ES|QL FROM command
The FROM source command returns a table with data from a data stream, index,
or alias.
For time series data, use the TS source command instead of FROM. TS enables time series aggregation functions and is optimized for processing time series indices.
FROM index_pattern [METADATA fields]
FROM index_pattern [, (FROM index_pattern [METADATA fields] [| processing_commands])]* [METADATA fields]
FROM (FROM index_pattern [METADATA fields] [| processing_commands]) [, (FROM index_pattern [METADATA fields] [| processing_commands])]* [METADATA fields]
index_pattern- A list of indices, data streams or aliases. Supports wildcards and date math.
fields- A comma-separated list of metadata fields to retrieve.
The FROM source command returns a table with data from a data stream, index,
or alias. Each row in the resulting table represents a document. Each column
corresponds to a field, and can be accessed by the name of that field.
By default, an ES|QL query without an explicit LIMIT uses an implicit
limit of 1000. This applies to FROM too. A FROM command without LIMIT:
FROM employees
is executed as:
FROM employees
| LIMIT 1000
The FROM command supports subqueries,
which are complete ES|QL queries wrapped in parentheses. Each subquery starts
with a FROM source command followed by zero or more piped processing commands.
Multiple subqueries and regular index patterns can be combined in a single
FROM clause, separated by commas.
FROM
employees,
(FROM sample_data | WHERE client_ip == "172.21.3.15")
The following examples show common FROM patterns.
FROM employees
Use date math to refer to indices, aliases, and data streams. This can be useful for time series data, for example to access today’s index:
FROM <logs-{now/d}>
Use comma-separated lists or wildcards to query multiple data streams, indices, or aliases:
FROM employees-00001,other-employees-*
Use the format <remote_cluster_name>:<target> to
query data streams and indices on remote clusters:
FROM cluster_one:employees-00001,cluster_two:other-employees-*
By default, queries run across the origin project and all linked projects. To learn more, refer to query across serverless projects.
Use the optional METADATA directive to enable
metadata fields:
FROM employees METADATA _id
Use enclosing double quotes (") or three enclosing double quotes (""") to escape index names
that contain special characters:
FROM "this=that", """this[that"""