[DOCS] ES|QL: Adding a tip to the WHERE documentation #114050
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Documentation preview: |
|
@KyleOnK8s please enable the option "Allow edits and access to secrets by maintainers" on your PR. For more information, see the documentation. |
elasticsearchmachine
added
v9.0.0
Team:Docs
|
Pinging @elastic/es-docs (Team:Docs) |
This option does not appear to exist for me. Docs team, please let me know if you need me to do something differently. |
elasticsearchmachine
added
the
Team:Analytics
|
Pinging @elastic/es-analytical-engine (Team:Analytics) |
astefan
reviewed
Oct 14, 2024
Co-authored-by: Andrei Stefan <[email protected]>
leemthompo
added
auto-backport
leemthompo
approved these changes
Oct 14, 2024
There was a problem hiding this comment.
Just a nit to remove parenthesis :)
@astefan How far do we need to backport this?
|
@leemthompo Not sure about backporting. This is the default behavior of ES|QL since the beginning I think, it's nothing new imo. But it's good that we are explicit about this behavior, since ES itself behaves slightly different. |
Rephrasing for clarity Co-authored-by: Liam Thompson <[email protected]>
davidkyle
pushed a commit
to davidkyle/elasticsearch
that referenced
this pull request
Oct 14, 2024
* Adding a tip to make null field behavior more apparent. * Update docs/reference/esql/processing-commands/where.asciidoc Co-authored-by: Andrei Stefan <[email protected]> * Update docs/reference/esql/processing-commands/where.asciidoc Rephrasing for clarity Co-authored-by: Liam Thompson <[email protected]> --------- Co-authored-by: Andrei Stefan <[email protected]> Co-authored-by: Liam Thompson <[email protected]>
davidkyle
pushed a commit
that referenced
this pull request
Oct 15, 2024
* Adding a tip to make null field behavior more apparent. * Update docs/reference/esql/processing-commands/where.asciidoc Co-authored-by: Andrei Stefan <[email protected]> * Update docs/reference/esql/processing-commands/where.asciidoc Rephrasing for clarity Co-authored-by: Liam Thompson <[email protected]> --------- Co-authored-by: Andrei Stefan <[email protected]> Co-authored-by: Liam Thompson <[email protected]>
georgewallace
pushed a commit
to georgewallace/elasticsearch
that referenced
this pull request
Oct 25, 2024
* Adding a tip to make null field behavior more apparent. * Update docs/reference/esql/processing-commands/where.asciidoc Co-authored-by: Andrei Stefan <[email protected]> * Update docs/reference/esql/processing-commands/where.asciidoc Rephrasing for clarity Co-authored-by: Liam Thompson <[email protected]> --------- Co-authored-by: Andrei Stefan <[email protected]> Co-authored-by: Liam Thompson <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The
WHEREclause in ES|QL will excludenullresults when using a!=operator. Examples provided in screenshots. This is the opposite behavior from other query languages supported in Elastic. I tested KQL, Query DSL, and Lucene. I did not test any scripting languages.This can result in users accidentally excluding data they do not want to. This is especially concerning in Security applications where customers are building their rules to span multiple source types and those source types have mapping conflicts or other field disparity.
There is currently no information on this behavior in the ES|QL support docs. This PR is to address documentation.
No filters (for reference)
KQL
Lucene
Query DSL
ES|QL without filters (for reference)
ES|QL with NOT filter only (excludes the
nullresult)ES|QL with NOT or IS NULL filter (includes the
nullresult)