Description

ESQL needs ability to join with other set of data at search-time

So the functionalites similar to join command in Splunk
But better to follow the standards of SQL (like inner join, outer join, left outer join etc) concept to combine two sets of data

An example would be

FROM employees
| WHERE emp.salary > 50000
| join type=left_join ON manager.id [| from managers | keep manager.id , manager.name, manager.salary]
| keep employee.name, manager.name, manager.salary