Skip to content

ESQL: MATCH, MATCH_PHRASE allowed past LOOKUP JOIN (and fails uncontrolled) #129778

@bpintea

Description

@bpintea

Description

The following query fails with an assertion[*], instead of a verification error:

FROM sample_data | LOOKUP JOIN sample__data_ts_nanos_lookup ON client_ip | WHERE message : "Disconnected" 

Here's a second example, to make the field ownership clearer (i.e. belonging to the lookup index):

FROM employees | EVAL language_code = languages | LOOKUP JOIN languages_lookup ON language_code | WHERE language_name : "French" | KEEP emp_no, language_code, language_name, first_name 

The verification works for KQL, QSTR, however, the error message should be improved: [QSTR] function cannot be used after LOOKUP (there's a splitting of node's name and only picking the first token).

Only tried main, 8.19 is probably affected too.

[*] Assertion failure:

[2025-07-03T16:11:34,186][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [runTask-0] fatal error in thread [elasticsearch[runTask-0][esql_worker][T#5]], exiting java.lang.AssertionError: LuceneQueryExpressionEvaluato r expects DocBlock as input at org.elasticsearch.compute.lucene.LuceneQueryEvaluator.executeQuery(LuceneQueryEvaluator.java:66) at org.elasticsearch.compute.lucene.LuceneQueryExpressionEvaluator.eval(LuceneQueryExpressionEvaluator.java:39) at org.elasticsearch.compute.operator.FilterOperator.process(FilterOperator.java:43) at org.elasticsearch.compute.operator.AbstractPageMappingOperator.getOutput(AbstractPageMappingOperator.java:85) at org.elasticsearch.compute.operator.Driver.runSingleLoopIteration(Driver.java:265) at org.elasticsearch.compute.operator.Driver.run(Driver.java:185) at org.elasticsearch.compute.operator.Driver$1.doRun(Driver.java:406) at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27) at org.elasticsearch.compute.operator.DriverScheduler$1.doRun(DriverScheduler.java:57) at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27) at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:35) at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1044) at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) at java.base/java.lang.Thread.run(Thread.java:1575) 

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions