Error with SQL Subquery in OpenSearch: NullPointerException in FieldMappings

Plugins SQL
1

Hello,

I’m encountering an issue that I can’t figure out the source of. According to the SQL subquery documentation, it’s possible to use queries like this:

SELECT a1.firstname, a1.lastname, a1.balance
FROM accounts a1
WHERE a1.account_number IN (
  SELECT a2.account_number
  FROM accounts a2
  WHERE a2.balance > 10000
)

However, when I attempt to apply a similar query in my use case:

POST _plugins/_sql
{
  "query": """
  SELECT a1.winlog.event_data.SubjectLogonId
  FROM winlogbeat-* a1
  WHERE a1.event.code = '4697' AND a1.winlog.event_data.SubjectLogonId IN (
    SELECT a2.winlog.event_data.TargetLogonId
    FROM winlogbeat-* a2
    WHERE a2.event.code = '4624'
  )
  """
}

I receive this error:

{
  "error": {
    "reason": "Invalid SQL query",
    "details": "Cannot invoke \"org.opensearch.sql.legacy.esdomain.mapping.FieldMappings.has(String)\" because \"fieldMappings\" is null",
    "type": "NullPointerException"
  },
  "status": 400
}

Could you help me understand what’s causing this issue?

FYI: i use opensearch v 2.12.0