Skip to content

Commit f9e71ec

Browse files
ES|QL: Add Known Issues note about STATS (v 8.x) elastic#130644 (elastic#131001)
1 parent b190eed commit f9e71ec

File tree

2 files changed

+24
-0
lines changed

2 files changed

+24
-0
lines changed

docs/reference/esql/esql-limitations.asciidoc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,3 +219,17 @@ the <<esql-mv-functions,multivalue functions>>.
219219
=== Kibana limitations
220220

221221
include::esql-kibana.asciidoc[tag=limitations]
222+
223+
[discrete]
224+
[[esql-known-issues]]
225+
== Known issues
226+
227+
A bug in the ES|QL STATS command may yield incorrect results. The bug only happens in very specific cases that follow this pattern: `STATS ... BY keyword1, keyword2`, i.e. the command must have exactly two grouping fields, both keywords, where the first field has high cardinality (more than 65k distinct values).
228+
229+
The bug is described in detail in [this issue](https://github.com/elastic/elasticsearch/issues/130644).
230+
The problem was introduced in 8.16.0 and [fixed](https://github.com/elastic/elasticsearch/pull/130705) in 8.17.9, 8.18.7.
231+
232+
Possible workarounds include:
233+
* switching the order of the grouping keys (eg. `STATS ... BY keyword2, keyword1`, if the `keyword2` has a lower cardinality)
234+
* reducing the grouping key cardinality, by filtering out values before STATS
235+

docs/reference/release-notes/8.16.0.asciidoc

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -517,3 +517,13 @@ Snapshot/Restore::
517517
{esql}::
518518

519519
* Some valid queries using an `ENRICH` command can fail when a match field is used that is absent from some indices or shards, either with a 500 status code due to `NullPointerException` or `ClassCastException` or with a 400 status code and `IllegalArgumentException`. This is fixed in {es-pull}126187[#126187].
520+
521+
* A bug in the ES|QL STATS command may yield incorrect results. The bug only happens in very specific cases that follow this pattern: `STATS ... BY keyword1, keyword2`, i.e. the command must have exactly two grouping fields, both keywords, where the first field has high cardinality (more than 65k distinct values).
522+
523+
The bug is described in detail in [this issue](https://github.com/elastic/elasticsearch/issues/130644).
524+
The problem was introduced in 8.16.0 and [fixed](https://github.com/elastic/elasticsearch/pull/130705) in 8.17.9, 8.18.7.
525+
526+
Possible workarounds include:
527+
* switching the order of the grouping keys (eg. `STATS ... BY keyword2, keyword1`, if the `keyword2` has a lower cardinality)
528+
* reducing the grouping key cardinality, by filtering out values before STATS
529+

0 commit comments

Comments
 (0)