[CI] EsqlSecurityIT testLookupJoinIndexAllowed failing

[elasticsearchmachine]

Build Scans:

• elasticsearch-periodic #5547 / release-tests
• elasticsearch-periodic #5542 / release-tests
• elasticsearch-periodic #5537 / release-tests
• elasticsearch-periodic #5532 / release-tests

Reproduction Line:

./gradlew ":x-pack:plugin:esql:qa:security:javaRestTest" --tests "org.elasticsearch.xpack.esql.EsqlSecurityIT.testLookupJoinIndexForbidden" -Dtests.seed=E3A9E76E177B1FD2 -Dbuild.snapshot=false -Dtests.jvm.argline="-Dbuild.snapshot=false" -Dlicense.key=x-pack/license-tools/src/test/resources/public.key -Dtests.locale=so-DJ -Dtests.timezone=UTC -Druntime.java=23

Applicable branches:
8.x

Reproduces locally?:
N/A

Failure History:
See dashboard

Failure Message:

java.lang.AssertionError: 
Expected: a string containing "Unknown index [lookup-user1]"
     but: was "method [POST], host [http://[::1]:39039], URI [_query?error_trace=true], status line [HTTP/1.1 400 Bad Request]
{"error":{"root_cause":[{"type":"parsing_exception","reason":"line 1:41: mismatched input 'LOOKUP' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'keep', 'limit', 'mv_expand', 'rename', 'sort', 'stats', 'where'}","stack_trace":"org.elasticsearch.xpack.esql.parser.ParsingException: line 1:41: mismatched input 'LOOKUP' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'keep', 'limit', 'mv_expand', 'rename', 'sort', 'stats', 'where'}\n\tat org.elasticsearch.xpack.esql.parser.EsqlParser$1.syntaxError(EsqlParser.java:140)\n\tat org.antlr.v4.runtime.ProxyErrorListener.syntaxError(ProxyErrorListener.java:41)\n\tat org.antlr.v4.runtime.Parser.notifyErrorListeners(Parser.java:544)\n\tat org.antlr.v4.runtime.DefaultErrorStrategy.reportInputMismatch(DefaultErrorStrategy.java:327)\n\tat org.antlr.v4.runtime.DefaultErrorStrategy.reportError(DefaultErrorStrategy.java:139)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.processingCommand(EsqlBaseParser.java:651)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.query(EsqlBaseParser.java:347)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.singleStatement(EsqlBaseParser.java:230)\n\tat org.elasticsearch.xpack.esql.parser.EsqlParser.invokeParser(EsqlParser.java:96)\n\tat org.elasticsearch.xpack.esql.parser.EsqlParser.createStatement(EsqlParser.java:63)\n\tat org.elasticsearch.xpack.esql.session.EsqlSession.parse(EsqlSession.java:282)\n\tat org.elasticsearch.xpack.esql.session.EsqlSession.execute(EsqlSession.java:158)\n\tat org.elasticsearch.xpack.esql.execution.PlanExecutor.esql(PlanExecutor.java:83)\n\tat org.elasticsearch.xpack.esql.plugin.TransportEsqlQueryAction.innerExecute(TransportEsqlQueryAction.java:191)\n\tat org.elasticsearch.xpack.esql.plugin.TransportEsqlQueryAction.doExecuteForked(TransportEsqlQueryAction.java:153)\n\tat org.elasticsearch.xpack.esql.plugin.TransportEsqlQueryAction.lambda$doExecute$0(TransportEsqlQueryAction.java:137)\n\tat [email protected]/org.elasticsearch.action.ActionRunnable$4.doRun(ActionRunnable.java:101)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:34)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1044)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)\n\tat java.base/java.lang.Thread.run(Thread.java:1575)\nCaused by: org.antlr.v4.runtime.InputMismatchException\n\tat org.antlr.v4.runtime.DefaultErrorStrategy.sync(DefaultErrorStrategy.java:270)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.processingCommand(EsqlBaseParser.java:534)\n\t... 18 more\n"}],"type":"parsing_exception","reason":"line 1:41: mismatched input 'LOOKUP' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'keep', 'limit', 'mv_expand', 'rename', 'sort', 'stats', 'where'}","caused_by":{"type":"input_mismatch_exception","reason":null,"stack_trace":"org.antlr.v4.runtime.InputMismatchException\n\tat org.antlr.v4.runtime.DefaultErrorStrategy.sync(DefaultErrorStrategy.java:270)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.processingCommand(EsqlBaseParser.java:534)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.query(EsqlBaseParser.java:347)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.singleStatement(EsqlBaseParser.java:230)\n\tat org.elasticsearch.xpack.esql.parser.EsqlParser.invokeParser(EsqlParser.java:96)\n\tat org.elasticsearch.xpack.esql.parser.EsqlParser.createStatement(EsqlParser.java:63)\n\tat org.elasticsearch.xpack.esql.session.EsqlSession.parse(EsqlSession.java:282)\n\tat org.elasticsearch.xpack.esql.session.EsqlSession.execute(EsqlSession.java:158)\n\tat org.elasticsearch.xpack.esql.execution.PlanExecutor.esql(PlanExecutor.java:83)\n\tat org.elasticsearch.xpack.esql.plugin.TransportEsqlQueryAction.innerExecute(TransportEsqlQueryAction.java:191)\n\tat org.elasticsearch.xpack.esql.plugin.TransportEsqlQueryAction.doExecuteForked(TransportEsqlQueryAction.java:153)\n\tat org.elasticsearch.xpack.esql.plugin.TransportEsqlQueryAction.lambda$doExecute$0(TransportEsqlQueryAction.java:137)\n\tat [email protected]/org.elasticsearch.action.ActionRunnable$4.doRun(ActionRunnable.java:101)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:34)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1044)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)\n\tat java.base/java.lang.Thread.run(Thread.java:1575)\n"},"stack_trace":"org.elasticsearch.xpack.esql.parser.ParsingException: line 1:41: mismatched input 'LOOKUP' expecting {'dissect', 'drop', 'enrich', 'eval', 'grok', 'keep', 'limit', 'mv_expand', 'rename', 'sort', 'stats', 'where'}\n\tat org.elasticsearch.xpack.esql.parser.EsqlParser$1.syntaxError(EsqlParser.java:140)\n\tat org.antlr.v4.runtime.ProxyErrorListener.syntaxError(ProxyErrorListener.java:41)\n\tat org.antlr.v4.runtime.Parser.notifyErrorListeners(Parser.java:544)\n\tat org.antlr.v4.runtime.DefaultErrorStrategy.reportInputMismatch(DefaultErrorStrategy.java:327)\n\tat org.antlr.v4.runtime.DefaultErrorStrategy.reportError(DefaultErrorStrategy.java:139)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.processingCommand(EsqlBaseParser.java:651)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.query(EsqlBaseParser.java:347)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.singleStatement(EsqlBaseParser.java:230)\n\tat org.elasticsearch.xpack.esql.parser.EsqlParser.invokeParser(EsqlParser.java:96)\n\tat org.elasticsearch.xpack.esql.parser.EsqlParser.createStatement(EsqlParser.java:63)\n\tat org.elasticsearch.xpack.esql.session.EsqlSession.parse(EsqlSession.java:282)\n\tat org.elasticsearch.xpack.esql.session.EsqlSession.execute(EsqlSession.java:158)\n\tat org.elasticsearch.xpack.esql.execution.PlanExecutor.esql(PlanExecutor.java:83)\n\tat org.elasticsearch.xpack.esql.plugin.TransportEsqlQueryAction.innerExecute(TransportEsqlQueryAction.java:191)\n\tat org.elasticsearch.xpack.esql.plugin.TransportEsqlQueryAction.doExecuteForked(TransportEsqlQueryAction.java:153)\n\tat org.elasticsearch.xpack.esql.plugin.TransportEsqlQueryAction.lambda$doExecute$0(TransportEsqlQueryAction.java:137)\n\tat [email protected]/org.elasticsearch.action.ActionRunnable$4.doRun(ActionRunnable.java:101)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:34)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1044)\n\tat [email protected]/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)\n\tat java.base/java.lang.Thread.run(Thread.java:1575)\nCaused by: org.antlr.v4.runtime.InputMismatchException\n\tat org.antlr.v4.runtime.DefaultErrorStrategy.sync(DefaultErrorStrategy.java:270)\n\tat org.elasticsearch.xpack.esql.parser.EsqlBaseParser.processingCommand(EsqlBaseParser.java:534)\n\t... 18 more\n"},"status":400}"

Issue Reasons:

• [8.x] 4 consecutive failures in step release-tests
• [8.x] 4 failures in test testLookupJoinIndexAllowed (3.6% fail rate in 112 executions)
• [8.x] 4 failures in step release-tests (100.0% fail rate in 4 executions)
• [8.x] 4 failures in pipeline elasticsearch-periodic (100.0% fail rate in 4 executions)

Note:
This issue was created using new test triage automation. Please report issues or feedback to es-delivery.

[elasticsearchmachine]

Pinging @elastic/es-analytical-engine (Team:Analytics)