elasticsearch icon indicating copy to clipboard operation
elasticsearch copied to clipboard

ESQL: Joining with sub-search results

Open getkub opened this issue 1 year ago • 10 comments

Description

ESQL needs ability to join with other set of data at search-time

So the functionalites similar to join command in Splunk But better to follow the standards of SQL (like inner join, outer join, left outer join etc) concept to combine two sets of data

An example would be

FROM employees
| WHERE emp.salary > 50000
| join type=left_join ON manager.id [| from managers | keep manager.id , manager.name, manager.salary]
| keep employee.name, manager.name, manager.salary

getkub avatar Oct 20 '23 09:10 getkub