from languages_lookup_non_unique_ke* | enrich languages_policy on language_name | sort country DESC, language_code ASC NULLS LAST, language_name NULLS FIRST | limit 14081 | keep `language_name`, `country`, *, `country.keyword` | mv_expand country.keyword | grok language_name "%{WORD:YEcxuCOHsGzb} %{WORD:country.keyword}"| rename country.keyword as other1| rename language_code as other2 | lookup join multi_column_joinable_lookup on other1, other2 | where NOT id_int <= 50 OR NOT false AND NOT other2 == 50 | where false AND NOT true OR id_int > 50 AND true | where NOT false AND other2 == 50 

{ "error": { "root_cause": [ { "type": "rule_execution_exception", "reason": "Rule execution limit [100] reached" } ], "type": "rule_execution_exception", "reason": "Rule execution limit [100] reached" }, "status": 500 }