mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-06-28 17:34:17 -04:00
212fc05808
Expose "_ignored" metadata field in ESQL queries. This is the same code merged here: https://github.com/elastic/elasticsearch/pull/108770 Which got reverted here: https://github.com/elastic/elasticsearch/pull/108864 It was reverted because of a test failure: https://gradle-enterprise.elastic.co/s/dpi2eib2x2fj2
58 lines
1.7 KiB
Text
58 lines
1.7 KiB
Text
[[esql-metadata-fields]]
|
|
=== {esql} metadata fields
|
|
|
|
++++
|
|
<titleabbrev>Metadata fields</titleabbrev>
|
|
++++
|
|
|
|
{esql} can access <<mapping-fields, metadata fields>>. The currently
|
|
supported ones are:
|
|
|
|
* <<mapping-index-field,`_index`>>: the index to which the document belongs.
|
|
The field is of the type <<keyword, keyword>>.
|
|
|
|
* <<mapping-id-field,`_id`>>: the source document's ID. The field is of the
|
|
type <<keyword, keyword>>.
|
|
|
|
* `_version`: the source document's version. The field is of the type
|
|
<<number,long>>.
|
|
|
|
* <<mapping-ignored-field,`_ignored`>>: the ignored source document fields. The field is of the type
|
|
<<keyword,keyword>>.
|
|
|
|
To enable the access to these fields, the <<esql-from,`FROM`>> source command needs
|
|
to be provided with a dedicated directive:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM index METADATA _index, _id
|
|
----
|
|
|
|
Metadata fields are only available if the source of the data is an index.
|
|
Consequently, `FROM` is the only source commands that supports the `METADATA`
|
|
directive.
|
|
|
|
Once enabled, these fields will be available to subsequent processing commands, just
|
|
like other index fields:
|
|
|
|
[source.merge.styled,esql]
|
|
----
|
|
include::{esql-specs}/metadata.csv-spec[tag=multipleIndices]
|
|
----
|
|
[%header.monospaced.styled,format=dsv,separator=|]
|
|
|===
|
|
include::{esql-specs}/metadata.csv-spec[tag=multipleIndices-result]
|
|
|===
|
|
|
|
Similar to index fields, once an aggregation is performed, a
|
|
metadata field will no longer be accessible to subsequent commands, unless
|
|
used as a grouping field:
|
|
|
|
[source.merge.styled,esql]
|
|
----
|
|
include::{esql-specs}/metadata.csv-spec[tag=metaIndexInAggs]
|
|
----
|
|
[%header.monospaced.styled,format=dsv,separator=|]
|
|
|===
|
|
include::{esql-specs}/metadata.csv-spec[tag=metaIndexInAggs-result]
|
|
|===
|