Skip to content

Add ESQL View as an IndexAbstraction#139778

Merged
dakrone merged 6 commits intoelastic:mainfrom
dakrone:view-index-abstraction
Jan 2, 2026
Merged

Add ESQL View as an IndexAbstraction#139778
dakrone merged 6 commits intoelastic:mainfrom
dakrone:view-index-abstraction

Conversation

@dakrone
Copy link
Copy Markdown
Member

@dakrone dakrone commented Dec 18, 2025

This commit adds the View class as the fourth IndexAbstraction. This means that it can be
"resolved" in the expression resolver, and moves us towards implementing the ES security model for
views. It also includes code that prevents conflicting views, indices, aliases, and data streams
with the same name. Additionally, we prevent indexing into a view or directly resolving it for a
search (if someone searches for * for instance).

Relates to #137818

@dakrone dakrone force-pushed the view-index-abstraction branch 4 times, most recently from 6434f70 to 4a43dd1 Compare December 29, 2025 17:06
@dakrone dakrone force-pushed the view-index-abstraction branch from 03d42b6 to 4656e6d Compare December 30, 2025 16:13
This commit adds the `View` class as the fourth `IndexAbstraction`. This means that it can be
"resolved" in the expression resolver, and moves us towards implementing the ES security model for
views. It also includes code that prevents conflicting views, indices, aliases, and data streams
with the same name. Additionally, we prevent indexing into a view or directly resolving it for a
search (if someone searches for `*` for instance).

Relates to elastic#137818
@dakrone dakrone force-pushed the view-index-abstraction branch from 4656e6d to c0316f7 Compare December 30, 2025 17:35
@dakrone dakrone changed the title View index abstraction Add ESQL View as an IndexAbstraction Dec 30, 2025
@dakrone dakrone added the :Data Management/Indices APIs DO NOT USE. Use ":Distributed/Indices APIs" or ":StorageEngine/Templates" instead. label Dec 30, 2025
@dakrone dakrone marked this pull request as ready for review December 30, 2025 18:41
@elasticsearchmachine elasticsearchmachine added the Team:Data Management (obsolete) DO NOT USE. This team no longer exists. label Dec 30, 2025
@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-data-management (Team:Data Management)

@dakrone dakrone requested a review from gmarouli December 30, 2025 18:41
Copy link
Copy Markdown
Contributor

@gmarouli gmarouli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great @dakrone , I had 2 minor comments.

assertThat(
e.getMessage(),
equalTo("Invalid alias name [logs]: an index or data stream exists with the same name as the alias")
equalTo("Invalid alias name [logs]: an index, data stream, or ESQL view exists with the same name as the alias")
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: considering that this is a user facing message, do we need to write ES|QL instead of ESQL?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've seen a mixture of both in the codebase, but I found more using "ESQL" than "ES|QL", so I went with this one.

throw new IllegalArgumentException("cannot add view, the maximum number of views is reached: " + this.maxViewsCount);
}

final Map<String, IndexAbstraction> indicesLookup = getIndicesLookup(metadata);
Copy link
Copy Markdown
Contributor

@salvatore-campagna salvatore-campagna Dec 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see this logic is used to check naming collision for views against all other types. Why can't we use it elsewhere? I wonder if it could be a method in ProjectMetadata....that would make also collision logic easier to test.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I opened #140131 for tracking unifying the name collision work. I agree that it definitely can be improved in subsequent work.

Copy link
Copy Markdown
Contributor

@craigtaverner craigtaverner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice improvement. Great that name conflict checks appear to be implemented in both directions. There was a loose end in the TestCluster around wiping views, but other than that this looks good to me.

@dakrone dakrone merged commit 2469089 into elastic:main Jan 2, 2026
35 checks passed
samxbr pushed a commit to samxbr/elasticsearch that referenced this pull request Jan 5, 2026
* Add ESQL View as an IndexAbstraction

This commit adds the `View` class as the fourth `IndexAbstraction`. This means that it can be
"resolved" in the expression resolver, and moves us towards implementing the ES security model for
views. It also includes code that prevents conflicting views, indices, aliases, and data streams
with the same name. Additionally, we prevent indexing into a view or directly resolving it for a
search (if someone searches for `*` for instance).

Relates to elastic#137818

* Include views in comment

* Add earlier filtering of views in IndexNameExpressionResolver

* Use empty list of indices and null write index for View
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

:Data Management/Indices APIs DO NOT USE. Use ":Distributed/Indices APIs" or ":StorageEngine/Templates" instead. >non-issue Team:Data Management (obsolete) DO NOT USE. This team no longer exists. v9.4.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants