Cartesian Product
A query operation that produces all possible combinations of
events from two or more subqueries. When multiple subqueries
each return multiple events, a cartesian product results in
every event from one subquery being paired with every event from
another subquery, producing quadratic output growth or worse.
For example, if one subquery returns 100 events and another
returns 200 events, the cartesian product produces 20,000 result
events (100 x 200 combinations). This quadratic growth can cause
performance issues and excessive resource consumption. Certain
query functions can potentially produce cartesian products. For
example, stats() and the
[ ] subquery syntax can produce
a cartesian product, as can collect() when
used on multiple fields with
multival=false. Cartesian products are
not allowed in persisted aggregations.
aggregation
groupby
join