[SavedObjects] use ComposerQuery for esql pipeline option#270628
Open
rudolf wants to merge 3 commits into
Open
[SavedObjects] use ComposerQuery for esql pipeline option#270628rudolf wants to merge 3 commits into
rudolf wants to merge 3 commits into
Conversation
Replace the raw `pipeline: string` API on `SavedObjectsEsqlOptions` with
`pipeline: ComposerQuery` from `@elastic/esql`. Template holes (`${{ name: value }}`)
are promoted to ES|QL named parameters forwarded at the protocol level, eliminating
the injection risk of string interpolation.
- Remove `SOURCE_COMMAND_PATTERN` guard (type system enforces it now)
- Call `.toRequest()` to extract the pipeline string and params
- Merge ComposerQuery params with any explicitly provided `params`
- Update example routes and integration tests to use the `esql` tag
Co-authored-by: Cursor <cursoragent@cursor.com>
6f2330f to
6edf70b
Compare
Contributor
|
@rudolf I believe the changes to the ES Lint were not pushed ? |
…peline Restores the runtime check that rejects pipelines starting with FROM, ROW, SHOW, METRICS, or TS. The check now runs against toRequest().query rather than the raw string, since pipeline is now always a ComposerQuery. Without this a developer writing esql`FROM .kibana | LIMIT 10` would get an opaque ES|QL syntax error from Elasticsearch instead of a clear message. Co-authored-by: Cursor <cursoragent@cursor.com>
d5bd87a to
7cbeab1
Compare
Contributor
💔 Build Failed
Failed CI StepsMetrics [docs]
History
|
stratoula
reviewed
May 27, 2026
Contributor
stratoula
left a comment
There was a problem hiding this comment.
We should not do the change in the esql pipeline, is there a reason you did that?
| steps: | ||
| - command: .buildkite/scripts/steps/esql_generate_function_metadata.sh | ||
| label: Generate Function Metadata | ||
| - command: .buildkite/scripts/steps/esql_grammar_sync.sh |
Contributor
There was a problem hiding this comment.
Why did you change this? esql_grammar_sync.sh doesnt exist at the repo anymore, it is at the esql-js one
TamerlanG
approved these changes
May 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the raw
pipeline: stringoption onSavedObjectsEsqlOptionswithpipeline: ComposerQueryfrom@elastic/esql.Developers now use the
esqltagged template to build pipelines:Template holes (
${{ name: value }}) are promoted to ES|QL named parameters — values are forwarded to Elasticsearch at the protocol level and never appear in the query string, eliminating the injection risk of string interpolation.Changes
@kbn/core-saved-objects-api-serverSavedObjectsEsqlOptions.pipelinechanged fromstringtoComposerQuery@elastic/esqlimport in theparamsexample (params are now extracted automatically from the template)@kbn/core-saved-objects-api-server-internalSOURCE_COMMAND_PATTERNguard (the type system now prevents raw strings; theesqltag's parser handles source-command detection)performEsqlcalls.toRequest()unconditionally to extract the pipeline string and named paramsparamsbefore the request@kbn/eslint-plugin-esqlno_invalid_esql_templaterule gains apipelinePropertyNamesoption (default:['pipeline'])esqltemplate is used as the value of apipeline:property, the missing-FROM warning is suppressed — the FROM clause is supplied by the calleeConsumers updated
examples/saved_objects/server/esql_example_routes.tssrc/core/server/integration_tests/saved_objects/service/lib/esql.test.tsdev_docs/tutorials/saved_objects_esql.mdxTest plan
node scripts/jest src/core/packages/saved-objects/api-server-internal/src/lib/apis/esql.test.ts(24 tests)node scripts/jest packages/kbn-eslint-plugin-esql(36 tests)node scripts/type_check --project src/core/packages/saved-objects/api-server-internal/tsconfig.jsonnode scripts/jest_integration src/core/server/integration_tests/saved_objects/service/lib/esql.test.tsMade with Cursor