[DOCS] ES|QL: Adding a tip to the WHERE documentation

[KyleOnK8s]

The WHERE clause in ES|QL will exclude null results when using a != operator. Examples provided in screenshots. This is the opposite behavior from other query languages supported in Elastic. I tested KQL, Query DSL, and Lucene. I did not test any scripting languages.

This can result in users accidentally excluding data they do not want to. This is especially concerning in Security applications where customers are building their rules to span multiple source types and those source types have mapping conflicts or other field disparity.

There is currently no information on this behavior in the ES|QL support docs. This PR is to address documentation.

No filters (for reference)

KQL

Lucene

Query DSL

ES|QL without filters (for reference)

ES|QL with NOT filter only (excludes the null result)

ES|QL with NOT or IS NULL filter (includes the null result)

[github-actions]

Documentation preview:

• ✨ Changed pages

[elasticsearchmachine]

@KyleOnK8s please enable the option "Allow edits and access to secrets by maintainers" on your PR. For more information, see the documentation.

[elasticsearchmachine]

Pinging @elastic/es-docs (Team:Docs)

[KyleOnK8s]

@KyleOnK8s please enable the option "Allow edits and access to secrets by maintainers" on your PR. For more information, see the documentation.

This option does not appear to exist for me. Docs team, please let me know if you need me to do something differently.