Loading

ES|QL string functions

ES|QL supports these string functions:

  • BIT_LENGTH

    Returns the bit length of a string.

  • BYTE_LENGTH

    Returns the byte length of a string.

  • CHUNK

    Splits a text field into smaller chunks.

  • CONCAT

    Concatenates two or more strings.

  • CONTAINS

    Checks whether a keyword substring is contained within another string.

  • ENDS_WITH

    Checks whether a keyword string ends with another string.

  • FROM_BASE64

    Decodes a base64 string.

  • HASH

    Computes the hash of the input using a specified algorithm.

  • JSON_EXTRACT

    Extracts a value from a JSON string using JSONPath syntax.

  • LEFT

    Returns a substring of the specified length from the left side of a string.

  • LENGTH

    Returns the character length of a string.

  • LOCATE

    Returns the position of a keyword substring within another string.

  • LTRIM

    Removes leading whitespaces from a string.

  • MD5

    Computes the MD5 hash of the input.

  • REPEAT

    Returns a string repeated a specified number of times.

  • REPLACE

    Replaces regular expression matches in a string with a replacement string.

  • REVERSE

    Returns the input string in reverse order.

  • RIGHT

    Returns a substring of the specified length from the right side of a string.

  • RTRIM

    Removes trailing whitespaces from a string.

  • SHA1

    Computes the SHA1 hash of the input.

  • SHA256

    Computes the SHA256 hash of the input.

  • SPACE

    Returns a string made of the specified number of spaces.

  • SPLIT

    Splits a single valued string into multiple strings.

  • STARTS_WITH

    Checks whether a keyword string starts with another string.

  • SUBSTRING

    Returns a substring of a string, specified by a start position and an optional length.

  • TO_BASE64

    Encodes a string to a base64 string.

  • TO_LOWER

    Returns a new string converted to lower case.

  • TO_UPPER

    Returns a new string converted to upper case.

  • TRIM

    Removes leading and trailing whitespaces from a string.

  • URL_DECODE

    Decodes a URL-encoded string.

  • URL_ENCODE

    URL-encodes a string with spaces encoded as plus signs.

  • URL_ENCODE_COMPONENT

    URL-encodes a string with spaces encoded as percent codes.