mirrors
/
elasticsearch
mirror of https://mirror.osredm.com/root/elasticsearch.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] Update esql-lookup-join.md (#127306) 

- I trimmed the KEEP query in my final iteration in https://github.com/elastic/elasticsearch/pull/127215 but neglected to update the query itself, only the response. This fixes that so the query matches the response.

- 🚘 I also updated the table response to match other ESQL response tables
This commit is contained in:
Liam Thompson 2025-04-24 12:32:17 +02:00 committed by GitHub
parent ff1c9b7c6c
commit c4cba5a545
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/reference/query-languages/esql/esql-lookup-join.md
View File

@ -122,7 +122,7 @@ FROM firewall_logs # The source index
| LOOKUP JOIN threat_list ON source.ip # The lookup index and join field
| WHERE threat_level IS NOT NULL # Filter for rows non-null threat levels
| SORT timestamp # LOOKUP JOIN does not guarantee output order, so you must explicitly sort the results if needed
| KEEP timestamp, source.ip, destination.ip, action, threat_level, threat_type # Keep only relevant fields
| KEEP source.ip, action, threat_type, threat_level # Keep only relevant fields
| LIMIT 10 # Limit the output to 10 rows
```
@ -130,13 +130,11 @@ FROM firewall_logs # The source index
A successful query will output a table. In this example, you can see that the `source.ip` field from the `firewall_logs` index is matched with the `source.ip` field in the `threat_list` index, and the corresponding `threat_level` and `threat_type` fields are added to the output.
```
source.ip | action | threat_type | threat_level
---------------+---------------+---------------+---------------
203.0.113.5 |allow |C2_SERVER |high
198.51.100.2 |block |SCANNER |medium
203.0.113.5 |allow |C2_SERVER |high
```
|source.ip|action|threat_type|threat_level|
|---|---|---|---|
|203.0.113.5|allow|C2_SERVER|high|
|198.51.100.2|block|SCANNER|medium|
|203.0.113.5|allow|C2_SERVER|high|
### Additional examples