This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Data enrichment ES|QL time spans »
Elastic Docs ›Elasticsearch Guide [master] ›ES|QL ›ES|QL reference

ES|QL implicit casting

edit

ES|QL implicit casting

edit

Often users will input date, date_period, time_duration, ip or version as simple strings in their queries for use in predicates, functions, or expressions. ES|QL provides type conversion functions to explicitly convert these strings into the desired data types.

Without implicit casting users must explicitly code these to_X functions in their queries, when string literals don’t match the target data types they are assigned or compared to. Here is an example of using to_datetime to explicitly perform a data type conversion.

FROM employees
| EVAL dd_ns1=date_diff("day", to_datetime("2023-12-02T11:00:00.00Z"), birth_date)
| SORT emp_no
| KEEP dd_ns1
| LIMIT 1

Implicit casting example

edit

Implicit casting automatically converts string literals to the target data type. This allows users to specify string values for types like date, date_period, time_duration, ip and version in their queries.

The first query can be coded without calling the to_datetime function, as follows:

FROM employees
| EVAL dd_ns1=date_diff("day", "2023-12-02T11:00:00.00Z", birth_date)
| SORT emp_no
| KEEP dd_ns1
| LIMIT 1

Operations that support implicit casting

edit

The following table details which ES|QL operations support implicit casting for different data types.

ScalarFunctions Operators GroupingFunctions AggregateFunctions

DATE

Y

Y

Y

N

DATE_PERIOD/TIME_DURATION

Y

N

Y

N

IP

Y

Y

Y

N

VERSION

Y

Y

Y

N

BOOLEAN

Y

Y

Y

N

ScalarFunctions includes:

Operators includes:

« Data enrichment ES|QL time spans »