Elasticsearch: Add frozen indices search support (#36018)

* Revert "Revert "Elasticsearch: add frozen indices search support (#27472)" (#27726)"

This reverts commit 4c7131425b.

* Make label width a bit more consistent

* Add documentation for X-Pack & Frozen Indices support in Elasticsearch

* Change UI & docs casing

* create default empty dataframe

* Remove backticks and simplify regex

* small doc improvement

pkg/tsdb/elasticsearch/client/client.go

@@ -334,12 +334,23 @@ func (c *baseClientImpl) createMultiSearchRequests(searchRequests []*SearchReque
 }
 
 func (c *baseClientImpl) getMultiSearchQueryParameters() string {
+	var qs []string
+
 	if c.version.Major() >= 7 {
 		maxConcurrentShardRequests := c.getSettings().Get("maxConcurrentShardRequests").MustInt(5)
-		return fmt.Sprintf("max_concurrent_shard_requests=%d", maxConcurrentShardRequests)
+		qs = append(qs, fmt.Sprintf("max_concurrent_shard_requests=%d", maxConcurrentShardRequests))
 	}
 
-	return ""
+	// Querying frozen indices was added in 6.6 with xpack
+	includeFrozen := c.getSettings().Get("includeFrozen").MustBool(false)
+	xpack := c.getSettings().Get("xpack").MustBool(false)
+	allowedFrozenIndicesVersionRange, _ := semver.NewConstraint(">=6.6.0")
+
+	if (allowedFrozenIndicesVersionRange.Check(c.version)) && includeFrozen && xpack {
+		qs = append(qs, "ignore_throttled=false")
+	}
+
+	return strings.Join(qs, "&")
 }
 
 func (c *baseClientImpl) MultiSearch() *MultiSearchRequestBuilder {

pkg/tsdb/elasticsearch/client/client_test.go

@@ -253,10 +253,12 @@ func TestClient_ExecuteMultisearch(t *testing.T) {
 	httpClientScenario(t, "Given a fake http client and a v5.6 client with response", &models.DataSource{
 		Database: "[metrics-]YYYY.MM.DD",
 		JsonData: simplejson.NewFromAny(map[string]interface{}{
-			"esVersion":                  56,
+			"esVersion":                  "5.6.0",
 			"maxConcurrentShardRequests": 100,
 			"timeField":                  "@timestamp",
 			"interval":                   "Daily",
+			"includeFrozen":              true,
+			"xpack":                      true,
 		}),
 	}, func(sc *scenarioContext) {
 		sc.responseBody = `{
@@ -276,6 +278,7 @@ func TestClient_ExecuteMultisearch(t *testing.T) {
 		require.NotNil(t, sc.request)
 		assert.Equal(t, http.MethodPost, sc.request.Method)
 		assert.Equal(t, "/_msearch", sc.request.URL.Path)
+		assert.NotContains(t, sc.request.URL.RawQuery, "ignore_throttled=")
 
 		require.NotNil(t, sc.requestBody)
 
@@ -305,10 +308,12 @@ func TestClient_ExecuteMultisearch(t *testing.T) {
 	httpClientScenario(t, "Given a fake http client and a v7.0 client with response", &models.DataSource{
 		Database: "[metrics-]YYYY.MM.DD",
 		JsonData: simplejson.NewFromAny(map[string]interface{}{
-			"esVersion":                  70,
+			"esVersion":                  "7.0.0",
 			"maxConcurrentShardRequests": 6,
 			"timeField":                  "@timestamp",
 			"interval":                   "Daily",
+			"includeFrozen":              true,
+			"xpack":                      true,
 		}),
 	}, func(sc *scenarioContext) {
 		sc.responseBody = `{
@@ -328,7 +333,7 @@ func TestClient_ExecuteMultisearch(t *testing.T) {
 		require.NotNil(t, sc.request)
 		assert.Equal(t, http.MethodPost, sc.request.Method)
 		assert.Equal(t, "/_msearch", sc.request.URL.Path)
-		assert.Equal(t, "max_concurrent_shard_requests=6", sc.request.URL.RawQuery)
+		assert.Equal(t, "max_concurrent_shard_requests=6&ignore_throttled=false", sc.request.URL.RawQuery)
 
 		require.NotNil(t, sc.requestBody)
 
@@ -346,6 +351,7 @@ func TestClient_ExecuteMultisearch(t *testing.T) {
 		assert.True(t, jHeader.Get("ignore_unavailable").MustBool(false))
 		assert.Equal(t, "query_then_fetch", jHeader.Get("search_type").MustString())
 		assert.Empty(t, jHeader.Get("max_concurrent_shard_requests"))
+		assert.False(t, jHeader.Get("ignore_throttled").MustBool())
 
 		assert.Equal(t, "15000*@hostname", jBody.GetPath("aggs", "2", "aggs", "1", "avg", "script").MustString())
 

pkg/tsdb/elasticsearch/response_parser.go

@@ -67,7 +67,8 @@ func (rp *responseParser) getTimeSeries() (plugins.DataResponse, error) {
 		}
 
 		queryRes := plugins.DataQueryResult{
-			Meta: debugInfo,
+			Meta:       debugInfo,
+			Dataframes: plugins.NewDecodedDataFrames(data.Frames{}),
 		}
 		props := make(map[string]string)
 		err := rp.processBuckets(res.Aggregations, target, &queryRes, props, 0)