## FROM

The `FROM` command in ES|QL is a source command that returns a table with data from a data stream, index, or alias. Each row in the resulting table represents a document, and each column corresponds to a field, which can be accessed by the name of that field.

By default, an ES|QL query without an explicit `LIMIT` uses an implicit limit of 1000. This applies to `FROM` too. For example, a `FROM` command without `LIMIT`:

```esql
FROM employees
```

is executed as:

```esql
FROM employees
| LIMIT 1000
```

You can use date math to refer to indices, aliases and data streams, which can be useful for time series data. For example, to access today’s index:

```esql
FROM <logs-{now/d}>
```

You can use comma-separated lists or wildcards to query multiple data streams, indices, or aliases:

```esql
FROM employees-00001,other-employees-*
```

You can also use the format `<remote_cluster_name>:<target>` to query data streams and indices on remote clusters:

```esql
FROM cluster_one:employees-00001,cluster_two:other-employees-*
```

The optional `METADATA` directive can be used to enable metadata fields:

```esql
FROM employees METADATA _id
```

### Syntax

`FROM index_pattern [METADATA fields]`

#### Parameters

- `index_pattern`: A list of indices, data streams or aliases. Supports wildcards and date math.
- `fields`: A comma-separated list of metadata fields to retrieve.

### Limitations

Please note that the `FROM` command does not support querying time series data streams (TSDS). For more details on the limitations of ES|QL, refer to the [ES|QL limitations](https://www.elastic.co/guide/en/elasticsearch/reference/current/sql-limitations.html) documentation.