Creating an ES|QL query

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Creating an ES|QL query

edit

To construct an ES|QL query you start from one of the ES|QL source commands:

`ESQL.from_`

edit

The FROM command selects the indices, data streams or aliases to be queried.

Examples:

from elasticsearch.esql import ESQL

# FROM employees
query1 = ESQL.from_("employees")

# FROM <logs-{now/d}>
query2 = ESQL.from_("<logs-{now/d}>")

# FROM employees-00001, other-employees-*
query3 = ESQL.from_("employees-00001", "other-employees-*")

# FROM cluster_one:employees-00001, cluster_two:other-employees-*
query4 = ESQL.from_("cluster_one:employees-00001", "cluster_two:other-employees-*")

# FROM employees METADATA _id
query5 = ESQL.from_("employees").metadata("_id")

Note how in the last example the optional METADATA clause of the FROM command is added as a chained method.

`ESQL.row`

edit

The ROW command produces a row with one or more columns, with the values that you specify.

Examples:

from elasticsearch.esql import ESQL, functions

# ROW a = 1, b = "two", c = null
query1 = ESQL.row(a=1, b="two", c=None)

# ROW a = [1, 2]
query2 = ESQL.row(a=[1, 2])

# ROW a = ROUND(1.23, 0)
query3 = ESQL.row(a=functions.round(1.23, 0))

`ESQL.show`

edit

The SHOW command returns information about the deployment and its capabilities.

Example:

from elasticsearch.esql import ESQL

# SHOW INFO
query = ESQL.show("INFO")

« ES|QL Query Builder Adding processing commands »