Skip to content

ESQL: unmapped_fields="load" in case a field is partially mapped but not as KEYWORD but cast explicitly #141912

@alex-spies

Description

@alex-spies

Relates #138888.

This is for the case when a partially mapped field is used in the query within a conversion function (as opposed to #141995)

Reproducer using spec tests:

SET unmapped_fields=\"load\";
FROM sample_data, no_mapping_sample_data
| EVAL x = event_duration::DOUBLE

event_duration is mapped as long in sample_data and unmapped in no_mapping_sample_data. This query should work, but instead we get a cryptic error:

Found 1 problem\nline 1:77: EVAL does not support type [unsupported] as the return data type of expression [event_duration]

Looking at the analyzer, it seems we trigger ResolveUnionTypes and that somehow thinks we want to cast to the UNSUPPORTED type:

[2026-02-05T11:57:22,258][TRACE][o.e.x.e.a.A.changes      ] [runTask-0] Rule analysis.Analyzer$ResolveUnionTypes applied with change
Eval[[TODOUBLE(event_duration{f}#130) AS x#125]]                                                        ! Eval[[$$event_duration$converted_to$unsupported{f$}#131 AS x#125]]
\_EsRelation[sample_data,no_mapping_sample_data][@timestamp{f}#126, client_ip{f}#128, event_duration..] = \_EsRelation[sample_data,no_mapping_sample_data][@timestamp{f}#126, client_ip{f}#128, event_duration..]

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions