mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-26 16:17:19 -04:00
1256a49c3a
This copies the first line of the description of each command to just under the syntax so that it's "in order", before the `Parameters` section. That way if you are reading from top to bottom you see: ``` syntax short description parameter names and descriptions long description examples ``` I've also removed the `Description` section entirely if the description was just one sentence. So in some cases that just isn't `long description`.
95 lines
1.9 KiB
Text
95 lines
1.9 KiB
Text
[discrete]
|
|
[[esql-from]]
|
|
=== `FROM`
|
|
|
|
The `FROM` source command returns a table with data from a data stream, index,
|
|
or alias.
|
|
|
|
**Syntax**
|
|
|
|
[source,esql]
|
|
----
|
|
FROM index_pattern [METADATA fields]
|
|
----
|
|
|
|
*Parameters*
|
|
|
|
`index_pattern`::
|
|
A list of indices, data streams or aliases. Supports wildcards and date math.
|
|
|
|
`fields`::
|
|
A comma-separated list of <<esql-metadata-fields,metadata fields>> to retrieve.
|
|
|
|
*Description*
|
|
|
|
The `FROM` source command returns a table with data from a data stream, index,
|
|
or alias. Each row in the resulting table represents a document. Each column
|
|
corresponds to a field, and can be accessed by the name of that field.
|
|
|
|
[NOTE]
|
|
====
|
|
By default, an {esql} query without an explicit <<esql-limit>> uses an implicit
|
|
limit of 1000. This applies to `FROM` too. A `FROM` command without `LIMIT`:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM employees
|
|
----
|
|
|
|
is executed as:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM employees
|
|
| LIMIT 1000
|
|
----
|
|
====
|
|
|
|
*Examples*
|
|
|
|
[source,esql]
|
|
----
|
|
FROM employees
|
|
----
|
|
|
|
You can use <<api-date-math-index-names,date math>> to refer to indices, aliases
|
|
and data streams. This can be useful for time series data, for example to access
|
|
today's index:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM <logs-{now/d}>
|
|
----
|
|
|
|
Use comma-separated lists or wildcards to query multiple data streams, indices,
|
|
or aliases:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM employees-00001,other-employees-*
|
|
----
|
|
|
|
Use the format `<remote_cluster_name>:<target>` to query data streams and indices
|
|
on remote clusters:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM cluster_one:employees-00001,cluster_two:other-employees-*
|
|
----
|
|
|
|
See <<esql-cross-clusters, using {esql} across clusters>>.
|
|
|
|
Use the optional `METADATA` directive to enable <<esql-metadata-fields,metadata fields>>:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM employees METADATA _id
|
|
----
|
|
|
|
Use enclosing double quotes (`"`) or three enclosing double quotes (`"""`) to escape index names
|
|
that contain special characters:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM "this=that", """this[that"""
|
|
----
|