diff --git a/docs/reference/query-languages/esql/limitations.md b/docs/reference/query-languages/esql/limitations.md index 615876d806627..c1e2cbfbf4236 100644 --- a/docs/reference/query-languages/esql/limitations.md +++ b/docs/reference/query-languages/esql/limitations.md @@ -254,3 +254,6 @@ Work around this limitation by converting the field to single value with one of * CSV export from Discover shows no more than 10,000 rows. This limit only applies to the number of rows that are retrieved by the query and displayed in Discover. Queries and aggregations run on the full data set. * Querying many indices at once without any filters can cause an error in kibana which looks like `[esql] > Unexpected error from Elasticsearch: The content length (536885793) is bigger than the maximum allowed string (536870888)`. The response from {{esql}} is too long. Use [`DROP`](/reference/query-languages/esql/commands/processing-commands.md#esql-drop) or [`KEEP`](/reference/query-languages/esql/commands/processing-commands.md#esql-keep) to limit the number of fields returned. +## Known issues [esql-known-issues] + +Refer to [Known issues](/release-notes/known-issues.md) for a list of known issues for {{esql}}. diff --git a/docs/release-notes/known-issues.md b/docs/release-notes/known-issues.md index c95f2a353bd06..a4df1487a21b9 100644 --- a/docs/release-notes/known-issues.md +++ b/docs/release-notes/known-issues.md @@ -34,3 +34,12 @@ This issue will be fixed in a future patch release (see [PR #126990](https://git DELETE _index_template/.watches POST /_watcher/_start ``` + +* A bug in the ES|QL STATS command may yield incorrect results. The bug only happens in very specific cases that follow this pattern: `STATS ... BY keyword1, keyword2`, i.e. the command must have exactly two grouping fields, both keywords, where the first field has high cardinality (more than 65k distinct values). + + The bug is described in detail in [this issue](https://github.com/elastic/elasticsearch/issues/130644). + The problem was introduced in 8.16.0 and [fixed](https://github.com/elastic/elasticsearch/pull/130705) in 8.17.9, 8.18.7, 9.0.4. + + Possible workarounds include: + * switching the order of the grouping keys (eg. `STATS ... BY keyword2, keyword1`, if the `keyword2` has a lower cardinality) + * reducing the grouping key cardinality, by filtering out values before STATS