Nest ES|QL queries using subqueries

A subquery is a complete ES|QL query wrapped in parentheses, nested inside another query. Each subquery runs independently and cannot reference columns from the outer query.

You can use subqueries in two places:

• In a FROM command: each subquery runs its own pipeline and its rows are combined into the outer result set.
• With IN or NOT IN: the subquery returns one column, or a tuple of columns matched by position, and can appear in WHERE. It can also appear in EVAL, and the per-aggregate WHERE of STATS and INLINE STATS Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. .

A subquery starts with one of the following source commands:

• FROM: read from an index pattern.
• TS: read from a time series index pattern.
• ROW: synthesize rows from literal values.

The source command can be followed by zero or more piped processing commands:

• CHANGE_POINT
• COMPLETION
• DISSECT
• DROP
• ENRICH
• EVAL
• GROK
• INLINE STATS
• KEEP
• LIMIT
• LOOKUP JOIN
• MV_EXPAND
• RENAME
• RERANK
• SAMPLE
• SORT
• STATS
• WHERE

• Use subqueries in a FROM command: combine result sets from independently processed sources.
• Use subqueries with IN and NOT IN: filter or evaluate rows against another query.
• Runtime search: how a full-text search after a FROM with subqueries contributes to _score.