Loading

ES|QL MV_GREATER function

Checks whether a multivalue field has any value greater than a bound.

Embedded
field
Multivalue expression to test. If null or empty, the function returns false.
bound
Comparison bound, of the same type as field. If null or multivalued, the function returns false.
options

(Optional) Bound inclusivity options.

Returns true if at least one value of field is greater than bound, using the natural order of the type. A null or empty field returns false, as does a null or multivalued bound. The comparison is strict (>) by default; set include_bound to true in the optional options map to make it inclusive (>=). Works on any ordered type: numbers, dates, IPs, versions, and strings (compared by their UTF-8 bytes).

field bound options result
date date named parameters boolean
date date boolean
date_nanos date_nanos boolean
double double named parameters boolean
double double boolean
integer integer named parameters boolean
integer integer boolean
ip ip boolean
keyword keyword named parameters boolean
keyword keyword boolean
keyword text boolean
long long named parameters boolean
long long boolean
text keyword boolean
text text boolean
unsigned_long unsigned_long boolean
version version boolean
include_bound

(boolean) Whether the bound is inclusive. Defaults to false (strict >); true makes it inclusive (>=).

ROW values = [1, 5, 10]
| EVAL greater = mv_greater(values, 4)
values:integer greater:boolean
[1, 5, 10] true

With include_bound: true a value equal to the bound matches too:

ROW values = [4]
| EVAL greater = mv_greater(values, 4, {"include_bound": true})
values:integer greater:boolean
[4] true

Strings are compared by their UTF-8 bytes:

ROW words = ["apple", "cherry"]
| EVAL greater = mv_greater(words, "banana")
words:keyword greater:boolean
[apple, cherry] true