Skip to content

[FEATURE] Support implicit field joins when fields match across indices #5484

@Swiddis

Description

@Swiddis

Is your feature request related to a problem?
Consider a query like:

source = idx1 | join left=l right=r on l.fieldname = r.fieldname idx2

It would be nice if, because fieldname is the same in both indices, we could write:

source = idx1 | join left=l right=r on fieldname idx2

This currently returns:

{
  "error": {
    "details": "Ambiguous field: fieldname",
    "reason": "Invalid Query",
    "type": "IllegalArgumentException"
  },
  "status": 400
}

What solution would you like?
Implement this type of auto-field-join

What alternatives have you considered?
At least make the error more obvious

Do you have any additional context?
N/A

Metadata

Metadata

Assignees

No one assigned

    Labels

    PPLPiped processing languageenhancementNew feature or requestuntriaged

    Type

    No type
    No fields configured for issues without a type.

    Projects

    Status

    Not Started

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions