Skip to content

[DOCS] Update esql-lookup-join.md #127306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 24, 2025
Merged

[DOCS] Update esql-lookup-join.md #127306

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
104e10a
[DOCS] Update esql-lookup-join.md
leemthompo Apr 24, 2025
f2de6b7
Merge branch 'elastic:main' into main
leemthompo Apr 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 6 additions & 8 deletions docs/reference/query-languages/esql/esql-lookup-join.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,21 +122,19 @@ FROM firewall_logs # The source index
| LOOKUP JOIN threat_list ON source.ip # The lookup index and join field
| WHERE threat_level IS NOT NULL # Filter for rows non-null threat levels
| SORT timestamp # LOOKUP JOIN does not guarantee output order, so you must explicitly sort the results if needed
| KEEP timestamp, source.ip, destination.ip, action, threat_level, threat_type # Keep only relevant fields
| KEEP source.ip, action, threat_type, threat_level # Keep only relevant fields
| LIMIT 10 # Limit the output to 10 rows
```

### Response

A successful query will output a table. In this example, you can see that the `source.ip` field from the `firewall_logs` index is matched with the `source.ip` field in the `threat_list` index, and the corresponding `threat_level` and `threat_type` fields are added to the output.

```
source.ip | action | threat_type | threat_level
---------------+---------------+---------------+---------------
203.0.113.5 |allow |C2_SERVER |high
198.51.100.2 |block |SCANNER |medium
203.0.113.5 |allow |C2_SERVER |high
```
|source.ip|action|threat_type|threat_level|
|---|---|---|---|
|203.0.113.5|allow|C2_SERVER|high|
|198.51.100.2|block|SCANNER|medium|
|203.0.113.5|allow|C2_SERVER|high|

### Additional examples

Expand Down
Loading