Skip to content

ESQL: loading unmapped fields on synthetic _source#144112

Merged
GalLalouche merged 15 commits intoelastic:mainfrom
GalLalouche:fix/synthetic_load
Mar 26, 2026
Merged

ESQL: loading unmapped fields on synthetic _source#144112
GalLalouche merged 15 commits intoelastic:mainfrom
GalLalouche:fix/synthetic_load

Conversation

@GalLalouche
Copy link
Contributor

@GalLalouche GalLalouche commented Mar 12, 2026

Fix loading of unmapped numeric values when the _source is synthetic. Also add a few more timeseries tests, since now we can actually run them!

Resolves #143916.

@GalLalouche GalLalouche marked this pull request as draft March 12, 2026 15:42
…3916)

Add forUnmappedLoad flag to KeywordFieldType so only the unmapped-keyword
path (created by ESQL for PotentiallyUnmappedKeywordEsField) converts
decoded Object values to string in the fallback synthetic source reader;
mapped keyword fields keep assuming BytesRef.

Add synthetic-source test cases to unmapped-load and unmapped-nullify:
- partial_mapping_synthetic_sample_data (unmapped_event_duration as long)
- unmappedNumericFromK8sSyntheticTsIndex (TS k8s_unmapped, network.cost)

Made-with: Cursor
@GalLalouche GalLalouche marked this pull request as ready for review March 17, 2026 13:37
@elasticsearchmachine elasticsearchmachine added the needs:triage Requires assignment of a team area label label Mar 17, 2026
@GalLalouche GalLalouche changed the title Fix/synthetic load DRAFT ESQL: loading unmapped fields on synthetic _source Mar 17, 2026
@GalLalouche GalLalouche added >test Issues or PRs that are addressing/adding tests Team:Analytics Meta label for analytical engine team (ESQL/Aggs/Geo) :Analytics/ES|QL AKA ESQL >bug and removed >test Issues or PRs that are addressing/adding tests needs:triage Requires assignment of a team area label labels Mar 17, 2026
@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-analytical-engine (Team:Analytics)

@elasticsearchmachine
Copy link
Collaborator

Hi @GalLalouche, I've created a changelog YAML for you.

public static final TypeParser PARSER = createTypeParserWithLegacySupport(Builder::new);

public static final class KeywordFieldType extends TextFamilyFieldType {
public static class KeywordFieldType extends TextFamilyFieldType {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wouldn't change this class unless someone from the core ES team approves it. My advice is to seek approval for this from the relevant team.

return new FallbackSyntheticSourceBlockLoader.SingleValueReader<BytesRef>(nullValueBytes) {
@Override
public void convertValue(Object value, List<BytesRef> accumulator) {
String stringValue = ((BytesRef) value).utf8ToString();
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you're fine to change this line rather than making KeywordFieldType non-final. ie:

String stringValue = value instanceof BytesRef br ? br.utf8ToString() : value.toString();

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wanted to be extra defensive and avoid changing behavior if the field is not potentially unmapped, but if you're fine with it then I'm fine with it :)

Copy link
Contributor

@romseygeek romseygeek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

172.21.2.113 |null |null |null
172.21.2.162 |null |null |null
172.21.3.15 |null |null |null
client_ip:ip | foo:null | bar:keyword | baz:null
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These changes were unnecessary.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Of course not, but I used a script to fix the alignments for the tests I did add, and it just makes it easier to align the entire file rather than align a subset of it. I can revert it if you think it's a blocker.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Definitely not a blocker.

Copy link
Contributor

@astefan astefan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@GalLalouche GalLalouche enabled auto-merge (squash) March 24, 2026 13:11
@GalLalouche GalLalouche merged commit 4a0e210 into elastic:main Mar 26, 2026
36 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

:Analytics/ES|QL AKA ESQL >bug Team:Analytics Meta label for analytical engine team (ESQL/Aggs/Geo) v9.4.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ESQL: Load for unmapped numerics fails during synthetic source loading

4 participants