ES|QL MV_FIRST function
field-
Multivalue expression.
Converts a multivalued expression into a single valued column containing the first value. This is most useful when reading from a function that emits multivalued columns in a known order like SPLIT.
The order that multivalued fields are read from
underlying storage is not guaranteed. It is frequently ascending, but don’t
rely on that. If you need the minimum value use MV_MIN instead of
MV_FIRST. MV_MIN has optimizations for sorted values so there isn’t a
performance benefit to MV_FIRST.
| field | result |
|---|---|
| boolean | boolean |
| cartesian_point | cartesian_point |
| cartesian_shape | cartesian_shape |
| date | date |
| date_nanos | date_nanos |
| double | double |
| geo_point | geo_point |
| geo_shape | geo_shape |
| geohash | geohash |
| geohex | geohex |
| geotile | geotile |
| integer | integer |
| ip | ip |
| keyword | keyword |
| long | long |
| text | keyword |
| unsigned_long | unsigned_long |
| version | version |
ROW a="foo;bar;baz"
| EVAL first_a = MV_FIRST(SPLIT(a, ";"))
| a:keyword | first_a:keyword |
|---|---|
| foo;bar;baz | "foo" |