Nest ES|QL queries using subqueries

A subquery is a complete ES|QL query wrapped in parentheses, nested inside another query. Each subquery runs independently and cannot reference columns from the outer query.

You can use subqueries in two places:

• In a FROM command: each subquery runs its own pipeline and its rows are combined into the outer result set.
• In a WHERE command with IN or NOT IN: the subquery returns exactly one column, and the outer query filters rows against those values.

A subquery starts with one of the following source commands:

• FROM: read from an index pattern.
• TS: read from a time series index pattern.
• ROW: synthesize rows from literal values.

The source command can be followed by zero or more piped processing commands:

• CHANGE_POINT
• COMPLETION
• DISSECT
• DROP
• ENRICH
• EVAL
• GROK
• INLINE STATS
• KEEP
• LIMIT
• LOOKUP JOIN
• MV_EXPAND
• RENAME
• RERANK
• SAMPLE
• SORT
• STATS
• WHERE

• Use subqueries in a FROM command: combine result sets from independently processed sources.
• Use subqueries in a WHERE command: filter rows with IN or NOT IN.