ESQL: Replace [ccq.mode] in favor of a policy prefix (#105224)

For consistency, replace [ccq.mode:<type>] with _<resolution>:policyName
`ENRICH [ccq.mode=any] policyName` becomes `ENRICH _any:policyName`

Author: costin

x-pack/plugin/esql/qa/testFixtures/src/main/java/org/elasticsearch/xpack/esql/EsqlTestUtils.java

@@ -221,11 +221,11 @@ public static String randomEnrichCommand(String name, Enrich.Mode mode, String m
             }
             withFields = " WITH " + String.join(",", fields);
         }
-        String enrich = "ENRICH";
+        String enrich = "ENRICH ";
         if (mode != Enrich.Mode.ANY || randomBoolean()) {
-            enrich += " [ccq.mode: " + mode + "] ";
+            enrich += " _" + mode + ":";
         }
-        enrich += " " + name;
+        enrich += name;
         enrich += onField;
         enrich += withFields;
         List<String> all = new ArrayList<>(before);

x-pack/plugin/esql/src/internalClusterTest/java/org/elasticsearch/xpack/esql/action/CrossClustersEnrichIT.java

@@ -414,7 +414,7 @@ public void testTopNThenEnrichRemote() {
             | %s
             """, enrichHosts(Enrich.Mode.REMOTE));
         var error = expectThrows(VerificationException.class, () -> runQuery(query).close());
-        assertThat(error.getMessage(), containsString("enrich with [ccq.mode:remote] can't be executed after LIMIT"));
+        assertThat(error.getMessage(), containsString("ENRICH with remote policy can't be executed after LIMIT"));
     }
 
     public void testLimitThenEnrichRemote() {
@@ -425,7 +425,7 @@ public void testLimitThenEnrichRemote() {
             | %s
             """, enrichHosts(Enrich.Mode.REMOTE));
         var error = expectThrows(VerificationException.class, () -> runQuery(query).close());
-        assertThat(error.getMessage(), containsString("enrich with [ccq.mode:remote] can't be executed after LIMIT"));
+        assertThat(error.getMessage(), containsString("ENRICH with remote policy can't be executed after LIMIT"));
     }
 
     public void testAggThenEnrichRemote() {
@@ -438,7 +438,7 @@ public void testAggThenEnrichRemote() {
             | sort vendor
             """, enrichHosts(Enrich.Mode.ANY), enrichVendors(Enrich.Mode.REMOTE));
         var error = expectThrows(VerificationException.class, () -> runQuery(query).close());
-        assertThat(error.getMessage(), containsString("enrich with [ccq.mode:remote] can't be executed after STATS"));
+        assertThat(error.getMessage(), containsString("ENRICH with remote policy can't be executed after STATS"));
     }
 
     public void testEnrichCoordinatorThenEnrichRemote() {
@@ -452,7 +452,7 @@ public void testEnrichCoordinatorThenEnrichRemote() {
         var error = expectThrows(VerificationException.class, () -> runQuery(query).close());
         assertThat(
             error.getMessage(),
-            containsString("enrich with [ccq.mode:remote] can't be executed after another enrich with [ccq.mode:coordinator]")
+            containsString("ENRICH with remote policy can't be executed after another ENRICH with coordinator policy")
         );
     }
 

x-pack/plugin/esql/src/main/antlr/EsqlBaseLexer.g4

@@ -291,7 +291,8 @@ fragment ENRICH_POLICY_NAME_BODY
     ;
 
 ENRICH_POLICY_NAME
-    : (LETTER | DIGIT) ENRICH_POLICY_NAME_BODY*
+    // allow prefix for the policy to specify its resolution
+    : (ENRICH_POLICY_NAME_BODY+ COLON)? ENRICH_POLICY_NAME_BODY+
     ;
 
 ENRICH_QUOTED_IDENTIFIER

x-pack/plugin/esql/src/main/antlr/EsqlBaseParser.g4

@@ -249,13 +249,9 @@ showCommand
     ;
 
 enrichCommand
-    : ENRICH setting* policyName=ENRICH_POLICY_NAME (ON matchField=qualifiedNamePattern)? (WITH enrichWithClause (COMMA enrichWithClause)*)?
+    : ENRICH policyName=ENRICH_POLICY_NAME (ON matchField=qualifiedNamePattern)? (WITH enrichWithClause (COMMA enrichWithClause)*)?
     ;
 
 enrichWithClause
     : (newName=qualifiedNamePattern ASSIGN)? enrichField=qualifiedNamePattern
     ;
-
-setting
-    : OPENING_BRACKET name=SETTING COLON value=SETTING CLOSING_BRACKET
-    ;

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/analysis/Verifier.java

@@ -387,8 +387,8 @@ private static Failure validateUnsignedLongNegation(Neg neg) {
      * TODO:
      * For Limit and TopN, we can insert the same node after the remote enrich (also needs to move projections around)
      * to eliminate this limitation. Otherwise, we force users to write queries that might not perform well.
-     * For example, `FROM test | ORDER @timestamp | LIMIT 10 | ENRICH[ccq.mode:remote]` doesn't work.
-     * In that case, users have to write it as `FROM test | ENRICH[ccq.mode:remote] | ORDER @timestamp | LIMIT 10`,
+     * For example, `FROM test | ORDER @timestamp | LIMIT 10 | ENRICH _remote:` doesn't work.
+     * In that case, users have to write it as `FROM test | ENRICH _remote: | ORDER @timestamp | LIMIT 10`,
      * which is equivalent to bringing all data to the coordinating cluster.
      * We might consider implementing the actual remote enrich on the coordinating cluster, however, this requires
      * retaining the originating cluster and restructing pages for routing, which might be complicated.
@@ -409,15 +409,13 @@ private static void checkRemoteEnrich(LogicalPlan plan, Set<Failure> failures) {
             }
             if (u instanceof Enrich enrich && enrich.mode() == Enrich.Mode.REMOTE) {
                 if (limit[0]) {
-                    failures.add(fail(enrich, "enrich with [ccq.mode:remote] can't be executed after LIMIT"));
+                    failures.add(fail(enrich, "ENRICH with remote policy can't be executed after LIMIT"));
                 }
                 if (agg[0]) {
-                    failures.add(fail(enrich, "enrich with [ccq.mode:remote] can't be executed after STATS"));
+                    failures.add(fail(enrich, "ENRICH with remote policy can't be executed after STATS"));
                 }
                 if (enrichCoord[0]) {
-                    failures.add(
-                        fail(enrich, "enrich with [ccq.mode:remote] can't be executed after another enrich with [ccq.mode:coordinator]")
-                    );
+                    failures.add(fail(enrich, "ENRICH with remote policy can't be executed after another ENRICH with coordinator policy"));
                 }
             }
         });