You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/reference/query-languages/esql/esql-enrich-data.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,7 +17,7 @@ For example, you can use `ENRICH` to:
17
17
18
18
[`ENRICH`](/reference/query-languages/esql/esql-commands.md#esql-enrich) is similar to [`LOOKUP join`](/reference/query-languages/esql/esql-commands.md#esql-lookup-join) in the fact that they both help you join data together. You should use `ENRICH` when:
19
19
20
-
* Enrichment data doesn't changes frequently
20
+
* Enrichment data doesn't change frequently
21
21
* You can accept index-time overhead
22
22
* You are working with structured enrichment patterns
23
23
* You can accept having multiple matches combined into multi-values
Copy file name to clipboardExpand all lines: docs/reference/query-languages/esql/esql-lookup-join.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,13 +33,13 @@ The `LOOKUP JOIN` command adds new columns to a table, with data from {{es}} ind
33
33
$$$esql-source-index$$$
34
34
35
35
Source index
36
-
: An index which stores enrich data that the `LOOKUP` command can add to input tables. You can create and manage these indices just like a regular {{es}} index. You can use multiple source indices in an enrich policy. You also can use the same source index in multiple enrich policies.
36
+
: An index which stores data that the `LOOKUP` command can add to input tables. You can create and manage these indices just like a regular {{es}} index. You also can use the same source index in multiple lookup joins.
37
37
38
38
## Example
39
39
40
40
In the case where there are multiple matches on the index `LOOKUP JOIN` the output rows is the combination of each match from the left with each match on the right.
41
41
42
-
Image you have the two tables:
42
+
Imagine you have the two tables:
43
43
44
44
**Left**
45
45
@@ -97,8 +97,8 @@ The following are the current limitations with `LOOKUP JOIN`
97
97
* Indices in [lookup](/reference/elasticsearch/index-settings/index-modules.md#index-mode-setting) mode are always single-sharded.
98
98
* Cross cluster search is unsupported. Both source and lookup indicies must be local.
99
99
*`LOOKUP JOIN` can only use a single match field, and can only use a single index. Wildcards, aliases, and datastreams are not supported.
100
-
* The name of the match field in `LOOKUP JOIN lu_idx ON match_field` must match an existing field in the query. This may require renames or evals to achieve it.
101
-
* The query will circuit break if you fetch too much data in a single page. A large heap is needed to manage results of multiple megabytes.
100
+
* The name of the match field in `LOOKUP JOIN lu_idx ON match_field` must match an existing field in the query. This may require renames or evals to achieve.
101
+
* The query will circuit break if many documents from the lookup index have the same key. A large heap is needed to manage results of multiple megabytes per key.
102
102
* This limit is per page of data which is about about 10,000 rows.
103
103
* Matching many rows per incoming row will count against this limit.
104
104
* This limit is approximately the same as for [`ENRICH`](/reference/query-languages/esql/esql-commands.md#esql-enrich).
0 commit comments