elasticsearch/docs/reference/esql/metadata-fields.asciidoc
Nik Everett 089fd7d7da
ESQL: Rework integration-only csv testing (#108313)
This reworks the integration-test-only csv testing for `metadata` to use
the `required_feature:` syntax instead of the `-IT_tests_only`
extension. This is a little more flexible and way nicer on the eyes.
2024-05-06 11:06:50 -04:00

55 lines
1.6 KiB
Text

[[esql-metadata-fields]]
=== {esql} metadata fields
++++
<titleabbrev>Metadata fields</titleabbrev>
++++
{esql} can access <<mapping-fields, metadata fields>>. The currently
supported ones are:
* <<mapping-index-field,`_index`>>: the index to which the document belongs.
The field is of the type <<keyword, keyword>>.
* <<mapping-id-field,`_id`>>: the source document's ID. The field is of the
type <<keyword, keyword>>.
* `_version`: the source document's version. The field is of the type
<<number,long>>.
To enable the access to these fields, the <<esql-from,`FROM`>> source command needs
to be provided with a dedicated directive:
[source,esql]
----
FROM index METADATA _index, _id
----
Metadata fields are only available if the source of the data is an index.
Consequently, `FROM` is the only source commands that supports the `METADATA`
directive.
Once enabled, these fields will be available to subsequent processing commands, just
like other index fields:
[source.merge.styled,esql]
----
include::{esql-specs}/metadata.csv-spec[tag=multipleIndices]
----
[%header.monospaced.styled,format=dsv,separator=|]
|===
include::{esql-specs}/metadata.csv-spec[tag=multipleIndices-result]
|===
Similar to index fields, once an aggregation is performed, a
metadata field will no longer be accessible to subsequent commands, unless
used as a grouping field:
[source.merge.styled,esql]
----
include::{esql-specs}/metadata.csv-spec[tag=metaIndexInAggs]
----
[%header.monospaced.styled,format=dsv,separator=|]
|===
include::{esql-specs}/metadata.csv-spec[tag=metaIndexInAggs-result]
|===