Skip to content

EQL: enable CPS#137833

Merged
luigidellaquila merged 26 commits intoelastic:mainfrom
luigidellaquila:eql/cps_w_validation
Nov 19, 2025
Merged

EQL: enable CPS#137833
luigidellaquila merged 26 commits intoelastic:mainfrom
luigidellaquila:eql/cps_w_validation

Conversation

@luigidellaquila
Copy link
Contributor

@luigidellaquila luigidellaquila commented Nov 10, 2025 •
edited
Loading

Add CPS settings both to EQL action and to inner field_caps invocation

PIT is not ready for it yet, it will be managed with a follow-up PR
@luigidellaquila luigidellaquila mentioned this pull request Nov 10, 2025
Closed
@luigidellaquila luigidellaquila changed the title EQL: enable CPS - tests take 2 Nov 10, 2025
@luigidellaquila luigidellaquila marked this pull request as ready for review November 10, 2025 15:05
@elasticsearchmachine elasticsearchmachine added the Team:Analytics Meta label for analytical engine team (ESQL/Aggs/Geo) label Nov 10, 2025
@elasticsearchmachine
Copy link
Collaborator

elasticsearchmachine commented Nov 10, 2025

Pinging @elastic/es-analytical-engine (Team:Analytics)
@elasticsearchmachine
Copy link
Collaborator

elasticsearchmachine commented Nov 10, 2025

Hi @luigidellaquila, I've created a changelog YAML for you.
@elasticsearchmachine elasticsearchmachine added the serverless-linked Added by automation, don't add manually label Nov 10, 2025
@luigidellaquila luigidellaquila mentioned this pull request Nov 10, 2025
Closed
@luigidellaquila
Copy link
Contributor Author

luigidellaquila commented Nov 11, 2025

@piergm It seems to work fine, but I have a doubt: I changed indicesOptions for the field_caps call (fan-out), but not for the subsequent _search calls. Should I also do it in that case?

This is where I prepare the search requests: https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/execution/search/RuntimeUtils.java#L189-L196
@piergm
Copy link
Member

piergm commented Nov 11, 2025

@luigidellaquila I have to take a deeper look, but I think we should do the same as we do for the field caps call.
My theory on why it's currently working is because both PIT (so MRT=false) and _search with MRT=true are not CPS enabled.
@luigidellaquila
Copy link
Contributor Author

luigidellaquila commented Nov 14, 2025

@piergm I added the same indices options to _search and it seems to be OK
idegtiarenko
idegtiarenko reviewed Nov 17, 2025
View reviewed changes
x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequest.java

@Override
public boolean allowsCrossProject() {
return true;
Copy link
Contributor

@idegtiarenko idegtiarenko Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we make it conditional?
For cases when we are not running in CPS mode?
Copy link
Contributor Author

@luigidellaquila luigidellaquila Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My understanding is that this flag just indicates that the API can be used for CPS in general, but I don't know how Serverless will use it.
I see all the other enabled APIs have true.

Maybe @piergm can provide more details
Copy link
Member

@piergm piergm Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Returning true is fine here, it simply means that we can use this endpoint in CPS. We have a check in CrossProjectModeDecider#resolvesCrossProject that considers the return value of allowsCrossProject iff cross project is enabled for the project with the cluster level setting serverless.cross_project.enabled=true
piergm
piergm reviewed Nov 19, 2025
View reviewed changes
Copy link
Member

@piergm piergm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did a first high level review, changes looks good but I left few comments I'd like your take on! 😄
x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequest.java

@Override
public boolean allowsCrossProject() {
return true;
Copy link
Member

@piergm piergm Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Returning true is fine here, it simply means that we can use this endpoint in CPS. We have a check in CrossProjectModeDecider#resolvesCrossProject that considers the return value of allowsCrossProject iff cross project is enabled for the project with the cluster level setting serverless.cross_project.enabled=true
piergm
piergm approved these changes Nov 19, 2025
View reviewed changes
Copy link
Member

@piergm piergm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for the iterations 👍
@luigidellaquila luigidellaquila merged commit 6b65726 into elastic:main Nov 19, 2025
34 checks passed
@luigidellaquila
Copy link
Contributor Author

luigidellaquila commented Nov 19, 2025

Thanks @piergm @idegtiarenko!
ncordon pushed a commit to ncordon/elasticsearch that referenced this pull request Nov 26, 2025
@luigidellaquila @ncordon
EQL: enable CPS (elastic#137833)
970156e 
Event queries only for now, since PIT is not supported yet
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

:Analytics/EQL EQL querying >enhancement serverless-linked Added by automation, don't add manually Team:Analytics Meta label for analytical engine team (ESQL/Aggs/Geo) v9.3.0

5 participants

@luigidellaquila @elasticsearchmachine @piergm @idegtiarenko @richard-dennehy