Hi, I have an index created from JSON files and due to the structure of the JSON with multiple same name keys I have now fields which are lists. I am wondering how to use such fields in ESQL queries. For example in the index named someindex there is a document with a field someIDs with the value [123,456]. The query
FROM someindex* | WHERE someIDs IN ("456")
does not find that document. I also tried the query the other way around as in
FROM someindex* | WHERE "456" IN someIDs
but that gave an error.
Hi @duckasylum
Yeah it is kinda weird... try MV_EXPAND
FROM logs-*
| MV_EXPAND someIDs
| where someIDs == "456"
| LIMIT 10