Class FieldAttribute

All Implemented Interfaces:
NamedWriteable, Writeable, Resolvable
Direct Known Subclasses:
TemporalityAttribute, TimeSeriesMetadataAttribute, UnsupportedAttribute

public sealed class FieldAttribute extends TypedAttribute permits TemporalityAttribute, TimeSeriesMetadataAttribute, UnsupportedAttribute
Treat this as final - avoid creating new subclasses. This is used extensively throughout the codebase, making new subclasses risky. Consider using a new EsField subclass if needed.

Attribute for an ES field. May actually stand for a field with the same name across different indices (a union), e.g. when index pattern were used in the query: FROM logs-* | KEEP field.

This class offers:

  • name - the name of the attribute, but not necessarily of the field.
  • The raw EsField representing the field; for parent.child.grandchild this is just grandchild.
  • parentName - the full path to the immediate parent of the field, e.g. parent.child (without .grandchild)

To adequately represent e.g. union types, the name of the attribute can be altered because we may have multiple synthetic field attributes that really belong to the same underlying field. For instance, if a multi-typed field is used both as field::string and field::ip, we'll generate 2 field attributes called $$field$converted_to$keyword and $$field$converted_to$ip which still refer to the same underlying index field.