[[esql-substring]]
=== `SUBSTRING`
Returns a substring of a string, specified by a start position and an optional
length. This example returns the first three characters of every last name:

[source,esql]
----
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 1, 3)
----

A negative start position is interpreted as being relative to the end of the
string. This example returns the last three characters of of every last name:

[source,esql]
----
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, -3, 3)
----

If length is omitted, substring returns the remainder of the string. This
example returns all characters except for the first:

[source,esql]
----
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 2)
----