usage of WHERE is ambiguous

[JLT032]

Type of issue

None

What documentation page is affected

https://www.elastic.co/docs/reference/query-languages/esql/commands/where

What happened?

this behaviour is subtly implied but not explicitly documented

queries don't return data consistently

FROM filebeat-* | WHERE service.name IN ("name1","name2") | KEEP field1,field2,field3  | STATS count(field2),VALUES(field1),VALUES(field3) by field2,field3,field1

= variation =

FROM filebeat-* | KEEP field1,field2,field3  | WHERE service.name IN ("name1","name2")  | STATS count(field2),VALUES(field1),VALUES(field3) by field2,field3,field1

returns less data than

FROM filebeat-* | KEEP field1,field2,field3  | STATS count(field2),VALUES(field1),VALUES(field3) by field2,field3,field1| WHERE service.name IN ("name1","name2")

Additional info

No response

[yetanothertw]

Thanks for reaching out and highlighting this. We’ve reviewed the issue and added it to our backlog for an upcoming sprint. We’ll keep this thread updated as we make progress. Your feedback helps us make the docs better for everyone. Thank you.