CCS logging fixes

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/logging/EqlLogContext.java

@@ -7,6 +7,7 @@
 
 package org.elasticsearch.xpack.eql.logging;
 
+import org.elasticsearch.action.ResolvedIndexExpressions;
 import org.elasticsearch.action.search.ShardSearchFailure;
 import org.elasticsearch.common.logging.activity.ActivityLoggerContext;
 import org.elasticsearch.tasks.Task;
@@ -67,14 +68,19 @@ private static int getFailedShards(EqlSearchResponse response) {
 
     // CCS stuff
     public long remoteClusterCount() {
-        var resolved = request.getResolvedIndexExpressions();
+        ResolvedIndexExpressions resolved = request.getResolvedIndexExpressions();
         if (resolved != null) {
             return resolved.getRemoteIndicesList()
                 .stream()
                 .filter(RemoteClusterAware::isRemoteIndexName)
                 .map(i -> RemoteClusterAware.splitIndexName(i)[0])
                 .distinct()
                 .count();
+        } else {
+            String[] indices = request.indices();
+            if (indices != null) {
+                return Arrays.stream(indices).filter(RemoteClusterAware::isRemoteIndexName).count();
+            }
         }
         return 0;
     }

x-pack/plugin/esql/src/internalClusterTest/java/org/elasticsearch/xpack/esql/action/CrossClusterLoggingIT.java

@@ -25,12 +25,14 @@
 import java.util.Map;
 
 import static org.elasticsearch.common.logging.activity.ActivityLogger.ACTIVITY_LOGGER_ENABLED;
+import static org.elasticsearch.common.logging.activity.QueryLogging.QUERY_FIELD_INDICES;
 import static org.elasticsearch.common.logging.activity.QueryLogging.QUERY_FIELD_IS_CCS;
 import static org.elasticsearch.common.logging.activity.QueryLogging.QUERY_FIELD_REMOTE_COUNT;
 import static org.elasticsearch.test.ActivityLoggingUtils.assertMessageSuccess;
 import static org.elasticsearch.test.ActivityLoggingUtils.getMessageData;
 import static org.elasticsearch.test.hamcrest.ElasticsearchAssertions.assertAcked;
 import static org.elasticsearch.xpack.esql.EsqlTestUtils.getValuesList;
+import static org.hamcrest.Matchers.arrayContainingInAnyOrder;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.hasSize;
 
@@ -94,6 +96,7 @@ public void testLocalQueryLogging() throws IOException {
         assertMessageSuccess(message, EsqlLogContext.TYPE, "from logs-*");
         assertNull(message.get(QUERY_FIELD_IS_CCS));
         assertNull(message.get(QUERY_FIELD_REMOTE_COUNT));
+        assertThat(message.get(QUERY_FIELD_INDICES), equalTo("logs-*"));
     }
 
     public void testRemoteQueryLogging() throws IOException {
@@ -108,5 +111,9 @@ public void testRemoteQueryLogging() throws IOException {
         assertMessageSuccess(message, EsqlLogContext.TYPE, "from logs-*");
         assertThat(message.get(QUERY_FIELD_IS_CCS), equalTo("true"));
         assertThat(message.get(QUERY_FIELD_REMOTE_COUNT), equalTo("2"));
+        assertThat(
+            message.get(QUERY_FIELD_INDICES).split(","),
+            arrayContainingInAnyOrder("logs-*", REMOTE_CLUSTER_1 + ":logs-*", REMOTE_CLUSTER_2 + ":logs-*")
+        );
     }
 }

x-pack/plugin/esql/src/internalClusterTest/java/org/elasticsearch/xpack/esql/action/EsqlQueryLoggingIT.java

@@ -27,6 +27,7 @@
 import org.junit.Before;
 import org.junit.BeforeClass;
 
+import static org.elasticsearch.common.logging.activity.QueryLogging.QUERY_FIELD_INDICES;
 import static org.elasticsearch.common.logging.activity.QueryLogging.QUERY_FIELD_RESULT_COUNT;
 import static org.elasticsearch.common.logging.activity.QueryLogging.QUERY_FIELD_SHARDS;
 import static org.elasticsearch.test.ActivityLoggingUtils.assertMessageFailure;
@@ -100,6 +101,7 @@ private void assertQuery(String query, long hits) {
                 assertTrue("Expected profile field present: " + tookKey, message.containsKey(tookKey));
             }
             assertThat(message.get(QUERY_FIELD_RESULT_COUNT), equalTo(Long.toString(hits)));
+            assertThat(message.get(QUERY_FIELD_INDICES), equalTo("index-*"));
         }
     }
 
@@ -153,6 +155,7 @@ public void testLoggingPartialShardFailure() throws Exception {
         assertThat(Integer.valueOf(message.get(QUERY_FIELD_SHARDS + "successful")), greaterThanOrEqualTo(1));
         assertThat(Integer.valueOf(message.getOrDefault(QUERY_FIELD_SHARDS + "skipped", "0")), equalTo(0));
         assertThat(Integer.valueOf(message.get(QUERY_FIELD_SHARDS + "failed")), greaterThanOrEqualTo(1));
+        assertThat(message.get(QUERY_FIELD_INDICES), equalTo("esql_partial_test"));
     }
 
 }

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/querylog/EsqlLogContext.java

@@ -16,6 +16,7 @@
 import org.elasticsearch.xpack.esql.action.EsqlQueryRequest;
 import org.elasticsearch.xpack.esql.action.EsqlQueryResponse;
 
+import java.util.Arrays;
 import java.util.Optional;
 import java.util.concurrent.atomic.AtomicInteger;
 
@@ -87,4 +88,19 @@ public long remoteClusterCount() {
                 .count()
             : 0;
     }
+
+    public String[] getIndices() {
+        if (response == null) {
+            return null;
+        }
+        return response.getExecutionInfo()
+            .getClusters()
+            .values()
+            .stream()
+            .flatMap(
+                cluster -> Arrays.stream(cluster.getIndexExpression().split(","))
+                    .map(ind -> RemoteClusterAware.buildRemoteIndexName(cluster.getClusterAlias(), ind))
+            )
+            .toArray(String[]::new);
+    }
 }

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/querylog/EsqlLogProducer.java

@@ -24,6 +24,7 @@ public class EsqlLogProducer implements ActivityLogProducer<EsqlLogContext> {
     public Optional<ESLogMessage> produce(EsqlLogContext context, ActionLoggingFields additionalFields) {
         ESLogMessage msg = produceCommon(context, QueryLogging.ES_QUERY_FIELDS_PREFIX, additionalFields);
         msg.field(QueryLogging.QUERY_FIELD_QUERY, context.getQuery()).field(QueryLogging.QUERY_FIELD_RESULT_COUNT, context.getHits());
+        msg.field(QueryLogging.QUERY_FIELD_INDICES, context.getIndices());
         context.getQueryProfile().ifPresent(profile -> {
             for (TimeSpanMarker timeSpanMarker : profile.timeSpanMarkers()) {
                 TimeValue timeTook = timeSpanMarker.timeTook();