From 01d7870f54db2562240a5ebbb8541e1190ee3626 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Mon, 29 Sep 2025 08:10:43 -0600 Subject: [PATCH] Add release note for #135051 (#135475) * Add release note for #135051 --- docs/changelog/135051.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/changelog/135051.yaml b/docs/changelog/135051.yaml index f9b22e0f9d570..f1f0e9765db64 100644 --- a/docs/changelog/135051.yaml +++ b/docs/changelog/135051.yaml @@ -3,3 +3,13 @@ summary: Ban Limit + `MvExpand` before remote Enrich area: ES|QL type: bug issues: [] +highlight: + title: Prevent LIMIT + MV_EXPAND before remote ENRICH + body: |- + Queries using LIMIT followed by MV_EXPAND before a remote ENRICH can produce incorrect results due to distributed execution semantics. + These queries are now unsupported and produce an error. Example: + [source,yaml] + ---------------------------- + FROM *:events | SORT @timestamp | LIMIT 2 | MV_EXPAND ip | ENRICH _remote:clientip_policy ON ip + ---------------------------- + To avoid this error, reorder your query, for example by moving ENRICH earlier in the pipeline.