94 lines
1.9 KiB
Plaintext
94 lines
1.9 KiB
Plaintext
[discrete]
|
|
[[esql-from]]
|
|
=== `FROM`
|
|
|
|
The `FROM` source command returns a table with data from a data stream, index,
|
|
or alias.
|
|
|
|
**Syntax**
|
|
|
|
[source,esql]
|
|
----
|
|
FROM index_pattern [METADATA fields]
|
|
----
|
|
|
|
*Parameters*
|
|
|
|
`index_pattern`::
|
|
A list of indices, data streams or aliases. Supports wildcards and date math.
|
|
|
|
`fields`::
|
|
A comma-separated list of <<esql-metadata-fields,metadata fields>> to retrieve.
|
|
|
|
*Description*
|
|
|
|
The `FROM` source command returns a table with data from a data stream, index,
|
|
or alias. Each row in the resulting table represents a document. Each column
|
|
corresponds to a field, and can be accessed by the name of that field.
|
|
|
|
[NOTE]
|
|
====
|
|
By default, an {esql} query without an explicit <<esql-limit>> uses an implicit
|
|
limit of 1000. This applies to `FROM` too. A `FROM` command without `LIMIT`:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM employees
|
|
----
|
|
|
|
is executed as:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM employees
|
|
| LIMIT 1000
|
|
----
|
|
====
|
|
|
|
*Examples*
|
|
|
|
[source,esql]
|
|
----
|
|
FROM employees
|
|
----
|
|
|
|
You can use <<api-date-math-index-names,date math>> to refer to indices, aliases
|
|
and data streams. This can be useful for time series data, for example to access
|
|
today's index:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM <logs-{now/d}>
|
|
----
|
|
|
|
Use comma-separated lists or wildcards to <<esql-multi-index, query multiple data streams, indices,
|
|
or aliases>>:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM employees-00001,other-employees-*
|
|
----
|
|
|
|
Use the format `<remote_cluster_name>:<target>` to <<esql-cross-clusters, query data streams and indices
|
|
on remote clusters>>:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM cluster_one:employees-00001,cluster_two:other-employees-*
|
|
----
|
|
|
|
Use the optional `METADATA` directive to enable <<esql-metadata-fields,metadata fields>>:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM employees METADATA _id
|
|
----
|
|
|
|
Use enclosing double quotes (`"`) or three enclosing double quotes (`"""`) to escape index names
|
|
that contain special characters:
|
|
|
|
[source,esql]
|
|
----
|
|
FROM "this=that", """this[that"""
|
|
----
|