Package org.elasticsearch.xpack.esql.datasources

Class DatasetRewriter

java.lang.Object

org.elasticsearch.xpack.esql.datasources.DatasetRewriter

public final class DatasetRewriter
extends Object

Rewrites FROM <dataset> into the same UnresolvedExternalRelation the EXTERNAL command produces, so both paths converge at the existing resolver + analyzer. Runs once on the parsed plan before pre-analysis.

Pattern expansion (wildcards, exclusions, date math, hidden flag) is not done here. It happens in the authorization engine: DatasetResolver dispatches each relation's raw FROM patterns to EsqlResolveDatasetAction, whose body calls resolve(java.lang.String[], java.lang.String[], org.elasticsearch.cluster.metadata.ProjectMetadata, org.elasticsearch.cluster.metadata.IndexNameExpressionResolver) to expand the patterns against the caller's authorized abstractions (wildcard expansion lands where authorization lives, not client-side). resolve(java.lang.String[], java.lang.String[], org.elasticsearch.cluster.metadata.ProjectMetadata, org.elasticsearch.cluster.metadata.IndexNameExpressionResolver) returns, per relation, the authorized concrete dataset names plus whether the relation also targets non-dataset abstractions. rewrite(org.elasticsearch.xpack.esql.plan.logical.LogicalPlan, org.elasticsearch.cluster.metadata.ProjectMetadata, java.util.Map<org.elasticsearch.xpack.esql.plan.logical.UnresolvedRelation, org.elasticsearch.xpack.esql.datasources.DatasetRewriter.DatasetResolution>, boolean)/rewriteOne(org.elasticsearch.xpack.esql.plan.logical.UnresolvedRelation, org.elasticsearch.cluster.metadata.DatasetMetadata, org.elasticsearch.xpack.esql.datasources.metadata.DataSourceMetadata, org.elasticsearch.xpack.esql.datasources.DatasetRewriter.DatasetResolution, boolean) then consume that DatasetRewriter.DatasetResolution to build the plan — they no longer resolve, expand, or gate on authorization.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	DatasetRewriter.DatasetResolution	Per-relation result of resolve(java.lang.String[], java.lang.String[], org.elasticsearch.cluster.metadata.ProjectMetadata, org.elasticsearch.cluster.metadata.IndexNameExpressionResolver): the authorized concrete dataset names the relation targets, the concrete non-dataset names resolved from the same pattern (drives heterogeneous-FROM UnionAll building), and the explicitly-named datasets absent from the authorized set (surfaced by rewriteOne(org.elasticsearch.xpack.esql.plan.logical.UnresolvedRelation, org.elasticsearch.cluster.metadata.DatasetMetadata, org.elasticsearch.xpack.esql.datasources.metadata.DataSourceMetadata, org.elasticsearch.xpack.esql.datasources.DatasetRewriter.DatasetResolution, boolean) as Unknown index).

Field Summary

Fields

Modifier and Type	Field	Description
static final IndicesOptions	RESOLVER_OPTIONS	IndexResolver.DEFAULT_OPTIONS (which carries ALLOW_UNAVAILABLE_TARGETS) plus resolveDatasets(true).

Method Summary

Modifier and Type	Method	Description
static DatasetRewriter.DatasetResolution	resolve(String[] authorizedIndices, String[] rawPatterns, ProjectMetadata projectMetadata, IndexNameExpressionResolver iner)	Per-relation engine-side resolution, run from the EsqlResolveDatasetAction body.
static LogicalPlan	rewrite(LogicalPlan parsed, ProjectMetadata projectMetadata, Map<UnresolvedRelation,DatasetRewriter.DatasetResolution> resolutions, boolean crossProjectEnabled)	Walks parsed and rewrites every UnresolvedRelation that resolved to authorized dataset(s) into UnresolvedExternalRelation (single dataset) or UnionAll of such (multi), using the per-relation DatasetRewriter.DatasetResolution computed engine-side by resolve(java.lang.String[], java.lang.String[], org.elasticsearch.cluster.metadata.ProjectMetadata, org.elasticsearch.cluster.metadata.IndexNameExpressionResolver).
static LogicalPlan	rewriteUnsecured(LogicalPlan parsed, ProjectMetadata projectMetadata, IndexNameExpressionResolver iner)	Convenience entry for an unsecured context (security disabled, or tests): resolves every dataset-candidate relation with the full authorized set and rewrite(org.elasticsearch.xpack.esql.plan.logical.LogicalPlan, org.elasticsearch.cluster.metadata.ProjectMetadata, java.util.Map<org.elasticsearch.xpack.esql.plan.logical.UnresolvedRelation, org.elasticsearch.xpack.esql.datasources.DatasetRewriter.DatasetResolution>, boolean)s — the in-process equivalent of DatasetResolver's dispatch, minus the EsqlResolveDatasetAction round-trip.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

RESOLVER_OPTIONS

public static final IndicesOptions RESOLVER_OPTIONS

IndexResolver.DEFAULT_OPTIONS (which carries ALLOW_UNAVAILABLE_TARGETS) plus resolveDatasets(true). Shared with EsqlResolveDatasetAction.Request, so the security filter silently narrows an unauthorized concrete dataset name to nothing rather than throwing a 403 — a 403 on an explicit name would be an existence oracle ("this dataset exists but you can't read it"). Existence-hiding is completed in rewriteOne(org.elasticsearch.xpack.esql.plan.logical.UnresolvedRelation, org.elasticsearch.cluster.metadata.DatasetMetadata, org.elasticsearch.xpack.esql.datasources.metadata.DataSourceMetadata, org.elasticsearch.xpack.esql.datasources.DatasetRewriter.DatasetResolution, boolean), which surfaces an explicitly-named-but-unauthorized dataset as the same Unknown index (400) a missing index gives — see resolve(java.lang.String[], java.lang.String[], org.elasticsearch.cluster.metadata.ProjectMetadata, org.elasticsearch.cluster.metadata.IndexNameExpressionResolver).

Method Details

resolve

public static DatasetRewriter.DatasetResolution resolve(String[] authorizedIndices,
 String[] rawPatterns,
 ProjectMetadata projectMetadata,
 IndexNameExpressionResolver iner)

Per-relation engine-side resolution, run from the EsqlResolveDatasetAction body. Returns the authorized dataset names, the concrete non-dataset names resolved from the same pattern (used in heterogeneous-FROM UnionAll building), and the explicitly-named-but-unauthorized datasets — which rewriteOne(org.elasticsearch.xpack.esql.plan.logical.UnresolvedRelation, org.elasticsearch.cluster.metadata.DatasetMetadata, org.elasticsearch.xpack.esql.datasources.metadata.DataSourceMetadata, org.elasticsearch.xpack.esql.datasources.DatasetRewriter.DatasetResolution, boolean) surfaces as Unknown index (400), the same error a missing index gives, so an unauthorized dataset can't be told apart from a missing name.

rewriteUnsecured

public static LogicalPlan rewriteUnsecured(LogicalPlan parsed,
 ProjectMetadata projectMetadata,
 IndexNameExpressionResolver iner)

Convenience entry for an unsecured context (security disabled, or tests): resolves every dataset-candidate relation with the full authorized set and rewrite(org.elasticsearch.xpack.esql.plan.logical.LogicalPlan, org.elasticsearch.cluster.metadata.ProjectMetadata, java.util.Map<org.elasticsearch.xpack.esql.plan.logical.UnresolvedRelation, org.elasticsearch.xpack.esql.datasources.DatasetRewriter.DatasetResolution>, boolean)s — the in-process equivalent of DatasetResolver's dispatch, minus the EsqlResolveDatasetAction round-trip. null or dataset-free project is a no-op.

rewrite

public static LogicalPlan rewrite(LogicalPlan parsed,
 ProjectMetadata projectMetadata,
 Map<UnresolvedRelation,DatasetRewriter.DatasetResolution> resolutions,
 boolean crossProjectEnabled)

Walks parsed and rewrites every UnresolvedRelation that resolved to authorized dataset(s) into UnresolvedExternalRelation (single dataset) or UnionAll of such (multi), using the per-relation DatasetRewriter.DatasetResolution computed engine-side by resolve(java.lang.String[], java.lang.String[], org.elasticsearch.cluster.metadata.ProjectMetadata, org.elasticsearch.cluster.metadata.IndexNameExpressionResolver). All other relations are left untouched. The projectMetadata == null / no-datasets-registered short-circuits avoid touching the common path.

Throws VerificationException for: non-STANDARD IndexMode on a dataset, or UnionAll branch-cap exceeded. Designed to run once on the parsed plan before pre-analysis (so the analyzer sees a uniform UnresolvedExternalRelation tree regardless of whether the user wrote FROM <dataset> or inline EXTERNAL).

Parameters:

resolutions - per-relation resolution keyed by relation identity (see DatasetResolver). A relation absent from the map (e.g. remote-prefixed, or no pattern could match a dataset name) is left unchanged.

crossProjectEnabled - whether cross-project search (CPS) is active; when true, a wildcard that matched a dataset is kept alongside the dataset so the remote (linked-project) half still resolves — see rewriteOne(org.elasticsearch.xpack.esql.plan.logical.UnresolvedRelation, org.elasticsearch.cluster.metadata.DatasetMetadata, org.elasticsearch.xpack.esql.datasources.metadata.DataSourceMetadata, org.elasticsearch.xpack.esql.datasources.DatasetRewriter.DatasetResolution, boolean).