Skip to content

Commit 699f22f

Browse files
update docs
1 parent bb6f490 commit 699f22f

File tree

1 file changed

+48
-0
lines changed

1 file changed

+48
-0
lines changed

docs/reference/query-languages/esql/esql-multi-index.md

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,54 @@ FROM events_*
135135
| 2023-10-23T12:27:28.948Z | 172.21.2.113 | 2764889 | Connected to 10.1.0.2 |
136136
| 2023-10-23T12:15:03.360Z | 172.21.2.162 | 3450233 | Connected to 10.1.0.3 |
137137

138+
When the type of an {{ES|QL}} field is a *union* of `date` and `date_nanos` across different indices, {{ES|QL}} automatically casts all values to the `date_nanos` type during query execution. This implicit casting ensures that all values are handled with nanosecond precision, regardless of their original type. As a result, users can write queries against such fields without needing to perform explicit type conversions, and the query engine will seamlessly align the types for consistent and precise results.
139+
140+
For example, if the `@timestamp` field is mapped as `date` in one index and `date_nanos` in another, {{ES|QL}} will automatically treat all `@timestamp` values as `date_nanos` during query execution. This allows users to write queries that utilize the `@timestamp` field without encountering type mismatch errors, ensuring accurate time-based operations and comparisons across the combined dataset.
141+
142+
**index: events_date**
143+
144+
```
145+
{
146+
"mappings": {
147+
"properties": {
148+
"@timestamp": { "type": "date" },
149+
"client_ip": { "type": "ip" },
150+
"event_duration": { "type": "long" },
151+
"message": { "type": "keyword" }
152+
}
153+
}
154+
}
155+
```
156+
157+
**index: events_date_nanos**
158+
159+
```
160+
{
161+
"mappings": {
162+
"properties": {
163+
"@timestamp": { "type": "date_nanos" },
164+
"client_ip": { "type": "ip" },
165+
"event_duration": { "type": "long" },
166+
"message": { "type": "keyword" }
167+
}
168+
}
169+
}
170+
```
171+
172+
```esql
173+
FROM events_date, events_date_nanos
174+
| WHERE @timestamp >= "2023-10-23T13:00:00Z"
175+
| KEEP @timestamp, client_ip, event_duration, message
176+
| SORT @timestamp DESC
177+
```
178+
179+
| @timestamp:date | client_ip:ip | event_duration:long | message:keyword |
180+
| --- | --- | --- | --- |
181+
| 2023-10-23T13:55:01.543Z | 172.21.3.15 | 1756467 | Connected to 10.1.0.1 |
182+
| 2023-10-23T13:53:55.832Z | 172.21.3.15 | 5033755 | Connection error |
183+
| 2023-10-23T13:52:55.015Z | 172.21.3.15 | 8268153 | Connection error |
184+
| 2023-10-23T13:51:54.732Z | 172.21.3.15 | 725448 | Connection error |
185+
| 2023-10-23T13:33:34.937Z | 172.21.0.5 | 1232382 | Disconnected |
138186

139187
## Index metadata [esql-multi-index-index-metadata]
140188

0 commit comments

Comments
 (0)