ES|QL: Grok only supports KEYWORD or TEXT values, found expression [type] type [INTEGER]

[luigidellaquila]

With CSV dataset

from multivalue_points,h*,messa* 
| eval  `card` = true, PbehoQUqKSF = "VLGjhcgNkQiEVyCLo", DsxMWtGL = true, qSxTIvUorMim = true, `location` = 8593178066470220111, type = -446161601, FSkGQkgmS = false 
| eval  PbehoQUqKSF = 753987034, HLNMQfQj = true, `within` = true, `id` = "JDKKkYwhhh", lk = null, aecuvjTkgZza = 510616700, aDAMpuVtNX = null, qCopgNZPt = "AjhJUtZefqKdJYH", BxHHlFoA = "isBrmhKLc"
| rename message as message 
| lookup join message_types_lookup on message 
| sort PbehoQUqKSF DESC, ip1 DESC NULLS LAST 
| limit 5845 
| drop `subset`, ip*, `card`, `within`, host.v*, description, `aecuvjTkgZza`, host.version, `ip0`, height_range, DsxMWtGL, host_group, `aDAMpuVtNX`, PbehoQUqKSF, `intersects`, `host.os`, aDAMpuVtNX, *ight_range, HLNMQfQj, `FSkGQkgmS`, BxHHlFoA, card 
| grok type "%{WORD:GknCxQFo}" 
| eval  `location` = null, ZjWUUvGusyyz = null, HeeKIpzgh = false, `id` = 4325287503714500302, host = false, `lk` = null, HvTQdOqFajpH = false, fKNlsYoT = true, `location` = -1158449473, `qCopgNZPt` = 1219986202615280617 
| drop HeeKIpzg*, `ZjWUUvGusyyz`, `message`, `type`, `lk` 
| grok GknCxQFo "%{WORD:location} %{WORD:HvTQdOqFajpH}" 
| drop HvTQdOqFajpH, `location`, centroid 
| mv_expand GknCxQFo 
| limit 410 
| limit 3815 
| rename `id` AS `GknCxQFo` 
| grok host.name "%{WORD:oGQQZHxQHj} %{WORD:qCopgNZPt} %{WORD:vHKOmmocPcTO}" 
| stats  BkQXJRMeAM = min(GknCxQFo) 
| keep `BkQXJRMeAM`

verification_exception�reason
Found 1 problem |
line 1:787: Grok only supports KEYWORD or TEXT values, found expression [type] type [INTEGER]

[elasticsearchmachine]

Pinging @elastic/es-analytical-engine (Team:Analytics)

[kanoshiou]

Simplified query here:

from message_types 
| eval type = 1 
| lookup join message_types_lookup on message 
| drop  message 
| grok type "%{WORD:b}" 
| stats x = max(b) 
| keep x