ES|QL functions and operators reference

Complete mapping of ES|QL functions and operators to their Elastic.Esql equivalents. Functions not yet supported are listed at the bottom of each section.

Aggregations run inside .GroupBy(...).Select(...) or as terminal operators like .Count(). See STATS...BY aggregation for details on the GroupBy pattern.

var topLevels = client.CreateQuery<LogEntry>()
    .GroupBy(l => l.Level)
    .Select(g => new {
        Level = g.Key,
        Count = g.Count(),
        Avg = g.Average(l => l.Duration),
        P99 = EsqlFunctions.Percentile(g, l => l.Duration, 99)
    });
// STATS count = COUNT(*), avg = AVG(duration), p99 = PERCENTILE(duration, 99) BY level = log.level
		

Not yet supported: ST_CENTROID_AGG, ST_EXTENT_AGG.

Conditional logic in projections. The ternary operator maps to CASE WHEN.

.Select(l => new { Status = l.StatusCode >= 500 ? "error" : "ok" })
// EVAL status = CASE WHEN statusCode >= 500 THEN "error" ELSE "ok" END
		

DateTime properties translate to DATE_EXTRACT. Arithmetic methods like .AddDays() produce date math expressions.

.Where(l => l.Timestamp > DateTime.UtcNow.AddHours(-1) && l.Timestamp.Year == 2025)
// WHERE (@timestamp > (NOW() + -1 hours) AND DATE_EXTRACT("year", @timestamp) == 2025)
		

Grouping uses standard LINQ .GroupBy(). ES|QL-specific grouping functions are available through EsqlFunctions. See STATS...BY aggregation for the full GroupBy pattern.

.GroupBy(l => EsqlFunctions.Bucket(l.Duration, 10))
.Select(g => new { Bucket = g.Key, Count = g.Count() })
// STATS count = COUNT(*) BY bucket = BUCKET(duration, 10)
		

using static Elastic.Esql.Functions.EsqlFunctions;
.Where(l => CidrMatch(l.ClientIp, "10.0.0.0/8"))
// WHERE CIDR_MATCH(client_ip, "10.0.0.0/8")
		

Standard Math.* methods translate to their ES|QL equivalents in both Where and Select. EsqlFunctions methods also work in both contexts.

.Select(l => new { Abs = Math.Abs(l.Delta), Root = Math.Sqrt(l.Value) })
// EVAL abs = ABS(delta), root = SQRT(value)
		

Note: Math.E, Math.PI, and Math.Tau are const fields that the C# compiler inlines as numeric literals. Use EsqlFunctions.E(), .Pi(), .Tau() instead to generate the ES|QL function calls.

Vector search and similarity functions for dense_vector fields. Vectors are passed as DenseVector<T> (with implicit conversion from T[] and ReadOnlyMemory<T>). Use T = float for element_type: "float" and T = byte for both element_type: "byte" and element_type: "bit"; the bundled JSON converter handles the signed-byte wire format for byte vectors so you can pass natural unsigned values. See the vector and hybrid search guide for the full pattern, including FROM ... METADATA, EsqlMetadata.Score, and FORK/FUSE hybrid pipelines.

.From("books", MetadataField.Score)
.Where(b => EsqlFunctions.Knn(b.Embedding, new float[] { 0.5f, 0.25f, 0.75f }, new KnnOptions { K = 10 }))
// FROM books METADATA _score | WHERE KNN(embedding, [0.5, 0.25, 0.75], { "k": 10 })
		

The optional third argument to Knn is a typed KnnOptions record. Set the properties you want to override; only set properties are emitted into the ES|QL named-parameter object (e.g. new KnnOptions { K = 10, MinCandidates = 100 } -> { "k": 10, "min_candidates": 100 }). Available properties: K, MinCandidates, Similarity, Boost, VisitPercentage, RescoreOversample.

Not yet supported: EMBEDDING (planned, currently serverless-only preview).

Full-text search and pattern matching functions available through EsqlFunctions.

using static Elastic.Esql.Functions.EsqlFunctions;
.Where(l => Match(l.Message, "connection error"))
// WHERE MATCH(message, "connection error")
		

C# string methods translate to ES|QL string functions. Contains, StartsWith, and EndsWith map to LIKE patterns.

.Where(l => l.Host.StartsWith("prod-") && l.Message.ToLower().Contains("timeout"))
// WHERE host LIKE "prod-*" AND TO_LOWER(message) LIKE "*timeout*"
		

All comparison, arithmetic, logical, and pattern-matching operators are fully supported.

using static Elastic.Esql.Functions.EsqlFunctions;

.Where(l => Like(l.Path, "/api/v?/users"))     // path LIKE "/api/v?/users"
.Where(l => Rlike(l.Path, "/api/v[0-9]+/.*"))  // path RLIKE "/api/v[0-9]+/.*"
.Where(l => levels.Contains(l.Level))           // log.level IN ("a", "b")
		

.Select(l => new { IntDuration = EsqlFunctions.CastToInteger(l.Duration) })
// EVAL intDuration = duration::integer
		

The following ES|QL function categories have no Elastic.Esql equivalents yet:

Spatial functions: ST_CONTAINS, ST_DISTANCE, ST_DISJOINT, ST_ENVELOPE, ST_INTERSECTS, ST_NPOINTS, ST_SIMPLIFY, ST_WITHIN, ST_X, ST_XMAX, ST_XMIN, ST_Y, ST_YMAX, ST_YMIN, ST_GEOTILE, ST_GEOHEX, ST_GEOHASH.

Multivalue functions: MV_APPEND, MV_AVG, MV_CONCAT, MV_CONTAINS, MV_COUNT, MV_DEDUPE, MV_FIRST, MV_INTERSECTION, MV_INTERSECTS, MV_LAST, MV_MAX, MV_MEDIAN, MV_MEDIAN_ABSOLUTE_DEVIATION, MV_MIN, MV_PERCENTILE, MV_PSERIES_WEIGHTED_SUM, MV_SLICE, MV_SORT, MV_SUM, MV_UNION, MV_ZIP.

Type conversion functions: TO_BOOLEAN, TO_CARTESIANPOINT, TO_CARTESIANSHAPE, TO_DATEPERIOD, TO_DATETIME, TO_DATE_NANOS, TO_DEGREES, TO_DENSE_VECTOR, TO_DOUBLE, TO_GEOHASH, TO_GEOHEX, TO_GEOPOINT, TO_GEOSHAPE, TO_GEOTILE, TO_INTEGER, TO_IP, TO_LONG, TO_RADIANS, TO_STRING, TO_TIMEDURATION, TO_UNSIGNED_LONG, TO_VERSION, TO_AGGREGATE_METRIC_DOUBLE.

Time series aggregation functions: ABSENT_OVER_TIME, AVG_OVER_TIME, COUNT_OVER_TIME, COUNT_DISTINCT_OVER_TIME, DELTA, DERIV, FIRST_OVER_TIME, IDELTA, INCREASE, IRATE, LAST_OVER_TIME, MAX_OVER_TIME, MIN_OVER_TIME, PERCENTILE_OVER_TIME, PRESENT_OVER_TIME, RATE, STDDEV_OVER_TIME, VARIANCE_OVER_TIME, SUM_OVER_TIME.