Skip to content

Remove limitation of using full text functions after LIMIT #115297

@ioanatia

Description

@ioanatia

When using match or qstr after limit we are returning an error that indicates this is not currently supported:

FROM kibana_sample_data_logs
| LIMIT 10000 
| WHERE MATCH(geo.dest, \"CN\")

In Kibana, in order to suggest values for filters, we construct a query similar to:

FROM kibana_sample_data_logs
| LIMIT 10000
| WHERE MATCH(geo.dest, \"CN\")
| WHERE `geo.src` IS NOT NULL
| STATS `geo.src_terms` = count(`geo.src`) BY `geo.src`
| SORT `geo.src_terms` DESC\n 
| LIMIT 10

This query would return suggested values for the geo.src field:

Image

Because of the limitation we have for match where it cannot be used after limit, Kibana will return an error when it tries to suggest values for filters:

Image

related elastic/kibana#196995

Kibana is one use case that would benefit from removing this limitation.
We can expect that ES|QL users will also hit it in other contexts.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions