Skip to content

ESQL: MATCH, MATCH_PHRASE allowed past LOOKUP JOIN (and fails uncontrolled) #129778

@bpintea

Description

@bpintea

Description

The following query fails with an assertion[*], instead of a verification error:

FROM sample_data
| LOOKUP JOIN sample__data_ts_nanos_lookup ON client_ip
| WHERE message : "Disconnected"

Here's a second example, to make the field ownership clearer (i.e. belonging to the lookup index):

FROM employees
| EVAL language_code = languages
| LOOKUP JOIN languages_lookup ON language_code
| WHERE language_name : "French"
| KEEP emp_no, language_code, language_name, first_name

The verification works for KQL, QSTR, however, the error message should be improved: [QSTR] function cannot be used after LOOKUP (there's a splitting of node's name and only picking the first token).

Only tried main, 8.19 is probably affected too.

[*] Assertion failure:

[2025-07-03T16:11:34,186][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [runTask-0] fatal error in thread [elasticsearch[runTask-0][esql_worker][T#5]], exiting java.lang.AssertionError: LuceneQueryExpressionEvaluato
r expects DocBlock as input
        at org.elasticsearch.compute.lucene.LuceneQueryEvaluator.executeQuery(LuceneQueryEvaluator.java:66)
        at org.elasticsearch.compute.lucene.LuceneQueryExpressionEvaluator.eval(LuceneQueryExpressionEvaluator.java:39)
        at org.elasticsearch.compute.operator.FilterOperator.process(FilterOperator.java:43)
        at org.elasticsearch.compute.operator.AbstractPageMappingOperator.getOutput(AbstractPageMappingOperator.java:85)
        at org.elasticsearch.compute.operator.Driver.runSingleLoopIteration(Driver.java:265)
        at org.elasticsearch.compute.operator.Driver.run(Driver.java:185)
        at org.elasticsearch.compute.operator.Driver$1.doRun(Driver.java:406)
        at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27)
        at org.elasticsearch.compute.operator.DriverScheduler$1.doRun(DriverScheduler.java:57)
        at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27)
        at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:35)
        at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1044)
        at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
        at java.base/java.lang.Thread.run(Thread.java:1575)

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions