ES|QL MV_EXPAND command
The MV_EXPAND processing command expands multivalued columns into one row per
value, duplicating other columns.
MV_EXPAND column
column- The multivalued column to expand.
Warning
MV_EXPAND does not preserve the sort order from a preceding SORT. The output
rows can be in any order. To guarantee a certain ordering, place a SORT after
MV_EXPAND.
Additionally, if a WHERE clause follows MV_EXPAND, it may prevent the query
planner from merging a preceding SORT with a trailing LIMIT into an
efficient TopN operation. In such cases, the query will fail with a
validation exception: MV_EXPAND [MV_EXPAND field] cannot yet have an unbounded SORT [SORT field] before it: either move the SORT after it, or add a LIMIT after the SORT.
To work around this, add a LIMIT before MV_EXPAND:
FROM index | SORT field | LIMIT 1000 | MV_EXPAND mv_field | WHERE mv_field == "value"
ROW a=[1,2,3], b="b", j=["a","b"]
| MV_EXPAND a
| a:integer | b:keyword | j:keyword |
|---|---|---|
| 1 | b | ["a", "b"] |
| 2 | b | ["a", "b"] |
| 3 | b | ["a", "b"] |