---
title: ES|QL MV_DIFFERENCE function
description: 
url: https://www.elastic.co/elastic/docs-builder/docs/3601/reference/query-languages/esql/functions-operators/mv-functions/mv_difference
products:
  - Elasticsearch
---

# ES|QL MV_DIFFERENCE function
<applies-to>
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.4
</applies-to>

Returns values from first field not in second field.

## Syntax

![Embedded](https://www.elastic.co/elastic/docs-builder/docs/3601/reference/query-languages/esql/images/generated/x-pack-esql/functions/mv_difference.svg)


## Parameters

<definitions>
  <definition term="field1">
    Expression that can be null, a single value, or multiple values. If null, the function returns null.
  </definition>
  <definition term="field2">
    Expression that can be null, a single value, or multiple values. If null, the function returns field1.
  </definition>
</definitions>


## Description

Returns the values that appear in the first field, except those that appear in the second. Returns `null` if the first expression is null (nothing to remove) or the value of the first field if the second is null.

## Supported types


| field1                                                    | field2                                                    | result          |
|-----------------------------------------------------------|-----------------------------------------------------------|-----------------|
| boolean                                                   | boolean                                                   | boolean         |
| cartesian_point                                           | cartesian_point                                           | cartesian_point |
| cartesian_shape                                           | cartesian_shape                                           | cartesian_shape |
| date                                                      | date                                                      | date            |
| date_nanos                                                | date_nanos                                                | date_nanos      |
| double                                                    | double                                                    | double          |
| flattened <applies-to>Elastic Stack: Planned</applies-to> | flattened <applies-to>Elastic Stack: Planned</applies-to> | flattened       |
| geo_point                                                 | geo_point                                                 | geo_point       |
| geo_shape                                                 | geo_shape                                                 | geo_shape       |
| geohash                                                   | geohash                                                   | geohash         |
| geohex                                                    | geohex                                                    | geohex          |
| geotile                                                   | geotile                                                   | geotile         |
| integer                                                   | integer                                                   | integer         |
| ip                                                        | ip                                                        | ip              |
| keyword                                                   | keyword                                                   | keyword         |
| keyword                                                   | text                                                      | keyword         |
| long                                                      | long                                                      | long            |
| text                                                      | keyword                                                   | keyword         |
| text                                                      | text                                                      | keyword         |
| unsigned_long                                             | unsigned_long                                             | unsigned_long   |
| version                                                   | version                                                   | version         |


## Example

```esql
ROW values = ["a", "b", "c"], element = "a"
| EVAL result = mv_difference(values, element)
```


| values:keyword | element:keyword | result:keyword |
|----------------|-----------------|----------------|
| [a, b, c]      | a               | [b, c]         |