module Elasticsearch::Helpers::ESQLHelper

Elasticsearch Client Helper for the ES|QL API

@see www.elastic.co/guide/en/elasticsearch/reference/current/esql-query-api.html

Public Class Methods

query(client, query, params = {}, parser: {}) click to toggle source

Query helper for ES|QL

By default, the ‘esql.query` API returns a Hash response with the following keys:

  • ‘columns` with the value being an Array of `{ name: type }` Hashes for each column.

  • ‘values` with the value being an Array of Arrays with the values for each row.

This helper function returns an Array of hashes with the columns as keys and the respective values: ‘{ column => value }`.

@param client [Elasticsearch::Client] an instance of the Client to use for the query. @param query [Hash, String] The query to be passed to the ES|QL query API. @param params [Hash] options to pass to the ES|QL query API. @param parser [Hash] Hash of column name keys and Proc values to transform the value of

a given column.

@example Using the ES|QL helper

require 'elasticsearch/helpers/esql_helper'
query = <<~ESQL
          FROM sample_data
          | EVAL duration_ms = ROUND(event.duration / 1000000.0, 1)
        ESQL
response = Elasticsearch::Helpers::ESQLHelper.query(client, query)

@example Using the ES|QL helper with a parser

response = Elasticsearch::Helpers::ESQLHelper.query(
             client,
             query,
             parser: { '@timestamp' => Proc.new { |t| DateTime.parse(t) } }
           )

@see www.elastic.co/guide/en/elasticsearch/client/ruby-api/current/Helpers.html#_esql_helper

# File lib/elasticsearch/helpers/esql_helper.rb, line 58
def self.query(client, query, params = {}, parser: {})
  response = client.esql.query({ body: { query: query }, format: 'json' }.merge(params))

  columns = response['columns']
  response['values'].map do |value|
    (value.length - 1).downto(0).map do |index|
      key = columns[index]['name']
      value[index] = parser[key].call(value[index]) if value[index] && parser[key]
      { key => value[index] }
    end.reduce({}, :merge)
  end
end