All Classes and Interfaces
Class
Description
Base class for functions that converts a field into a function-specific type.
AbstractLookupService performs a LEFT JOIN for a given input
page against another index that must have only a single
shard.AbstractLookupService uses this to power the queries and field loading that
it needs to perform to actually do the lookup.Create a
AbstractLookupService.LookupShardContext for a locally allocated ShardId.Base class for functions that reduce multivalued fields into single valued fields.
Base evaluator that can handle both nulls- and no-nulls-containing blocks.
Base evaluator that can handle evaluator-checked exceptions; i.e.
Inverse cosine trigonometric function.
A type of
Function that takes multiple values and extracts a single value out of them.This class is part of the planner.
Inverse cosine trigonometric function.
Inverse cosine trigonometric function.
Inverse cosine trigonometric function.
Matches
BytesRefs against automata.Spatial functions that take two arguments that must both be spatial types can inherit from this class.
For most spatial functions we only need to know if the CRS is geo or cartesian, not whether the type is point or shape.
This rule must always be placed after
LiteralsOnTheRight
since it looks at TRUE/FALSE literals' existence on the right hand-side of the Equals/NotEquals expressions.Splits dates and numbers into a given number of buckets.
This class supports case-insensitive lexing by wrapping an existing
CharStream and forcing the lexer to see lowercase characters
Grammar literals should then be lower case such as begin.Categorizes text messages.
Round a number up to the nearest integer.
This function takes a first parameter of type IP, followed by one or more parameters evaluated to a CIDR specification:
a string literal;
a field of type keyword;
a function outputting a keyword.
Function returning the first non-null value.
A "column" from a
table provided in the request.Combine disjunctive Equals, In or CIDRMatch expressions on the same field into an In or CIDRMatch expression.
Combine multiple Evals into one in order to reduce the number of nodes in a plan.
Computes the result of a
PhysicalPlan.Join strings.
Cosine trigonometric function.
Cosine hyperbolic function.
Subtract the second argument from the third argument and return their difference
in multiples of the unit specified in the first argument.
Represents units that can be used for DATE_DIFF function and how the difference
between 2 dates is calculated
Slowdown function - for debug purposes only.
Function that emits constants, like Euler’s number.
Function that emits Euler’s number.
When a spatial distance predicate can be pushed down to lucene, this is done by capturing the distance within the same function.
EnrichLookupService performs enrich lookup for a given input page.Resolves enrich policies across clusters in several steps:
1.
Holds the resolution results of the enrich polices.
Context of each shard we're operating against.
Arithmetic (quad) function.
This class provides an empty implementation of
EsqlBaseParserListener,
which can be extended to create a listener which only needs to handle a subset
of the available methods.This class provides an empty implementation of
EsqlBaseParserVisitor,
which can be extended to create a visitor which only needs to handle a subset
of the available methods.This interface defines a complete listener for a parse tree produced by
EsqlBaseParser.This interface defines a complete generic visitor for a parse tree produced
by
EsqlBaseParser.Holds execution metadata about ES|QL queries for cross-cluster searches in order to display
this information in ES|QL JSON responses.
Represents the search metadata about a particular cluster involved in a cross-cluster search.
Since the Cluster object is immutable, use this Builder class to create
a new Cluster object using the "copyFrom" Cluster passed in and set only
changed values.
Marks the status of a Cluster search involved in a Cross-Cluster search.
NodeFeatures declared by ESQL.A fork of the field-caps API for ES|QL.
View over the response, that supports the xpack core transport API.
Listens for a single
EsqlQueryResponse, builds a corresponding RestResponse and sends it.A
ScalarFunction is a Function that takes values from some
operation and converts each to another value.A fork of the search shards API for ES|QL.
Interface for running the underlying plan.
Request to gather usage statistics
Specialized query class for retrieving statistics about the underlying data and not the actual documents.
Expressions that have a mapping to an
EvalOperator.ExpressionEvaluator.An example of using a function that is rendered in the docs.
Returns the value of e raised to the power of tbe number specified as parameter
Maps expressions that have a mapping to an
ScoreOperator.ExpressionScorer.Extract a per-function expression filter applied to all the aggs as a query
Filter, when no groups are provided.Glorified list for managing
Failures.A
Filter is a type of Plan that performs filtering of results.Basic wrapper for expressions declared with a nested filter (typically in stats).
Round a number down to the nearest integer.
Base class for functions that converts a constant into an interval type - DATE_PERIOD or TIME_DURATION.
Base class for full-text functions that use ES queries to match documents.
Converts an
UnresolvedFunction into a proper Function.Describes functions.
Strategy indicating the type of resolution to apply for resolving the actual function definition in a pluggable way.
The position the function can appear in the language.
Returns the maximum value of multiple columns.
Returns the hypotenuse of the numbers given as parameters.
A
LocalSupplier that contains already filled Blocks.The
IN operator.EvalOperator.ExpressionEvaluator implementation for In.EvalOperator.ExpressionEvaluator implementation for In.Contains an index pattern together with its
Source.EvalOperator.ExpressionEvaluator implementation for In.Simplify IsNotNull targets by resolving the underlying expression to its root fields.
The vast majority of aggs ignore null entries - this rule adds a pushable filter, as it is cheap
to execute, to filter this entries out to begin with.
EvalOperator.ExpressionEvaluator implementation for In.Specialized type of join where the source of the left and right plans are the same.
Enriches the stream of data with the results of running a
STATS.EvalOperator.ExpressionEvaluator implementation for In.EvalOperator.ExpressionEvaluator implementation for In.EvalOperator.ExpressionEvaluator implementation for In.Materialize the concrete fields that need to be extracted from the storage until the last possible moment.
Truncates an IP value to a given prefix length.
Configuration for a
JOIN style operation.Utility class defining the concrete types of joins supported by ESQL.
Join type for the USING clause - shorthand for defining an equi-join (equality join meaning the condition checks if columns across
each side of the join are equal).
Full text function that performs a
KqlQuery .Maintains the mapping from attribute ids to channels (block index).
Builder class for Layout.
Returns the minimum value of multiple columns.
{code left(foo, len)} is an alias to {code substring(foo, 0, len)}
Base class for hooking versioning information into the ANTLR parser.
The local execution planner takes a plan (represented as PlanNode tree / digraph) as input and creates the corresponding
drivers that are used to execute the given plan.
Plan representation that is geared towards execution on a single node
Context object used while generating a local plan.
Immutable physical operation.
This class is part of the planner.
Maps a (local) logical plan into a (local) physical plan.
Manages field extraction and pushing parts of the query into Lucene.
Local aggregation can only produce intermediate state that get wired into the global agg.
Supplies fixed
Blocks for things calculated at plan time.Locate function, given a string 'a' and a substring 'b', it returns the index of the first occurrence of the substring 'b' in 'a'.
A LogicalPlan is what (not the "how") a user told us they want to do.
Order is important in the enum; any values should be added at the end.
Translates what we get back from Antlr into the data structures the rest of the planner steps will act on.
This class is part of the planner
Looks up values from the associated
tables.LookupFromIndexService performs lookup against a Lookup index for
a given input page.Lookup join - specialized LEFT (OUTER) JOIN between the main left side and a lookup index (index_mode = lookup) on the right.
Removes leading whitespaces from a string.
This utilities class provides access to protected methods in Lucene using alternative APIs.
When deciding if a filter or topN can be pushed down to Lucene, we need to check a few things on the field.
Describes a function map argument represented by
MapExpression.This class is part of the planner
Full text function that performs a
MatchQuery .This class performs a
MatchQuery using an operator.Class encapsulating the metrics collected for ESQL
Appends values to a multi-value
Reduce a multivalued field to a single valued field containing the average value.
Reduce a multivalued string field to a single valued field by concatenating all values.
Reduce a multivalued field to a single valued field containing the count of values.
Removes duplicate values from a multivalued field.
Reduce a multivalued field to a single valued field containing the minimum value.
Reduce a multivalued field to a single valued field containing the minimum value.
Reduce a multivalued field to a single valued field containing the maximum value.
Reduce a multivalued field to a single valued field containing the median of the values.
Reduce a multivalued field to a single valued field containing the median absolute deviation of the values.
Reduce a multivalued field to a single valued field containing the minimum value.
Reduce a multivalued field to a single valued field containing the weighted sum of all element applying the P series function.
Returns a subset of the multivalued field using the start and end index values.
Sorts a multivalued field in lexicographical order.
Reduce a multivalued field to a single valued field containing the sum of all values.
Combines the values from two multivalued fields with a delimiter that joins them together.
Sentinel exception indicating that logical planning could not find any clusters to search
when, for a remote-only cross-cluster search, all clusters have been marked as SKIPPED.
Aggregate function that receives a numeric, signed field, and returns a single double value.
Marker interface indicating that a function accepts one optional argument (typically the last one).
Describes function parameters.
Parses the
tables request body parameter.Fold the arms of
CASE statements.A PhysicalPlan is "how" a LogicalPlan (the "what") actually gets translated into one or more queries.
This class is part of the planner.
Physical plan verifier.
Function that emits pi.
A customized stream input used to deserialize ESQL physical plan fragments.
A customized stream output used to serialize ESQL physical plan fragments.
This class is responsible for collecting metrics related to ES|QL planning.
This class is responsible for publishing metrics related to ES|QL planning.
Interface implemented by expressions or plans that require validation after query plan analysis,
when the indices and references have been resolved, but before the plan is transformed further by optimizations.
Interface implemented by expressions or plans that require validation after query plan analysis,
when the indices and references have been resolved, but before the plan is transformed further by optimizations.
Interface implemented by expressions that require validation post logical optimization,
when the plan and references have been not just resolved but also replaced.
This class is part of the planner.
A
Project is a Plan with one child.Adds an explicit project to minimize the amount of attributes sent from the local plan to the coordinator.
Propagate Equals to eliminate conjuncted Ranges or BinaryComparisons.
Replace any reference attribute with its source, if it does not affect the result.
Replace any evaluation from the inlined aggregation side (right side) to the left side (source) to perform the matching.
Merges unmapped fields into the output of the ES relation.
Remove unused columns created in the plan, in fields inside eval or aggregations inside stats.
SORT cannot be executed without a LIMIT, as ES|QL doesn't support unbounded sort (yet).
Looks for the case where certain stats exist right before the query and thus can be pushed down.
We handle two main scenarios here:
Queries like `FROM index | SORT field` will be pushed to the source if the field is an indexed field.
Some
FullTextFunction implementations such as Match
will be translated to a QueryBuilder that require a rewrite phase on the coordinator.Represent a strongly typed parameter value
There are two main types of plans,
LogicalPlan and PhysicalPlanHolds the pragmas for an ESQL query.
Full text function that performs a
QueryStringQuery .Removes
Aggregate overrides in grouping, aggregates and across them inside.Replace nested expressions over aggregates with synthetic eval post the aggregation
stats a = sum(a) + min(b) by x
becomes
stats a1 = sum(a), a2 = min(b) by x | eval a = a1 + a2 | keep a, x
The rule also considers expressions applied over groups:
STATS a = x + 1 BY x becomes STATS BY x | EVAL a = x + 1 | KEEP a, x
And to combine the two:
stats a = x + count(*) by x
becomes
stats a1 = count(*) by x | eval a = x + a1 | keep a1, x
Since the logic is very similar, this rule also handles duplicate aggregate functions to avoid duplicate compute
stats a = min(x), b = min(x), c = count(*), d = count() by g
becomes
stats a = min(x), c = count(*) by g | eval b = a, d = c | keep a, b, c, d, gReplace nested expressions inside a
Aggregate with synthetic eval.Replace aliasing evals (eval x=a) with a projection which can be further combined / simplified.
Look for any fields used in the plan that are missing locally and replace them with null.
Replaces an aggregation function having a false/null filter with an EVAL node.
Break TopN back into Limit + OrderBy to allow the order rules to kick in.
Replace type converting eval with aliasing eval when type change does not occur.
Collection of static utility methods for helping transform response data between pages and values.
Results from running a chunk of ESQL.
Function that reverses a string.
{code right(foo, len)} is an alias to {code substring(foo, foo.length-len, len)}
Removes trailing whitespaces from a string.
Rules that apply transformation to a tree.
Maps an expression tree into ExpressionScorer.Factory, so scores can be evaluated for an expression tree.
This class provides
SearchStats from a list of SearchExecutionContext's.Interface for determining information about fields in the index.
When there are no search stats available, for example when there are no search contexts, we have static results.
Simplifies arithmetic expressions with BinaryComparisons and fixed point fields, such as: (int + 2) / 3 > 4 => int > 10
Sine trigonometric function.
Lucene query that wraps another query and only selects documents that match
the wrapped query and have a single field value.
Sine hyperbolic function.
This interface is intended to check redundancy of a previous SORT.
All spatial aggregate functions extend this class to enable the planning of reading from doc values for higher performance.
Calculate spatial centroid of all geo_point or cartesian point values of a field in matching documents.
This is the primary class for supporting the function ST_CONTAINS.
This is the primary class for supporting the function ST_DISJOINT.
This rule is responsible for marking spatial fields to be extracted from doc-values instead of source values.
Calculate spatial extent of all values of a field in matching documents.
This is the primary class for supporting the function ST_INTERSECTS.
This rule is responsible for marking spatial shape fields whose extent can be extracted from the binary representation encoded by
GeometryDocValueWriter.This is the primary class for supporting the function ST_WITHIN.
Splits a string on some delimiter into a multivalued string field.
3 in (field, 4, 5) --> 3 in (field) or 3 in (4, 5)
Computes the distance between two points.
This class is a CRS specific interface for generalizing distance calculations for the various possible ways
that the geometries can be provided, from source, from evals, from literals and from doc values.
Determines the minimum bounding rectangle of a geometry.
Synthetic
LogicalPlan used by the planner that the child plan is referred elsewhere.Extracts the x-coordinate from a point geometry.
Determines the maximum value of the x-coordinate from a geometry.
Determines the minimum value of the x-coordinate from a geometry.
Extracts the y-coordinate from a point geometry.
Determines the maximum value of the y-coordinate from a geometry.
Determines the minimum value of the y-coordinate from a geometry.
Physical plan representing a subquery, meaning a section of the plan that needs to be executed independently.
This rule should not be needed - the substitute infrastructure should be enough.
Currently this works similarly to SurrogateExpression, leaving the logic inside the expressions,
so each can decide for itself whether or not to change to a surrogate expression.
Sum all values of a field in matching documents.
Interface signaling to the planner that the declaring expression
has to be replaced by a different form.
Interface signaling to the planner that the declaring plan should be replaced with the surrogate plan.
Tangent trigonometric function.
Tangent hyperbolic function.
Function that emits tau, also known as 2 * pi.
Interface for plan nodes that need to be accounted in the statistics
Full text function that performs a
TermQuery .Templating class for displaying ESQL responses in text formats.
Formats
EsqlQueryResponse for the textual representation.Expressions that have a mapping to an
AggregatorFunctionSupplier.An internal aggregate function that always emits intermediate (or partial) output regardless
of the aggregate mode.
Rate aggregation is special because it must be computed per time series, regardless of the grouping keys.
Expressions implementing this interface can get called on data nodes to provide an Elasticsearch/Lucene query.
Subinterface for expressions that can only process single values (and null out on MVs).
Expressions that store their own
QueryBuilder and implement
TranslationAware can use TranslationAwareExpressionQuery
to wrap their QueryBuilder, instead of using the other existing Query implementations.Handler used during query translation.
This action will stop running async request and collect the results.
Performs the stats operation.
Removes leading and trailing whitespaces from a string.
Marker interface indicating that a function accepts two optional arguments (the last two).
A
UnaryPlan is a LogicalPlan with exactly one child, for example, WHERE x in a
SQL statement is an UnaryPlan.Unresolved expression for encapsulating a pattern:
KEEP `a*`, b*, `c*`*`d*`
a* is an actual name (UnresolvedAttribute)
b* is a name pattern (this class)
`c*`*`d*` is a name pattern
Unsupported attribute meaning an attribute that has been found yet cannot be used (hence why UnresolvedAttribute
cannot be used) expect in special conditions (currently only in projections to allow it to flow through
the engine).
This class is part of the planner.