Access All Ingested Data in ES|QL for Flexible Analysis (GA)
- Dominant language
- No language data
- Stars
- 6
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
## Value Proposition
Break free from rigid schema constraints and access every piece of data you've ingested — mapped or not — directly within ES|QL queries. This eliminates the "ignorance cliff" by ensuring that all fields are queryable, providing flexibility for ad-hoc exploration, threat hunting, and troubleshooting across diverse and evolving datasets without costly reindexing.
## Expected Outcome
Access to unmapped fields in ES|QL shipped in Tech Preview in Elasticsearch 9.4, with two modes: NULLIFY (return nulls for missing fields) and LOAD (fetch values from _source at query time).
For GA, we are hardening both modes for production use:
- **Full-text search compatibility:** LOAD mode works alongside MATCH and other full-text functions on mapped fields
- **Branching command support:** LOAD works correctly with subqueries, views, and FORK
- **Performance validation:** nightly benchmarks and heap-safety testing to ensure LOAD scales gracefully and circuit-breaks correctly under adversarial workloads
- **Backward compatibility:** version-gated autocasting behavior for safe mixed-version cluster upgrades
- **Correctness:** resolved interactions with LOOKUP JOIN, partially unmapped fields, and type conflicts across indices
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.