@@ -259,6 +259,16 @@ And is the EQL equivalent of the following plaintext query.
259259SELECT id FROM examples ORDER BY field DESC ;
260260```
261261
262+ ** Grouping example:**
263+
264+ ORE indexes can be used along with the ` cs_grouped_value_v1 ` aggregate function to group by an encrypted column:
265+
266+ ```
267+ SELECT cs_grouped_value_v1(encrypted_field) COUNT(*)
268+ FROM users
269+ GROUP BY cs_ore_64_8_v1(encrypted_field)
270+ ```
271+
262272## Querying JSONB data with EQL
263273
264274### ` cs_ste_term_v1(val JSONB, epath TEXT) `
@@ -354,7 +364,6 @@ Which is the equivalent to the following SQL query:
354364SELECT attrs->' login_count' FROM users;
355365```
356366
357-
358367### Extraction (in WHERE, ORDER BY)
359368
360369Select rows that match a field in a JSONB object:
@@ -366,7 +375,20 @@ SELECT * FROM users WHERE cs_ste_term_v1(attrs, 'DQ1rbhWJXmmqi/+niUG6qw') > 'QAJ
366375Which is the equivalent to the following SQL query:
367376
368377```sql
369- SELECT * FROM users WHERE attrs->' login_count' > 10;
378+ SELECT * FROM users WHERE attrs->' login_count' > 10;
379+ ```
380+
381+ ### Grouping
382+
383+ `cs_ste_vec_term_v1` can be used along with the `cs_grouped_value_v1` aggregate function to group by a field in an encrypted JSONB column:
384+
385+ ```
386+ -- $1 here is a param that containts the EQL payload for an ejson path.
387+ -- Example EQL payload for the path `$.field_one`:
388+ -- ' {" k" : " pt" , " p" : " $.field_one" , " q" : " ejson_path" , " i" : {" t" : " users" , " c" : " attrs" }, " v" : 1 }'
389+ SELECT cs_grouped_value_v1(cs_ste_vec_value_v1(attrs), $1) COUNT(*)
390+ FROM users
391+ GROUP BY cs_ste_vec_term_v1(attrs, $1);
370392```
371393
372394## Managing indexes with EQL
0 commit comments