---
title: ES|QL MV_DIFFERENCE function
description: 
url: https://www.elastic.co/elastic/docs-builder/docs/3729/reference/query-languages/esql/functions-operators/mv-functions/mv_difference
products:
  - Elasticsearch
---

# ES|QL MV_DIFFERENCE function
<applies-to>
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.4
</applies-to>

Returns values from first field not in second field.

## Syntax

![Embedded](https://www.elastic.co/elastic/docs-builder/docs/3729/reference/query-languages/esql/images/generated/x-pack-esql/functions/mv_difference.svg)


## Parameters

<definitions>
  <definition term="field1">
    Expression that can be null, a single value, or multiple values. If null, the function returns null.
  </definition>
  <definition term="field2">
    Expression that can be null, a single value, or multiple values. If null, the function returns field1.
  </definition>
</definitions>


## Description

Returns the values that appear in the first field, except those that appear in the second. Returns `null` if the first expression is null (nothing to remove) or the value of the first field if the second is null.

## Supported types


| field1                                                              | field2                                                              | result          |
|---------------------------------------------------------------------|---------------------------------------------------------------------|-----------------|
| boolean                                                             | boolean                                                             | boolean         |
| cartesian_point                                                     | cartesian_point                                                     | cartesian_point |
| cartesian_shape                                                     | cartesian_shape                                                     | cartesian_shape |
| date                                                                | date                                                                | date            |
| date_nanos                                                          | date_nanos                                                          | date_nanos      |
| double                                                              | double                                                              | double          |
| flattened <applies-to>Elastic Stack: Preview since 9.5</applies-to> | flattened <applies-to>Elastic Stack: Preview since 9.5</applies-to> | flattened       |
| geo_point                                                           | geo_point                                                           | geo_point       |
| geo_shape                                                           | geo_shape                                                           | geo_shape       |
| geohash                                                             | geohash                                                             | geohash         |
| geohex                                                              | geohex                                                              | geohex          |
| geotile                                                             | geotile                                                             | geotile         |
| integer                                                             | integer                                                             | integer         |
| ip                                                                  | ip                                                                  | ip              |
| keyword                                                             | keyword                                                             | keyword         |
| keyword                                                             | text                                                                | keyword         |
| long                                                                | long                                                                | long            |
| text                                                                | keyword                                                             | keyword         |
| text                                                                | text                                                                | keyword         |
| unsigned_long                                                       | unsigned_long                                                       | unsigned_long   |
| version                                                             | version                                                             | version         |


## Example

```esql
ROW values = ["a", "b", "c"], element = "a"
| EVAL result = mv_difference(values, element)
```


| values:keyword | element:keyword | result:keyword |
|----------------|-----------------|----------------|
| [a, b, c]      | a               | [b, c]         |