This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Geo Functions System Functions »
Elastic Docs ›Elasticsearch Guide [master] ›SQL ›Functions and Operators

Conditional Functions And Expressions

edit

Conditional Functions And Expressions

edit

Functions that return one of their arguments by evaluating in an if-else manner.

CASE

edit

Synopsis:

CASE WHEN condition THEN result
    [WHEN ...]
    [ELSE default_result]
END

Input:

One or multiple WHEN condition THEN result clauses are used and the expression can optionally have an ELSE default_result clause. Every condition should be a boolean expression.

Output: one of the result expressions if the corresponding WHEN condition evaluates to true or the default_result if all WHEN condition clauses evaluate to false. If the optional ELSE default_result clause is missing and all WHEN condition clauses evaluate to false then null is returned.

Description: The CASE expression is a generic conditional expression which simulates if/else statements of other programming languages If the condition’s result is true, the value of the result expression that follows the condition will be the returned the subsequent when clauses will be skipped and not processed.

SELECT CASE WHEN 1 > 2 THEN 'elastic'
            WHEN 2 <= 3 THEN 'search'
       END AS "case";

    case
---------------
search
SELECT CASE WHEN 1 > 2 THEN 'elastic'
            WHEN 2 > 10 THEN 'search'
       END AS "case";

    case
---------------
null
SELECT CASE WHEN 1 > 2 THEN 'elastic'
            WHEN 2 > 10 THEN 'search'
            ELSE 'default'
       END AS "case";

    case
---------------
default

As a variant, a case expression can be expressed with a syntax similar to switch-case of other programming languages:

CASE expression
     WHEN value1 THEN result1
    [WHEN value2 THEN result2]
    [WHEN ...]
    [ELSE default_result]
END

In this case it’s transformed internally to:

CASE WHEN expression = value1 THEN result1
    [WHEN expression = value2 THEN result2]
    [WHEN ...]
    [ELSE default_result]
END
SELECT CASE 5
            WHEN 1 THEN 'elastic'
            WHEN 2 THEN 'search'
            WHEN 5 THEN 'elasticsearch'
       END AS "case";

    case
---------------
elasticsearch
SELECT CASE 5
            WHEN 1 THEN 'elastic'
            WHEN 2 THEN 'search'
            WHEN 3 THEN 'elasticsearch'
            ELSE 'default'
       END AS "case";

    case
---------------
default

All result expressions must be of compatible data types. More specifically all result expressions should have a compatible data type with the 1st non-null result expression. E.g.:

for the following query:

CASE WHEN a = 1 THEN null
     WHEN a > 2 THEN 10
     WHEN a > 5 THEN 'foo'
END

an error message would be returned, mentioning that foo is of data type keyword, which does not match the expected data type integer (based on result 10).

Conditional bucketing

edit

CASE can be used as a GROUP BY key in a query to facilitate custom bucketing and assign descriptive names to those buckets. If, for example, the values for a key are too many or, simply, ranges of those values are more interesting than every single value, CASE can create custom buckets as in the following example:

SELECT count(*) AS count,
  CASE WHEN NVL(languages, 0) = 0 THEN 'zero'
    WHEN languages = 1 THEN 'one'
    WHEN languages = 2 THEN 'bilingual'
    WHEN languages = 3 THEN 'trilingual'
    ELSE 'multilingual'
  END as lang_skills
FROM employees
GROUP BY lang_skills
ORDER BY lang_skills;

With this query, one can create normal grouping buckets for values 0, 1, 2, 3 with descriptive names, and every value >= 4 falls into the multilingual bucket.

COALESCE

edit

Synopsis:

COALESCE(
    expression, 
    expression, 
    ...)

Input:

1st expression

2nd expression

…​

Nth expression

COALESCE can take an arbitrary number of arguments.

Output: one of the expressions or null

Description: Returns the first of its arguments that is not null. If all arguments are null, then it returns null.

SELECT COALESCE(null, 'elastic', 'search') AS "coalesce";

    coalesce
---------------
elastic
SELECT COALESCE(null, null, null, null) AS "coalesce";

    coalesce
---------------
null

GREATEST

edit

Synopsis:

GREATEST(
    expression, 
    expression, 
    ...)

Input:

1st expression

2nd expression

…​

Nth expression

GREATEST can take an arbitrary number of arguments and all of them must be of the same data type.

Output: one of the expressions or null

Description: Returns the argument that has the largest value which is not null. If all arguments are null, then it returns null.

SELECT GREATEST(null, 1, 2) AS "greatest";

    greatest
---------------
2
SELECT GREATEST(null, null, null, null) AS "greatest";

    greatest
---------------
null

IFNULL

edit

Synopsis:

IFNULL(
    expression, 
    expression)

Input:

1st expression

2nd expression

Output: 2nd expression if 1st expression is null, otherwise 1st expression.

Description: Variant of COALESCE with only two arguments. Returns the first of its arguments that is not null. If all arguments are null, then it returns null.

SELECT IFNULL('elastic', null) AS "ifnull";

    ifnull
---------------
elastic
SELECT IFNULL(null, 'search') AS "ifnull";

    ifnull
---------------
search

IIF

edit

Synopsis:

IIF(
    expression,   
    expression,   
    [expression])

Input:

boolean condition to check

return value if the boolean condition evaluates to true

return value if the boolean condition evaluates false; optional

Output: 2nd expression if 1st expression (condition) evaluates to true. If it evaluates to false return 3rd expression. If 3rd expression is not provided return null.

Description: Conditional function that implements the standard IF <condition> THEN <result1> ELSE <result2> logic of programming languages. If the 3rd expression is not provided and the condition evaluates to false, null is returned.

SELECT IIF(1 < 2, 'TRUE', 'FALSE') AS result1, IIF(1 > 2, 'TRUE', 'FALSE') AS result2;

    result1    |    result2
---------------+---------------
TRUE           |FALSE
SELECT IIF(1 < 2, 'TRUE') AS result1, IIF(1 > 2 , 'TRUE') AS result2;

    result1    |    result2
---------------+---------------
TRUE           |null

IIF functions can be combined to implement more complex logic simulating the CASE expression. E.g.:

IIF(a = 1, 'one', IIF(a = 2, 'two', IIF(a = 3, 'three', 'many')))

ISNULL

edit

Synopsis:

ISNULL(
    expression, 
    expression)

Input:

1st expression

2nd expression

Output: 2nd expression if 1st expression is null, otherwise 1st expression.

Description: Variant of COALESCE with only two arguments. Returns the first of its arguments that is not null. If all arguments are null, then it returns null.

SELECT ISNULL('elastic', null) AS "isnull";

    isnull
---------------
elastic
SELECT ISNULL(null, 'search') AS "isnull";

    isnull
---------------
search

LEAST

edit

Synopsis:

LEAST(
    expression, 
    expression, 
    ...)

Input:

1st expression

2nd expression

…​

Nth expression

LEAST can take an arbitrary number of arguments and all of them must be of the same data type.

Output: one of the expressions or null

Description: Returns the argument that has the smallest value which is not null. If all arguments are null, then it returns null.

SELECT LEAST(null, 2, 1) AS "least";

    least
---------------
1
SELECT LEAST(null, null, null, null) AS "least";

    least
---------------
null

NULLIF

edit

Synopsis:

NULLIF(
    expression, 
    expression)

Input:

1st expression

2nd expression

Output: null if the 2 expressions are equal, otherwise the 1st expression.

Description: Returns null when the two input expressions are equal and if not, it returns the 1st expression.

SELECT NULLIF('elastic', 'search') AS "nullif";
    nullif
---------------
elastic
SELECT NULLIF('elastic', 'elastic') AS "nullif";

    nullif:s
---------------
null

NVL

edit

Synopsis:

NVL(
    expression, 
    expression)

Input:

1st expression

2nd expression

Output: 2nd expression if 1st expression is null, otherwise 1st expression.

Description: Variant of COALESCE with only two arguments. Returns the first of its arguments that is not null. If all arguments are null, then it returns null.

SELECT NVL('elastic', null) AS "nvl";

    nvl
---------------
elastic
SELECT NVL(null, 'search') AS "nvl";

    nvl
---------------
search
« Geo Functions System Functions »