ES|QL MV_INTERSECTION function
Returns values present in both multi-value fields.
field1- Expression that can be null, a single value, or multiple values. If null, the function returns null.
field2-
Expression that can be null, a single value, or multiple values. If null, the function returns null.
Returns the values that appear in both input fields. Returns null if either field is null or if no values match.
| field1 | field2 | result |
|---|---|---|
| boolean | boolean | boolean |
| cartesian_point | cartesian_point | cartesian_point |
| cartesian_shape | cartesian_shape | cartesian_shape |
| date | date | date |
| date_nanos | date_nanos | date_nanos |
| double | double | double |
| geo_point | geo_point | geo_point |
| geo_shape | geo_shape | geo_shape |
| geohash | geohash | geohash |
| geohex | geohex | geohex |
| geotile | geotile | geotile |
| integer | integer | integer |
| ip | ip | ip |
| keyword | keyword | keyword |
| keyword | text | keyword |
| long | long | long |
| text | keyword | keyword |
| text | text | keyword |
| unsigned_long | unsigned_long | unsigned_long |
| version | version | version |
ROW a = [1, 2, 3, 4, 5], b = [2, 3, 4, 5, 6]
| EVAL finalValue = MV_INTERSECTION(a, b)
| KEEP finalValue
| finalValue:integer |
|---|
| [2, 3, 4, 5] |
ROW a = [1, 2, 3, 4, 5]::long, b = [2, 3, 4, 5, 6]::long
| EVAL finalValue = MV_INTERSECTION(a, b)
| KEEP finalValue
| finalValue:long |
|---|
| [2, 3, 4, 5] |
ROW a = [true, false, false, false], b = [false]
| EVAL finalValue = MV_INTERSECTION(a, b)
| KEEP finalValue
| finalValue:boolean |
|---|
| [false] |
ROW a = [5.2, 10.5, 1.12345, 2.6928], b = [10.5, 2.6928]
| EVAL finalValue = MV_INTERSECTION(a, b)
| KEEP finalValue
| finalValue:double |
|---|
| [10.5, 2.6928] |
ROW a = ["one", "two", "three", "four", "five"], b = ["one", "four"]
| EVAL finalValue = MV_INTERSECTION(a, b)
| KEEP finalValue
| finalValue:keyword |
|---|
| ["one", "four"] |