ES|QL query with double-quote character (" ")

[MihaelaIorda]

Elastic.Clients.Elasticsearch version: 8.15.10

Elasticsearch version: 8.13

.NET runtime version: .net 6

Operating system version: Windows 11. .net app runs in constainer on Linux subsistem.

Description of the problem including expected versus actual behavior:

I want to run a simple ES|QL query that retrieves documents where message field containes word "exception".
The executed query is:
string query = "FROM index | WHERE message LIKE "exception" | KEEP @timestamp, message | SORT @timestamp DESC | LIMIT 3 "

Even if not visible, in string above exception is surrounded by escape character , like in image below:

I tried 2 methods to execute the query:

var response = await client.Esql.QueryAsync(r => r
.Query(query)
.Format(Elastic.Clients.Elasticsearch.Esql.EsqlFormat.Csv)
);
var responseQ = await client.Esql.QueryAsObjectsAsync(x => x.Query(query));

Call fails with a Timeout exception.

NOTE:
I tried various ways to build the string for ES|QL query with no successful result, such as these:
query = $"FROM recipients-* | WHERE message LIKE " + Convert.ToChar(34) + "Exception*" + Convert.ToChar(34) + " | SORT @timestamp DESC | LIMIT 5 ";
query = @"FROM recipients-* | WHERE message LIKE ""Exception*"" | SORT @timestamp DESC | LIMIT 5 ";

ES|QL queries with WHERE clause that do not contain double-quote character, such as this string
"FROM index | WHERE fields.Elapsed > 500 | KEEP @timestamp, message | SORT @timestamp DESC | LIMIT 5 "
would execute ok and retrieve data.

Steps to reproduce:

1. instantiate client using Authentication with BasicAuthentication.
2. execute ES|QL query that constains double-quote character

Expected behavior
retrieve data

Provide ConnectionSettings (if relevant):

Provide DebugInformation (if relevant):
Exception: The request was canceled due to the configured HttpClient.Timeout of 60 seconds elapsing.

Audit trail of this API call:

• [1] BadRequest: Node: https://elastic. Took: 00:01:00.1480361
• [2] MaxTimeoutReached:

OriginalException: System.Threading.Tasks.TaskCanceledException: The request was canceled due to the configured HttpClient.Timeout of 60 seconds elapsing.

---> System.TimeoutException: The operation was canceled.
---> System.Threading.Tasks.TaskCanceledException: The operation was canceled.
---> System.IO.IOException: Unable to read data from the transport connection: Operation canceled.
---> System.Net.Sockets.SocketException (125): Operation canceled
--- End of inner exception stack trace ---
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource<System.Int32>.GetResult(Int16 token)
at System.Net.Security.SslStream.EnsureFullTlsFrameAsync[TIOAdapter](TIOAdapter adapter)
at System.Net.Security.SslStream.ReadAsyncInternal[TIOAdapter](TIOAdapter adapter, Memory`1 buffer)
at System.Net.Http.HttpConnection.InitialFillAsync(Boolean async)
at System.Net.Http.HttpConnection.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at System.Net.Http.HttpConnection.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
--- End of inner exception stack trace ---
--- End of inner exception stack trace ---
at System.Net.Http.HttpClient.HandleFailure(Exception e, Boolean telemetryStarted, HttpResponseMessage response, CancellationTokenSource cts, CancellationToken cancellationToken, CancellationTokenSource pendingRequestsCts)
at System.Net.Http.HttpClient.g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Elastic.Transport.HttpRequestInvoker.RequestCoreAsync[TResponse](Boolean isAsync, RequestData requestData, CancellationToken cancellationToken)

Request:

<Request stream not captured or already read to completion by serializer. Set DisableDirectStreaming() on TransportConfiguration to force it to be set on the response.>

Response:

<Response stream not captured or already read to completion by serializer. Set DisableDirectStreaming() on TransportConfiguration to force it to be set on the response.>

[flobernd]

Hi @MihaelaIorda,

this looks like a server bug. The client only serializes the given string to JSON and fires the request. There is no logic involved at all.

I was not able to reproduce the issue when connecting to a 8.15.2 server. Do you have the chance to test this with a ES server version greater than 8.13 (potentially using the start-local script)?

[github-actions]

This issue is stale because it has been open 5 days with no activity. Remove stale label or comment or this will be closed in 2 days.

[github-actions]

This issue was closed because it has been stalled for 2 days with no activity.