---
title: ES|QL MV_DIFFERENCE function
description: 
url: https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/mv-functions/mv_difference
products:
  - Elasticsearch
---

# ES|QL MV_DIFFERENCE function
<applies-to>
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Planned
</applies-to>


## Syntax

![Embedded](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/images/functions/mv_difference.svg)


## Parameters

<definitions>
  <definition term="field1">
    Expression that can be null, a single value, or multiple values. If null, the function returns null.
  </definition>
  <definition term="field2">
    Expression that can be null, a single value, or multiple values. If null, the function returns field1.
  </definition>
</definitions>


## Description

Returns the values that appear in the first field, except those that appear in the second. Returns `null` if the first expression is null (nothing to remove) or the value of the first field if the second is null.

## Supported types


| field1          | field2          | result          |
|-----------------|-----------------|-----------------|
| boolean         | boolean         | boolean         |
| cartesian_point | cartesian_point | cartesian_point |
| cartesian_shape | cartesian_shape | cartesian_shape |
| date            | date            | date            |
| date_nanos      | date_nanos      | date_nanos      |
| double          | double          | double          |
| geo_point       | geo_point       | geo_point       |
| geo_shape       | geo_shape       | geo_shape       |
| geohash         | geohash         | geohash         |
| geohex          | geohex          | geohex          |
| geotile         | geotile         | geotile         |
| integer         | integer         | integer         |
| ip              | ip              | ip              |
| keyword         | keyword         | keyword         |
| keyword         | text            | keyword         |
| long            | long            | long            |
| text            | keyword         | keyword         |
| text            | text            | keyword         |
| unsigned_long   | unsigned_long   | unsigned_long   |
| version         | version         | version         |


## Example

```esql
ROW values = ["a", "b", "c"], element = "a"
| EVAL result = mv_difference(values, element)
```


| values:keyword | element:keyword | result:keyword |
|----------------|-----------------|----------------|
| [a, b, c]      | a               | [b, c]         |