elasticsearch/docs/reference/esql/functions/mv-functions.asciidoc
Nik Everett 5ef5dca334
ESQL: MV_FIRST and MV_LAST (#103928)
This creates the `MV_FIRST` and `MV_LAST` functions that return the
first and last values from a multivalue field. They are noops from a
single valued field. They are quite similar to `MV_MIN` and `MV_MAX`
except they work on positional data rather than relative size. That
sounds like a large distinction, but in practice our multivalued fields
are often sorted. And when they operate on sorted arrays `MV_MIN` does
*the same* thing as `MV_FIRST`.

But there are some cases where it really does matter - say you are
`SPLIT`ing something - so `MV_FIRST(SPLIT("foo;bar;baz", ";"))` gets you
`foo` like you'd expect. No sorting needed.

Relates to #103879
2024-01-09 08:46:34 -05:00

32 lines
675 B
Text

[[esql-mv-functions]]
==== {esql} multivalue functions
++++
<titleabbrev>Multivalue functions</titleabbrev>
++++
{esql} supports these multivalue functions:
// tag::mv_list[]
* <<esql-mv_avg>>
* <<esql-mv_concat>>
* <<esql-mv_count>>
* <<esql-mv_dedupe>>
* <<esql-mv_first>>
* <<esql-mv_last>>
* <<esql-mv_max>>
* <<esql-mv_median>>
* <<esql-mv_min>>
* <<esql-mv_sum>>
// end::mv_list[]
include::mv_avg.asciidoc[]
include::mv_concat.asciidoc[]
include::mv_count.asciidoc[]
include::mv_dedupe.asciidoc[]
include::mv_first.asciidoc[]
include::mv_last.asciidoc[]
include::mv_max.asciidoc[]
include::mv_median.asciidoc[]
include::mv_min.asciidoc[]
include::mv_sum.asciidoc[]