Skip to content

Commit 51c8726

Browse files
committed
Add release note for elastic#135051
1 parent a8fa797 commit 51c8726

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

docs/changelog/135051.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,13 @@ summary: Ban Limit + `MvExpand` before remote Enrich
33
area: ES|QL
44
type: bug
55
issues: []
6+
highlight:
7+
title: Mark Limit + MvExpand before remote Enrich as unsupported
8+
body: |-
9+
Due to the distribured nature of remote `ENRICH`, using a `LIMIT` command followed by a `MV_EXPAND` command before a remote `ENRICH` command
10+
can lead to incorrect results. Such queries are identified by the engine and marked as unsupported, leading to query failure. Example:
11+
[source,yaml]
12+
----------------------------
13+
FROM *:events | SORT @timestamp | LIMIT 2 | MV_EXPAND ip | ENRICH _remote:clientip_policy ON ip
14+
----------------------------
15+
Such query will now produce an error. The users are advised to rewrite it (e.g. by placing `ENRICH` earlier in the query) to avoid the error.

0 commit comments

Comments
 (0)