FROMFROM index_pattern [METADATA _id, _index] | ROWROW column1 = value1[, column2 = value2, ...] | SHOWSHOW INFO |
WHEREWHERE condition | EVALEVAL [col1 =] val1[, ..., [colN =] valN] | STATS...BYSTATS [col =] expr [BY grouping_expr] |
SORTSORT column1 [ASC|DESC][, column2 ...] | LIMITLIMIT max_rows | KEEPKEEP column1[, column2, ...] |
DROPDROP column1[, column2, ...] | RENAMERENAME old_name AS new_name | DISSECTDISSECT column "%{pattern}" |
GROKGROK column "%{PATTERN:field}" | ENRICHENRICH policy [ON field] [WITH cols] | MV_EXPANDMV_EXPAND column |
LOOKUP JOINLOOKUP JOIN index ON field | INLINE STATSINLINE STATS expr BY grouping_expr | FORKFORK (branch1) (branch2) [...] |
FUSEFUSE [RRF | LINEAR] | SAMPLESAMPLE probability | RERANKRERANK "query" ON field BY model |
COMPLETIONCOMPLETION "prompt" WITH model |
AVGAVG(expression) | COUNTCOUNT([expression]) | COUNT_DISTINCTCOUNT_DISTINCT(expr[, precision]) |
MAXMAX(expression) | MEDIANMEDIAN(expression) | MEDIAN_ABSOLUTE_DEVIATIONMEDIAN_ABSOLUTE_DEVIATION(expr) |
MINMIN(expression) | PERCENTILEPERCENTILE(expression, percentile) | SUMSUM(expression) |
TOPTOP(field, limit, order) | WEIGHTED_AVGWEIGHTED_AVG(expression, weight) | VALUESVALUES(field) |
ST_CENTROID_AGGST_CENTROID_AGG(geo_field) | EARLIESTEARLIEST(field) | LATESTLATEST(field) |
BUCKETBUCKET(expression, buckets, from, to) | CATEGORIZECATEGORIZE(field) |
CONCATCONCAT(str1, str2[, ..., strN]) | ENDS_WITHENDS_WITH(string_field, suffix) | FROM_BASE64FROM_BASE64(string) |
LEFTLEFT(str, length) | LENGTHLENGTH(str) | LOCATELOCATE(string, substring, start) |
LTRIMLTRIM(string) | REPEATREPEAT(string, number) | REPLACEREPLACE(str, regex, newStr) |
RIGHTRIGHT(string, length) | RTRIMRTRIM(string) | SPLITSPLIT(string, delim) |
STARTS_WITHSTARTS_WITH(string_field, prefix) | SUBSTRINGSUBSTRING(string, start, length) | TO_BASE64TO_BASE64(string) |
TO_LOWERTO_LOWER(string) | TO_UPPERTO_UPPER(string) | TRIMTRIM(string) |
DATE_DIFFDATE_DIFF(unit, startTs, endTs) | DATE_EXTRACTDATE_EXTRACT(datePart, date) | DATE_FORMATDATE_FORMAT(dateFormat, date) |
DATE_PARSEDATE_PARSE(datePattern, dateString) | DATE_TRUNCDATE_TRUNC(interval, date) | DAY_OF_WEEKDAY_OF_WEEK(date) |
MONTH_NAMEMONTH_NAME(date) | NOWNOW() |
ABSABS(number) | ACOSACOS(number) | ASINASIN(number) |
ATANATAN(number) | ATAN2ATAN2(y, x) | CBRTCBRT(number) |
CEILCEIL(number) | COSCOS(angle) | COSHCOSH(number) |
EE() | EXPEXP(number) | FLOORFLOOR(number) |
HYPOTHYPOT(a, b) | LOGLOG(base, value) | LOG10LOG10(number) |
PIPI() | POWPOW(base, exponent) | ROUNDROUND(number[, decimals]) |
SIGNUMSIGNUM(number) | SINSIN(angle) | SINHSINH(number) |
SQRTSQRT(number) | TANTAN(angle) | TANHTANH(number) |
TAUTAU() |
CASECASE(cond1, val1[, ..., default]) | COALESCECOALESCE(expr1, expr2[, ...]) | GREATESTGREATEST(val1, val2[, ...]) |
LEASTLEAST(val1, val2[, ...]) | CLAMPCLAMP(value, min, max) | CLAMP_MINCLAMP_MIN(value, min) |
CLAMP_MAXCLAMP_MAX(value, max) |
MV_APPENDMV_APPEND(field1, field2) | MV_AVGMV_AVG(number_field) | MV_CONCATMV_CONCAT(field, delim) |
MV_COUNTMV_COUNT(field) | MV_DEDUPEMV_DEDUPE(field) | MV_EXCEPTMV_EXCEPT(field1, field2) |
MV_FIRSTMV_FIRST(field) | MV_INTERSECTMV_INTERSECT(field1, field2) | MV_LASTMV_LAST(field) |
MV_MAXMV_MAX(field) | MV_MEDIANMV_MEDIAN(number_field) | MV_MINMV_MIN(field) |
MV_SLICEMV_SLICE(field, start[, end]) | MV_SORTMV_SORT(field[, order]) | MV_SUMMV_SUM(number_field) |
MV_UNIONMV_UNION(field1, field2) | MV_ZIPMV_ZIP(field1, field2, delim) |
TO_BOOLEANTO_BOOLEAN(field) | TO_CARTESIANPOINTTO_CARTESIANPOINT(field) | TO_CARTESIANSHAPETO_CARTESIANSHAPE(field) |
TO_DATETIMETO_DATETIME(field) | TO_DEGREESTO_DEGREES(number) | TO_DOUBLETO_DOUBLE(field) |
TO_GEOPOINTTO_GEOPOINT(field) | TO_GEOSHAPETO_GEOSHAPE(field) | TO_INTEGERTO_INTEGER(field) |
TO_IPTO_IP(field) | TO_LONGTO_LONG(field) | TO_RADIANSTO_RADIANS(number) |
TO_STRINGTO_STRING(field) | TO_UNSIGNED_LONGTO_UNSIGNED_LONG(field) | TO_VERSIONTO_VERSION(field) |
==field == value | !=field != value | <field < value |
<=field <= value | >field > value | >=field >= value |
ANDcondition1 AND condition2 | ORcondition1 OR condition2 | NOTNOT condition |
IS NULLfield IS NULL | IS NOT NULLfield IS NOT NULL | INfield IN (val1, val2[, ...]) |
LIKEfield LIKE "pattern*" | RLIKEfield RLIKE "regex" | ::field::type (cast shorthand) |
MATCHfield : "search text" | + - * / %Arithmetic operators |
