ES|QL SUBSTRING function

×

string

String expression. If null, the function returns null.

start

Start position.

length

Length of the substring from the start position. Optional; if omitted, all positions after start are returned.

Returns a substring of a string, specified by a start position and an optional length.

This example returns the first three characters of every last name:

FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 1, 3)
		

A negative start position is interpreted as being relative to the end of the string. This example returns the last three characters of every last name:

FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, -3, 3)
		

If length is omitted, substring returns the remainder of the string. This example returns all characters except for the first:

FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 2)