We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 159980e commit 8b24b91Copy full SHA for 8b24b91
docs/changelog/135051.yaml
@@ -3,3 +3,13 @@ summary: Ban Limit + `MvExpand` before remote Enrich
3
area: ES|QL
4
type: bug
5
issues: []
6
+highlight:
7
+ title: Prevent LIMIT + MV_EXPAND before remote ENRICH
8
+ body: |-
9
+ Queries using LIMIT followed by MV_EXPAND before a remote ENRICH can produce incorrect results due to distributed execution semantics.
10
+ These queries are now unsupported and produce an error. Example:
11
+ [source,yaml]
12
+ ----------------------------
13
+ FROM *:events | SORT @timestamp | LIMIT 2 | MV_EXPAND ip | ENRICH _remote:clientip_policy ON ip
14
15
+ To avoid this error, reorder your query, for example by moving ENRICH earlier in the pipeline.
0 commit comments