[ES|QL] Improve FieldNameUtils.resolveFieldNames to identify subquery field names for field caps call, instead of using all fields `*`

[fang-xing-esql]

This is a follow up to #135744.

The detailed information related to this issue can be found here.

[elasticsearchmachine]

Pinging @elastic/es-analytical-engine (Team:Analytics)

[kanoshiou]

Hi @fang-xing-esql, I'd be happy to help resolve this issue!

[kanoshiou]

I believe I've completed the code that resolves this issue and I'm currently running the tests locally. The CSV tests are all passing, but I'm seeing failures in FieldNameUtilsTests.

I'm not sure if this is a bug. In the test FieldNameUtilsTests.testForkBranchWithKeep:

FROM languages
| FORK ( WHERE language_name == "English" | KEEP language_name, language_code )
       ( WHERE language_name != "English" )
| SORT _fork, language_name

Based on my understanding of FORK, since the second branch returns all fields from languages, shouldn't we include all fields in the field-caps call?

Additionally, the following tests are failing too:

• testFuseWithStats
• testForkBeforeStats
• testForkBeforeStatsWithWhere
• testForkFieldsWithStatsInOneBranch
• testForkFieldsWithEnrichAndLookupJoins

[idegtiarenko]

Based on my understanding of FORK, since the second branch returns all fields from languages, shouldn't we include all fields in the field-caps call?

I believe you are correct, we should request all fields in such cases.

[fang-xing-esql]

@kanoshiou Thank you for helping with this issue. While Subquery is internally related to fork, they differ in the way they handle index patterns. I’d like the solution to specifically target Subquery and keep the current behavior of fork unchanged for now, and I have started working on this.

[kanoshiou]

Thanks for the information, @idegtiarenko @fang-xing-esql!

I believe this is a bug in fork. In the following query:

FROM employees 
| FORK ( WHERE first_name == "Georgi" | KEEP first_name ) 
       ( WHERE first_name != "Georgi" )"

it should return all fields, but currently only returns first_name and _fork.

I think this could be a good opportunity to fix the fork bug together with the Subquery issue discussed here.