ES|QL functions and operators reference

Complete mapping of ES|QL functions and operators to their Elastic.Esql equivalents. Functions not yet supported are listed at the bottom of each section.

Aggregations run inside .GroupBy(...).Select(...) or as terminal operators like .Count(). See STATS...BY aggregation for details on the GroupBy pattern.

var topLevels = client.CreateQuery<LogEntry>()
    .GroupBy(l => l.Level)
    .Select(g => new {
        Level = g.Key,
        Count = g.Count(),
        Avg = g.Average(l => l.Duration),
        P99 = EsqlFunctions.Percentile(g, l => l.Duration, 99)
    });
// STATS count = COUNT(*), avg = AVG(duration), p99 = PERCENTILE(duration, 99) BY level = log.level
		

Not yet supported: ST_CENTROID_AGG, ST_EXTENT_AGG.

Conditional logic in projections. The ternary operator maps to CASE WHEN.

.Select(l => new { Status = l.StatusCode >= 500 ? "error" : "ok" })
// EVAL status = CASE WHEN statusCode >= 500 THEN "error" ELSE "ok" END
		

DateTime properties translate to DATE_EXTRACT. Arithmetic methods like .AddDays() produce date math expressions.

.Where(l => l.Timestamp > DateTime.UtcNow.AddHours(-1) && l.Timestamp.Year == 2025)
// WHERE (@timestamp > (NOW() + -1 hours) AND DATE_EXTRACT("year", @timestamp) == 2025)
		

Grouping uses standard LINQ .GroupBy(). ES|QL-specific grouping functions are available through EsqlFunctions. See STATS...BY aggregation for the full GroupBy pattern.

.GroupBy(l => EsqlFunctions.Bucket(l.Duration, 10))
.Select(g => new { Bucket = g.Key, Count = g.Count() })
// STATS count = COUNT(*) BY bucket = BUCKET(duration, 10)
		

using static Elastic.Esql.Functions.EsqlFunctions;
.Where(l => CidrMatch(l.ClientIp, "10.0.0.0/8"))
// WHERE CIDR_MATCH(client_ip, "10.0.0.0/8")
		

Standard Math.* methods translate to their ES|QL equivalents in both Where and Select. EsqlFunctions methods also work in both contexts.

.Select(l => new { Abs = Math.Abs(l.Delta), Root = Math.Sqrt(l.Value) })
// EVAL abs = ABS(delta), root = SQRT(value)
		

Note: Math.E, Math.PI, and Math.Tau are const fields that the C# compiler inlines as numeric literals. Use EsqlFunctions.E(), .Pi(), .Tau() instead to generate the ES|QL function calls.

Full-text search and pattern matching functions available through EsqlFunctions.

using static Elastic.Esql.Functions.EsqlFunctions;
.Where(l => Match(l.Message, "connection error"))
// WHERE MATCH(message, "connection error")
		

C# string methods translate to ES|QL string functions. Contains, StartsWith, and EndsWith map to LIKE patterns.

.Where(l => l.Host.StartsWith("prod-") && l.Message.ToLower().Contains("timeout"))
// WHERE host LIKE "prod-*" AND TO_LOWER(message) LIKE "*timeout*"
		

All comparison, arithmetic, logical, and pattern-matching operators are fully supported.

using static Elastic.Esql.Functions.EsqlFunctions;

.Where(l => Like(l.Path, "/api/v?/users"))     // path LIKE "/api/v?/users"
.Where(l => Rlike(l.Path, "/api/v[0-9]+/.*"))  // path RLIKE "/api/v[0-9]+/.*"
.Where(l => levels.Contains(l.Level))           // log.level IN ("a", "b")
		

.Select(l => new { IntDuration = EsqlFunctions.CastToInteger(l.Duration) })
// EVAL intDuration = duration::integer
		

The following ES|QL function categories have no Elastic.Esql equivalents yet:

Spatial functions: ST_CONTAINS, ST_DISTANCE, ST_DISJOINT, ST_ENVELOPE, ST_INTERSECTS, ST_NPOINTS, ST_SIMPLIFY, ST_WITHIN, ST_X, ST_XMAX, ST_XMIN, ST_Y, ST_YMAX, ST_YMIN, ST_GEOTILE, ST_GEOHEX, ST_GEOHASH.

Multivalue functions: MV_APPEND, MV_AVG, MV_CONCAT, MV_CONTAINS, MV_COUNT, MV_DEDUPE, MV_FIRST, MV_INTERSECTION, MV_INTERSECTS, MV_LAST, MV_MAX, MV_MEDIAN, MV_MEDIAN_ABSOLUTE_DEVIATION, MV_MIN, MV_PERCENTILE, MV_PSERIES_WEIGHTED_SUM, MV_SLICE, MV_SORT, MV_SUM, MV_UNION, MV_ZIP.

Type conversion functions: TO_BOOLEAN, TO_CARTESIANPOINT, TO_CARTESIANSHAPE, TO_DATEPERIOD, TO_DATETIME, TO_DATE_NANOS, TO_DEGREES, TO_DENSE_VECTOR, TO_DOUBLE, TO_GEOHASH, TO_GEOHEX, TO_GEOPOINT, TO_GEOSHAPE, TO_GEOTILE, TO_INTEGER, TO_IP, TO_LONG, TO_RADIANS, TO_STRING, TO_TIMEDURATION, TO_UNSIGNED_LONG, TO_VERSION, TO_AGGREGATE_METRIC_DOUBLE.

Dense vector functions: KNN, TEXT_EMBEDDING, V_COSINE, V_DOT_PRODUCT, V_HAMMING, V_L1_NORM, V_L2_NORM.

Time series aggregation functions: ABSENT_OVER_TIME, AVG_OVER_TIME, COUNT_OVER_TIME, COUNT_DISTINCT_OVER_TIME, DELTA, DERIV, FIRST_OVER_TIME, IDELTA, INCREASE, IRATE, LAST_OVER_TIME, MAX_OVER_TIME, MIN_OVER_TIME, PERCENTILE_OVER_TIME, PRESENT_OVER_TIME, RATE, STDDEV_OVER_TIME, VARIANCE_OVER_TIME, SUM_OVER_TIME.