Skip to content

Commit 8b24b91

Browse files
authored
* Add release note for elastic#135051
1 parent 159980e commit 8b24b91

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

docs/changelog/135051.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,13 @@ summary: Ban Limit + `MvExpand` before remote Enrich
33
area: ES|QL
44
type: bug
55
issues: []
6+
highlight:
7+
title: Prevent LIMIT + MV_EXPAND before remote ENRICH
8+
body: |-
9+
Queries using LIMIT followed by MV_EXPAND before a remote ENRICH can produce incorrect results due to distributed execution semantics.
10+
These queries are now unsupported and produce an error. Example:
11+
[source,yaml]
12+
----------------------------
13+
FROM *:events | SORT @timestamp | LIMIT 2 | MV_EXPAND ip | ENRICH _remote:clientip_policy ON ip
14+
----------------------------
15+
To avoid this error, reorder your query, for example by moving ENRICH earlier in the pipeline.

0 commit comments

Comments
 (0)