IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

› › ›

SELECT

edit

SELECT

edit

This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

Synopsis.

SELECT select_expr [, ...]
[ FROM table_name ]
[ WHERE condition ]
[ GROUP BY grouping_element [, ...] ]
[ HAVING condition]
[ ORDER BY expression [ ASC | DESC ] [, ...] ]
[ LIMIT [ count ] ]

DescriptionRetrieves rows from zero or more tables.

The general execution of SELECT is as follows:

All elements in the FROM list are computed (each element can be base or alias table). Currently FROM supports exactly one table. Do note however that the table name can be a pattern (see FROM Clause below).
If the WHERE clause is specified, all rows that do not satisfy the condition are eliminated from the output. (See WHERE Clause below.)
If the GROUP BY clause is specified, or if there are aggregate function calls, the output is combined into groups of rows that match on one or more values, and the results of aggregate functions are computed. If the HAVING clause is present, it eliminates groups that do not satisfy the given condition. (See GROUP BY Clause and HAVING Clause below.)
The actual output rows are computed using the SELECT output expressions for each selected row or row group.
If the ORDER BY clause is specified, the returned rows are sorted in the specified order. If ORDER BY is not given, the rows are returned in whatever order the system finds fastest to produce. (See ORDER BY Clause below.)
If the LIMIT is specified, the SELECT statement only returns a subset of the result rows. (See LIMIT Clause below.)

`SELECT` List

edit

SELECT list, namely the expressions between SELECT and FROM, represent the output rows of the SELECT statement.

As with a table, every output column of a SELECT has a name which can be either specified per column through the AS keyword :

SELECT 1 + 1 AS result;

    result
---------------
2

Note: AS is an optional keyword however it helps with the readability and in some case ambiguity of the query which is why it is recommended to specify it.

assigned by Elasticsearch SQL if no name is given:

SELECT 1 + 1;

    1 + 1
--------------
2

or if it’s a simple column reference, use its name as the column name:

SELECT emp_no FROM emp LIMIT 1;

    emp_no
---------------
10001

Wildcard

edit

To select all the columns in the source, one can use *:

SELECT * FROM emp LIMIT 1;

     birth_date     |    emp_no     |  first_name   |    gender     |     hire_date      |   languages   |   last_name   |    salary
--------------------+---------------+---------------+---------------+--------------------+---------------+---------------+---------------
1953-09-02T00:00:00Z|10001          |Georgi         |M              |1986-06-26T00:00:00Z|2              |Facello        |57305

which essentially returns all(top-level fields, sub-fields, such as multi-fields are ignored] columns found.

FROM Clause

edit

The FROM clause specifies one table for the SELECT and has the following syntax:

FROM table_name [ [ AS ] alias ]

where:

table_name: Represents the name (optionally qualified) of an existing table, either a concrete or base one (actual index) or alias.

If the table name contains special SQL characters (such as .,-,*,etc…) use double quotes to escape them:

SELECT * FROM "emp" LIMIT 1;

     birth_date     |    emp_no     |  first_name   |    gender     |     hire_date      |   languages   |   last_name   |    salary
--------------------+---------------+---------------+---------------+--------------------+---------------+---------------+---------------
1953-09-02T00:00:00Z|10001          |Georgi         |M              |1986-06-26T00:00:00Z|2              |Facello        |57305

The name can be a pattern pointing to multiple indices (likely requiring quoting as mentioned above) with the restriction that all resolved concrete tables have exact mapping.

SELECT emp_no FROM "e*p" LIMIT 1;

    emp_no
---------------
10001

alias: A substitute name for the FROM item containing the alias. An alias is used for brevity or to eliminate ambiguity. When an alias is provided, it completely hides the actual name of the table and must be used in its place.

SELECT e.emp_no FROM emp AS e LIMIT 1;

    emp_no
-------------
10001

WHERE Clause

edit

The optional WHERE clause is used to filter rows from the query and has the following syntax:

WHERE condition

where:

condition: Represents an expression that evaluates to a boolean. Only the rows that match the condition (to true) are returned.

SELECT last_name FROM emp WHERE emp_no = 10001;

   last_name
---------------
Facello

GROUP BY

edit

The GROUP BY clause is used to divide the results into groups of rows on matching values from the designated columns. It has the following syntax:

GROUP BY grouping_element [, ...]

where:

grouping_element: Represents an expression on which rows are being grouped on. It can be a column name, alias or ordinal number of a column or an arbitrary expression of column values.

A common, group by column name:

SELECT gender AS g FROM emp GROUP BY gender;

       g
---------------
null
F
M

Grouping by output ordinal:

SELECT gender FROM emp GROUP BY 1;

    gender
---------------
null
F
M

Grouping by alias:

SELECT gender AS g FROM emp GROUP BY g;

       g
---------------
null
F
M

And grouping by column expression (typically used along-side an alias):

SELECT languages + 1 AS l FROM emp GROUP BY l;

       l
---------------
null
2
3
4
5
6

Or a mixture of the above:

SELECT gender g, languages l, COUNT(*) c FROM "emp" GROUP BY g, l ORDER BY languages ASC, gender DESC;

       g       |       l       |       c
---------------+---------------+---------------
M              |null           |7
F              |null           |3
M              |1              |9
F              |1              |4
null           |1              |2
M              |2              |11
F              |2              |5
null           |2              |3
M              |3              |11
F              |3              |6
M              |4              |11
F              |4              |6
null           |4              |1
M              |5              |8
F              |5              |9
null           |5              |4

When a GROUP BY clause is used in a SELECT, all output expressions must be either aggregate functions or expressions used for grouping or derivatives of (otherwise there would be more than one possible value to return for each ungrouped column).

To wit:

SELECT gender AS g, COUNT(*) AS c FROM emp GROUP BY gender;

       g       |       c
---------------+---------------
null           |10
F              |33
M              |57

Expressions over aggregates used in output:

SELECT gender AS g, ROUND((MIN(salary) / 100)) AS salary FROM emp GROUP BY gender;

       g       |    salary
---------------+---------------
null           |253
F              |260
M              |259

Multiple aggregates used:

SELECT gender AS g, KURTOSIS(salary) AS k, SKEWNESS(salary) AS s FROM emp GROUP BY gender;

       g       |        k         |         s
---------------+------------------+-------------------
null           |2.2215791166941923|-0.03373126000214023
F              |1.7873117044424276|0.05504995122217512
M              |2.280646181070106 |0.44302407229580243

Implicit Grouping

edit

When an aggregation is used without an associated GROUP BY, an implicit grouping is applied, meaning all selected rows are considered to form a single default, or implicit group. As such, the query emits only a single row (as there is only a single group).

A common example is counting the number of records:

SELECT COUNT(*) AS count FROM emp;

     count
---------------
100

Of course, multiple aggregations can be applied:

SELECT MIN(salary) AS min, MAX(salary) AS max, AVG(salary) AS avg, COUNT(*) AS count FROM emp;

      min:i    |      max:i    |      avg:d    |     count:l
---------------+---------------+---------------+---------------
25324          |74999          |48248          |100

HAVING

edit

The HAVING clause can be used only along aggregate functions (and thus GROUP BY) to filter what groups are kept or not and has the following syntax:

GROUP BY condition

where:

condition: Represents an expression that evaluates to a boolean. Only groups that match the condition (to true) are returned.

Both WHERE and HAVING are used for filtering however there are several significant differences between them:

WHERE works on individual rows, HAVING works on the groups created by ``GROUP BY``
WHERE is evaluated before grouping, HAVING is evaluated after grouping

SELECT languages AS l, COUNT(*) AS c FROM emp GROUP BY l HAVING c BETWEEN 15 AND 20;

       l       |       c
---------------+---------------
1              |15
2              |19
3              |17
4              |18

Further more, one can use multiple aggregate expressions inside HAVING even ones that are not used in the output (SELECT):

SELECT MIN(salary) AS min, MAX(salary) AS max, MAX(salary) - MIN(salary) AS diff FROM emp GROUP BY languages HAVING diff - max % min > 0 AND AVG(salary) > 30000;

      min      |      max      |     diff
---------------+---------------+---------------
28336          |74999          |46663
25976          |73717          |47741
29175          |73578          |44403
26436          |74970          |48534
27215          |74572          |47357
25324          |66817          |41493

Implicit Grouping

edit

As indicated above, it is possible to have a HAVING clause without a ``GROUP BY``. In this case, the so-called implicit grouping is applied, meaning all selected rows are considered to form a single group and HAVING can be applied on any of the aggregate functions specified on this group. ` As such, the query emits only a single row (as there is only a single group) and HAVING condition returns either one row (the group) or zero if the condition fails.

In this example, HAVING matches:

SELECT MIN(salary) AS min, MAX(salary) AS max FROM emp HAVING min > 25000;

      min      |      max
---------------+---------------
25324          |74999

ORDER BY

edit

The ORDER BY clause is used to sort the results of SELECT by one or more expressions:

ORDER BY expression [ ASC | DESC ] [, ...]

where:

expression: Represents an input column, an output column or an ordinal number of the position (starting from one) of an output column. Additionally, ordering can be done based on the results score ` The direction, if not specified, is by default ASC (ascending). ` Regardless of the ordering specified, null values are ordered last (at the end).

When used along-side, GROUP BY expression can point only to the columns used for grouping.

For example, the following query sorts by an arbitrary input field (page_count):

SELECT * FROM library ORDER BY page_count DESC LIMIT 5;

     author      |        name        |  page_count   |    release_date
-----------------+--------------------+---------------+--------------------
Peter F. Hamilton|Pandora's Star      |768            |2004-03-02T00:00:00Z
Vernor Vinge     |A Fire Upon the Deep|613            |1992-06-01T00:00:00Z
Frank Herbert    |Dune                |604            |1965-06-01T00:00:00Z
Alastair Reynolds|Revelation Space    |585            |2000-03-15T00:00:00Z
James S.A. Corey |Leviathan Wakes     |561            |2011-06-02T00:00:00Z

Order By Score

edit

When doing full-text queries in the WHERE clause, results can be returned based on their score or relevance to the given query.

When doing multiple text queries in the WHERE clause then, their scores will be combined using the same rules as Elasticsearch’s bool query.

To sort based on the score, use the special function SCORE():

SELECT SCORE(), * FROM library WHERE MATCH(name, 'dune') ORDER BY SCORE() DESC;

    SCORE()    |    author     |       name        |  page_count   |    release_date
---------------+---------------+-------------------+---------------+--------------------
2.288635       |Frank Herbert  |Dune               |604            |1965-06-01T00:00:00Z
1.8893257      |Frank Herbert  |Dune Messiah       |331            |1969-10-15T00:00:00Z
1.6086555      |Frank Herbert  |Children of Dune   |408            |1976-04-21T00:00:00Z
1.4005898      |Frank Herbert  |God Emperor of Dune|454            |1981-05-28T00:00:00Z

Note that you can return SCORE() by using a full-text search predicate in the WHERE clause. This is possible even if SCORE() is not used for sorting:

SELECT SCORE(), * FROM library WHERE MATCH(name, 'dune') ORDER BY page_count DESC;

    SCORE()    |    author     |       name        |  page_count   |    release_date
---------------+---------------+-------------------+---------------+--------------------
2.288635       |Frank Herbert  |Dune               |604            |1965-06-01T00:00:00Z
1.4005898      |Frank Herbert  |God Emperor of Dune|454            |1981-05-28T00:00:00Z
1.6086555      |Frank Herbert  |Children of Dune   |408            |1976-04-21T00:00:00Z
1.8893257      |Frank Herbert  |Dune Messiah       |331            |1969-10-15T00:00:00Z

NOTE: Trying to return score from a non full-text query will return the same value for all results, as all are equally relevant.

LIMIT

edit

The LIMIT clause restricts (limits) the number of rows returns using the format:

LIMIT ( count | ALL )

where

count: is a positive integer or zero indicating the maximum possible number of results being returned (as there might be less matches than the limit). If 0 is specified, no results are returned.
ALL: indicates there is no limit and thus all results are being returned.

To return

SELECT first_name, last_name, emp_no FROM emp LIMIT 1;

  first_name   |   last_name   |    emp_no
---------------+---------------+---------------
Georgi         |Facello        |10001

« DESCRIBE TABLE SHOW COLUMNS »

SELECT

SELECT

SELECT List

Wildcard

FROM Clause

WHERE Clause

GROUP BY

Implicit Grouping

HAVING

Implicit Grouping

ORDER BY

Order By Score

LIMIT

`SELECT` List