elasticsearch
elasticsearch copied to clipboard
ESQL: Joining with sub-search results
Description
ESQL needs ability to join with other set of data at search-time
So the functionalites similar to join command in Splunk But better to follow the standards of SQL (like inner join, outer join, left outer join etc) concept to combine two sets of data
An example would be
FROM employees
| WHERE emp.salary > 50000
| join type=left_join ON manager.id [| from managers | keep manager.id , manager.name, manager.salary]
| keep employee.name, manager.name, manager.salary