elasticsearch/docs/reference/esql/metadata-fields.asciidoc

[[esql-metadata-fields]]
=== {esql} metadata fields

++++
<titleabbrev>Metadata fields</titleabbrev>
++++

{esql} can access <<mapping-fields, metadata fields>>. The currently
supported ones are:

  * <<mapping-index-field,`_index`>>: the index to which the document belongs.
  The field is of the type <<keyword, keyword>>.

  * <<mapping-id-field,`_id`>>: the source document's ID. The field is of the
  type <<keyword, keyword>>.

  * `_version`: the source document's version. The field is of the type
  <<number,long>>.

  * <<mapping-ignored-field,`_ignored`>>: the ignored source document fields. The field is of the type
  <<keyword,keyword>>.

To enable the access to these fields, the <<esql-from,`FROM`>> source command needs
to be provided with a dedicated directive:

[source,esql]
----
FROM index METADATA _index, _id
----

Metadata fields are only available if the source of the data is an index.
Consequently, `FROM` is the only source commands that supports the `METADATA`
directive.

Once enabled, these fields will be available to subsequent processing commands, just
like other index fields:

[source.merge.styled,esql]
----
include::{esql-specs}/metadata.csv-spec[tag=multipleIndices]
----
[%header.monospaced.styled,format=dsv,separator=|]
|===
include::{esql-specs}/metadata.csv-spec[tag=multipleIndices-result]
|===

Similar to index fields, once an aggregation is performed, a
metadata field will no longer be accessible to subsequent commands, unless
used as a grouping field:

[source.merge.styled,esql]
----
include::{esql-specs}/metadata.csv-spec[tag=metaIndexInAggs]
----
[%header.monospaced.styled,format=dsv,separator=|]
|===
include::{esql-specs}/metadata.csv-spec[tag=metaIndexInAggs-result]
|===