Skip to content

Commit 1632577

Browse files
Apply suggestions from code review
Co-authored-by: Alexander Spies <[email protected]>
1 parent c64bfb9 commit 1632577

File tree

3 files changed

+6
-6
lines changed

3 files changed

+6
-6
lines changed

docs/reference/query-languages/esql/esql-commands.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -691,7 +691,7 @@ FROM firewall_logs
691691
| LOOKUP JOIN threat_list ON source.IP
692692
```
693693

694-
**Host metadata correctlation**: This query pulls in environment or ownership details for each host to correlate your metrics data.
694+
**Host metadata correlation**: This query pulls in environment or ownership details for each host to correlate with your metrics data.
695695

696696
```esql
697697
FROM system_metrics

docs/reference/query-languages/esql/esql-enrich-data.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ For example, you can use `ENRICH` to:
1717

1818
[`ENRICH`](/reference/query-languages/esql/esql-commands.md#esql-enrich) is similar to [`LOOKUP join`](/reference/query-languages/esql/esql-commands.md#esql-lookup-join) in the fact that they both help you join data together. You should use `ENRICH` when:
1919

20-
* Enrichment data doesn't changes frequently
20+
* Enrichment data doesn't change frequently
2121
* You can accept index-time overhead
2222
* You are working with structured enrichment patterns
2323
* You can accept having multiple matches combined into multi-values

docs/reference/query-languages/esql/esql-lookup-join.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,13 @@ The `LOOKUP JOIN` command adds new columns to a table, with data from {{es}} ind
3333
$$$esql-source-index$$$
3434

3535
Source index
36-
: An index which stores enrich data that the `LOOKUP` command can add to input tables. You can create and manage these indices just like a regular {{es}} index. You can use multiple source indices in an enrich policy. You also can use the same source index in multiple enrich policies.
36+
: An index which stores data that the `LOOKUP` command can add to input tables. You can create and manage these indices just like a regular {{es}} index. You also can use the same source index in multiple lookup joins.
3737

3838
## Example
3939

4040
In the case where there are multiple matches on the index `LOOKUP JOIN` the output rows is the combination of each match from the left with each match on the right.
4141

42-
Image you have the two tables:
42+
Imagine you have the two tables:
4343

4444
**Left**
4545

@@ -97,8 +97,8 @@ The following are the current limitations with `LOOKUP JOIN`
9797
* Indices in [lookup](/reference/elasticsearch/index-settings/index-modules.md#index-mode-setting) mode are always single-sharded.
9898
* Cross cluster search is unsupported. Both source and lookup indicies must be local.
9999
* `LOOKUP JOIN` can only use a single match field, and can only use a single index. Wildcards, aliases, and datastreams are not supported.
100-
* The name of the match field in `LOOKUP JOIN lu_idx ON match_field` must match an existing field in the query. This may require renames or evals to achieve it.
101-
* The query will circuit break if you fetch too much data in a single page. A large heap is needed to manage results of multiple megabytes.
100+
* The name of the match field in `LOOKUP JOIN lu_idx ON match_field` must match an existing field in the query. This may require renames or evals to achieve.
101+
* The query will circuit break if many documents from the lookup index have the same key. A large heap is needed to manage results of multiple megabytes per key.
102102
* This limit is per page of data which is about about 10,000 rows.
103103
* Matching many rows per incoming row will count against this limit.
104104
* This limit is approximately the same as for [`ENRICH`](/reference/query-languages/esql/esql-commands.md#esql-enrich).

0 commit comments

Comments
 (0)