Convert transport.request() to typed ES client methods by rudolf · Pull Request #256456 · elastic/kibana

rudolf · 2026-03-06T13:32:27Z

Summary

Partially addresses https://github.com/elastic/kibana-team/issues/2886

Further iteration on #256430 — converts transport.request() calls to typed elasticsearch-js client methods where feasible, improving type safety and ensuring CPS project_routing is automatically handled by the client library.

Converted (4 call sites):

elasticsearch_retriever.ts → esClient.search() — Search Playground RAG retriever
esql_request.ts → esql.asyncQuery() / asyncQueryGet() / asyncQueryDelete() — Security detection engine ES|QL executor
esql_search_strategy.ts → esql.query() — Synchronous ES|QL search (Discover/Lens)
esql_async_search_strategy.ts → esql.asyncQuery() / asyncQueryGet() / asyncQueryStop() / asyncQueryDelete() — Async ES|QL search. Also fixed incorrect SqlGetAsyncResponse type → EsqlAsyncQueryResponse

Remaining as transport.request (2 call sites):

mvt_routes.ts — Maps MVT tiles. Requires restructuring getTile() helper and tile request builders to pass index/field/zoom/x/y as separate params instead of a pre-built path string
observability_ai_assistant elasticsearch.ts — Dynamic caller by design, method/path determined at runtime by AI

Why typed methods are better for CPS:
Typed client methods already include meta.acceptedParams in their implementation, so the CPS handler automatically injects project_routing — no explicit injection or annotation needed. The two remaining transport.request callers use explicit project_routing: '_alias:_origin' injection (stripped automatically when CPS is disabled).

Test plan

conversational_chain.test.ts — 12/12 pass (updated mocks from transport.request to search())
esql_request.test.ts — all pass (updated mocks to typed esql methods)
esql.test.ts — 5/5 pass (updated mocks)
esql_async_search_strategy.test.ts — 15/15 pass (updated mocks + assertions)
async_utils.test.ts — 16/16 pass
es_search_strategy.test.ts + ese_search_strategy.test.ts — 35/35 pass (regression check)
cps_request_handler.test.ts — 38/38 pass (CPS handler sanity check)
mvt_routes.test.ts — pass
Typecheck passes for all affected plugins

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

Replace transport.request() with typed esClient.search() in the Search Playground's ElasticsearchRetriever. Remove explicit project_routing (CPS handler injects it automatically for typed methods). Remove unused AggregationsAggregate and SearchResponse imports. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace transport.request() calls with typed elasticsearch-js client methods in the Security Solution ES|QL request executor: - POST /_query/async -> esClient.esql.asyncQuery() - GET /_query/async/${id} -> esClient.esql.asyncQueryGet() - DELETE /_query/async/${id} -> esClient.esql.asyncQueryDelete() Remove explicit project_routing from submit body (CPS handler injects it automatically for typed methods). Cast response to AsyncEsqlResponse via unknown since the local type uses narrower column/value types than the ES client's EsqlAsyncQueryResponse. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

elasticmachine · 2026-03-06T13:32:35Z

Pinging @elastic/obs-ai-team (Team:obs-ai)

github-actions · 2026-03-06T13:32:39Z

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

/oblt-deploy : Deploy a Kibana instance using the Observability test environments.
run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

rudolf · 2026-03-06T13:38:30Z

-        path: `/_query/async`,
-        body: params,
-        querystring: dropNullColumns ? 'drop_null_columns' : '',
+        ...params,


As noted in https://github.com/elastic/kibana-team/issues/2886 ES|QL search strategy often uses transport.request as a way to quickly adopt new ES features before the specs are available.

While I converted to the typed API method now, if we ever get blocked by specs we can safely convert it back to a transport.request using project_routing: '_alias:_origin' as the default for when project_routing isn't specified by the caller.

viduni94

Obs AI changes LGTM (CR only)

nreese

kibana-presentation changes LGTM
code review only

Use the ES client return types directly instead of double-casting through `unknown`. Adds a runtime guard for the optional `id` field and removes the redundant local `AsyncEsqlResponse` type. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

TattdCodeMonkey

search changes LGTM, but left some comments related to typescript

lukasolson

I opened a PR against this branch to clean up a few things: #256523

lukasolson · 2026-03-06T18:02:39Z

      {
-        method: 'GET',
-        path: `/_query/async/${id}`,
+        id: id!,


Removed in #256523.

rylnd

Detection Engine changes LGTM.

rylnd · 2026-03-06T18:45:29Z

-      body: requestBody,
-      querystring: requestQueryParams,
+    const asyncEsqlResponse = await esClient.esql.asyncQuery({
+      ...requestBody,


For posterity: while requestQueryParams is only ever { drop_null_columns?: boolean }, which I see handled similarly elsewhere, requestBody contains both query and filter keys, both of which are top-level params to asyncQuery 👍

markov00

Changes LGTM

## Summary Fixing some type issues in #256456. This is PR against the branch from that PR (not main)

…_async_search/esql_async_search_strategy.test.ts Co-authored-by: Marco Vettorello <marco.vettorello@elastic.co>

mbondyra

Thank you for doing this! Checked the results for data plugin/Discover and when mocking projectRouting == undefined, the results are the same as with _alias:_origin.

denar50

LGTM!

Replace transport.request() calls with typed elasticsearch-js client methods: - POST /_query/async -> esClient.esql.asyncQuery() - GET /_query/async/${id} -> esClient.esql.asyncQueryGet() - POST /_query/async/${id}/stop -> esClient.esql.asyncQueryStop() - DELETE /_query/async/${id} -> esClient.esql.asyncQueryDelete() Typed methods include meta.acceptedParams so the CPS OnRequestHandler automatically injects project_routing — no explicit injection needed. Also fixes the incorrect SqlGetAsyncResponse type to EsqlAsyncEsqlResult. Inspired by elastic#256456. Made-with: Cursor

- Remove stray `);` syntax error in esql_async_search_strategy.test.ts - Set queryId before early return in esql_request.ts so completed queries are cleaned up - Update FTR test assertions for `drop_null_columns=true` query param serialization Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

elasticmachine · 2026-03-11T15:43:55Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: c4f51f7
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-256456-c4f51f7c18c7

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #25 / Cloud Security Posture Vulnerability Dashboard API responds with a 200 status code and matching data mock

History

Replace transport.request() calls with typed elasticsearch-js client methods: - POST /_query/async -> esClient.esql.asyncQuery() - GET /_query/async/${id} -> esClient.esql.asyncQueryGet() - POST /_query/async/${id}/stop -> esClient.esql.asyncQueryStop() - DELETE /_query/async/${id} -> esClient.esql.asyncQueryDelete() Typed methods include meta.acceptedParams so the CPS OnRequestHandler automatically injects project_routing — no explicit injection needed. Also fixes the incorrect SqlGetAsyncResponse type to EsqlAsyncEsqlResult. Inspired by elastic#256456. Made-with: Cursor

## Summary 1. In this one: #256456 we accidentally patched Maps mvt routes with only supporting local project routing, but we shouldn't have, as CPS is supported on Maps (the setting should be taken from the project picker) 2. In this PR I also removed a setting from the cps picker, since it cannot be linked for tech preview <img width="932" height="263" alt="Screenshot 2026-03-13 at 16 41 35" src="https://github.com/user-attachments/assets/ec12dcf5-3a9d-4597-bda6-1573b4f9247d" />

## Summary Partially addresses elastic/kibana-team#2886 Further iteration on #256430 — converts `transport.request()` calls to typed elasticsearch-js client methods where feasible, improving type safety and ensuring CPS `project_routing` is automatically handled by the client library. **Converted (4 call sites):** - `elasticsearch_retriever.ts` → `esClient.search()` — Search Playground RAG retriever - `esql_request.ts` → `esql.asyncQuery()` / `asyncQueryGet()` / `asyncQueryDelete()` — Security detection engine ES|QL executor - `esql_search_strategy.ts` → `esql.query()` — Synchronous ES|QL search (Discover/Lens) - `esql_async_search_strategy.ts` → `esql.asyncQuery()` / `asyncQueryGet()` / `asyncQueryStop()` / `asyncQueryDelete()` — Async ES|QL search. Also fixed incorrect `SqlGetAsyncResponse` type → `EsqlAsyncQueryResponse` **Remaining as transport.request (2 call sites):** - `mvt_routes.ts` — Maps MVT tiles. Requires restructuring `getTile()` helper and tile request builders to pass `index`/`field`/`zoom`/`x`/`y` as separate params instead of a pre-built path string - `observability_ai_assistant elasticsearch.ts` — Dynamic caller by design, method/path determined at runtime by AI **Why typed methods are better for CPS:** Typed client methods already include `meta.acceptedParams` in their implementation, so the CPS handler automatically injects `project_routing` — no explicit injection or annotation needed. The two remaining `transport.request` callers use explicit `project_routing: '_alias:_origin'` injection (stripped automatically when CPS is disabled). ## Test plan - [x] `conversational_chain.test.ts` — 12/12 pass (updated mocks from `transport.request` to `search()`) - [x] `esql_request.test.ts` — all pass (updated mocks to typed esql methods) - [x] `esql.test.ts` — 5/5 pass (updated mocks) - [x] `esql_async_search_strategy.test.ts` — 15/15 pass (updated mocks + assertions) - [x] `async_utils.test.ts` — 16/16 pass - [x] `es_search_strategy.test.ts` + `ese_search_strategy.test.ts` — 35/35 pass (regression check) - [x] `cps_request_handler.test.ts` — 38/38 pass (CPS handler sanity check) - [x] `mvt_routes.test.ts` — pass - [x] Typecheck passes for all affected plugins 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lukas Olson <lukas@elastic.co> Co-authored-by: Marco Vettorello <marco.vettorello@elastic.co>

## Summary 1. In this one: #256456 we accidentally patched Maps mvt routes with only supporting local project routing, but we shouldn't have, as CPS is supported on Maps (the setting should be taken from the project picker) 2. In this PR I also removed a setting from the cps picker, since it cannot be linked for tech preview <img width="932" height="263" alt="Screenshot 2026-03-13 at 16 41 35" src="https://github.com/user-attachments/assets/ec12dcf5-3a9d-4597-bda6-1573b4f9247d" />

## Summary Partially addresses elastic/kibana-team#2886 Further iteration on elastic#256430 — converts `transport.request()` calls to typed elasticsearch-js client methods where feasible, improving type safety and ensuring CPS `project_routing` is automatically handled by the client library. **Converted (4 call sites):** - `elasticsearch_retriever.ts` → `esClient.search()` — Search Playground RAG retriever - `esql_request.ts` → `esql.asyncQuery()` / `asyncQueryGet()` / `asyncQueryDelete()` — Security detection engine ES|QL executor - `esql_search_strategy.ts` → `esql.query()` — Synchronous ES|QL search (Discover/Lens) - `esql_async_search_strategy.ts` → `esql.asyncQuery()` / `asyncQueryGet()` / `asyncQueryStop()` / `asyncQueryDelete()` — Async ES|QL search. Also fixed incorrect `SqlGetAsyncResponse` type → `EsqlAsyncQueryResponse` **Remaining as transport.request (2 call sites):** - `mvt_routes.ts` — Maps MVT tiles. Requires restructuring `getTile()` helper and tile request builders to pass `index`/`field`/`zoom`/`x`/`y` as separate params instead of a pre-built path string - `observability_ai_assistant elasticsearch.ts` — Dynamic caller by design, method/path determined at runtime by AI **Why typed methods are better for CPS:** Typed client methods already include `meta.acceptedParams` in their implementation, so the CPS handler automatically injects `project_routing` — no explicit injection or annotation needed. The two remaining `transport.request` callers use explicit `project_routing: '_alias:_origin'` injection (stripped automatically when CPS is disabled). ## Test plan - [x] `conversational_chain.test.ts` — 12/12 pass (updated mocks from `transport.request` to `search()`) - [x] `esql_request.test.ts` — all pass (updated mocks to typed esql methods) - [x] `esql.test.ts` — 5/5 pass (updated mocks) - [x] `esql_async_search_strategy.test.ts` — 15/15 pass (updated mocks + assertions) - [x] `async_utils.test.ts` — 16/16 pass - [x] `es_search_strategy.test.ts` + `ese_search_strategy.test.ts` — 35/35 pass (regression check) - [x] `cps_request_handler.test.ts` — 38/38 pass (CPS handler sanity check) - [x] `mvt_routes.test.ts` — pass - [x] Typecheck passes for all affected plugins 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Lukas Olson <lukas@elastic.co> Co-authored-by: Marco Vettorello <marco.vettorello@elastic.co>

…7706) ## Summary 1. In this one: elastic#256456 we accidentally patched Maps mvt routes with only supporting local project routing, but we shouldn't have, as CPS is supported on Maps (the setting should be taken from the project picker) 2. In this PR I also removed a setting from the cps picker, since it cannot be linked for tech preview <img width="932" height="263" alt="Screenshot 2026-03-13 at 16 41 35" src="https://github.com/user-attachments/assets/ec12dcf5-3a9d-4597-bda6-1573b4f9247d" />

rudolf and others added 6 commits March 6, 2026 12:39

Explicit origin-only project_routing for transport.request calls

9ab288a

feat: US-003 - Convert esql_search_strategy to esClient.esql.query()

d75bc14

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat: US-005 - Convert esql_async_search_strategy to typed esql methods

fb07f5a

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix: update conversational_chain tests for typed search() method

fefc1a6

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

rudolf requested review from a team as code owners March 6, 2026 13:32

rudolf requested a review from denar50 March 6, 2026 13:32

botelastic Bot added ci:project-deploy-observability Create an Observability project Team:obs-ai Observability AI team labels Mar 6, 2026

rudolf commented Mar 6, 2026

View reviewed changes

efegurkan approved these changes Mar 6, 2026

View reviewed changes

viduni94 approved these changes Mar 6, 2026

View reviewed changes

rudolf mentioned this pull request Mar 6, 2026

Inject origin-only project_routing into transport.request CPS call sites #256430

Closed

rudolf added backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes labels Mar 6, 2026

denar50 reviewed Mar 6, 2026

View reviewed changes

Comment thread ...curity/plugins/security_solution/server/lib/detection_engine/rule_types/esql/esql_request.ts Outdated

nreese approved these changes Mar 6, 2026

View reviewed changes

TattdCodeMonkey reviewed Mar 6, 2026

View reviewed changes

Comment thread ...plugins/shared/data/server/search/strategies/esql_async_search/esql_async_search_strategy.ts Outdated

Comment thread ...plugins/shared/data/server/search/strategies/esql_async_search/esql_async_search_strategy.ts Outdated

TattdCodeMonkey reviewed Mar 6, 2026

View reviewed changes

Comment thread ...curity/plugins/security_solution/server/lib/detection_engine/rule_types/esql/esql_request.ts

lukasolson mentioned this pull request Mar 6, 2026

esql async search type improvements #256523

Merged

lukasolson reviewed Mar 6, 2026

View reviewed changes

rylnd approved these changes Mar 6, 2026

View reviewed changes

markov00 approved these changes Mar 9, 2026

View reviewed changes

Comment thread ...ns/shared/data/server/search/strategies/esql_async_search/esql_async_search_strategy.test.ts Outdated

lukasolson and others added 3 commits March 9, 2026 12:37

esql async search type improvements (#256523)

f6ae463

## Summary Fixing some type issues in #256456. This is PR against the branch from that PR (not main)

Update src/platform/plugins/shared/data/server/search/strategies/esql…

04599c4

…_async_search/esql_async_search_strategy.test.ts Co-authored-by: Marco Vettorello <marco.vettorello@elastic.co>

Merge branch 'main' into ralph/typed-es-client-methods

62602ce

mbondyra approved these changes Mar 9, 2026

View reviewed changes

denar50 approved these changes Mar 9, 2026

View reviewed changes

lukasolson approved these changes Mar 9, 2026

View reviewed changes

rudolf enabled auto-merge (squash) March 10, 2026 11:05

Merge branch 'main' into ralph/typed-es-client-methods

ac1c576

This was referenced Mar 10, 2026

[CPS] Introduce x-kbn-project-routing HTTP header #256844

Closed

[CPS] Simplify project_routing propagation in the data plugin via x-kbn-project-routing header gsoldevila/kibana#4

Closed

rudolf and others added 4 commits March 10, 2026 16:37

Using empty string as unset state is confusing

550cc43

Merge branch 'main' into ralph/typed-es-client-methods

eaec93b

Merge branch 'main' into ralph/typed-es-client-methods

c4f51f7

rudolf merged commit f148f02 into main Mar 11, 2026
18 checks passed

rudolf deleted the ralph/typed-es-client-methods branch March 11, 2026 16:33

kibanamachine added the v9.4.0 label Mar 11, 2026

mbondyra mentioned this pull request Mar 13, 2026

[Maps] Do not patch maps calls with local project_routing #257706

Merged

Conversation

rudolf commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

elasticmachine commented Mar 6, 2026

Uh oh!

github-actions Bot commented Mar 6, 2026

🤖 GitHub comments

Uh oh!

rudolf Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

viduni94 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nreese left a comment

Choose a reason for hiding this comment

Uh oh!

TattdCodeMonkey left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lukasolson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lukasolson Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rylnd left a comment

Choose a reason for hiding this comment

Uh oh!

rylnd Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

markov00 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mbondyra left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

denar50 left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

rudolf commented Mar 6, 2026 •

edited

Loading

mbondyra left a comment •

edited

Loading

elasticmachine commented Mar 11, 2026 •

edited

Loading