Skip to content

Commit 1705756

Browse files
authored
Document filter usage for column elimination cases (elastic#136536)
1 parent 4ccd68e commit 1705756

File tree

1 file changed

+36
-0
lines changed

1 file changed

+36
-0
lines changed

docs/reference/query-languages/esql/esql-rest.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,42 @@ Douglas Adams |The Hitchhiker's Guide to the Galaxy|180 |1979-10-12T
152152
% TESTRESPONSE[s/\|/\\|/ s/\+/\\+/]
153153
% TESTRESPONSE[non_json]
154154

155+
#### Filter vs WHERE clause behavior
156+
157+
The `filter` parameter can eliminate columns from the result set when it skips entire indices.
158+
This is useful for resolving type conflicts between attributes of different indices.
159+
160+
For example, if several days of data in a data stream were indexed with an incorrect type, you can use a filter to exclude the incorrect range.
161+
This allows {{esql}} to use the correct type for the remaining data without changing the source pattern.
162+
163+
##### Example
164+
165+
Consider querying `index-1` with an `f1` attribute and `index-2` with an `f2` attribute.
166+
167+
Using a filter the following query returns only the `f1` column:
168+
169+
```console
170+
POST /_query?format=txt
171+
{
172+
"query": "FROM index-*",
173+
"filter": {
174+
"term": {
175+
"f1": *
176+
}
177+
}
178+
}
179+
```
180+
181+
Using a WHERE clause returns both the `f1` and `f2` columns:
182+
183+
```console
184+
POST /_query?format=txt
185+
{
186+
"query": "FROM index-* WHERE f1 is not null"
187+
}
188+
```
189+
190+
155191
### Columnar results [esql-rest-columnar]
156192

157193
By default, {{esql}} returns results as rows. For example, `FROM` returns each individual document as one row. For the `json`, `yaml`, `cbor` and `smile` [formats](#esql-rest-format), {{esql}} can return the results in a columnar fashion where one row represents all the values of a certain column in the results.

0 commit comments

Comments
 (0)