Package org.elasticsearch.xpack.esql.core.anonymizer

Class AnonymizationContext

java.lang.Object
org.elasticsearch.xpack.esql.core.anonymizer.AnonymizationContext
public final class AnonymizationContext extends Object
Per-query-submission state carried through a single anonymize() traversal of a plan tree. Holds the HMAC key (derived from the cluster identifier) plus the token maps that intern each identifier and literal so a given input maps to the same token across every appearance in the tree.

Two scopes of stability:

  • Column, index, enrich and lookup names get a per-cluster-stable token via HMAC-SHA256(cluster_uuid, name). Same name on the same cluster yields the same token across queries — useful for cross-incident field-usage telemetry. Disjoint across clusters by construction.
  • Literals get a per-submission interning id so identity within one query is preserved (the two 5s in f == 5 AND bar == 5 share a token) but the same 5 gets a fresh token in the next query.
A fresh context is constructed per query submission via forSubmission(String); reusing one across submissions would leak literal identity across queries. Used entirely within a single thread, so its plain HashMap state needs no synchronization.

  • Method Details

    • forSubmission

      public static AnonymizationContext forSubmission(String clusterUuid)
      One context per query submission so literal tokens don't carry across queries.

    • mapper

      public NodeStringMapper mapper()
      Returns the NodeStringMapper view backed by this context's state. The mapper is a function — pass it to nodeString / toString. The context holds the lifecycle; the mapper exposes the pure-function surface call sites consume.