ES|QL support#194

Merged

mashhurs merged 21 commits intologstash-plugins:mainfrom

mashhurs:esql-support

Jul 18, 2025

Commits on Jul 7, 2025

ESQL and DSL executors are introduced. param can accept ES|QL query shape now. is introduced for initial step but needs team's feedback. DSL logics moved into DSL executors.
mashhurs
committed
Clean up and add unit tests
mashhurs
committed
Resolve query type with query shape and params validations. Drop null columns support, documentation is added, basic integration tests are added.
mashhurs
committed
Require drop null columns by default. Set limit to 1 by defaul if FROM query used. Add more debug, ward logs.
mashhurs
committed
Update ES|QL supported plugin version in the docs.
mashhurs
committed
Remove drop_null_columns param from doc reference.
mashhurs
committed
Apply suggestions from code review

mashhurs
and
yaauie
committed
Apply suggestions from code review

mashhurs
and
yaauie
committed
Rebase against upstream main after target support added. Separate unit test for DSL. Address comments: do not save ES version in client, add apply target method in executors, set to target if targe…

mashhurs
and
yaauie
committed
Fix the unit test failures.
mashhurs
committed
Introduce query_type option which accepts dsl or esql to define a query shape. Remove multi-depth nested named_params and keep only top-level query_params which aligns with placeholder structure i…
mashhurs
committed
Separate event referenced and static valued fields at initialization of the ESQL executor.
mashhurs
committed
query_params now supports both Array and Hash types.
mashhurs
committed
ES|QL executor parameters resolution logic simplification.
mashhurs
committed
Add tech preview section under ESQL.
mashhurs
committed
Place the query results based on the target specified. If not specified, first result will be set to event's top level.
mashhurs
committed
Apply suggestions from code review

mashhurs
and
jsvd
committed
ES|QL result mapping to event doc correction.
mashhurs
committed
A bugfix of when setting null values and integrations tests updated which removes non-allowed the fields param.
mashhurs
committed
Failed unit test fixed.
mashhurs
committed
Integration tests to run with credentials anebled and SSL configs.
mashhurs
committed