Update View CRUD Actions to be Index Actions #141570

jfreden · 2026-01-30T08:35:48Z

The PR updates View CRUD actions to be Index actions, adds new named index privileges for the new actions and adds support to the authorization engine to resolve views.

Index Actions

DeleteViewAction, GetViewAction, PutViewAction are now implemented as index actions.

New Privileges

REST Method New Index Privileges that grant Existing Index Privileges that grant

PUT /_query/view/ create_view, manage_view all, manage

GET /_query/view/ read_view_metadata, manage_view all, manage, monitor

DELETE /_query/view/ delete_view, manage_view all, manage

Authorization Engine

Added resolveViews boolean to IndicesOptions.WildcardOptions.
IndexNameExpressionResolver and IndexAbstractionResolver respect resolveViews when resolving index expressions.
The new view actions use IndicesOptions with resolveViews=true

Follow up work

This PR is a prerequisite to adding ESQL View Authorization that will be added in Add Views Security Model #141050
https://github.com/elastic/elasticsearch-team/issues/2329#issue-3896212956 has been opened to document the new index privileges

CI Failures

After the views PR was merged, the open security model PR tests started failing with failures related to the put views action. Along with the delete views action, it's the only action that isn't local since it needs to update cluster state on the master node. In the initial views PR it's a cluster action, but in this PR it's updated to be an index (view) action (so it has a new name). There is a problem in the mixed cluster scenario, where the cluster is being upgraded and is trying to call the new index action, but the master has not yet been upgraded, so it can't find it. Since this is behind a feature flag there is no need to add any additional protection, these tests should start working as soon as this has been merged.

jfreden · 2026-02-03T15:39:38Z

server/src/main/java/org/elasticsearch/action/support/IndicesOptions.java

     * @param resolveAliases, aliases will be included in the result, if false we treat them like they do not exist
     * @param allowEmptyExpressions, when an expression does not result in any indices, if false it throws an error if true it treats it as
     *                               an empty result
+     * @param resolveViews, views will be included in the result, if false we treat them like they do not exist


IndicesOptions.wildcardOptions defines how wildcard expressions should be expanded. The new resolveViews wildcard option is added to allow index expressions to be resolved to views by the authorization engine. In addition to that the new flag on the wilcard index option should:

Not be populated from REST requests, since there is no support for it in the APIs (it's hardcoded to always resolve views where it's used)

Not be populated when transport requests are serialized (writeIndicesOptions) or deserialized (readIndicesOptions) since it's only used for local actions (this may change if delete starts supporting multi-target syntax since the request will be sent to the master node and authorized there).

jfreden · 2026-02-03T15:41:22Z

...java/org/elasticsearch/action/admin/cluster/snapshots/create/CreateSnapshotRequestTests.java

                            defaultResolveAliasForThisRequest,
-                            randomBoolean()
+                            randomBoolean(),
+                            false  // Specifying views in the create snapshot request is not supported


Specifying views in a restore/create snapshot request is currently not part of the views feature. Not sure if we want to support this?

Views are already part of snapshots in that we capture all views as part of the global state in a snapshot, from

elasticsearch/server/src/main/java/org/elasticsearch/cluster/metadata/ViewMetadata.java

Line 90 in 8b34252

return Metadata.ALL_CONTEXTS;

I think eventually the ESQL team will need to decide how to treat views individually, since they cannot be selected currently other than all-or-nothing.

@craigtaverner FYI might be useful with an issue/task for this.

jfreden · 2026-02-03T15:41:31Z

...va/org/elasticsearch/action/admin/cluster/snapshots/restore/RestoreSnapshotRequestTests.java

                            instance.indicesOptions().ignoreAliases() == false,
-                            randomBoolean()
+                            randomBoolean(),
+                            false // Specifying views in the restore snapshot request is not supported


Specifying views in a restore/create snapshot request is currently not part of the views feature. Not sure if we want to support this?

jfreden · 2026-02-03T15:42:14Z

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/DeleteViewAction.java


-    public static class Request extends AcknowledgedRequest<Request> {
+    public static class Request extends AcknowledgedRequest<Request> implements IndicesRequest {
+        // TODO this currently doesn't support multi-target syntax, but should probably if action.destructive_requires_name=false


This can be done in a follow up.

https://github.com/elastic/elasticsearch-team/issues/2328

jfreden · 2026-02-03T15:43:27Z

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/TransportGetViewAction.java

-        List<String> names = request.names();
-        if (names.isEmpty()) {
+        String[] names = request.indices();
+        // TODO currently doesn't support multi-target when security is off


This code will be replaced in the follow up PR since it adds the new resolve views transport action that can handle multi-target syntax even if security is off.

What is multi-target syntax? Do you mean wildcards? Will FROM view* not work until the next PR?

https://www.elastic.co/docs/reference/elasticsearch/rest-apis/api-conventions#api-multi-index

It will work with security on, but not with security off since we don't do any wildcard expansion here. I'll add it in the next PR since it contains the view expression resolver transport action that can be reused here that covers both security on and off.

FROM view* still works as it currently does, this is only the GET /_query/view/<name> API.

Nit: I'd rephrase the comment as:
// TODO fully support wildcarded expressions when security is disabled
It's less about multi-syntax because that can be an expression like logs,logs-a which works fine and more about wildcards like logs*

elasticsearchmachine · 2026-02-03T15:45:17Z

Pinging @elastic/es-security (Team:Security)

elasticsearchmachine · 2026-02-03T15:45:18Z

Pinging @elastic/es-analytical-engine (Team:Analytics)

elasticsearchmachine · 2026-02-03T15:45:18Z

Hi @jfreden, I've created a changelog YAML for you.

github-actions · 2026-02-04T08:35:32Z

🔍 Preview links for changed docs

ℹ️ Important: Docs version tagging

👋 Thanks for updating the docs! Just a friendly reminder that our docs are now cumulative. This means all 9.x versions are documented on the same page and published off of the main branch, instead of creating separate pages for each minor version.

We use applies_to tags to mark version-specific features and changes.

Expand for a quick overview

When to use applies_to tags:

✅ At the page level to indicate which products/deployments the content applies to (mandatory)
✅ When features change state (e.g. preview, ga) in a specific version
✅ When availability differs across deployments and environments

What NOT to do:

❌ Don't remove or replace information that applies to an older version
❌ Don't add new information that applies to a specific version without an applies_to tag
❌ Don't forget that applies_to tags can be used at the page, section, and inline level

🤔 Need help?

Check out the cumulative docs guidelines
Reach out in the #docs Slack channel

craigtaverner

LGTM. I did have some questions, comments and suggestions.

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/DeleteViewAction.java

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/PutViewAction.java

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/GetViewAction.java

craigtaverner · 2026-02-04T10:05:02Z

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/RestGetViewAction.java

-        );
+        GetViewAction.Request req = new GetViewAction.Request(RestUtils.getMasterNodeTimeout(request));
+        var requestedViews = Strings.splitStringByCommaToArray(request.param("name"));
+        req.indices(requestedViews.length == 0 ? new String[] { "*" } : requestedViews);


Could this not be done inside the constructor for GetViewAction.Request?

I notice that the tests that call this constructor do not follow this pattern and pass in the "*", they just leave it empty.

Ah, I see the TransportGetViewAction explicitly checks for null, empty and "*" and treats them the same. Why do we bother with "*" here then?

We're telling the authorization engine that we want all views we're authorized to see. I'll investigate if there is a better way to do it.

Looks fine to handle it like this. Is it deliberate that we are not supporting _all as another way to get back all views?

craigtaverner · 2026-02-04T10:13:12Z

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/TransportGetViewAction.java

-        List<String> names = request.names();
-        if (names.isEmpty()) {
+        String[] names = request.indices();
+        // TODO currently doesn't support multi-target when security is off


What is multi-target syntax? Do you mean wildcards? Will FROM view* not work until the next PR?

...ugin/esql/qa/security/src/javaRestTest/java/org/elasticsearch/xpack/esql/EsqlSecurityIT.java

…view/DeleteViewAction.java Co-authored-by: Craig Taverner <craig@amanzi.com>

…view/PutViewAction.java Co-authored-by: Craig Taverner <craig@amanzi.com>

dakrone

LGTM, I left only super minor comments

server/src/main/java/org/elasticsearch/cluster/metadata/IndexNameExpressionResolver.java

dakrone · 2026-02-04T15:53:32Z

...java/org/elasticsearch/action/admin/cluster/snapshots/create/CreateSnapshotRequestTests.java

                            defaultResolveAliasForThisRequest,
-                            randomBoolean()
+                            randomBoolean(),
+                            false  // Specifying views in the create snapshot request is not supported


Views are already part of snapshots in that we capture all views as part of the global state in a snapshot, from

elasticsearch/server/src/main/java/org/elasticsearch/cluster/metadata/ViewMetadata.java

Line 90 in 8b34252

return Metadata.ALL_CONTEXTS;

I think eventually the ESQL team will need to decide how to treat views individually, since they cannot be selected currently other than all-or-nothing.

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/GetViewAction.java

jfreden · 2026-02-05T08:34:19Z

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/RestDeleteViewAction.java


 import static org.elasticsearch.rest.RestRequest.Method.DELETE;

-@ServerlessScope(Scope.PUBLIC)


@craigtaverner I removed public here until we have a complete story for Serverless/CPS so this doesn't accidentally get exposed.

n1v0lg

LGTM.

Perhaps this is going in a follow-up PR but it'd be great to add some view specific tests to IndicesAndAliasesResolverTests:

SearchRequest (resolveViews=false) returns no views even if they exist
GetViewRequest returns views if they exist

And some more variations thereof.

n1v0lg · 2026-02-05T14:47:48Z

server/src/main/java/org/elasticsearch/cluster/metadata/ProjectMetadata.java

            ImmutableOpenMap<String, IndexMetadata> indices
        ) {
-            if (indices.isEmpty()) {
+            if (indices.isEmpty() && viewMetadata.views().isEmpty()) {


Is the reason that views are included here but data streams are not is that views can exist without indices whereas data streams can't?

Yes, I got some strange results when testing views without creating indices first. Since a view can be valid and even return results without referencing an index, we need this check.

n1v0lg · 2026-02-05T15:31:41Z

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/TransportGetViewAction.java

+        if (names == null || names.length == 0 || (names.length == 1 && Regex.isMatchAllPattern(names[0]))) {
            views = viewService.getMetadata(projectId).views().values();
-        } else {
+        } else if (names != IndicesAndAliasesResolverField.NO_INDICES_OR_ALIASES_ARRAY) {


Nit preference would be to use Array.equals(names, IndicesAndAliasesResolverField.NO_INDICES_OR_ALIASES_ARRAY) here

n1v0lg · 2026-02-05T15:34:41Z

...core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java

                entry("cross_cluster_replication", CROSS_CLUSTER_REPLICATION),
-                entry("cross_cluster_replication_internal", CROSS_CLUSTER_REPLICATION_INTERNAL)
+                entry("cross_cluster_replication_internal", CROSS_CLUSTER_REPLICATION_INTERNAL),
+                entry("manage_view", MANAGE_VIEW),


There's no views feature flag behind which we could hide these right?

There is. Refactored this to be behind a feature flag.

n1v0lg · 2026-02-05T15:48:20Z

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/TransportGetViewAction.java

-        List<String> names = request.names();
-        if (names.isEmpty()) {
+        String[] names = request.indices();
+        // TODO currently doesn't support multi-target when security is off


Nit: I'd rephrase the comment as:
// TODO fully support wildcarded expressions when security is disabled
It's less about multi-syntax because that can be an expression like logs,logs-a which works fine and more about wildcards like logs*

n1v0lg · 2026-02-05T16:17:35Z

...ugin/esql/qa/security/src/javaRestTest/java/org/elasticsearch/xpack/esql/EsqlSecurityIT.java

+            assertThat(views.getFirst().get("name"), equalTo("view-user2"));
+        }
+        {
+            var resp = getView("test-admin", null);


Would be great to cover _all and "*" here as well.

n1v0lg · 2026-02-05T16:21:53Z

...ugin/esql/qa/security/src/javaRestTest/java/org/elasticsearch/xpack/esql/EsqlSecurityIT.java

+            var respMap = entityAsMap(resp);
+            var views = (List<Map<String, Object>>) respMap.get("views");
+            assertThat(views.size(), equalTo(3));
+        }


I think we should also cover:

calling get view on an index, data stream, or alias returns an error; same for mixing views and indices

a wildcard case that exercises the no_indices path (i.e. user without permissions on any views targeted by a wildcard expression gets an empty result)

mix of wildcard expressions and concrete expressions

n1v0lg · 2026-02-05T16:24:21Z

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/view/RestGetViewAction.java

-        );
+        GetViewAction.Request req = new GetViewAction.Request(RestUtils.getMasterNodeTimeout(request));
+        var requestedViews = Strings.splitStringByCommaToArray(request.param("name"));
+        req.indices(requestedViews.length == 0 ? new String[] { "*" } : requestedViews);


Looks fine to handle it like this. Is it deliberate that we are not supporting _all as another way to get back all views?

elasticsearchmachine added the v9.4.0 label Jan 30, 2026

jfreden force-pushed the views/update_actions branch 7 times, most recently from 5986166 to bbeb05a Compare February 3, 2026 15:32

jfreden commented Feb 3, 2026

View reviewed changes

jfreden added :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC :Analytics/ES|QL AKA ESQL >enhancement labels Feb 3, 2026

jfreden marked this pull request as ready for review February 3, 2026 15:44

jfreden requested a review from a team as a code owner February 3, 2026 15:44

jfreden requested a review from craigtaverner February 3, 2026 15:45

elasticsearchmachine added Team:Analytics Meta label for analytical engine team (ESQL/Aggs/Geo) Team:Security Meta label for security team labels Feb 3, 2026

jfreden requested review from a team as code owners February 4, 2026 08:32

github-actions bot deployed to docs-preview February 4, 2026 08:33 View deployment

Update View CRUD Actions to be Index Actions

464a468

[CI] Auto commit changes from spotless

5cccaea

jfreden force-pushed the views/update_actions branch from 9749ae2 to 5cccaea Compare February 4, 2026 08:39

jfreden removed request for a team February 4, 2026 08:41

elasticsearchmachine added the serverless-linked Added by automation, don't add manually label Feb 4, 2026

craigtaverner approved these changes Feb 4, 2026

View reviewed changes

jfreden and others added 3 commits February 4, 2026 11:31

Update x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/…

3ec5ea2

…view/DeleteViewAction.java Co-authored-by: Craig Taverner <craig@amanzi.com>

Update x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/…

c0c867b

…view/PutViewAction.java Co-authored-by: Craig Taverner <craig@amanzi.com>

fixup! Code review comment

aaf5c60

jfreden requested a review from dakrone February 4, 2026 10:47

dakrone approved these changes Feb 4, 2026

View reviewed changes

Remove ServerlessScope(Scope.PUBLIC) from view CRUD

beddddf

jfreden commented Feb 5, 2026

View reviewed changes

jfreden and others added 3 commits February 5, 2026 10:07

fixup! Code review comments

b09d35b

Merge branch 'main' into views/update_actions

3faf350

fixup! CI error since views not in serverless

3a7709a

n1v0lg requested review from n1v0lg and removed request for a team February 5, 2026 12:09

jfreden added 2 commits February 5, 2026 13:37

Merge branch 'main' into views/update_actions

eaf9983

Merge branch 'main' into views/update_actions

47fd65c

n1v0lg approved these changes Feb 5, 2026

View reviewed changes

jfreden and others added 9 commits February 6, 2026 11:36

fixup! Code review comments

ec8db54

[CI] Auto commit changes from spotless

e91761b

fixup! Test

4bb756f

fixup! Code review

ab286ff

Merge remote-tracking branch 'upstream/main' into views/update_actions

0342a3d

fixup! Array indexing

38af812

fixup! CI

0328bc4

Try to disable MixedClusterEsqlSpecIT if new actions not available

1ffbf25

fixup! Update test to require views_crud_as_index_actions

bbfe727

REST Method	New Index Privileges that grant	Existing Index Privileges that grant
PUT /_query/view/	create_view, manage_view	all, manage
GET /_query/view/	read_view_metadata, manage_view	all, manage, monitor
DELETE /_query/view/	delete_view, manage_view	all, manage


		import static org.elasticsearch.rest.RestRequest.Method.DELETE;

		@ServerlessScope(Scope.PUBLIC)

Update View CRUD Actions to be Index Actions #141570

Are you sure you want to change the base?

Update View CRUD Actions to be Index Actions #141570

Conversation

jfreden commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Index Actions

New Privileges

Authorization Engine

Follow up work

CI Failures

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticsearchmachine commented Feb 3, 2026

Uh oh!

elasticsearchmachine commented Feb 3, 2026

Uh oh!

elasticsearchmachine commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 4, 2026

🔍 Preview links for changed docs

Uh oh!

github-actions bot commented Feb 4, 2026

ℹ️ Important: Docs version tagging

When to use applies_to tags:

What NOT to do:

🤔 Need help?

Uh oh!

craigtaverner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dakrone left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jfreden commented Jan 30, 2026 •

edited

Loading