File tree Expand file tree Collapse file tree 1 file changed +10
-0
lines changed
Expand file tree Collapse file tree 1 file changed +10
-0
lines changed Original file line number Diff line number Diff line change @@ -3,3 +3,13 @@ summary: Ban Limit + `MvExpand` before remote Enrich
33area : ES|QL
44type : bug
55issues : []
6+ highlight :
7+ title : Mark Limit + MvExpand before remote Enrich as unsupported
8+ body : |-
9+ Due to the distribured nature of remote `ENRICH`, using a `LIMIT` command followed by a `MV_EXPAND` command before a remote `ENRICH` command
10+ can lead to incorrect results. Such queries are identified by the engine and marked as unsupported, leading to query failure. Example:
11+ [source,yaml]
12+ ----------------------------
13+ FROM *:events | SORT @timestamp | LIMIT 2 | MV_EXPAND ip | ENRICH _remote:clientip_policy ON ip
14+ ----------------------------
15+ Such query will now produce an error. The users are advised to rewrite it (e.g. by placing `ENRICH` earlier in the query) to avoid the error.
You can’t perform that action at this time.
0 commit comments