search

elastic / elasticsearch

Free and Open Source, Distributed, RESTful Search Engine
https://www.elastic.co/products/elasticsearch
Other
1.12k stars 24.83k forks source link

ESQL: add support for partial results #111518

Open bpintea opened 3 months ago

bpintea commented 3 months ago

Description

Allow a query to not fail on a shard failure. Similar to _search'es allow_partial_search_results.

elasticsearchmachine commented 3 months ago

Pinging @elastic/es-analytical-engine (Team:Analytics)

bpintea commented 3 months ago

Related: https://github.com/elastic/elasticsearch/issues/103081

getkub commented 3 months ago

Please note, this will be Sev1 or Sev2 incident for large Enterprise customers; as the SIEM rules/Analytics run using ESQL will entirely fail even if there is a small shard failure or during underlying host upgrades. allow_partial_search_results should be default behaviour in our view.