ES|QL source commands
An ES|QL source command produces a table, typically with data from Elasticsearch. An ES|QL query must start with a source command.
ES|QL supports these source commands:
The FROM source command returns a table with data from a data stream, index,
or alias.
Syntax
FROM index_pattern [METADATA fields]
Parameters
index_pattern- A list of indices, data streams or aliases. Supports wildcards and date math.
fields- A comma-separated list of metadata fields to retrieve.
Description
The FROM source command returns a table with data from a data stream, index,
or alias. Each row in the resulting table represents a document. Each column
corresponds to a field, and can be accessed by the name of that field.
By default, an ES|QL query without an explicit LIMIT uses an implicit
limit of 1000. This applies to FROM too. A FROM command without LIMIT:
FROM employees
is executed as:
FROM employees
| LIMIT 1000
Examples
FROM employees
You can use date math to refer to indices, aliases and data streams. This can be useful for time series data, for example to access today’s index:
FROM <logs-{now/d}>
Use comma-separated lists or wildcards to query multiple data streams, indices, or aliases:
FROM employees-00001,other-employees-*
Use the format <remote_cluster_name>:<target> to
query data streams and indices on remote clusters:
FROM cluster_one:employees-00001,cluster_two:other-employees-*
Use the optional METADATA directive to enable
metadata fields:
FROM employees METADATA _id
Use enclosing double quotes (") or three enclosing double quotes (""") to escape index names
that contain special characters:
FROM "this=that", """this[that"""
The ROW source command produces a row with one or more columns with values
that you specify. This can be useful for testing.
Syntax
ROW column1 = value1[, ..., columnN = valueN]
Parameters
columnX- The column name. In case of duplicate column names, only the rightmost duplicate creates a column.
valueX- The value for the column. Can be a literal, an expression, or a function.
Examples
ROW a = 1, b = "two", c = null
| a:integer | b:keyword | c:null |
|---|---|---|
| 1 | "two" | null |
Use square brackets to create multi-value columns:
ROW a = [2, 1]
ROW supports the use of functions:
ROW a = ROUND(1.23, 0)
The SHOW source command returns information about the deployment and
its capabilities.
Syntax
SHOW item
Parameters
item- Can only be
INFO.
Examples
Use SHOW INFO to return the deployment’s version, build date and hash.
SHOW INFO
| version | date | hash |
|---|---|---|
| 8.13.0 | 2024-02-23T10:04:18.123117961Z | 04ba8c8db2507501c88f215e475de7b0798cb3b3 |