ES|QL MV_LIKE function

Checks if any value of a multivalue field matches a wildcard pattern.

×

field

Multivalue expression to test. If null or empty, the function returns false.

pattern

Wildcard pattern. Must be a constant. * matches any run of characters, ? matches a single character; escape either with \.

Returns true when any value yielded by field matches pattern, using the same wildcard syntax as LIKE. LIKE is a single-value scalar: applied to a multivalue field it emits a warning and returns null, so this is how you match a wildcard pattern against a multivalue field. A null or empty field returns false, and because the result is never null the predicate composes under AND/OR/NOT.

ROW names = ["Anna", "Bob", "Carl"]
| EVAL any_starts_with_a = mv_like(names, "A*")
		

A prefix pattern matches when any value starts with the literal:

ROW names = ["Anna", "Bob"]
| EVAL has_bo = mv_like(names, "Bo*")
		

Because the result is never null, it composes under NOT:

ROW names = ["Anna", "Bob"]
| EVAL no_carl = NOT mv_like(names, "Carl*")