Merge with upstream, warn if query doesn't include METADATA which DSL adds by default - might be users are looking for by default.

Author: mashhurs

lib/logstash/inputs/elasticsearch.rb

@@ -366,15 +366,16 @@ def register
   def run(output_queue)
     if @schedule
       scheduler.cron(@schedule, :overlap => @schedule_overlap) do
-        @query_executor.do_run(output_queue, get_query_object())
+        @query_executor.do_run(output_queue, get_query_object)
       end
       scheduler.join
     else
-      @query_executor.do_run(output_queue, get_query_object())
+      @query_executor.do_run(output_queue, get_query_object)
     end
   end
 
   def get_query_object
+    return @query if @response_type == 'esql'
     if @cursor_tracker
       query = @cursor_tracker.inject_cursor(@query)
       @logger.debug("new query is #{query}")

lib/logstash/inputs/elasticsearch/esql.rb

@@ -17,14 +17,18 @@ def initialize(client, plugin)
           @plugin = plugin
           @retries = @plugin_params["retries"]
           @query = @plugin_params["query"]
+          unless @query.include?('METADATA')
+            logger.warn("The query doesn't have METADATA keyword. Including it makes _id and _version available in the documents", {:query => @query})
+          end
         end
 
         # Execute the ESQL query and process results
         # @param output_queue [Queue] The queue to push processed events to
-        def do_run(output_queue)
+        # @param query A query to be executed
+        def do_run(output_queue, query)
           logger.info("ES|QL executor starting")
           response = retryable(ESQL_JOB) do
-            @client.esql.query({ body: { query: @query }, format: 'json' })
+            @client.esql.query({ body: { query: query }, format: 'json' })
           end
           # retriable already printed error details
           return if response == false