EQL allows you to issue a request against normalized records, using record-to-record relationship filter expressions. These types of requests are called Record Relationship Navigation (RRN) queries.

If you have different record types in your source data, you can keep the records uncombined by using a Switch join in your pipeline. Then, by issuing an RRN query, the MDEX Engine can apply a relationship filter to the records at query time. Depending on how you have tagged the properties on the records, an RRN query can return records of only one type or of multiple types.

For example, assume that you want to have three record types (Author records, Book records, and Editor records). To define the record type, all the records have a property named Recordtype (the actual name does not matter). Author records have this property set to “author”, Book records have it set to “book”, and Editor records use a value of “editor”. In your pipeline, you use a Switch join to leave those records uncombined. You can then filter Book records via relationship filters with Author and Editor records, but the returned records (and their dimension refinements) will be Book records only. This means that any other query parameters apply only to the record type that is returned.