ES|QL commands

An ES|QL source command produces a table, typically with data from Elasticsearch. An ES|QL query must start with a source command.

×

ES|QL supports these source commands:

• FROM
• ROW
• SHOW

ES|QL processing commands change an input table by adding, removing, or changing rows and columns.

×

ES|QL supports these processing commands:

• CHANGE_POINT
• DISSECT
• DROP
• ENRICH
• EVAL
• GROK
• KEEP
• LIMIT
• [preview] LOOKUP JOIN
• [preview] MV_EXPAND
• RENAME
• SORT
• STATS
• WHERE