mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-06-28 17:34:17 -04:00
7916e6a231
This adds support for `LOOKUP`, a command that implements a sort of
inline `ENRICH`, using data that is passed in the request:
```
$ curl -uelastic:password -HContent-Type:application/json -XPOST \
'localhost:9200/_query?error_trace&pretty&format=txt' \
-d'{
"query": "ROW a=1::LONG | LOOKUP t ON a",
"tables": {
"t": {
"a:long": [ 1, 4, 2],
"v1:integer": [ 10, 11, 12],
"v2:keyword": ["cat", "dog", "wow"]
}
},
"version": "2024.04.01"
}'
v1 | v2 | a
---------------+---------------+---------------
10 |cat |1
```
This required these PRs: * #107624 * #107634 * #107701 * #107762 *
#107923 * #107894 * #107982 * #108012 * #108020 * #108169 * #108191 *
#108334 * #108482 * #108696 * #109040 * #109045
Closes #107306
71 lines
1.9 KiB
Text
71 lines
1.9 KiB
Text
[[esql-commands]]
|
|
=== {esql} commands
|
|
|
|
++++
|
|
<titleabbrev>Commands</titleabbrev>
|
|
++++
|
|
|
|
[[esql-source-commands]]
|
|
// tag::source_commands[]
|
|
==== Source commands
|
|
|
|
An {esql} source command produces a table, typically with data from {es}. An {esql} query must start with a source command.
|
|
|
|
image::images/esql/source-command.svg[A source command producing a table from {es},align="center"]
|
|
|
|
{esql} supports these source commands:
|
|
|
|
* <<esql-from>>
|
|
* <<esql-row>>
|
|
* <<esql-show>>
|
|
|
|
// end::source_command[]
|
|
|
|
[[esql-processing-commands]]
|
|
// tag::proc_commands[]
|
|
==== Processing commands
|
|
|
|
{esql} processing commands change an input table by adding, removing, or changing
|
|
rows and columns.
|
|
|
|
image::images/esql/processing-command.svg[A processing command changing an input table,align="center"]
|
|
|
|
{esql} supports these processing commands:
|
|
|
|
* <<esql-dissect>>
|
|
* <<esql-drop>>
|
|
* <<esql-enrich>>
|
|
* <<esql-eval>>
|
|
* <<esql-grok>>
|
|
* <<esql-keep>>
|
|
* <<esql-limit>>
|
|
ifeval::["{release-state}"=="unreleased"]
|
|
* experimental:[] <<esql-lookup>>
|
|
endif::[]
|
|
* experimental:[] <<esql-mv_expand>>
|
|
* <<esql-rename>>
|
|
* <<esql-sort>>
|
|
* <<esql-stats-by>>
|
|
* <<esql-where>>
|
|
|
|
// end::proc_command[]
|
|
|
|
include::source-commands/from.asciidoc[]
|
|
include::source-commands/row.asciidoc[]
|
|
include::source-commands/show.asciidoc[]
|
|
|
|
include::processing-commands/dissect.asciidoc[]
|
|
include::processing-commands/drop.asciidoc[]
|
|
include::processing-commands/enrich.asciidoc[]
|
|
include::processing-commands/eval.asciidoc[]
|
|
include::processing-commands/grok.asciidoc[]
|
|
include::processing-commands/keep.asciidoc[]
|
|
include::processing-commands/limit.asciidoc[]
|
|
ifeval::["{release-state}"=="unreleased"]
|
|
include::processing-commands/lookup.asciidoc[]
|
|
endif::[]
|
|
include::processing-commands/mv_expand.asciidoc[]
|
|
include::processing-commands/rename.asciidoc[]
|
|
include::processing-commands/sort.asciidoc[]
|
|
include::processing-commands/stats.asciidoc[]
|
|
include::processing-commands/where.asciidoc[]
|