Loading

ES|QL MV_CONTAINS function

Embedded
superset
Multivalue expression.
subset

Multivalue expression.

Checks if all values yielded by the second multivalue expression are present in the values yielded by the first multivalue expression. Returns a boolean. Null values are treated as an empty set.

superset subset result
boolean boolean boolean
cartesian_point cartesian_point boolean
cartesian_shape cartesian_shape boolean
date date boolean
date_nanos date_nanos boolean
double double boolean
geo_point geo_point boolean
geo_shape geo_shape boolean
geohash geohash boolean
geohex geohex boolean
geotile geotile boolean
integer integer boolean
ip ip boolean
keyword keyword boolean
keyword text boolean
long long boolean
text keyword boolean
text text boolean
unsigned_long unsigned_long boolean
version version boolean 
ROW set = ["a", "b", "c"], element = "a"
| EVAL set_contains_element = mv_contains(set, element)
set:keyword element:keyword set_contains_element:boolean
[a, b, c] a true 
ROW setA = ["a","c"], setB = ["a", "b", "c"]
| EVAL a_subset_of_b = mv_contains(setB, setA)
| EVAL b_subset_of_a = mv_contains(setA, setB)
setA:keyword setB:keyword a_subset_of_b:boolean b_subset_of_a:boolean
[a, c] [a, b, c] true false 
FROM airports
| WHERE mv_contains(type, ["major","military"]) AND scalerank == 9
| KEEP scalerank, name, country
scalerank:integer name:text country:keyword
9 Chandigarh Int'l India