Use LOOKUP JOIN when your ES|QL result needs context from another Elasticsearch index. Common examples include adding service owner, environment, host inventory, or threat intelligence fields to events during an investigation.
FROM app-logs-*
| WHERE @timestamp >= NOW() - 1 hour
| WHERE log.level IN ("error", "fatal")
| LOOKUP JOIN service_owners ON service.id
| KEEP @timestamp, service.id, service.name, team.name, escalation.email, message
| SORT @timestamp DESC
| LIMIT 50Why this ES|QL pattern helps
Raw logs often tell you what failed but not who owns the service or where the alert should go. A lookup join adds that operational context directly to the query result, which can speed up triage and reduce manual cross-checking during incidents.
What to change for your data
- Replace
service_ownerswith a lookup index or alias configured for your environment. - Join on a stable key such as
service.id,host.name,user.id, or an IP address. - Filter before the join when possible so fewer rows need enrichment.
When to use it
This is useful for Elastic Security enrichment, observability ownership mapping, incident routing, asset inventory lookups, and ES|QL support questions about replacing spreadsheet-based context during investigations.
Source reference: Elastic documentation: ES|QL LOOKUP JOIN command.