Stricter syntax validation for stats switch(...)

[cuongleqq]

Is your feature request related to a problem? Please describe

I think there are 2 things we can improve for switch in stats

Assume we have logs like this

printf '%s\n' \
'{"_time":"2026-04-09T10:00:00Z","service":"api","method":"POST","path":"/login","status":200,"bytes":512,"_msg":"login success"}' \
'{"_time":"2026-04-09T10:00:01Z","service":"api","method":"POST","path":"/login","status":401,"bytes":128,"_msg":"login failed"}' \
'{"_time":"2026-04-09T10:00:02Z","service":"api","method":"GET","path":"/orders","status":500,"bytes":64,"_msg":"db timeout"}' \
'{"_time":"2026-04-09T10:00:03Z","service":"api","method":"GET","path":"/orders","status":502,"bytes":96,"_msg":"upstream bad gateway"}' \
'{"_time":"2026-04-09T10:00:04Z","service":"api","method":"GET","path":"/health","status":200,"bytes":32,"_msg":"health ok"}' \
'{"_time":"2026-04-09T10:00:05Z","service":"api","method":"GET","path":"/users","status":404,"bytes":48,"_msg":"user not found"}' \
'{"_time":"2026-04-09T10:00:06Z","service":"auth","method":"POST","path":"/refresh","status":200,"bytes":220,"_msg":"token refreshed"}' \
'{"_time":"2026-04-09T10:00:07Z","service":"billing","method":"POST","path":"/invoice","status":503,"bytes":300,"_msg":"billing unavailable"}' \
| curl -sS -X POST \
  -H 'Content-Type: application/stream+json' \
  --data-binary @- \
  'http://localhost:9428/insert/jsonline'

1. Empty switch:

When I have an empty switch, the error is confusing: stats pipe must contain at least a single entry

curl -sS 'http://localhost:9428/select/logsql/query' \
  -d 'query=service:=api | stats count() switch()'

cannot parse `query` arg: cannot parse "stats" pipe: 'stats' pipe must contain at least a single entry; context: [service:=api | stats count() switch()]; query=service:=api | stats count() switch()

And if I have an empty switch but at the second stats function, it doesn't throw error like the first one, it just silently drops it.

curl -sS 'http://localhost:9428/select/logsql/query' \
  -d 'query=service:=api | stats count() as requests, sum(bytes) switch()'

{"requests":"6"}

2. Multiple defaults

Multiple defaults are currently allowed, this is a bit counterintuitive (and probably it's users' mistake we should warn about)

curl -sS 'http://localhost:9428/select/logsql/query' \
  -d 'query=service:=api | stats count() as requests, sum(bytes) switch(case (status:>=500) as server_error_bytes, default as other_api_bytes, default as fallback_bytes)'

{"requests":"6","server_error_bytes":"160","other_api_bytes":"720","fallback_bytes":"720"}

Describe the solution you'd like

IMO, we can reject empty switch, and return error on switch with multiple default cases. Because it's likely that users make some mistakes with their query. We better tell them instead of proceeding.

Describe alternatives you've considered

No response

Additional information

No response

[valyala]

VictoriaLogs should reject an empty switch() and a switch with duplicate default cases inside the stats pipe after the commit 0438950 . This commit will be included in the next release of VictoriaLogs.