Skip to content

Remove limitation of using full text functions after LIMIT #115297

Closed
@ioanatia

Description

@ioanatia

When using match or qstr after limit we are returning an error that indicates this is not currently supported:

FROM kibana_sample_data_logs
| LIMIT 10000 
| WHERE MATCH(geo.dest, \"CN\")

In Kibana, in order to suggest values for filters, we construct a query similar to:

FROM kibana_sample_data_logs
| LIMIT 10000
| WHERE MATCH(geo.dest, \"CN\")
| WHERE `geo.src` IS NOT NULL
| STATS `geo.src_terms` = count(`geo.src`) BY `geo.src`
| SORT `geo.src_terms` DESC\n 
| LIMIT 10

This query would return suggested values for the geo.src field:

Image

Because of the limitation we have for match where it cannot be used after limit, Kibana will return an error when it tries to suggest values for filters:

Image

related elastic/kibana#196995

Kibana is one use case that would benefit from removing this limitation.
We can expect that ES|QL users will also hit it in other contexts.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions