diff --git a/x-pack/plugin/kql/src/main/java/org/elasticsearch/xpack/kql/parser/KqlParserExecutionContext.java b/x-pack/plugin/kql/src/main/java/org/elasticsearch/xpack/kql/parser/KqlParserExecutionContext.java
index 6e81947a30242..420d66d059fe7 100644
--- a/x-pack/plugin/kql/src/main/java/org/elasticsearch/xpack/kql/parser/KqlParserExecutionContext.java
+++ b/x-pack/plugin/kql/src/main/java/org/elasticsearch/xpack/kql/parser/KqlParserExecutionContext.java
@@ -12,16 +12,17 @@
 import org.elasticsearch.index.mapper.DateFieldMapper;
 import org.elasticsearch.index.mapper.KeywordFieldMapper;
 import org.elasticsearch.index.mapper.MappedFieldType;
-import org.elasticsearch.index.query.SearchExecutionContext;
+import org.elasticsearch.index.query.QueryRewriteContext;
 
 import java.time.ZoneId;
 import java.util.List;
+import java.util.Set;
 import java.util.function.Predicate;
 import java.util.stream.Collectors;
 
 import static org.elasticsearch.core.Tuple.tuple;
 
-public class KqlParserExecutionContext extends SearchExecutionContext {
+public class KqlParserExecutionContext {
 
     private static final List<String> IGNORED_METADATA_FIELDS = List.of(
         "_seq_no",
@@ -37,17 +38,23 @@ public class KqlParserExecutionContext extends SearchExecutionContext {
         fieldDef.v1()
     );
 
-    public static Builder builder(SearchExecutionContext searchExecutionContext) {
-        return new Builder(searchExecutionContext);
+    public static Builder builder(QueryRewriteContext queryRewriteContext) {
+        return new Builder(queryRewriteContext);
     }
 
+    private QueryRewriteContext queryRewriteContext;
     private final boolean caseInsensitive;
     private final ZoneId timeZone;
 
     private final String defaultFields;
 
-    public KqlParserExecutionContext(SearchExecutionContext source, boolean caseInsensitive, ZoneId timeZone, String defaultFields) {
-        super(source);
+    public KqlParserExecutionContext(
+        QueryRewriteContext queryRewriteContext,
+        boolean caseInsensitive,
+        ZoneId timeZone,
+        String defaultFields
+    ) {
+        this.queryRewriteContext = queryRewriteContext;
         this.caseInsensitive = caseInsensitive;
         this.timeZone = timeZone;
         this.defaultFields = defaultFields;
@@ -56,13 +63,18 @@ public KqlParserExecutionContext(SearchExecutionContext source, boolean caseInse
     public Iterable<Tuple<String, MappedFieldType>> resolveFields(KqlBaseParser.FieldNameContext fieldNameContext) {
         // TODO: use index settings default field.
         String fieldNamePattern = fieldNameContext != null ? ParserUtils.extractText(fieldNameContext) : "*";
+        Set<String> matchingFieldNames = queryRewriteContext.getMatchingFieldNames(fieldNamePattern);
 
         if (fieldNameContext != null && fieldNameContext.value != null && fieldNameContext.value.getType() == KqlBaseParser.QUOTED_STRING) {
-            return isFieldMapped(fieldNamePattern) ? List.of(tuple(fieldNamePattern, getFieldType(fieldNamePattern))) : List.of();
+            if (matchingFieldNames.isEmpty() || fieldNamePattern.contains("*")) {
+                return List.of();
+            }
+
+            return List.of(tuple(fieldNamePattern, queryRewriteContext.getFieldType(fieldNamePattern)));
         }
 
-        return getMatchingFieldNames(fieldNamePattern).stream()
-            .map(fieldName -> tuple(fieldName, getFieldType(fieldName)))
+        return matchingFieldNames.stream()
+            .map(fieldName -> tuple(fieldName, queryRewriteContext.getFieldType(fieldName)))
             .filter(searchableFieldFilter.and(Predicate.not(ignoredFieldFilter)))
             .collect(Collectors.toList());
     }
@@ -72,7 +84,7 @@ public boolean caseInsensitive() {
     }
 
     public ZoneId timeZone() {
-        return null;
+        return timeZone;
     }
 
     public static boolean isRuntimeField(MappedFieldType fieldType) {
@@ -88,17 +100,17 @@ public static boolean isKeywordField(MappedFieldType fieldType) {
     }
 
     public static class Builder {
-        private final SearchExecutionContext searchExecutionContext;
+        private final QueryRewriteContext queryRewriteContext;
         private boolean caseInsensitive = true;
         private ZoneId timeZone = null;
         private String defaultFields = null;
 
-        private Builder(SearchExecutionContext searchExecutionContext) {
-            this.searchExecutionContext = searchExecutionContext;
+        private Builder(QueryRewriteContext queryRewriteContext) {
+            this.queryRewriteContext = queryRewriteContext;
         }
 
         public KqlParserExecutionContext build() {
-            return new KqlParserExecutionContext(searchExecutionContext, caseInsensitive, timeZone, defaultFields);
+            return new KqlParserExecutionContext(queryRewriteContext, caseInsensitive, timeZone, defaultFields);
         }
 
         public Builder caseInsensitive(boolean caseInsensitive) {
diff --git a/x-pack/plugin/kql/src/main/java/org/elasticsearch/xpack/kql/query/KqlQueryBuilder.java b/x-pack/plugin/kql/src/main/java/org/elasticsearch/xpack/kql/query/KqlQueryBuilder.java
index 42c30cbe7e660..c349c27433ea6 100644
--- a/x-pack/plugin/kql/src/main/java/org/elasticsearch/xpack/kql/query/KqlQueryBuilder.java
+++ b/x-pack/plugin/kql/src/main/java/org/elasticsearch/xpack/kql/query/KqlQueryBuilder.java
@@ -16,6 +16,7 @@
 import org.elasticsearch.common.io.stream.StreamOutput;
 import org.elasticsearch.index.query.AbstractQueryBuilder;
 import org.elasticsearch.index.query.QueryBuilder;
+import org.elasticsearch.index.query.QueryRewriteContext;
 import org.elasticsearch.index.query.SearchExecutionContext;
 import org.elasticsearch.logging.LogManager;
 import org.elasticsearch.logging.Logger;
@@ -149,9 +150,9 @@ protected void doXContent(XContentBuilder builder, Params params) throws IOExcep
     }
 
     @Override
-    protected QueryBuilder doSearchRewrite(SearchExecutionContext searchExecutionContext) throws IOException {
+    protected QueryBuilder doIndexMetadataRewrite(QueryRewriteContext context) throws IOException {
         KqlParser parser = new KqlParser();
-        QueryBuilder rewrittenQuery = parser.parseKqlQuery(query, createKqlParserContext(searchExecutionContext));
+        QueryBuilder rewrittenQuery = parser.parseKqlQuery(query, createKqlParserContext(context));
 
         if (log.isTraceEnabled()) {
             log.trace("KQL query {} translated to Query DSL: {}", query, Strings.toString(rewrittenQuery));
@@ -190,8 +191,8 @@ protected boolean doEquals(KqlQueryBuilder other) {
             && caseInsensitive == other.caseInsensitive;
     }
 
-    private KqlParserExecutionContext createKqlParserContext(SearchExecutionContext searchExecutionContext) {
-        return KqlParserExecutionContext.builder(searchExecutionContext)
+    private KqlParserExecutionContext createKqlParserContext(QueryRewriteContext queryRewriteContext) {
+        return KqlParserExecutionContext.builder(queryRewriteContext)
             .caseInsensitive(caseInsensitive)
             .timeZone(timeZone)
             .defaultFields(defaultFields)
diff --git a/x-pack/plugin/kql/src/test/java/org/elasticsearch/xpack/kql/parser/AbstractKqlParserTestCase.java b/x-pack/plugin/kql/src/test/java/org/elasticsearch/xpack/kql/parser/AbstractKqlParserTestCase.java
index 408950ab4f1bd..f3e375dce44fe 100644
--- a/x-pack/plugin/kql/src/test/java/org/elasticsearch/xpack/kql/parser/AbstractKqlParserTestCase.java
+++ b/x-pack/plugin/kql/src/test/java/org/elasticsearch/xpack/kql/parser/AbstractKqlParserTestCase.java
@@ -110,7 +110,7 @@ protected List<String> searchableFields(String fieldNamePattern) {
 
     protected QueryBuilder parseKqlQuery(String kqlQuery) {
         KqlParser parser = new KqlParser();
-        KqlParserExecutionContext kqlParserContext = KqlParserExecutionContext.builder(createSearchExecutionContext()).build();
+        KqlParserExecutionContext kqlParserContext = KqlParserExecutionContext.builder(createQueryRewriteContext()).build();
         return parser.parseKqlQuery(kqlQuery, kqlParserContext);
     }