ES|QL MV_INTERSECTION function
field1- Expression that can be null, a single value, or multiple values. If null, the function returns null.
field2-
Expression that can be null, a single value, or multiple values. If null, the function returns null.
Returns the values that appear in both input fields. Returns null if either field is null or if no values match.
| field1 | field2 | result |
|---|---|---|
| boolean | boolean | boolean |
| cartesian_point | cartesian_point | cartesian_point |
| cartesian_shape | cartesian_shape | cartesian_shape |
| date | date | date |
| date_nanos | date_nanos | date_nanos |
| double | double | double |
| geo_point | geo_point | geo_point |
| geo_shape | geo_shape | geo_shape |
| geohash | geohash | geohash |
| geohex | geohex | geohex |
| geotile | geotile | geotile |
| integer | integer | integer |
| ip | ip | ip |
| keyword | keyword | keyword |
| keyword | text | keyword |
| long | long | long |
| text | keyword | keyword |
| text | text | keyword |
| unsigned_long | unsigned_long | unsigned_long |
| version | version | version |
ROW a = [1, 2, 3, 4, 5], b = [2, 3, 4, 5, 6]
| EVAL finalValue = MV_INTERSECTION(a, b)
| KEEP finalValue
| finalValue:integer |
|---|
| [2, 3, 4, 5] |
ROW a = [1, 2, 3, 4, 5]::long, b = [2, 3, 4, 5, 6]::long
| EVAL finalValue = MV_INTERSECTION(a, b)
| KEEP finalValue
| finalValue:long |
|---|
| [2, 3, 4, 5] |
ROW a = [true, false, false, false], b = [false]
| EVAL finalValue = MV_INTERSECTION(a, b)
| KEEP finalValue
| finalValue:boolean |
|---|
| [false] |
ROW a = [5.2, 10.5, 1.12345, 2.6928], b = [10.5, 2.6928]
| EVAL finalValue = MV_INTERSECTION(a, b)
| KEEP finalValue
| finalValue:double |
|---|
| [10.5, 2.6928] |
ROW a = ["one", "two", "three", "four", "five"], b = ["one", "four"]
| EVAL finalValue = MV_INTERSECTION(a, b)
| KEEP finalValue
| finalValue:keyword |
|---|
| ["one", "four"] |