ESQL: fix FROM *_logs index name validation#149395
Conversation
Patterns like *_logs were rejected with "Invalid index name [_logs], must not start with '_', '-', or '+'". The parser strips wildcards and validates the remainder as a literal index name, but the "must not start with" rule only restricts literal names; it does not restrict patterns whose wildcard can match any prefix. Track whether the current pattern contained a wildcard, and skip the "must not start with" check in that case. Other validations (forbidden characters, length, dot-only) still apply. Closes elastic#146073
GalLalouche
added
>bug
Team:Analytics
|
Hi @GalLalouche, I've created a changelog YAML for you. |
🔍 Preview links for changed docs⏳ Building and deploying preview... View progress This comment will be updated with preview links when the build is complete. |
ℹ️ Important: Docs version tagging👋 Thanks for updating the docs! Just a friendly reminder that our docs are now cumulative. This means all 9.x versions are documented on the same page and published off of the main branch, instead of creating separate pages for each minor version. We use applies_to tags to mark version-specific features and changes. Expand for a quick overviewWhen to use applies_to tags:✅ At the page level to indicate which products/deployments the content applies to (mandatory) What NOT to do:❌ Don't remove or replace information that applies to an older version 🤔 Need help?
|
GalLalouche
force-pushed
the
fix/star_underscore
branch
from
316fba7 to
dddf656
Compare
The previous commit relaxed the "must not start with '_', '-', or '+'" check for any pattern containing a wildcard. That accepted sterile patterns like "_logs*" and "_*log" too: real indices can't start with those characters, so such patterns can never match. Tighten the relaxation to only patterns whose first character is '*' (the wildcard absorbs any legal prefix). Patterns that start with a reserved character literally are still rejected. Update the tests to pin down the boundary: "*_logs", "*+logs", "**_logs", "foo*_logs", "cluster:*_logs" still pass; "_logs*", "_*log", "+logs*" now fail with the original error.
GalLalouche
force-pushed
the
fix/star_underscore
branch
from
dddf656 to
b10df27
Compare
| } | ||
|
|
||
| String lineNumber = command.equals("FROM") ? "line 1:6: " : "line 1:4: "; | ||
| expectError(command + " _logs*", lineNumber + "Invalid index name [_logs], must not start with '_', '-', or '+'"); |
There was a problem hiding this comment.
These error messages are a bit confusing (since the user typed _*log, not _log), but it's an artifact of how we validate the patterns (we strip the * and then validate the underlying pattern), and I didn't want to change that in this PR.
|
Pinging @elastic/es-analytical-engine (Team:Analytics) |
GalLalouche
added
auto-backport
3 participants
Patterns like
*_logswere rejected with"Invalid index name [_logs], must not start with '_', '-', or '+'". The parser strips wildcards and validates the remainder as a literal index name, but the "must not start with" rule only restricts literal names; it does not restrict patterns whose wildcard can match any prefix.Closes #146073