When using match or qstr after limit we are returning an error that indicates this is not currently supported:
FROM kibana_sample_data_logs
| LIMIT 10000
| WHERE MATCH(geo.dest, \"CN\")
In Kibana, in order to suggest values for filters, we construct a query similar to:
FROM kibana_sample_data_logs
| LIMIT 10000
| WHERE MATCH(geo.dest, \"CN\")
| WHERE `geo.src` IS NOT NULL
| STATS `geo.src_terms` = count(`geo.src`) BY `geo.src`
| SORT `geo.src_terms` DESC\n
| LIMIT 10
This query would return suggested values for the geo.src field:

Because of the limitation we have for match where it cannot be used after limit, Kibana will return an error when it tries to suggest values for filters:

related elastic/kibana#196995
Kibana is one use case that would benefit from removing this limitation.
We can expect that ES|QL users will also hit it in other contexts.
When using
matchorqstrafterlimitwe are returning an error that indicates this is not currently supported:In Kibana, in order to suggest values for filters, we construct a query similar to:
This query would return suggested values for the
geo.srcfield:Because of the limitation we have for
matchwhere it cannot be used afterlimit, Kibana will return an error when it tries to suggest values for filters:related elastic/kibana#196995
Kibana is one use case that would benefit from removing this limitation.
We can expect that ES|QL users will also hit it in other contexts.