@@ -4585,6 +4585,37 @@ emp_no:integer | language_code:integer | language_name:keyword
4585
4585
10004 |null |null
4586
4586
;
4587
4587
4588
+ lookupJoinOnTimeSeriesIndex
4589
+ required_capability: join_lookup_v12
4590
+
4591
+ FROM k8s
4592
+ | RENAME network.bytes_in AS language_code
4593
+ | WHERE language_code < 10
4594
+ | LOOKUP JOIN languages_lookup ON language_code
4595
+ | DROP network*, event
4596
+ | SORT language_code, @timestamp
4597
+ ;
4598
+
4599
+ @timestamp:date |client.ip:ip |cluster:keyword|language_code:long|pod:keyword |language_name:keyword
4600
+ 2024-05-10T00:17:14.000Z|10.10.20.35 |prod |0 |one |null
4601
+ 2024-05-10T00:07:33.000Z|10.10.20.32 |qa |1 |two |English
4602
+ 2024-05-10T00:20:00.000Z|10.10.20.35 |staging |1 |three |English
4603
+ 2024-05-10T00:18:02.000Z|10.10.20.33 |qa |2 |one |French
4604
+ 2024-05-10T00:04:49.000Z|10.10.20.34 |prod |3 |one |Spanish
4605
+ 2024-05-10T00:05:16.000Z|10.10.20.35 |prod |3 |one |Spanish
4606
+ 2024-05-10T00:05:58.000Z|10.10.20.30 |qa |3 |two |Spanish
4607
+ 2024-05-10T00:06:07.000Z|10.10.20.32 |staging |3 |two |Spanish
4608
+ 2024-05-10T00:07:19.000Z|10.10.20.32 |qa |3 |one |Spanish
4609
+ 2024-05-10T00:09:58.000Z|10.10.20.35 |prod |3 |one |Spanish
4610
+ 2024-05-10T00:16:55.000Z|10.10.20.32 |staging |3 |two |Spanish
4611
+ 2024-05-10T00:22:42.000Z|10.10.20.30 |staging |3 |three |Spanish
4612
+ 2024-05-10T00:22:49.000Z|10.10.20.34 |staging |3 |two |Spanish
4613
+ 2024-05-10T00:11:24.000Z|10.10.20.35 |qa |4 |two |German
4614
+ 2024-05-10T00:14:33.000Z|10.10.20.30 |prod |4 |two |German
4615
+ 2024-05-10T00:18:02.000Z|10.10.20.33 |staging |4 |one |German
4616
+ 2024-05-10T00:19:48.000Z|10.10.20.32 |prod |4 |three |German
4617
+ ;
4618
+
4588
4619
###############################################
4589
4620
# LOOKUP JOIN on date_nanos field
4590
4621
###############################################
0 commit comments