Package org.elasticsearch.xpack.esql.expression.function.scalar.string

Class FieldExtract

java.lang.Object

org.elasticsearch.xpack.esql.core.tree.Node<Expression>

org.elasticsearch.xpack.esql.core.expression.Expression

org.elasticsearch.xpack.esql.core.expression.function.Function

org.elasticsearch.xpack.esql.core.expression.function.scalar.ScalarFunction

org.elasticsearch.xpack.esql.expression.function.scalar.EsqlScalarFunction

org.elasticsearch.xpack.esql.expression.function.scalar.string.FieldExtract

All Implemented Interfaces:

NamedWriteable, Writeable, Resolvable, EvaluatorMapper, BlockLoaderExpression

public class FieldExtract
extends EsqlScalarFunction
implements BlockLoaderExpression

Extracts a single sub-field from a flattened field root as keyword.

The second argument is the literal name of a flattened sub-field, that is, exactly the dotted key as it is stored in doc values for the flattened root (for example "host.name").

When the path is a foldable literal key on a real flattened FieldAttribute, the call is fused into the field load via BlockLoaderExpression. The keyed sub-field's doc values are read directly instead of materializing the whole flattened JSON and re-parsing it per row. The path is the flat sub-field name as is (no parsing), so any path that passes verifier-time validation is eligible for pushdown.

Nested Class Summary

Nested classes/interfaces inherited from class org.elasticsearch.xpack.esql.core.expression.Expression

Expression.TypeResolution

Nested classes/interfaces inherited from class org.elasticsearch.xpack.esql.core.tree.Node

Node.NodeStringFormat

Nested classes/interfaces inherited from interface org.elasticsearch.xpack.esql.expression.function.blockloader.BlockLoaderExpression

BlockLoaderExpression.PushedBlockLoaderExpression

Nested classes/interfaces inherited from interface org.elasticsearch.xpack.esql.evaluator.mapper.EvaluatorMapper

EvaluatorMapper.ToEvaluator

Nested classes/interfaces inherited from interface org.elasticsearch.common.io.stream.Writeable

Writeable.Reader<V>, Writeable.Writer<V>

Field Summary

Fields

Modifier and Type	Field	Description
static final FunctionDefinition	DEFINITION
static final NamedWriteableRegistry.Entry	ENTRY

Fields inherited from class org.elasticsearch.xpack.esql.core.expression.function.scalar.ScalarFunction

MAX_BYTES_REF_RESULT_SIZE

Fields inherited from class org.elasticsearch.xpack.esql.core.tree.Node

TO_STRING_MAX_LINES, TO_STRING_MAX_WIDTH

Constructor Summary

Constructors

Constructor	Description
FieldExtract(Source source, Expression field, Expression path)

Method Summary

Modifier and Type	Method	Description
DataType	dataType()	The DataType returned by executing the tree rooted at this expression.
boolean	foldable()	Whether the expression can be evaluated statically, aka "folded", or not.
String	getWriteableName()
protected NodeInfo<? extends Expression>	info()	Normally, you want to use one of the static create methods to implement this.
static boolean	isFnFieldExtractCapabilityMet()	Whether field_extract is part of the active function set for this build, matching the fn_field_extract entry emitted by EsqlFunctionRegistry.addCapabilities(org.elasticsearch.xpack.esql.action.EsqlCapabilities.Builder).
static void	process(BytesRefBlock.Builder builder, org.apache.lucene.util.BytesRef flattenedJson, org.apache.lucene.util.BytesRef path)
Expression	replaceChildren(List<Expression> newChildren)
protected Expression.TypeResolution	resolveType()	The implementation of Expression.typeResolved(), which is just a caching wrapper around this method.
ExpressionEvaluator.Factory	toEvaluator(EvaluatorMapper.ToEvaluator toEvaluator)	Convert this into an ExpressionEvaluator.
Optional<String>	tryAsKeyedSubfieldName(LucenePushdownPredicates pushdownPredicates)	If this field_extract can be pushed to a Lucene query against the keyed sub-field, returns the synthetic data-node field name (e.g.
BlockLoaderExpression.PushedBlockLoaderExpression	tryPushToFieldLoading(SearchStats stats)	The field and loading configuration that replaces this expression, effectively "fusing" the expression into the load.
void	writeTo(StreamOutput out)

Methods inherited from class org.elasticsearch.xpack.esql.expression.function.scalar.EsqlScalarFunction

fold

Methods inherited from class org.elasticsearch.xpack.esql.core.expression.function.Function

arguments, equals, functionName, hashCode, nodeString, nullable

Methods inherited from class org.elasticsearch.xpack.esql.core.expression.Expression

canonical, canonicalize, childrenResolved, propertiesToString, references, resolved, semanticEquals, semanticHash, toString, toString, typeResolved

Methods inherited from class org.elasticsearch.xpack.esql.core.tree.Node

allMatch, anyMatch, children, collect, collect, collect, collectFirstChildren, collectLeaves, doCollectFirst, forEachDown, forEachDown, forEachDownMayReturnEarly, forEachProperty, forEachPropertyDown, forEachPropertyOnly, forEachPropertyUp, forEachUp, forEachUp, nodeName, nodeProperties, nodeString, replaceChildrenSameSize, source, sourceLocation, sourceText, toString, transformChildren, transformChildren, transformDown, transformDown, transformDown, transformDown, transformDownSkipBranch, transformNodeProps, transformPropertiesDown, transformPropertiesOnly, transformPropertiesUp, transformUp, transformUp, transformUp

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface org.elasticsearch.xpack.esql.evaluator.mapper.EvaluatorMapper

fold

Field Details

ENTRY

public static final NamedWriteableRegistry.Entry ENTRY

DEFINITION

public static final FunctionDefinition DEFINITION

Constructor Details

FieldExtract

public FieldExtract(Source source,
 Expression field,
 Expression path)

Method Details

writeTo

public void writeTo(StreamOutput out)
             throws IOException

Specified by:

writeTo in interface Writeable

Throws:

IOException

getWriteableName

public String getWriteableName()

Specified by:

getWriteableName in interface NamedWriteable

dataType

public DataType dataType()

Description copied from class: Expression

The DataType returned by executing the tree rooted at this expression. If Expression.typeResolved() returns an error then the behavior of this method is undefined. It may return a valid type. Or it may throw an exception. Or it may return a totally nonsensical type.

Specified by:

dataType in class Expression

resolveType

protected Expression.TypeResolution resolveType()

Description copied from class: Expression

The implementation of Expression.typeResolved(), which is just a caching wrapper around this method. See it's javadoc for what this method should return.

Implementations will rarely interact with the Expression.TypeResolution class directly, instead usually calling the utility methods on TypeResolutions.

Implementations should fail if Expression.childrenResolved() returns false.

Overrides:

resolveType in class Expression

foldable

public boolean foldable()

Description copied from class: Expression

Whether the expression can be evaluated statically, aka "folded", or not.

Overrides:

foldable in class Expression

process

public static void process(BytesRefBlock.Builder builder,
 org.apache.lucene.util.BytesRef flattenedJson,
 org.apache.lucene.util.BytesRef path)

replaceChildren

public Expression replaceChildren(List<Expression> newChildren)

Specified by:

replaceChildren in class Node<Expression>

info

protected NodeInfo<? extends Expression> info()

Description copied from class: Node

Normally, you want to use one of the static create methods to implement this.

For QueryPlans, it is very important that the properties contain all of the expressions and references relevant to this node, and that all the properties are used in the provided constructor; otherwise query plan transformations like QueryPlan#transformExpressionsOnly(Function) will not have an effect.

Specified by:

info in class Node<Expression>

toEvaluator

public ExpressionEvaluator.Factory toEvaluator(EvaluatorMapper.ToEvaluator toEvaluator)

Description copied from interface: EvaluatorMapper

Convert this into an ExpressionEvaluator.

Note for implementors: If you are implementing this function, you should call the passed-in lambda on your children, after doing any other manipulation (casting, etc.) necessary.

Note for Callers: If you are attempting to call this method, and you have an Expression and a Layout, you likely want to call EvalMapper.toEvaluator(org.elasticsearch.xpack.esql.core.expression.FoldContext, org.elasticsearch.xpack.esql.core.expression.Expression, org.elasticsearch.xpack.esql.planner.Layout) instead. On the other hand, if you already have something that looks like the parameter for this method, you should call this method with that function.

Build an ExpressionEvaluator.Factory for the tree of expressions rooted at this node. This is only guaranteed to return a sensible evaluator if this node has a valid type. If this node is a subclass of Expression then "valid type" means that Expression.typeResolved() returns a non-error resolution. If Expression.typeResolved() returns an error then this method may throw. Or return an evaluator that produces garbage. Or return an evaluator that throws when run.

Specified by:

toEvaluator in interface EvaluatorMapper

isFnFieldExtractCapabilityMet

public static boolean isFnFieldExtractCapabilityMet()

Whether field_extract is part of the active function set for this build, matching the fn_field_extract entry emitted by EsqlFunctionRegistry.addCapabilities(org.elasticsearch.xpack.esql.action.EsqlCapabilities.Builder). Block-loader fusion and Lucene query pushdown use the same gate so they stay aligned with function registration (snapshot-only until the function is promoted to the main registry).

tryPushToFieldLoading

public BlockLoaderExpression.PushedBlockLoaderExpression tryPushToFieldLoading(SearchStats stats)

Description copied from interface: BlockLoaderExpression

The field and loading configuration that replaces this expression, effectively "fusing" the expression into the load. Or null if the fusion isn't possible.

SearchStats.supportsLoaderConfig(org.elasticsearch.xpack.esql.core.expression.FieldAttribute.FieldName, org.elasticsearch.index.mapper.blockloader.BlockLoaderFunctionConfig, org.elasticsearch.index.mapper.MappedFieldType.FieldExtractPreference) checks that the configuration is supported by all field mappers. Callers to this method must call that to confirm that configurations returned are supported. Implementations of this method do not need to call it, though they may use methods like SearchStats.hasDocValues(org.elasticsearch.xpack.esql.core.expression.FieldAttribute.FieldName) and SearchStats.isIndexed(org.elasticsearch.xpack.esql.core.expression.FieldAttribute.FieldName) as preflight checks. They should use those methods if it is expensive to build the BlockLoaderFunctionConfig.

Specified by:

tryPushToFieldLoading in interface BlockLoaderExpression

tryAsKeyedSubfieldName

public Optional<String> tryAsKeyedSubfieldName(LucenePushdownPredicates pushdownPredicates)

If this field_extract can be pushed to a Lucene query against the keyed sub-field, returns the synthetic data-node field name (e.g. "resource.attributes.host.name"). The data node's FieldTypeLookup resolves this name to a KeyedFlattenedFieldType which handles the key-prefix encoding in indexedValueForSearch. The caller is responsible for wrapping the produced query in a SingleValueQuery to preserve ES|QL's single-value comparison semantics.

Explicitly mapped sub-fields are not pushed: for them the synthetic name resolves to the real typed field (e.g. an ip or long), so a pushed query would apply that field's typed comparison semantics while the per-row evaluator compares the extracted value as a keyword. Keeping mapped sub-fields on the evaluator path makes field_extract's result independent of whether the optimizer pushed the call. That rejection is delegated to the flattened field type's MappedFieldType.supportsBlockLoaderConfig(org.elasticsearch.index.mapper.blockloader.BlockLoaderFunctionConfig, org.elasticsearch.index.mapper.MappedFieldType.FieldExtractPreference), the same hook that gates block-loader fusion, so both pushdown paths agree on which keys are pushable. The mapped/unmapped decision needs the data-node mapping, so the stats-less can_match predicates report no loader config as supported and push nothing.