elastic / elastic/roadmap

Access All Ingested Data in ES|QL for Flexible Analysis (GA)

Open
#304 0 comments 0 reactions 1 assignee Claimed by @tylerperk View on GitHub
Component: Elasticsearch product-area:platform
Dominant language
No language data
Stars
6
Forks
1
PR merge metrics
No merged PRs in 30d

Description

## Value Proposition

Break free from rigid schema constraints and access every piece of data you've ingested — mapped or not — directly within ES|QL queries. This eliminates the "ignorance cliff" by ensuring that all fields are queryable, providing flexibility for ad-hoc exploration, threat hunting, and troubleshooting across diverse and evolving datasets without costly reindexing.

## Expected Outcome

Access to unmapped fields in ES|QL shipped in Tech Preview in Elasticsearch 9.4, with two modes: NULLIFY (return nulls for missing fields) and LOAD (fetch values from _source at query time).

For GA, we are hardening both modes for production use:

- **Full-text search compatibility:** LOAD mode works alongside MATCH and other full-text functions on mapped fields
- **Branching command support:** LOAD works correctly with subqueries, views, and FORK
- **Performance validation:** nightly benchmarks and heap-safety testing to ensure LOAD scales gracefully and circuit-breaks correctly under adversarial workloads
- **Backward compatibility:** version-gated autocasting behavior for safe mixed-version cluster upgrades
- **Correctness:** resolved interactions with LOOKUP JOIN, partially unmapped fields, and type conflicts across indices

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.