3.6 KiB
WHERE [esql-where]
The WHERE processing command produces a table that contains all the rows from
the input table for which the provided condition evaluates to true.
::::{tip}
In case of value exclusions, fields with null values will be excluded from search results.
In this context a null means either there is an explicit null value in the document or
there is no value at all. For example: WHERE field != "value" will be interpreted as
WHERE field != "value" AND field IS NOT NULL.
::::
Syntax
WHERE expression
Parameters
expression- A boolean expression.
Examples
:::{include} ../examples/docs.csv-spec/where.md
:::
Which, if still_hired is a boolean field, can be simplified to:
:::{include} ../examples/docs.csv-spec/whereBoolean.md ::: Use date math to retrieve data from a specific time range. For example, to retrieve the last hour of logs:
:::{include} ../examples/date.csv-spec/docsNowWhere.md
:::
WHERE supports various functions.
For example the LENGTH function:
:::{include} ../examples/docs.csv-spec/whereFunction.md :::
For a complete list of all functions, refer to Functions overview.
NULL Predicates
For NULL comparison, use the IS NULL and IS NOT NULL predicates.
:::{include} ../../operators/examples/is_null.md :::
:::{include} ../../operators/examples/is_not_null.md :::
Matching text
For matching text, you can use full text search functions like MATCH.
Use MATCH to perform a
match query on a specified field.
Match can be used on text fields, as well as other field types like boolean, dates, and numeric types.
:::{include} ../../functions/examples/match.md :::
::::{tip}
You can also use the shorthand match operator : instead of MATCH.
::::
LIKE and RLIKE
Use LIKE to filter data based on string patterns using wildcards. LIKE usually acts on a field placed on the left-hand side of the operator, but it can also act on a constant (literal) expression. The right-hand side of the operator represents the pattern.
The following wildcard characters are supported:
*matches zero or more characters.?matches one character.
:::{include} ../../operators/types/like.md :::
:::{include} ../../operators/examples/like.md :::
:::{include} ../../operators/detailedDescription/like.md :::
Use RLIKE to filter data based on string patterns using using regular expressions. RLIKE usually acts on a field placed on the left-hand side of the operator, but it can also act on a constant (literal) expression. The right-hand side of the operator represents the pattern.
:::{include} ../../operators/types/rlike.md :::
:::{include} ../../operators/examples/rlike.md :::
:::{include} ../../operators/detailedDescription/rlike.md :::
IN
The IN operator allows testing whether a field or expression equals an element
in a list of literals, fields or expressions:
:::{include} ../../operators/examples/in.md :::
For a complete list of all operators, refer to Operators.