ES|QL SET directive

The SET directive can be used to specify query settings that modify the behavior of an ES|QL query.

Syntax

SET setting_name = setting_value[, ..., settingN = valueN]; <query>
		

Multiple SET directives can be included in a single query, separated by semicolons. If the same setting is defined multiple times, the last definition takes precedence.

Allowed settings

The default timezone to be used in the query. Defaults to UTC, and overrides the time_zone request parameter. See timezones.

Type: keyword

Example

SET time_zone = "+05:00";
TS k8s
| WHERE @timestamp == "2024-05-10T00:04:49.000Z"
| STATS by @timestamp, bucket = TBUCKET(3 hours)
| SORT @timestamp
| LIMIT 2
		

Defines how unmapped fields are treated. Possible values are: "FAIL" (default) - fails the query if unmapped fields are present; "NULLIFY" - treats unmapped fields as null values.

Type: keyword

Example

Make the field null if it is unmapped.

SET unmapped_fields="nullify";
FROM employees
| KEEP emp_*, foo
| SORT emp_no
| LIMIT 1