子句。
+
+## AVG
+
+```
+avg(col)
+```
+
+返回组中的平均值。空值不参与计算。
+
+## COUNT
+
+```
+count(*)
+count(col)
+```
+
+返回组中的项目数。空值不参与计算。
+
+## MAX
+
+```
+max(col)
+```
+
+返回组中的最大值。空值不参与计算。
+
+## MIN
+
+```
+min(col)
+```
+
+返回组中的最小值。空值不参与计算。
+
+## SUM
+
+```
+sum(col)
+```
+
+返回组中所有值的总和。空值不参与计算。
+
+## COLLECT
+
+```
+collect(*)
+collect(col)
+```
+
+返回组中指定的列或整个消息（参数为*时）的值组成的数组。
+
+## 示例
+
+- 获取当前窗口所有消息的列 a 的值组成的数组。假设列 a 的类型为 int, 则结果为: `[{"r1":[32, 45]}]`
+    ```sql
+    SELECT collect(a) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
+    ```
+- 获取当前窗口所有消息的列 a 的值组成的数组。结果为: `[{"r1":{"a":32, "b":"hello"}, {"a":45, "b":"world"}}]`
+    ```sql
+    SELECT collect(*) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
+    ```
+
+- 获取当前窗口第二个消息的列 `a` 的值。结果为: `[{"r1":32}]`
+    ```sql
+    SELECT collect(*)[1]->a as r1 FROM test GROUP BY TumblingWindow(ss, 10)
+    ```
+
+## DEDUPLICATE
+
+```
+deduplicate(col, false)
+```
+
+返回当前组去重的结果，通常用在窗口中。其中，第一个参数指定用于去重的列；第二个参数指定是否返回全部结果。若为 false
+，则仅返回最近的未重复的项；若最近的项有重复，则返回空数组；此时可以设置 sink
+参数 [omitIfEmpty](../../guide/sinks/overview.md#公共属性)，使得 sink 接到空结果后不触发。
+
+### 示例
+
+- 获取当前窗口中，列 `a` 值不重复的所有消息组成的数组。结果为: `[{"r1":{"a":32, "b":"hello"}, {"a":45, "b":"world"}}]`
+    ```sql
+    SELECT deduplicate(a, true) as r1 FROM test GROUP BY TumblingWindow(ss, 10)
+    ```
+- 获取列 `a` 值在过去一小时中不重复的值。每收到一条新消息，都会检测列 `a` 是否重复，若不重复则输出：`[{"r1":32}]`
+  或者 `[{"r1":45}]`。若检测到重复值，则输出 `[{}]` 。此时，可以设置 omitIfEmpty 的 sink 参数使得检测到重复值时不触发规则。
+     ```sql
+     SELECT deduplicate(a, false)->a as r1 FROM demo GROUP BY SlidingWindow(hh, 1)
+     ```
+
+## STDDEV
+
+```
+stddev(col)
+```
+
+返回组中所有值的标准差。空值不参与计算。
+
+## STDDEVS
+
+```
+stddevs(col)
+```
+
+返回组中所有值的样本标准差。空值不参与计算。
+
+## VAR
+
+```
+var(col)
+```
+
+返回组中所有值的方差。空值不参与计算。
+
+## VARS
+
+```
+vars(col)
+```
+
+返回组中所有值的样本方差。空值不参与计算。
+
+## PERCENTILE
+
+```
+percentile(col, 0.5)
+```
+
+返回组中所有值的指定百分位数。空值不参与计算。其中，第一个参数指定用于计算百分位数的列；第二个参数指定百分位数的值，取值范围为
+0.0 ~ 1.0 。
+
+## PERCENTILE_DISC
+
+```
+percentile_disc(col, 0.5)
+```
+
+返回组中所有值的指定百分位数。空值不参与计算。其中，第一个参数指定用于计算百分位数的列；第二个参数指定百分位数的值，取值范围为
+0.0 ~ 1.0 。

docs/zh_CN/sqls/functions/analytic_functions.md

@@ -0,0 +1,277 @@
+# 分析函数
+
+分析函数会保持状态来做分析工作。在流式处理规则中，分析函数会首先被执行，这样它们就不会受到 WHERE 子句的影响而必不更新状态。
+
+分析函数完整使用格式如下，其中 over 子句为可选子句。
+
+```
+AnalyticFuncName(<arguments>...) OVER ([PARTITION BY <partition key>] [WHEN <Expression>])
+```
+
+分析函数的计算是在当前查询输入的所有输入事件上进行的，可以选择限制分析函数只考虑符合 PARTITION BY 子句的事件。
+分析函数可以使用 PARTITION BY 子句，语法如下：
+
+```
+AnalyticFuncName(<arguments>...) OVER ([PARTITION BY <partition key>])
+```
+
+分析函数可以使用 WHEN 条件判断子句，根据是否满足条件来确定当前事件是否为有效事件。
+当为有效事件时，根据分析函数语意计算结果并更新状态。当为无效事件时，忽略事件值，复用保存的状态值。
+
+```
+AnalyticFuncName(<arguments>...) OVER ([WHEN <Expression>])
+```
+
+## LAG
+
+```
+lag(expr, [offset], [default value])
+```
+
+返回表达式前一个值在偏移 offset 处的结果，如果没有找到，则返回默认值，如果没有指定默认值则返回 nil。
+
+示例1：获取之前温度值的函数
+
+```text
+lag(temperature)
+```
+
+示例2：获取相同设备之前温度值的函数
+
+```text
+lag(temperature) OVER (PARTITION BY deviceId)
+```
+
+示例3：ts为时间戳，获取设备状态 statusCode1 和 statusCode2 不相等持续时间
+
+```text
+select lag(Status) as Status, ts - lag(ts, 1, ts) OVER (WHEN had_changed(true, statusCode)) as duration from demo
+```
+
+## LATEST
+
+```
+latest(expr, [default value])
+```
+
+返回表达式最新的非空值。如果没有找到，则返回默认值。否则，返回 nil 。
+
+## CHANGED_COL
+
+```
+changed_col(true, col)
+```
+
+返回列的相比上次执行后的变化值。若未变化则返回 null 。
+
+## HAD_CHANGED
+
+```
+had_changed(true, expr1, expr2, ...)
+```
+
+返回是否上次运行后列的值有变化。 其参数可以为 * 以方便地监测所有列。
+
+## 监控变化的函数
+
+### Changed_col 函数
+
+该函数为普通的标量函数，因此可在任意的子句，包括 SELECT 和 WHERE 中使用。
+
+**语法**
+
+```CHANGED_COL(<ignoreNull>, <expr>)```
+
+**参数**
+
+**ignoreNull**:  判断变化时是否忽略 null 值。若为 true，则收到 null 值或未收到值不会触发变化。
+
+**expr**: 用来监控变化状态和输出变化值的表达式。
+
+**返回值**
+
+返回变化后的值或者 null （未变化）。与所有标量函数相同，该函数默认返回的列名未函数的名字 changed_col 。可使用 `as alias` 赋别名。
+
+### Changed_cols 函数
+
+该函数返回多个列的结果，因此只能在 SELECT 子句中使用。
+
+**语法**
+
+```CHANGED_COLS (<prefix>, <ignoreNull>, <expr> [,...,<exprN>])```
+
+**参数**
+
+**prefix**: 返回的列名的前缀。默认情况下，返回的变化列名与原列名相同，例如 `CHANGED_COLS("", true, col1)` 返回 `col1`
+。如果设置了前缀参数，则返回的列名将加上前缀以区别于普通的列，例如 `CHANGED_COLS("changed_", true, col1)`
+将返回 `changed_col1`。
+
+**ignoreNull**: 判断变化时是否忽略 null 值。若为 true，则收到 null 值或未收到值不会触发变化。
+
+**expr**: 用来监控变化状态和输出变化值的表达式。可以为任何可在 SELECT 子句中使用的表达式。若表达式为 `*` 则会返回所有列的变化。
+
+**返回值**
+
+返回所有与上一次运行的值有变化的表达式的新值。如果在普通规则中使用，则与上次事件触发时的值比较。如果在窗口规则中使用，则与上次窗口输出的值比较。
+
+首次运行时，返回所有表达式的值，因为没有前一次的运行，所有表达式都判定为有变化。
+
+在接下来的运行中，如果选择的所有表达式都没有值变化，则返回空值。
+
+**注意事项**
+
+多列函数仅可在 select 子句中使用。其选出的值不能用于 WHERE 或其他子句中。若需要根据变化值做过滤，则应使用 CHANGED_COL
+函数，或者将 CHANGED_COLS 的规则作为规则流水线的前置规则。
+
+函数返回的列命别名仅能通过 prefix 参数做全局的设置。若需要给每个列设置单独的别名，则需要使用 CHANGED_COL 函数。
+
+### Had_changed 函数
+
+该函数为向量函数，支持不定长度参数。
+
+```HAD_CHANGED (<ignoreNull>, <expr> [,...,<exprN>])```
+
+**参数**
+
+**ignoreNull**: 判断变化时是否忽略 null 值。若为 true，则收到 null 值或未收到值不会触发变化。
+
+**expr**: 用来监控变化状态和输出变化值的表达式。可以为任何可在 SELECT 子句中使用的表达式。若表达式为 `*` 则监测所有列的变化。
+
+**返回值**
+
+返回一个 bool 值，表示上次运行后的变化状态。多参数版本与用或连接使用单个参数的版本相同，即 HAD_CHANGED(expr1) OR
+HAD_CHANGED(expr2) ... OR HAD_CHANGED(exprN) 。若需要监测别的关系，可单独使用此函数。例如，监测是否所有值都有变化，可使用
+HAD_CHANGED(expr1) AND HAD_CHANGED(expr2) ... AND HAD_CHANGED(exprN) 。
+
+### 范例
+
+创建流 demo，并给与如下输入。
+
+```json lines
+{
+  "ts": 1,
+  "temperature": 23,
+  "humidity": 88
+}
+{
+  "ts": 2,
+  "temperature": 23,
+  "humidity": 88
+}
+{
+  "ts": 3,
+  "temperature": 23,
+  "humidity": 88
+}
+{
+  "ts": 4,
+  "temperature": 25,
+  "humidity": 88
+}
+{
+  "ts": 5,
+  "temperature": 25,
+  "humidity": 90
+}
+{
+  "ts": 6,
+  "temperature": 25,
+  "humidity": 91
+}
+{
+  "ts": 7,
+  "temperature": 25,
+  "humidity": 91
+}
+{
+  "ts": 8,
+  "temperature": 25,
+  "humidity": 91
+}
+```
+
+获取 temperature 变化值的规则:
+
+```text
+SQL: SELECT CHANGED_COLS("", true, temperature) FROM demo
+___________________________________________________
+{"temperature":23}
+{"temperature":25}
+```
+
+获取 temperature 或 humidity 的变化值并添加名称前缀的规则:
+
+```text
+SQL: SELECT CHANGED_COLS("c_", true, temperature, humidity) FROM demo
+_________________________________________________________
+{"c_temperature":23,"c_humidity":88}
+{"c_temperature":25}
+{"c_humidity":90}
+{"c_humidity":91}
+```
+
+获取所有列的变化值并且不忽略 null 值的规则:
+
+```text
+SQL: SELECT CHANGED_COLS("c_", false, *) FROM demo
+_________________________________________________________
+{"c_ts":1, "c_temperature":23, "c_humidity":88}
+{"c_ts":2}
+{"c_ts":3}
+{"c_ts":4, "c_temperature":25}
+{"c_ts":5, "c_humidity":90}
+{"c_ts":6, "c_humidity":91}
+{"c_ts":7}
+{"c_ts":8}
+```
+
+获取窗口中平均值变化的规则:
+
+```text
+SQL: SELECT CHANGED_COLS("t", true, avg(temperature)) FROM demo GROUP BY CountWindow(2)
+_________________________________________________________________
+{"tavg":23}
+{"tavg":24}
+{"tavg":25}
+```
+
+当 temperature 或者 humidity 变化时获取数据:
+
+```text
+SQL: SELECT ts, temperature, humidity FROM demo
+WHERE HAD_CHANGED(true, temperature, humidity) = true
+_________________________________________________________
+{"ts":1,temperature":23,"humidity":88}
+{"ts":4,temperature":25,"humidity":88}
+{"ts":5,temperature":25,"humidity":90}
+{"ts":6,temperature":25,"humidity":91}
+```
+
+当 temperature 变化且 humidity 未变化时获取数据:
+
+```text
+SQL: SELECT ts, temperature, humidity FROM demo 
+WHERE HAD_CHANGED(true, temperature) = true AND HAD_CHANGED(true, humidity) = false
+_________________________________________________________
+{"ts":4,temperature":25,"humidity":88}
+```
+
+获取 temperature 和 humidity 的变化值并赋自定义名:
+
+```text
+SQL: SELECT CHANGED_COL(true, temperature) AS myTemp, CHANGED_COL(true, humidity) AS myHum FROM demo
+_________________________________________________________
+{"myTemp":23,"myHum":88}
+{"myTemp":25}
+{"myHum":90}
+{"myHum":91}
+```
+
+当 temperature 值变化后大于 24 时获取数据:
+
+```text
+SQL: SELECT ts, temperature, humidity FROM demo 
+WHERE CHANGED_COL(true, temperature) > 24
+_________________________________________________________
+{"ts":4,temperature":25,"humidity":88}
+```

docs/zh_CN/sqls/functions/array_functions.md

@@ -0,0 +1,124 @@
+# 数组函数
+
+数组函数用于操作数组或返回有关数组的信息。
+
+## CARDINALITY
+
+```
+cardinality(array)
+```
+
+返回数组中的元素数。
+
+## ARRAY_POSITION
+
+```
+array_position(array, value)
+```
+
+返回第二个参数在列表参数中的索引下标位置，索引下标从 0 开始，若该元素不存在，则返回 -1。
+
+## ELEMENT_AT
+
+```
+element_at(array, index)
+```
+
+返回列表参数中在给定索引下的元素，索引下标从 0 开始，若该索引小于 0，则该元素从列表末向列表头进行计数。
+
+## ARRAY_CONTAINS
+
+```
+array_contains(array, value)
+```
+
+返回给定元素是否存在列表参数中，存在则返回 true，否则返回 false。
+
+## ARRAY_CREATE
+
+```
+array_create(value1, ......)
+```
+
+将给定的元素参数们创建为一个列表元素。
+
+## ARRAY_REMOVE
+
+```
+array_remove(array, value)
+```
+
+返回删除了所有出现的给定元素的数组。
+
+## ARRAY_LAST_POSITION
+
+```
+array_last_position(array, val)
+```
+
+返回第二个参数在列表参数中最后一次出现的下标位置，索引下标从 0 开始，若该元素不存在，则返回 -1。
+
+## ARRAY_CONTAIN_ANY
+
+```
+array_contain_any(array1, array2)
+```
+
+返回第一个参数中是否存在第二个参数中的任意一个元素，存在则返回 true，否则返回 false。
+
+## ARRAY_INTERSECT
+
+```
+array_intersect(array1, array2)
+```
+
+返回两个数组的交集，且不包含重复元素。
+
+## ARRAY_UNION
+
+```
+array_union(array1, array2)
+```
+
+返回两个数组的并集，且不包含重复元素。
+
+## ARRAY_MAX
+
+```
+array_max(array)
+```
+
+返回数组中的最大值, 若数组元素中存在 null，则返回 null。
+
+## ARRAY_MIN
+
+```
+array_min(array)
+```
+
+返回数组中的最小值, 若数组元素中存在 null，则返回 null。
+
+## ARRAY_EXCEPT
+
+```
+array_except(array1, array2)
+```
+
+返回第一个数组中存在，但第二个数组中不存在的元素，且不包含重复元素。
+
+## REPEAT
+
+```
+repeat(value, count)
+```
+
+返回一个由给定元素参数重复出现指定次数的列表元素。
+
+## SEQUENCE
+
+```
+sequence(start, stop[, step])
+```
+
+返回一个从第一个开始参数到第二个结束参数的整数列表，每个元素按照给定的步长递增或递减。若未提供步长，则默认为
+1（如果第一个开始参数小于第二个结束参数），或 -1（如果第一个开始参数大于第二个结束参数），且步长不允许为 0。

docs/zh_CN/sqls/custom_functions.md

@@ -1,6 +1,6 @@
 # 定制函数
 
-eKuiper 可以定制函数，函数的开发、编译及使用请[参见这里](../extension/native/develop/function.md)。
+eKuiper 可以定制函数，函数的开发、编译及使用请[参见这里](../../extension/native/develop/function.md)。
 
 ## echo 插件
 
@@ -120,7 +120,7 @@ geohashDecodeInt 示例
 SELECT geohashDecodeInt(hash) FROM test
 ```
 
- geohashBoundingBox  示例
+geohashBoundingBox 示例
 
 - 输入：`{"hash" :"qgmpvf18h86e"} `
 - 输出：`{"geohashBoundingBox":{"MinLat":-25.345457140356302,"MaxLat":-25.34545697271824,"MinLng":131.03619195520878,"MaxLng":131.0361922904849}}`
@@ -129,7 +129,7 @@ SELECT geohashDecodeInt(hash) FROM test
 SELECT geohashBoundingBox(hash) FROM test
 ```
 
- geohashBoundingBoxInt  示例
+geohashBoundingBoxInt 示例
 
 - 输入：`{"hash" :12963433097944239317}`
 - 输出：`{"geohashBoundingBoxInt":{"MinLat":-25.345456302165985,"MaxLat":-25.34545626025647,"MinLng":131.0361886024475,"MaxLng":131.03618868626654}}`
@@ -186,8 +186,9 @@ SELECT labelImage(self) FROM tfdemo
 
 ### tfLite 插件
 
-该插件(只能用在有 slim 后缀的 docker image 中)用于执行 TensorFlow Lite 推理。用户只需上传 `.tflite` 模型，在 sql 中调用 `tfLite(model_name, input_data)` 函数，即可收到模型推理的结果。
-上传模型时请使用 [uploads](../api/restapi/uploads.md) 接口将模型文件上传即可。
+该插件(只能用在有 slim 后缀的 docker image 中)用于执行 TensorFlow Lite 推理。用户只需上传 `.tflite` 模型，在 sql
+中调用 `tfLite(model_name, input_data)` 函数，即可收到模型推理的结果。
+上传模型时请使用 [uploads](../../api/restapi/uploads.md) 接口将模型文件上传即可。
 函数调用时 `model_name` 参数为不带 `.tflite` 后缀的模型名称。 `input_data` 应该是消息中的 key 字段，对应的值应该是一维数组格式
 
 ```sql

docs/zh_CN/sqls/functions/hashing_functions.md

@@ -0,0 +1,43 @@
+# 哈希函数
+
+哈希函数用于计算输入值的哈希值。
+
+## MD5
+
+```
+md5(col)
+```
+
+返回参数的 md5 哈希值。
+
+## SHA1
+
+```
+sha1(col)
+```
+
+返回参数的 sha1 哈希值。
+
+## SHA256
+
+```
+sha256(col)
+```
+
+返回参数的 sha256 哈希值。
+
+## SHA384
+
+```
+sha384(col)
+```
+
+返回参数的 sha384 哈希值。
+
+## SHA512
+
+```
+sha512(col)
+```
+
+返回参数的 sha512 哈希值。

docs/zh_CN/sqls/functions/json_functions.md

@@ -0,0 +1,44 @@
+# JSON 函数
+
+JSON 函数操作 JSON 字符串或返回有关 JSON 的信息。
+这里面包含了几个 JSON PATH 操作函数。**请参阅 [json 路径函数](../json_expr.md#Json-路径函数) 了解如何编写json路径。**
+
+## TO_JSON
+
+```
+to_json(col)
+```
+
+将输入值转换为包含该值 JSON 表示的字符串。如果输入为 NULL，则结果也为 NULL。
+
+## PARSE_JSON
+
+```
+parse_json(col)
+```
+
+将输入的 JSON 字符串转换为值。如果输入为 NULL，则结果也为 NULL。
+
+## JSON_PATH_EXISTS
+
+```
+json_path_exists(col, json_path)
+```
+
+检查 JSON 路径是否返回指定 JSON 值的任何项目。 返回布尔值。
+
+## JSON_PATH_QUERY
+
+```
+json_path_query(col, json_path)
+```
+
+获取 JSON 路径返回的指定 JSON 值的所有项目。
+
+## JSON_PATH_QUERY_FIRST
+
+```
+json_path_query_first(col, json_path)
+```
+
+获取 JSON 路径返回的指定 JSON 值的第一个项目。

docs/zh_CN/sqls/functions/mathematical_functions.md

@@ -0,0 +1,203 @@
+# 数学函数
+
+数学函数执行许多常见的数学运算。它们接受数字输入并返回数字输出。
+
+## ABS
+
+```
+abs(col)
+```
+
+返回参数的绝对值。
+
+## ACOS
+
+```
+acos(col)
+```
+
+返回弧度数的反余弦值。
+
+## ASIN
+
+```
+asin(col)
+```
+
+返回弧度数的反正弦值。
+
+## ATAN
+
+```
+atan(col)
+```
+
+返回弧度数的反正切值。
+
+## ATAN2
+
+```
+atan2(col1, col2)
+```
+
+返回正x轴与两个自变量中定义的（x，y）点之间的弧度角。
+
+## BITAND
+
+```
+bitand(col1, col2)
+```
+
+对两个 Int 参数执行按位与运算。
+
+## BITOR
+
+```
+bitor(col1, col2)
+```
+
+对两个 Int 参数执行按位或运算。
+
+## BITXOR
+
+```
+bitxor(col1, col2)
+```
+
+对两个 Int 参数执行按位异或运算。
+
+## BITNOT
+
+```
+bitnot(col)
+```
+
+在 Int 参数的执行按位非运算。
+
+## CEIL
+
+```
+ceil(col)
+```
+
+将值舍入到最接近的 BIGINT 值。
+
+## COS
+
+```
+cos(col)
+```
+
+返回以弧度为单位的数字的余弦值。
+
+## COSH
+
+```
+cosh(col)
+```
+
+返回弧度数的双曲余弦值。
+
+## EXP
+
+```
+exp(col)
+```
+
+返回小数点参数的 e。
+
+## LN
+
+```
+ln(col)
+```
+
+返回参数的自然对数。
+
+## LOG
+
+```
+log(col)
+```
+
+返回参数的以10为底的对数。
+
+## MOD
+
+```
+mod(col1, col2)
+```
+
+返回第一个参数除以第二个参数的余数。
+
+## POWER
+
+```
+power(x, y)
+```
+
+返回 x 的 y 次方。
+
+## RAND
+
+```
+rand()
+```
+
+返回一个伪随机数，其均匀分布在0.0和1.0之间。
+
+## ROUND
+
+```
+round(col)
+```
+
+将值四舍五入到最接近的 BIGINT 值。
+
+## SIGN
+
+```
+sign(col)
+```
+
+返回给定数字的符号。 当参数的符号为正时，将返回1。 当参数的符号为负数时，返回-1。 如果参数为0，则返回0。
+
+## SIN
+
+```
+sin(col)
+```
+
+返回以弧度为单位的数字的正弦值。
+
+## SINH
+
+```
+sinh(col)
+```
+
+返回弧度数的双曲正弦值。
+
+## SQRT
+
+```
+sqrt(col)
+```
+
+返回参数的平方根。
+
+## TAN
+
+```
+tan(col)
+```
+
+返回以弧度为单位的数字的正切值。
+
+## TANH
+
+```
+tanh(col)
+```
+
+返回弧度数的双曲正切值。

docs/zh_CN/sqls/functions/multi_column_functions.md

@@ -0,0 +1,13 @@
+# 多列函数
+
+多列函数执行运算之后会返回多个列。相对来说，普通的标量函数只返回单列。
+
+多列函数仅可在 `SELECT` 子句中使用。
+
+## CHANGED_COLS
+
+```
+changed_cols(prefix, ignoreNull, colA, colB)
+```
+
+返回值有变化的列，列名添加指定前缀。请看 [changed_cols](./analytic_functions.md#changedcols-函数) 了解更多用法。

docs/zh_CN/sqls/functions/multi_row_functions.md

@@ -0,0 +1,73 @@
+# 多行函数
+
+多列函数执行运算之后会返回多个行。
+
+多行函数仅可在 `SELECT` 子句中使用, 并且在 `SELECT` 子句中只允许使用一个多行函数。
+
+## UNNEST
+
+```
+unnest(array)
+```
+
+参数必须是一个 array 对象。该函数将参数 array 展开成多行作为结果返回。如果 array 对象中每一个子项为 map[string]interface{}
+对象，则该子项会作为列在返回的行中。
+
+### 例子
+
+创建流 demo，并给与如下输入。
+
+```json lines
+{
+  "a": [
+    1,
+    2
+  ],
+  "b": 3
+}
+```
+
+获取 unnest 结果的规则:
+
+```text
+SQL: SELECT unnest(a) FROM demo
+___________________________________________________
+{"unnest":1}
+{"unnest":2}
+```
+
+获取 unnest 结果与其他列的规则:
+
+```text
+SQL: SELECT unnest(a), b FROM demo
+___________________________________________________
+{"unnest":1, "b":3}
+{"unnest":2, "b":3}
+```
+
+创建流 demo，并给与如下输入。
+
+```json lines
+{
+  "x": [
+    {
+      "a": 1,
+      "b": 2
+    },
+    {
+      "a": 3,
+      "b": 4
+    }
+  ],
+  "c": 5
+}
+```
+
+获取 unnest 结果与其他列的规则:
+
+```text
+SQL: SELECT unnest(x), c FROM demo
+___________________________________________________
+{"a":1, "b":2, "c": 5}
+{"a":3, "b":4, "c": 5}
+```

docs/zh_CN/sqls/functions/object_functions.md

@@ -0,0 +1,52 @@
+# 对象函数
+
+对象函数用于操作对象/映射。
+
+## KEYS
+
+```
+keys(map<string, any>)
+```
+
+返回的给定的 map 参数中的所有 key 值。
+
+## VALUES
+
+```
+values(map<string, any>)
+```
+
+返回给定的 map 参数中的所有 value 值。
+
+## OBJECT
+
+```
+object(arr1, arr2)
+```
+
+接受两个 list 参数来构造 map 对象，第一个 list 作为 map 对象的 key，第二个 list 作为 map 对象的 value。两个 list 参数长度必须相等。
+
+## ZIP
+
+```
+zip([arr1, arr2], ......)
+```
+
+接受一组 list 对象来构造 map 对象，每个 list 元素的长度必须为 2，每个 list 元素内的第一个元素将作为 key，第二个元素将作为
+value。
+
+## ITEMS
+
+```
+items(map<string, any>)
+```
+
+根据给定的 map 参数构造一个 list 对象，每个元素都为一个长度为 2 的 list 对象，其中第一个元素为 key，第二个元素为 value。
+
+## OBJECT_CONSTRUCT
+
+```
+object_construct(key1, col, ...)
+```
+
+返回由参数构建的 object/map 。参数为一系列的键值对，因此必须为偶数个。键必须为 string 类型，值可以为任意类型。如果值为空，则该键值对不会出现在最终的对象中。

docs/zh_CN/sqls/functions/other_functions.md

@@ -0,0 +1,98 @@
+## 其他函数
+
+本节介绍未分类到其余文档页面的内置函数。
+
+## ISNULL
+
+```
+isNull(col)
+```
+
+如果参数为空值，则返回 true ，否则返回 false 。
+
+## COALESCE
+
+```
+coalesce(expr1, expr2, ...)
+```
+
+返回第一个非空参数，如果所有参数都是 null ，则返回 null 。
+
+## NEWUUID
+
+```
+newuuid()
+```
+
+返回一个随机的 16 字节 UUID。
+
+## TSTAMP
+
+```
+tstamp()
+```
+
+返回当前时间戳，以1970年1月1日星期四00:00:00协调世界时（UTC）为单位。
+
+## RULE_ID
+
+```
+rule_id()
+```
+
+返回当前匹配到的规则的ID。
+
+## MQTT
+
+```
+mqtt(topic)
+```
+
+返回指定键的 MQTT 元数据。 当前支持的键包括:
+
+- topic：返回消息的主题。 如果有多个流源，则在参数中指定源名称。 如 `mqtt(src1.topic)`
+- messageid：返回消息的消息ID。 如果有多个流源，则在参数中指定源名称。 如 `mqtt(src2.messageid)`
+
+该函数仅用于数据源为 MQTT 的情况。其余数据源请使用 META 函数。
+
+## META
+
+```
+meta(key)
+```
+
+返回指定键的元数据。
+
+## WINDOW_START
+
+```
+window_start()
+```
+
+返回窗口的开始时间戳，格式为 int64。若运行时没有时间窗口，则返回默认值0。窗口的时间与规则所用的时间系统相同。若规则采用处理时间，则窗口的时间也为处理时间；若规则采用事件事件，则窗口的时间也为事件时间。
+
+## WINDOW_END
+
+```
+window_end()
+```
+
+返回窗口的结束时间戳，格式为 int64。若运行时没有时间窗口，则返回默认值0。窗口的时间与规则所用的时间系统相同。若规则采用处理时间，则窗口的时间也为处理时间；若规则采用事件事件，则窗口的时间也为事件时间。
+
+## GET_KEYED_STATE
+
+```
+get_keyed_state(key, state_name)
+```
+
+返回键在数据库中对应的值。第一个参数为 键 表达式，第二个参数为值类型，支持 bigint, float, string, boolean and datetime
+格式，第三个参数为默认值。默认数据库是sqlite，用户可以通过这个[配置](../../configuration/global_configurations.md#外部状态)
+更改数据库。
+
+## DELAY
+
+```
+delay(delayTime, returnVal)
+```
+
+延迟执行规则一段时间后返回第二个参数作为返回值。第一个参数为延迟时间，单位为毫秒，第二个参数为返回值。

docs/zh_CN/sqls/functions/overview.md

@@ -0,0 +1,22 @@
+# 函数
+
+eKuiper 具有许多内置函数，可以对数据执行计算。
+
+- [聚合函数](./aggregate_functions)
+- [数学函数](./mathematical_functions.md)
+- [字符串函数](./string_functions.md)
+- [数组函数](./array_functions.md)
+- [对象函数](./object_functions.md)
+- [哈希函数](./hashing_functions.md)
+- [转换函数](./transform_functions.md)
+- [JSON 函数](./json_functions.md)
+- [其他函数](./other_functions.md)
+
+
+- [分析函数](./analytic_functions)
+- [多行函数](./multi_row_functions.md)
+- [多列函数](./multi_column_functions.md)
+
+eKuiper 也有一组通过插件提供的函数。用户需要在使用之前安装插件。
+
+- [Custom Functions](./custom_functions.md)

docs/zh_CN/sqls/functions/string_functions.md

@@ -0,0 +1,183 @@
+# 字符串函数
+
+字符串函数用于操作字符串数据。
+
+## CONCAT
+
+```
+concat(col1...)
+```
+
+连接数组或字符串。 此函数接受任意数量的参数并返回 String 或 Array。
+
+## ENDSWITH
+
+```
+endswith(col1, col2)
+```
+
+返回一个布尔值，该布尔值指示第一个 String 参数是否以第二个 String 参数结尾。
+
+## FORMAT_TIME
+
+```
+format_time(col, format)
+```
+
+将日期时间格式化为字符串。其中，若参数 col
+为兼容类型，则在格式化之前[转换为 datetime 类型](./transform_functions.md#转换为-datetime-类型)
+。关于格式字符串，请参考 [时间格式](#时间格式)。
+
+### 时间格式
+
+时间格式为一些特定符号和字母组成的字符串。eKuiper 里支持的符号如下表所示：
+
+| 符号 | 含义       | 示例                                    |
+|----|----------|---------------------------------------|
+| G  | 公元       | G(AD)                                 |
+| Y  | 年        | YYYY(2004), YY(04)                    |
+| M  | 月        | M(1), MM(01), MMM(Jan), MMMM(January) |
+| d  | 日期       | d(2), dd(02)                          |
+| E  | 星期几      | EEE(Mon), EEEE(Monday)                |
+| H  | 24小时制的小时 | HH(15)                                |
+| h  | 12小时制的小时 | h(2), hh(03)                          |
+| a  | AM 或 PM  | a(PM)                                 |
+| m  | 分        | m(4), mm(04)                          |
+| s  | 秒        | s(5), ss(05)                          |
+| S  | 秒的分数     | S(.0), SS(.00), SSS(.000)             |
+| z  | 时区名      | z(MST)                                |
+| Z  | 4位数的时区   | Z(-0700)                              |
+| X  | 时区       | X(-07), XX(-0700), XXX(-07:00)        |
+
+示例:
+
+- YYYY-MM-dd T HH:mm:ss -> 2006-01-02 T 15:04:05
+- YYYY/MM/dd HH:mm:ssSSS XXX -> 2006/01/02 15:04:05.000 -07:00
+
+## INDEXOF
+
+```
+indexof(col1, col2)
+```
+
+返回第二个参数的第一个索引（从0开始），作为第一个参数中的子字符串。
+
+## LENGTH
+
+```
+length(col)
+```
+
+返回提供的字符串中的字符数。
+
+## LOWER
+
+```
+lower(col)
+```
+
+返回给定 String 的小写版本。
+
+## LPAD
+
+```
+lpad(col, padNum)
+```
+
+返回 String，在左侧用第二个参数指定的空格数填充。
+
+## LTRIM
+
+```
+ltrim(col)
+```
+
+从提供的字符串中删除所有前导空格（制表符和空格）。
+
+## NUMBYTES
+
+```
+numbytes(col)
+```
+
+返回提供的字符串中的字节数。
+
+## REGEXP_MATCHES
+
+```
+regexp_matches(col, regex)
+```
+
+如果字符串（第一个参数）包含正则表达式的匹配项，则返回 true。
+
+## REGEXP_REPLACE
+
+```
+regexp_replace(col, regex, str)
+```
+
+将第一个参数中所有出现的第二个参数（正则表达式）替换为第三个参数。
+
+## REGEXP_SUBSTR
+
+```
+regexp_substr(col, regex)
+```
+
+在第一个参数中找到第二个参数（regex）的第一个匹配项。
+
+## RPAD
+
+```
+rpad(col, padNum)
+```
+
+返回 String，在右侧填充第二个参数指定的空格数。
+
+## RTRIM
+
+```
+rtrim(col)
+```
+
+从提供的字符串中删除所有尾随空白（制表符和空格）。
+
+## SUBSTRING
+
+```
+substring(col, start, end)
+```
+
+返回 String，其中包含从 start 到 end 的子字符串。如果 end 为负数，则从字符串末尾开始计数。
+
+## STARTSWITH
+
+```
+startswith(col, str)
+```
+
+返回布尔值，是否第一个字符串参数是否以第二个字符串参数开头。
+
+## SPLIT_VALUE
+
+```
+split_value(col, splitter, index)
+```
+
+将第一个字符串参数以第二个字符串参数作为分隔符切分，返回切分后的第 index（参数三）个值。
+
+## TRIM
+
+```
+trim(col)
+```
+
+从提供的字符串中删除所有前导和尾随空格（制表符和空格）。
+
+## UPPER
+
+```
+upper(col)
+```
+
+返回给定 String 的大写版本。

docs/zh_CN/sqls/functions/transform_functions.md

@@ -0,0 +1,69 @@
+# 转换函数
+
+转换函数采用各种方式对数据进行转换，例如转换类型，使用 base64 编码和压缩。
+
+## CAST
+
+```
+cast(col,  "bigint")
+``
+```
+
+将值从一种数据类型转换为另一种数据类型。 支持的类型包括：bigint，float，string，boolean，bytea 和 datetime。
+
+### 转换为 datetime 类型
+
+使用 cast 函数转换到 datetime 类型时，转换规则如下：
+
+1. 如果参数为 datetime 类型，则直接返回原值。
+2. 如果参数为 bigint 或者 float 类型，则其数值会作为自 1970年1月1日0时起至今的毫秒值而转换为 datetime 类型。
+3. 如果参数为 string 类型，则会用默认格式 `"2006-01-02T15:04:05.000Z07:00"`  将其转换为 datetime类型。
+4. 其他类型的参数均不支持转换。
+
+## CHR
+
+```
+chr(col)
+```
+
+返回与给定 Int 参数对应的 ASCII 字符
+
+## ENCODE
+
+```
+encode(col, "base64")
+```
+
+根据编码方案将数据编码为其字符串表示形式。目前，只支持"base64" 编码类型。
+
+## DECODE
+
+```
+decode(col, "base64")
+```
+
+解码输入字符串。目前，只支持"base64" 类型。
+
+## TRUNC
+
+```
+trunc(dec, int)
+```
+
+将第一个参数截断为第二个参数指定的小数位数。 如果第二个参数小于零，则将其设置为零。 如果第二个参数大于34，则将其设置为34。从结果中去除尾随零。
+
+## COMPRESS
+
+```
+compress(input, "zlib")
+```
+
+压缩输入的字符串或二进制值。目前支持 'zlib', 'gzip', 'flate' 和 'zstd' 压缩算法。
+
+## DECOMPRESS
+
+```
+decompress(input, "zlib")
+```
+
+解压缩输入的字符串或二进制值。目前支持 'zlib', 'gzip', 'flate' 和 'zstd' 压缩算法。

docs/zh_CN/sqls/json_expr.md

@@ -213,9 +213,10 @@ json_path_query(col, jsonpath)
 json_path_query_first(col, jsonpath)
 ```
 
-请参考 [json 函数](./built-in_functions.md#JSON-函数) 获得详细信息.
+请参考 [json 函数](./functions/json_functions.md) 获得详细信息.
 
-所有这些函数共享相同的参数签名，其中，第二个参数是 jsonpath 字符串。 eKuiper 使用的 jsonpath 语法基于[JsonPath](https://goessner.net/articles/JsonPath/)
+所有这些函数共享相同的参数签名，其中，第二个参数是 jsonpath 字符串。 eKuiper 使用的 jsonpath
+语法基于[JsonPath](https://goessner.net/articles/JsonPath/)
 
 这些表达式的基本语法是将 JSON 对象的字段部分与一些元素结合使用：
 

docs/zh_CN/sqls/overview.md

@@ -4,8 +4,8 @@ eKuiper 提供了一种类似于 SQL 的查询语言，用于对事件流执行
 
 - [查询语言元素](query_language_elements.md)
 - [窗口](windows.md)
-- [内置函数](built-in_functions.md)
+- [内置函数](./functions/overview.md)
 - 扩展
-    - [插件扩展](../extension/overview.md)
-    - [外部服务扩展](../extension/external/external_func.md)
+  - [插件扩展](../extension/overview.md)
+  - [外部服务扩展](../extension/external/external_func.md)