elastic / elastic/roadmap

ES|QL Lookup Join functionality equivalent to Enrich for usage at query time

Open
#64 0 comments 0 reactions 1 assignee Assigned to @tylerperk View on GitHub
Component: Elasticsearch product-area:observability product-area:search product-area:security
Dominant language
No language data
Stars
6
Forks
1
PR merge metrics
No merged PRs in 30d

Description

**Value Proposition**

ES|QL added support for join-like operations early on with ENRICH, as it was convenient to reuse the existing ENRICH infrastructure from ingest pipelines. However, as ENRICH was optimised for ingest time lookups and small datasets that don’t change often, it has a poor UX with many commonly reported limitations when it is used for query time lookups as in ES|QL. To address this we introduced Lookup Join, which has advantages over ENRICH (lookup indices are directly updatable without enrich policy execution, lookup join supports complex expression joins...) but still has some feature gaps (lookup join doesn't support date/IP/numeric range matches like ENRICH, etc). This puts the burden on users to understand whether they should use ENRICH or LOOKUP JOIN in their queries. The goal is to achieve feature parity to remove that burden.

**Expected Outcome**

Lookup join will have feature parity with enrich, making Lookup Join the clear choice and removing user confusion about which feature to use. As we invest in Lookup Join enhancements and optimisations, we're also building a stronger foundation for additional types of joins in the future.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.