Then write a query like FROM foo* | WHERE process.name = "bar". That fails like it should - we don't know what the process.name field is because we don't understand nested. But if you write
FROM foo*
| EVAL s = CASE(process.name RLIKE ".*adfadsfdaf", 1, 0)
| WHERE s == 1
| STATS COUNT(*) BY process.name
that doesn't fail. Or didn't in an example I'm looking at. Neither does this:
FROM foo* | STATS COUNT(*) BY process.name
Now this could have something to do with foo* matching an index with the nested mapping and one without - but I'm not sure.
Elasticsearch Version
8.16
Installed Plugins
No response
Java Version
bundled
OS Version
cloud
Problem Description
ESQL isn't always making an error when referring to a
nested
field.Steps to Reproduce
Make an index with a mapping like:
Then write a query like
FROM foo* | WHERE process.name = "bar"
. That fails like it should - we don't know what theprocess.name
field is because we don't understandnested
. But if you writethat doesn't fail. Or didn't in an example I'm looking at. Neither does this:
Now this could have something to do with
foo*
matching an index with thenested
mapping and one without - but I'm not sure.Logs (if relevant)
No response