ES|QL KEEP command

The KEEP processing command enables you to specify what columns are returned and the order in which they are returned.

KEEP columns
		

columns

A comma-separated list of columns to keep. Supports wildcards. See below for the behavior in case an existing column matches multiple given wildcards or column names.

The KEEP processing command enables you to specify what columns are returned and the order in which they are returned.

Precedence rules are applied when a field name matches multiple expressions. Fields are added in the order they appear. If one field matches multiple expressions, the following precedence rules apply (from highest to lowest priority):

1. Complete field name (no wildcards)
2. Partial wildcard expressions (for example: fieldNam*)
3. Wildcard only (*)

If a field matches two expressions with the same precedence, the rightmost expression wins.

The following examples show how to select columns and illustrate the wildcard precedence rules.

Columns are returned in the order they are listed:

FROM employees
| KEEP emp_no, first_name, last_name, height
		

Rather than specify each column by name, you can use wildcards to return all columns with a name that matches a pattern:

FROM employees
| KEEP h*
		

The asterisk wildcard (*) by itself translates to all columns that do not match the other arguments. This query returns all columns with a name that starts with h, followed by all other columns:

FROM employees
| KEEP h*, *
		

Complete field name has precedence over wildcard expressions:

FROM employees
| KEEP first_name, last_name, first_name*
		

Wildcard expressions have the same priority, but the rightmost one wins (despite being less specific):

FROM employees
| KEEP first_name*, last_name, first_na*
		

A simple wildcard expression * has the lowest precedence. Output order is determined by the other arguments:

FROM employees
| KEEP *, first_name