Skip to content

Comments

[8.19] ES|QL support for partial results (#223198)#224641

Merged
kibanamachine merged 4 commits intoelastic:8.19from
kibanamachine:backport/8.19/pr-223198
Jun 23, 2025
Merged

[8.19] ES|QL support for partial results (#223198)#224641
kibanamachine merged 4 commits intoelastic:8.19from
kibanamachine:backport/8.19/pr-223198

Conversation

@kibanamachine
Copy link
Contributor

Backport

This will backport the following commits from main to 8.19:

Questions ?

Please refer to the Backport tool documentation

## ES|QL support for partial results

[Issue](elastic#211622)

We have 2 use cases:

- For aggregation query, we set `allow_partial_results` to false
- For normal query we are set warning status if there cluster failures

### How to test

1. Create a datastream

```
PUT _index_template/my_datastream_template
{
  "index_patterns": ["my_datastream*"],
  "data_stream": {},
  "template": {
    "mappings": {
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "host": {
          "properties": {
            "name": {
              "type": "keyword"
            }
          }
        }
      }
    }
  }
}

PUT /_data_stream/my_datastream
```

2.  For a single specific index set broken mapping

```

GET my_datastream

PUT .ds-my_datastream-2025.06.11-000001/_mapping
{
  "runtime": {
    "broken": {
      "type": "keyword",
      "script": {
        "source": "emit(doc['nonexistent_field'].value)"
      }
    }
  }
}
```

3.  Ingest document

```
POST my_datastream/_doc
{
  "@timestamp": "2025-06-05T09:04:11.493Z"
}
```

4. Check that query return partial result true:

```
POST _query/async?drop_null_columns=true&allow_partial_results=true
{
  "query": "from my_datastream* METADATA _id | limit 101",
  "keep_alive": "60s"
}
```

response:
```
{
  "is_running": false,
  "took": 5,
  "is_partial": true,
...
```

4. Create rule ES|QL with the same query and lookback which overlap
documents you created on step 3.

Observe warning

<img width="1261" alt="Screenshot 2025-06-11 at 08 52 07"
src="https://github.com/user-attachments/assets/c371f57b-51ff-4a13-96e3-19e2094d794c"
/>

---------

Co-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 8bd7f0e)
@kibanamachine kibanamachine added the backport This PR is a backport of another PR label Jun 20, 2025
@kibanamachine kibanamachine enabled auto-merge (squash) June 20, 2025 08:40
@nkhristinin
Copy link
Contributor

@elasticmachine merge upstream

@nkhristinin
Copy link
Contributor

@elasticmachine merge upstream

@nkhristinin
Copy link
Contributor

I don't import types here, as they wasn't backported in 8.19.

@kibanamachine kibanamachine merged commit ce30cca into elastic:8.19 Jun 23, 2025
8 checks passed
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

cc @nkhristinin

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants