elasticsearch
elastic/elasticsearch main 8964bf1
Reference
  • Reference
    • Elasticsearch
      • Configuration
        • Circuit breaker settings
        • Auditing settings
        • Enrich settings
        • Cluster-level shard allocation and routing settings
        • Miscellaneous cluster settings
        • Cross-cluster replication settings
        • Discovery and cluster formation settings
        • Field data cache settings
        • Health Diagnostic settings
        • Index lifecycle management settings
        • Data stream lifecycle settings
        • Index management settings
        • Index recovery settings
        • Indexing buffer settings
        • License settings
        • Local gateway
        • Machine learning settings
        • Inference settings
        • Monitoring settings
        • Node settings
        • Networking settings
        • Node query cache settings
        • Remote cluster settings
        • Search settings
        • Security settings
        • Shard request cache
        • Snapshot and restore settings
        • Transforms settings
        • Thread pool settings
        • Watcher settings
      • JVM settings
      • Built-in roles
      • Elasticsearch privileges
      • Index settings
        • Serverless index settings
        • General
        • Shard allocation
          • Data tier allocation
          • Index recovery prioritization
          • Total shards per node
        • History retention
        • Index blocks
        • Mapping limit
        • Merge
        • Similarity
        • Slow log
        • Sorting
          • Use index sorting to speed up conjunctions
        • Store
          • Preloading data into the file system cache
        • Time series
        • Source settings
        • Translog
        • Indexing pressure
        • Path
      • Index lifecycle actions
        • Allocate
        • Delete
        • Force merge
        • Migrate
        • Read only
        • Rollover
        • Downsample
        • Searchable snapshot
        • Set priority
        • Shrink
        • Unfollow
        • Wait for snapshot
      • REST APIs
        • API conventions
        • Common options
        • Compatibility
        • Guides and examples
          • Collapse search results
          • Create index from source
          • Understand the lifecycle status
          • Filter search results
          • Rescore search results
          • Find text structure API examples
          • Highlighting
            • Highlighting settings
            • Highlighting examples
            • How highlighters work internally
          • Analyze index disk usage
          • Optimistic concurrency control
          • Paginate search results
          • Query API key information
          • Reciprocal rank fusion
          • The refresh parameter
          • Reindex data stream
          • Reindex indices
          • Retrieve inner hits
          • Retrieve selected fields
          • Retrieve stored fields
          • Retrievers
            • kNN retriever
            • Linear retriever
            • Pinned retriever
            • Rescorer retriever
            • RRF retriever
            • Query rules retriever
            • Standard retriever
            • Text similarity re-ranker retriever
            • Diversify retriever
            • Examples
          • Search multiple data streams and indices
          • Profile search requests
          • Ranking evaluation
          • Search shard routing
          • Suggesters
          • Sort search results
          • Searching with query rules
          • The shard request cache
          • Term vectors API examples
          • Update By Query API
          • Update a document
          • Update cross-cluster API examples
          • Vector tile search API
      • Mapping
        • Document metadata fields
          • _doc_count field
          • _field_names field
          • _ignored field
          • _id field
          • _index field
          • _meta field
          • _routing field
          • _source field
          • _tier field
        • Field data types
          • Aggregate metric
          • Alias
          • Arrays
          • Binary
          • Boolean
          • Completion
          • Date
          • Date nanoseconds
          • Dense vector
          • GPU vector indexing
          • Flattened
          • Geopoint
          • Geoshape
          • Histogram
          • Exponential histogram
          • T-digest
          • IP
          • Join
          • Keyword
          • Nested
          • Numeric
          • Object
          • Pass-through object
          • Percolator
          • Point
          • Range
          • Rank feature
          • Rank features
          • Rank vectors
          • Search-as-you-type
          • Semantic text
            • Reference
            • How-to guides
              • Set up and configure
              • Ingest data
              • Search and retrieve
          • Shape
          • Sparse vector
          • Text type family
            • Text
            • Pattern Text
            • Match Only Text
          • Token count
          • Unsigned long
          • Version
        • Mapping parameters
          • analyzer
          • coerce
          • copy_to
          • doc_values
          • dynamic
          • eager_global_ordinals
          • enabled
          • format
          • ignore_above
          • ignore_above index setting
          • ignore_malformed
          • index
          • index_options
          • index_phrases
          • index_prefixes
          • meta
          • fields
          • normalizer
          • norms
          • null_value
          • position_increment_gap
          • properties
          • search_analyzer
          • similarity
          • store
          • subobjects
          • term_vector
          • Better Binary Quantization (BBQ)
      • Elasticsearch audit events
      • Command-line tools
        • elasticsearch-certgen
        • elasticsearch-certutil
        • elasticsearch-create-enrollment-token
        • elasticsearch-croneval
        • elasticsearch-keystore
        • elasticsearch-node
        • elasticsearch-reconfigure-node
        • elasticsearch-reset-password
        • elasticsearch-saml-metadata
        • elasticsearch-service-tokens
        • elasticsearch-setup-passwords
        • elasticsearch-shard
        • elasticsearch-syskeygen
        • elasticsearch-users
    • Community-contributed clients
    • Processor reference
      • Append
      • Attachment
      • Bytes
      • Circle
      • CEF
      • Community ID
      • Convert
      • CSV
      • Date
      • Date index name
      • Dissect
      • Dot expander
      • Drop
      • Enrich
      • Fail
      • Fingerprint
      • Foreach
      • Geo-grid
      • GeoIP
      • Grok
      • Gsub
      • HTML strip
      • Inference
      • IP Location
      • Join
      • JSON
      • KV
      • Lowercase
      • Network direction
      • Normalize for Stream
      • Pipeline
      • Redact
      • Registered domain
      • Recover Failure Document
      • Remove
      • Rename
      • Reroute
      • Script
      • Set
      • Set security user
      • Sort
      • Split
      • Terminate
      • Trim
      • Uppercase
      • URL decode
      • URI parts
      • User agent
    • Content connectors
      • Connectors references
        • Azure Blob Storage
        • Box
        • Confluence
        • Dropbox
        • GitHub
        • GitLab
        • Gmail
        • Google Cloud Storage
        • Google Drive
        • GraphQL
        • Jira
        • Microsoft SQL
        • MongoDB
        • MySQL
        • Network drive
        • Notion
        • OneDrive
        • OpenText Documentum
        • Oracle
        • Outlook
        • PostgreSQL
        • Redis
        • S3
        • Salesforce
        • Sandfly Security
        • ServiceNow
        • SharePoint Online
        • SharePoint Server
        • Slack
        • Teams
        • Zoom
      • Self-managed connectors
        • Running from a Docker container
        • Running from the source code
        • Docker Compose quickstart
        • Tutorial
      • Build and customize connectors
      • Connectors UI
      • Connector APIs
        • API tutorial
      • Content syncs
      • Extract and transform
        • Content extraction
        • Sync rules
      • Document level security for content connectors
        • How DLS works
        • DLS in Search Applications
      • Management topics
        • Scalability
        • Security
        • Troubleshooting
        • Logs
      • Use cases
        • Internal knowledge search
      • Known issues
      • Release notes
    • Elasticsearch plugins
      • Plugin management
        • Installing plugins
        • Custom URL or file system
        • Installing multiple plugins
        • Mandatory plugins
        • Listing, removing and updating installed plugins
        • Other command line parameters
        • Plugins directory
        • Manage plugins using a configuration file
        • Upload custom plugins and bundles
        • Managing plugins and extensions through the API
      • API extension plugins
      • Analysis plugins
        • ICU analysis plugin
          • ICU analyzer
          • ICU normalization character filter
          • ICU tokenizer
          • ICU normalization token filter
          • ICU folding token filter
          • ICU collation token filter
          • ICU collation keyword field
          • ICU transform token filter
        • Japanese (kuromoji) analysis plugin
          • kuromoji analyzer
          • kuromoji_iteration_mark character filter
          • kuromoji_tokenizer
          • kuromoji_baseform token filter
          • kuromoji_part_of_speech token filter
          • kuromoji_readingform token filter
          • kuromoji_stemmer token filter
          • ja_stop token filter
          • kuromoji_number token filter
          • hiragana_uppercase token filter
          • katakana_uppercase token filter
          • kuromoji_completion token filter
        • Korean (nori) analysis plugin
          • nori analyzer
          • nori_tokenizer
          • nori_part_of_speech token filter
          • nori_readingform token filter
          • nori_number token filter
        • Phonetic analysis plugin
          • phonetic token filter
        • Smart Chinese analysis plugin
          • Reimplementing and extending the smartcn analyzer
          • smartcn_stop token filter
        • Stempel Polish analysis plugin
          • Reimplementing and extending the polish analyzer
          • polish_stop token filter
        • Ukrainian analysis plugin
      • Discovery plugins
        • EC2 Discovery plugin
          • Using the EC2 discovery plugin
          • Best Practices in AWS
        • Azure Classic discovery plugin
          • Azure Virtual Machine discovery
          • Setup process for Azure Discovery
          • Scaling out
        • GCE Discovery plugin
          • GCE Virtual Machine discovery
          • GCE Network Host
          • Setting up GCE Discovery
          • Cloning your existing machine
          • Using GCE zones
          • Filtering by tags
          • Changing default transport port
          • GCE Tips
          • Testing GCE
      • Mapper plugins
        • Mapper size plugin
          • Using the _size field
        • Mapper murmur3 plugin
          • Using the murmur3 field
        • Mapper annotated text plugin
          • Using the annotated-text field
          • Data modelling tips
          • Using the annotated highlighter
          • Limitations
      • Snapshot/restore repository plugins
        • Hadoop HDFS repository plugin
          • Getting started with HDFS
          • Configuration properties
          • Hadoop security
      • Store plugins
        • Store SMB plugin
          • Working around a bug in Windows SMB and Java on windows
      • Authentication plugins
        • Microsoft Graph Authz
          • Configure Azure
          • Configuration properties
      • Integrations
    • Query languages
      • QueryDSL
        • Get started
        • Query and filter context
        • Compound queries
          • Boolean
          • Boosting
          • Constant score
          • Disjunction max
          • Function score
        • Full text queries
          • Intervals
          • Match
          • Match boolean prefix
          • Match phrase
          • Match phrase prefix
          • Combined fields
          • Multi-match
          • Query string
          • Simple query string
          • KQL
        • Geo queries
          • Geo-bounding box
          • Geo-distance
          • Geo-grid
          • Geo-polygon
          • Geoshape
        • Shape queries
          • Shape
        • Joining queries
          • Nested
          • Has child
          • Has parent
          • Parent ID
        • Match all
        • Span queries
          • Span containing
          • Span field masking
          • Span first
          • Span multi-term
          • Span near
          • Span not
          • Span or
          • Span term
          • Span within
        • Vector queries
          • Knn
          • Sparse vector
          • Semantic
          • Text expansion
          • Weighted tokens
        • Specialized queries
          • Distance feature
          • more_like_this
          • Percolate
          • Rank feature
          • Script
          • Script score
          • Wrapper
          • Pinned query
          • Rule
        • Term-level queries
          • Exists
          • Fuzzy
          • IDs
          • Prefix
          • Range
          • Regexp
          • Term
          • Terms
          • Terms set
          • Wildcard
        • minimum_should_match parameter
        • rewrite parameter
        • Regular expression syntax
      • ES|QL
        • Get started
        • Use cases
          • ES|QL for search
          • ES|QL for cybersecurity
        • REST API
        • Syntax reference
          • Basic syntax
          • Commands
            • Query directives
              • SET
            • Source commands
              • FROM
              • ROW
              • SHOW
              • TS
            • Processing commands
              • CHANGE_POINT
              • COMPLETION
              • DISSECT
              • DROP
              • ENRICH
              • EVAL
              • FORK
              • FUSE
              • GROK
              • INLINE STATS
              • KEEP
              • LIMIT
              • LOOKUP JOIN
              • MV_EXPAND
              • RENAME
              • RERANK
              • SAMPLE
              • SORT
              • STATS
              • WHERE
          • Functions and operators
            • Aggregation functions
            • Time series aggregation functions
            • Grouping functions
            • Conditional functions and expressions
            • Date-time functions
            • IP functions
            • Math functions
            • Search functions
            • Spatial functions
            • String functions
            • Dense vector functions
            • Type conversion functions
            • Multivalue functions
            • Operators
        • Query multiple sources
          • Query multiple indices
          • Query across clusters
        • Advanced workflows
          • Extract data with DISSECT and GROK
          • Combine data with ENRICH
          • Join data with LOOKUP JOIN
        • Types and fields
          • Implicit casting
          • Time spans
          • Metadata fields
          • Multivalued fields
        • Tutorials
          • ES|QL for search
          • ES|QL for threat hunting
        • Troubleshooting
          • Query log
          • List running queries
        • Limitations
      • SQL
        • Getting started
        • Conventions
        • Security
        • SQL REST API
          • Overview
          • Response data formats
          • Paginating through a large response
          • Filtering using Elasticsearch Query DSL
          • Columnar results
          • Passing parameters to a query
          • Use runtime fields
          • Run an async SQL search
        • SQL Translate API
        • SQL CLI
        • SQL JDBC
          • API usage
        • SQL ODBC
          • Driver installation
          • Configuration
        • SQL client applications
          • DBeaver
          • DbVisualizer
          • Microsoft Excel
          • Microsoft Power BI Desktop
          • Microsoft PowerShell
          • MicroStrategy Desktop
          • Qlik Sense Desktop
          • SQuirreL SQL
          • SQL Workbench/J
          • Tableau Desktop
          • Tableau Server
        • SQL language
          • Lexical structure
          • SQL commands
          • DESCRIBE TABLE
          • SELECT
          • SHOW CATALOGS
          • SHOW COLUMNS
          • SHOW FUNCTIONS
          • SHOW TABLES
          • Data types
          • Index patterns
          • Frozen indices
        • Functions and operators
          • Comparison operators
          • Logical operators
          • Math operators
          • Cast operators
          • LIKE and RLIKE operators
          • Aggregate functions
          • Grouping functions
          • Date/time and interval functions and operators
          • Full-text search functions
          • Mathematical functions
          • String functions
          • Type conversion functions
          • Geo functions
          • Conditional functions and expressions
          • System functions
        • Reserved keywords
        • SQL limitations
      • EQL
        • Syntax reference
        • Function reference
        • Pipe reference
      • Kibana Query Language
    • Scripting languages
      • Painless
        • A brief painless walkthrough
          • Accessing Doc Values from Painless
          • Missing keys or values
          • Updating Fields with Painless
          • Dates
          • Regular expressions
        • Use Painless scripts in runtime fields
        • Using datetime in Painless
          • Datetime representation
          • Datetime parsing and formatting
          • Datetime conversion
          • Datetime Pieces
          • Datetime Modification
          • Datetime difference
          • Datetime comparison
          • Datetime zone
          • Datetime Input
          • Datetime now
          • Datetime examples in contexts
        • Understanding method dispatching in Painless
        • Painless debugging
        • Painless execute API
        • Using ingest processors in Painless
        • Painless language specification
          • Comments
          • Keywords
          • Literals
          • Identifiers
          • Variables
          • Types
          • Casting
          • Operators
          • Operators: General
          • Operators: Numeric
          • Operators: Boolean
          • Operators: Reference
          • Operators: Array
          • Statements
          • Scripts
          • Functions
          • Lambdas
          • Regexes
        • Painless contexts
          • Context example data (eCommerce)
          • Runtime fields context
          • Ingest processor context
          • Update context
          • Update by query context
          • Reindex context
          • Sort context
          • Similarity context
          • Weight context
          • Score context
          • Field context
          • Filter context
          • Minimum should match context
          • Metric aggregation initialization context
          • Metric aggregation map context
          • Metric aggregation combine context
          • Metric aggregation reduce context
          • Bucket script aggregation context
          • Bucket selector aggregation context
          • Analysis Predicate Context
          • Watcher condition context
          • Watcher transform context
    • Text analysis components
      • Analyzer reference
        • Fingerprint
        • Keyword
        • Language
        • Pattern
        • Simple
        • Standard
        • Stop
        • Whitespace
      • Tokenizer reference
        • Character group
        • Classic
        • Edge n-gram
        • Keyword
        • Letter
        • Lowercase
        • N-gram
        • Path hierarchy
        • Pattern
        • Simple pattern
        • Simple pattern split
        • Standard
        • Thai
        • UAX URL email
        • Whitespace
      • Token filter reference
        • Apostrophe
        • ASCII folding
        • CJK bigram
        • CJK width
        • Classic
        • Common grams
        • Conditional
        • Decimal digit
        • Delimited payload
        • Dictionary decompounder
        • Edge n-gram
        • Elision
        • Fingerprint
        • Flatten graph
        • Hunspell
        • Hyphenation decompounder
        • Keep types
        • Keep words
        • Keyword marker
        • Keyword repeat
        • KStem
        • Length
        • Limit token count
        • Lowercase
        • MinHash
        • Multiplexer
        • N-gram
        • Normalization
        • Pattern capture
        • Pattern replace
        • Phonetic
        • Porter stem
        • Predicate script
        • Remove duplicates
        • Reverse
        • Shingle
        • Snowball
        • Stemmer
        • Stemmer override
        • Stop
        • Synonym
        • Synonym graph
        • Trim
        • Truncate
        • Unique
        • Uppercase
        • Word delimiter
        • Word delimiter graph
      • Character filter reference
        • HTML strip
        • Mapping
        • Pattern replace
      • Normalizers
    • Aggregations
      • Bucket
        • Adjacency matrix
        • Auto-interval date histogram
        • Categorize text
        • Children
        • Composite
        • Date histogram
        • Date range
        • Diversified sampler
        • Filter
        • Filters
        • Frequent item sets
        • Geo-distance
        • Geohash grid
        • Geohex grid
        • Geotile grid
        • Global
        • Histogram
        • IP prefix
        • IP range
        • Missing
        • Multi Terms
        • Nested
        • Parent
        • Random sampler
        • Range
        • Rare terms
        • Reverse nested
        • Sampler
        • Significant terms
        • Significant text
        • Terms
        • Time series
        • Variable width histogram
        • Subtleties of bucketing range fields
      • Metrics
        • Avg
        • Boxplot
        • Cardinality
        • Extended stats
        • Geo-bounds
        • Geo-centroid
        • Geo-line
        • Cartesian-bounds
        • Cartesian-centroid
        • Matrix stats
        • Max
        • Median absolute deviation
        • Min
        • Percentile ranks
        • Percentiles
        • Rate
        • Scripted metric
        • Stats
        • String stats
        • Sum
        • T-test
        • Top hits
        • Top metrics
        • Value count
        • Weighted avg
      • Pipeline
        • Average bucket
        • Bucket script
        • Bucket count K-S test
        • Bucket correlation
        • Bucket selector
        • Bucket sort
        • Change point
        • Cumulative cardinality
        • Cumulative sum
        • Derivative
        • Extended stats bucket
        • Inference bucket
        • Max bucket
        • Min bucket
        • Moving function
        • Moving percentiles
        • Normalize
        • Percentiles bucket
        • Serial differencing
        • Stats bucket
        • Sum bucket
  • Elasticsearch
    • Known issues
    • Breaking changes
    • Deprecations
  • Create Elasticsearch plugins
    • Creating text analysis plugins with the stable plugin API
      • The plugin descriptor file for stable plugins
      • Example text analysis plugin
    • Creating classic plugins
      • The plugin descriptor file for classic plugins
  • View as Markdown
  • Report a docs issue
  • Edit this page
  • Learn how to contribute
Loading
  1. Query languages /
  2. ES|QL /
  3. Syntax reference /
  4. Commands

ES|QL processing commands

ES|QL processing commands change an input table by adding, removing, or changing rows and columns.

A processing command changing an input table
× A processing command changing an input table

ES|QL supports these processing commands:

  • CHANGE_POINT
  • COMPLETION
  • DISSECT
  • DROP
  • ENRICH
  • EVAL
  • GROK
  • FORK
  • FUSE
  • KEEP
  • LIMIT
  • LOOKUP JOIN
  • INLINE STATS
  • MV_EXPAND
  • RENAME
  • RERANK
  • SAMPLE
  • SORT
  • STATS
  • WHERE
Previous
TS
Next
CHANGE_POINT
Elastic logo
  • Trademarks
  • Terms of Use
  • Privacy
  • Sitemap

© 2026 Elasticsearch B.V. All Rights Reserved.

This content is available in different formats for convenience only. All original licensing terms apply.

Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.