ES|QL MV_DIFFERENCE function
field1- Expression that can be null, a single value, or multiple values. If null, the function returns null.
field2-
Expression that can be null, a single value, or multiple values. If null, the function returns field1.
Returns the values that appear in the first field, except those that appear in the second. Returns null if the first expression is null (nothing to remove) or the value of the first field if the second is null.
| field1 | field2 | result |
|---|---|---|
| boolean | boolean | boolean |
| cartesian_point | cartesian_point | cartesian_point |
| cartesian_shape | cartesian_shape | cartesian_shape |
| date | date | date |
| date_nanos | date_nanos | date_nanos |
| double | double | double |
| geo_point | geo_point | geo_point |
| geo_shape | geo_shape | geo_shape |
| geohash | geohash | geohash |
| geohex | geohex | geohex |
| geotile | geotile | geotile |
| integer | integer | integer |
| ip | ip | ip |
| keyword | keyword | keyword |
| keyword | text | keyword |
| long | long | long |
| text | keyword | keyword |
| text | text | keyword |
| unsigned_long | unsigned_long | unsigned_long |
| version | version | version |
ROW values = ["a", "b", "c"], element = "a"
| EVAL result = mv_difference(values, element)
| values:keyword | element:keyword | result:keyword |
|---|---|---|
| [a, b, c] | a | [b, c] |