ESQL: Add more details on ENRICH vs. LOOKUP JOIN #125487
Conversation
alex-spies
added
>docs
elasticsearchmachine
added
Team:Docs
|
Pinging @elastic/es-docs (Team:Docs) |
|
Pinging @elastic/es-analytical-engine (Team:Analytics) |
|
|
||
| * Enrichment data doesn't change frequently | ||
| * You can accept index-time overhead | ||
| * You are working with structured enrichment patterns |
There was a problem hiding this comment.
I wasn't sure what this exactly means; maybe it's a bit too broad.
|
|
||
| * Your enrichment data changes frequently | ||
| * You want to avoid index-time processing | ||
| * You're working with regular indices |
There was a problem hiding this comment.
This was not entirely true, as lookup indices are still not perfectly the same as regular indices.
|
|
||
| The following are the current limitations with `LOOKUP JOIN` | ||
|
|
||
| * `LOOKUP JOIN` will be successful if the join field in the lookup index is a `KEYWORD` type. If the main index's join field is `TEXT` type, it must have an exact `.keyword` subfield that can be matched with the lookup index's `KEYWORD` field. |
There was a problem hiding this comment.
This is already mentioned above and not a limitation per-se.
| ```esql | ||
| FROM <source_index> | ||
| | LOOKUP JOIN <lookup_index> ON <field_name> | ||
| ``` |
There was a problem hiding this comment.
We use esql formatting for the syntax in the other commands.
| ```esql | ||
| FROM firewall_logs | ||
| | LOOKUP JOIN threat_list ON source.IP | ||
| | WHERE threat_level IS NOT NULL |
There was a problem hiding this comment.
Moved this below to the other examples.
leemthompo
added
auto-backport
|
💔 Backport failed
You can use sqren/backport to manually backport by running |
|
Err, I think we don't backport to 9.0, either. |
alex-spies
removed
auto-backport
…elastic#125528) Manual backport of docs-PR elastic#125487
3 participants
I think it's good to point out one more difference: there are enrich policies that match on ranges or spatial relations, which is currently not supported in LOOKUP JOIN.
Other than that, this adds a couple of minor edits (typo fixes, slight rewordings)