ES|QL query with double-quote character (" ")

[MihaelaIorda]

Elastic.Clients.Elasticsearch version: 8.15.10

Elasticsearch version: 8.13

.NET runtime version: .net 6

Operating system version: Windows 11. .net app runs in constainer on Linux subsistem.

Description of the problem including expected versus actual behavior:

I want to run a simple ES|QL query that retrieves documents where message field containes word "exception". The executed query is: string query = "FROM index | WHERE message LIKE \"exception\" | KEEP @timestamp, message | SORT @timestamp DESC | LIMIT 3 "

Even if not visible, in string above exception is surrounded by escape character \, like in image below:

I tried 2 methods to execute the query:

var response = await client.Esql.QueryAsync(r => r .Query(query) .Format(Elastic.Clients.Elasticsearch.Esql.EsqlFormat.Csv) ); var responseQ = await client.Esql.QueryAsObjectsAsync(x => x.Query(query));

Call fails with a Timeout exception.

NOTE: I tried various ways to build the string for ES|QL query with no successful result, such as these: query = $"FROM recipients- | WHERE message LIKE " + Convert.ToChar(34) + "Exception" + Convert.ToChar(34) + " | SORT @timestamp DESC | LIMIT 5 "; query = @"FROM recipients- | WHERE message LIKE ""Exception"" | SORT @timestamp DESC | LIMIT 5 ";

ES|QL queries with WHERE clause that do not contain double-quote character, such as this string "FROM index | WHERE fields.Elapsed > 500 | KEEP @timestamp, message | SORT @timestamp DESC | LIMIT 5 " would execute ok and retrieve data.

Steps to reproduce:

1. instantiate client using Authentication with BasicAuthentication.
2. execute ES|QL query that constains double-quote character

Expected behavior retrieve data

Provide ConnectionSettings (if relevant):

Provide DebugInformation (if relevant): Exception: The request was canceled due to the configured HttpClient.Timeout of 60 seconds elapsing.

Audit trail of this API call:

• [1] BadRequest: Node: https://elastic. Took: 00:01:00.1480361
• [2] MaxTimeoutReached:

  OriginalException: System.Threading.Tasks.TaskCanceledException: The request was canceled due to the configured HttpClient.Timeout of 60 seconds elapsing.

  ---> System.TimeoutException: The operation was canceled. ---> System.Threading.Tasks.TaskCanceledException: The operation was canceled. ---> System.IO.IOException: Unable to read data from the transport connection: Operation canceled. ---> System.Net.Sockets.SocketException (125): Operation canceled --- End of inner exception stack trace --- at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken) at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token) at System.Net.Security.SslStream.EnsureFullTlsFrameAsync[TIOAdapter](TIOAdapter adapter) at System.Net.Security.SslStream.ReadAsyncInternal[TIOAdapter](TIOAdapter adapter, Memory`1 buffer) at System.Net.Http.HttpConnection.InitialFillAsync(Boolean async) at System.Net.Http.HttpConnection.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) --- End of inner exception stack trace --- at System.Net.Http.HttpConnection.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken) at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpClient.g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken) --- End of inner exception stack trace --- --- End of inner exception stack trace --- at System.Net.Http.HttpClient.HandleFailure(Exception e, Boolean telemetryStarted, HttpResponseMessage response, CancellationTokenSource cts, CancellationToken cancellationToken, CancellationTokenSource pendingRequestsCts) at System.Net.Http.HttpClient.g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken) at Elastic.Transport.HttpRequestInvoker.RequestCoreAsync[TResponse](Boolean isAsync, RequestData requestData, CancellationToken cancellationToken)

  Request:

  <Request stream not captured or already read to completion by serializer. Set DisableDirectStreaming() on TransportConfiguration to force it to be set on the response.>

  Response:

  <Response stream not captured or already read to completion by serializer. Set DisableDirectStreaming() on TransportConfiguration to force it to be set on the response.>

[flobernd]

Hi @MihaelaIorda,

this looks like a server bug. The client only serializes the given string to JSON and fires the request. There is no logic involved at all.

I was not able to reproduce the issue when connecting to a 8.15.2 server. Do you have the chance to test this with a ES server version greater than 8.13 (potentially using the start-local script)?

[github-actions[bot]]

This issue is stale because it has been open 5 days with no activity. Remove stale label or comment or this will be closed in 2 days.

[github-actions[bot]]

This issue was closed because it has been stalled for 2 days with no activity.