--- title: ES|QL functions and operators reference description: Complete mapping of ES|QL functions and operators to their Elastic.Esql equivalents. Functions not yet supported are listed at the bottom of each section... url: https://docs-v3-preview.elastic.dev/esql-dotnet/esql/functions-reference --- # ES|QL functions and operators reference Complete mapping of [ES|QL functions and operators](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/esql-functions-operators) to their Elastic.Esql equivalents. Functions not yet supported are listed at the bottom of each section. ## Aggregation functions Aggregations run inside `.GroupBy(...).Select(...)` or as terminal operators like `.Count()`. See [STATS...BY aggregation](/esql-dotnet/esql/linq-translation#statsby---aggregation) for details on the GroupBy pattern. ```csharp var topLevels = client.CreateQuery() .GroupBy(l => l.Level) .Select(g => new { Level = g.Key, Count = g.Count(), Avg = g.Average(l => l.Duration), P99 = EsqlFunctions.Percentile(g, l => l.Duration, 99) }); // STATS count = COUNT(*), avg = AVG(duration), p99 = PERCENTILE(duration, 99) BY level = log.level ``` | ES|QL | `EsqlFunctions` | C# native | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------|---------------------------| | [`ABSENT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/absent) | `EsqlFunctions.Absent(g, x => x.Field)` | | | [`AVG`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/avg) | | `g.Average(x => x.Field)` | | [`COUNT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/count) | | `g.Count()` or `.Count()` | | [`COUNT_DISTINCT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/count_distinct) | `EsqlFunctions.CountDistinct(g, x => x.Field)` | | | [`FIRST`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/first) | `EsqlFunctions.First(g, x => x.Field)` | | | [`LAST`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/last) | `EsqlFunctions.Last(g, x => x.Field)` | | | [`MAX`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/max) | | `g.Max(x => x.Field)` | | [`MEDIAN`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/median) | `EsqlFunctions.Median(g, x => x.Field)` | | | [`MEDIAN_ABSOLUTE_DEVIATION`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/median_absolute_deviation) | `EsqlFunctions.MedianAbsoluteDeviation(g, x => x.Field)` | | | [`MIN`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/min) | | `g.Min(x => x.Field)` | | [`PERCENTILE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/percentile) | `EsqlFunctions.Percentile(g, x => x.Field, 99)` | | | [`PRESENT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/present) | `EsqlFunctions.Present(g, x => x.Field)` | | | [`SAMPLE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/sample) | `EsqlFunctions.Sample(g, x => x.Field)` | | | [`STD_DEV`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/std_dev) | `EsqlFunctions.StdDev(g, x => x.Field)` | | | [`SUM`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/sum) | | `g.Sum(x => x.Field)` | | [`TOP`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/top) | `EsqlFunctions.Top(g, x => x.Field, n, "asc")` | | | [`VALUES`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/values) | `EsqlFunctions.Values(g, x => x.Field)` | | | [`VARIANCE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/variance) | `EsqlFunctions.Variance(g, x => x.Field)` | | | [`WEIGHTED_AVG`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/aggregation-functions/weighted_avg) | `EsqlFunctions.WeightedAvg(g, x => x.Val, x => x.Weight)` | | Not yet supported: `ST_CENTROID_AGG`, `ST_EXTENT_AGG`. ## Conditional functions Conditional logic in projections. The ternary operator maps to `CASE WHEN`. ```csharp .Select(l => new { Status = l.StatusCode >= 500 ? "error" : "ok" }) // EVAL status = CASE WHEN statusCode >= 500 THEN "error" ELSE "ok" END ``` | ES|QL | `EsqlFunctions` | C# native | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------|----------------------------------| | [`CASE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/conditional-functions-and-expressions/case) | | `condition ? trueVal : falseVal` | | [`CLAMP`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/conditional-functions-and-expressions/clamp) | `EsqlFunctions.Clamp(n, min, max)` | `Math.Clamp(n, min, max)` | | [`COALESCE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/conditional-functions-and-expressions/coalesce) | `EsqlFunctions.Coalesce(a, b)` | | | [`GREATEST`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/conditional-functions-and-expressions/greatest) | | `Math.Max(a, b)` | | [`LEAST`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/conditional-functions-and-expressions/least) | | `Math.Min(a, b)` | ## Date and time functions DateTime properties translate to `DATE_EXTRACT`. Arithmetic methods like `.AddDays()` produce date math expressions. ```csharp .Where(l => l.Timestamp > DateTime.UtcNow.AddHours(-1) && l.Timestamp.Year == 2025) // WHERE (@timestamp > (NOW() + -1 hours) AND DATE_EXTRACT("year", @timestamp) == 2025) ``` | ES|QL | `EsqlFunctions` | C# native | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------|------------------------------------------------------------------------------------------| | [`DATE_DIFF`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/date-time-functions/date_diff) | `EsqlFunctions.DateDiff(unit, start, end)` | | | [`DATE_EXTRACT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/date-time-functions/date_extract) | | `.Year`, `.Month`, `.Day`, `.Hour`, `.Minute`, `.Second`, `.DayOfWeek`, `.DayOfYear` | | [`DATE_FORMAT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/date-time-functions/date_format) | `EsqlFunctions.DateFormat(field, pattern)` | | | [`DATE_PARSE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/date-time-functions/date_parse) | `EsqlFunctions.DateParse(pattern, str)` | | | [`DATE_TRUNC`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/date-time-functions/date_trunc) | `EsqlFunctions.DateTrunc(unit, field)` | `DateTime.Today` | | [`DAY_NAME`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/date-time-functions/day_name) | `EsqlFunctions.DayName(date)` | | | [`MONTH_NAME`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/date-time-functions/month_name) | `EsqlFunctions.MonthName(date)` | | | [`NOW`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/date-time-functions/now) | `EsqlFunctions.Now()` | `DateTime.Now`, `DateTime.UtcNow` | | [`TRANGE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/date-time-functions/trange) | `EsqlFunctions.TRange(start, end)` | | | Date arithmetic | | `.AddDays(n)`, `.AddHours(n)`, `.AddMinutes(n)`, `.AddSeconds(n)`, `.AddMilliseconds(n)` | | Time intervals | | `TimeSpan.FromDays(n)`, `.FromHours(n)`, `.FromMinutes(n)`, `.FromSeconds(n)` | ## Grouping functions Grouping uses standard LINQ `.GroupBy()`. ES|QL-specific grouping functions are available through `EsqlFunctions`. See [STATS...BY aggregation](/esql-dotnet/esql/linq-translation#statsby---aggregation) for the full GroupBy pattern. ```csharp .GroupBy(l => EsqlFunctions.Bucket(l.Duration, 10)) .Select(g => new { Bucket = g.Key, Count = g.Count() }) // STATS count = COUNT(*) BY bucket = BUCKET(duration, 10) ``` | ES|QL | `EsqlFunctions` | C# native | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------|-----------| | [`BUCKET`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/grouping-functions/bucket) | `EsqlFunctions.Bucket(field, n)` or `EsqlFunctions.Bucket(field, span)` | | | [`CATEGORIZE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/grouping-functions/categorize) | `EsqlFunctions.Categorize(field)` | | | [`TBUCKET`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/grouping-functions/tbucket) | `EsqlFunctions.TBucket(field, span)` | | ## IP functions ```csharp using static Elastic.Esql.Functions.EsqlFunctions; .Where(l => CidrMatch(l.ClientIp, "10.0.0.0/8")) // WHERE CIDR_MATCH(client_ip, "10.0.0.0/8") ``` | ES|QL | `EsqlFunctions` | C# native | |----------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------|-----------| | [`CIDR_MATCH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/ip-functions/cidr_match) | `EsqlFunctions.CidrMatch(ip, cidr)` | | | [`IP_PREFIX`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/ip-functions/ip_prefix) | `EsqlFunctions.IpPrefix(ip, prefixLen, ipVer)` | | ## Math functions Standard `Math.*` methods translate to their ES|QL equivalents in both Where and Select. `EsqlFunctions` methods also work in both contexts. ```csharp .Select(l => new { Abs = Math.Abs(l.Delta), Root = Math.Sqrt(l.Value) }) // EVAL abs = ABS(delta), root = SQRT(value) ``` | ES|QL | `EsqlFunctions` | C# native | |----------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------|----------------------------| | [`ABS`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/abs) | `EsqlFunctions.Abs(n)` | `Math.Abs(n)` | | [`ACOS`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/acos) | `EsqlFunctions.Acos(n)` | `Math.Acos(n)` | | [`ASIN`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/asin) | `EsqlFunctions.Asin(n)` | `Math.Asin(n)` | | [`ATAN`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/atan) | `EsqlFunctions.Atan(n)` | `Math.Atan(n)` | | [`ATAN2`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/atan2) | `EsqlFunctions.Atan2(y, x)` | `Math.Atan2(y, x)` | | [`CBRT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/cbrt) | `EsqlFunctions.Cbrt(n)` | `Math.Cbrt(n)` | | [`CEIL`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/ceil) | `EsqlFunctions.Ceil(n)` | `Math.Ceiling(n)` | | [`COPY_SIGN`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/copy_sign) | `EsqlFunctions.CopySign(mag, sign)` | `Math.CopySign(mag, sign)` | | [`COS`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/cos) | `EsqlFunctions.Cos(n)` | `Math.Cos(n)` | | [`COSH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/cosh) | `EsqlFunctions.Cosh(n)` | `Math.Cosh(n)` | | [`E`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/e) | `EsqlFunctions.E()` | | | [`EXP`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/exp) | `EsqlFunctions.Exp(n)` | `Math.Exp(n)` | | [`FLOOR`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/floor) | `EsqlFunctions.Floor(n)` | `Math.Floor(n)` | | [`HYPOT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/hypot) | `EsqlFunctions.Hypot(a, b)` | | | [`LOG`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/log) | | `Math.Log(n)` | | [`LOG10`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/log10) | | `Math.Log10(n)` | | [`PI`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/pi) | `EsqlFunctions.Pi()` | | | [`POW`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/pow) | | `Math.Pow(base, exp)` | | [`ROUND`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/round) | `EsqlFunctions.Round(n, decimals)` | `Math.Round(n)` | | [`ROUND_TO`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/round_to) | `EsqlFunctions.RoundTo(n, dp)` | | | [`SCALB`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/scalb) | `EsqlFunctions.ScaleB(n, exp)` | `Math.ScaleB(n, exp)` | | [`SIGNUM`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/signum) | `EsqlFunctions.Signum(n)` | `Math.Sign(n)` | | [`SIN`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/sin) | `EsqlFunctions.Sin(n)` | `Math.Sin(n)` | | [`SINH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/sinh) | `EsqlFunctions.Sinh(n)` | `Math.Sinh(n)` | | [`SQRT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/sqrt) | | `Math.Sqrt(n)` | | [`TAN`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/tan) | `EsqlFunctions.Tan(n)` | `Math.Tan(n)` | | [`TANH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/tanh) | `EsqlFunctions.Tanh(n)` | `Math.Tanh(n)` | | [`TAU`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/math-functions/tau) | `EsqlFunctions.Tau()` | | Note: `Math.E`, `Math.PI`, and `Math.Tau` are const fields that the C# compiler inlines as numeric literals. Use `EsqlFunctions.E()`, `.Pi()`, `.Tau()` instead to generate the ES|QL function calls. ## Search functions Full-text search and pattern matching functions available through `EsqlFunctions`. ```csharp using static Elastic.Esql.Functions.EsqlFunctions; .Where(l => Match(l.Message, "connection error")) // WHERE MATCH(message, "connection error") ``` | ES|QL | `EsqlFunctions` | C# native | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------|-----------| | [`DECAY`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/search-functions/decay) | `EsqlFunctions.Decay(func, field, origin, scale)` | | | [`KQL`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/search-functions/kql) | `EsqlFunctions.Kql(query)` | | | [`MATCH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/search-functions/match) | `EsqlFunctions.Match(field, query)` | | | [`MATCH_PHRASE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/search-functions/match_phrase) | `EsqlFunctions.MatchPhrase(field, phrase)` | | | [`QSTR`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/search-functions/qstr) | `EsqlFunctions.Qstr(query)` | | | [`SCORE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/search-functions/score) | `EsqlFunctions.Score()` | | | [`TOP_SNIPPETS`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/search-functions/top-snippets) | `EsqlFunctions.TopSnippets(field, n)` | | ## String functions C# string methods translate to ES|QL string functions. `Contains`, `StartsWith`, and `EndsWith` map to `LIKE` patterns. ```csharp .Where(l => l.Host.StartsWith("prod-") && l.Message.ToLower().Contains("timeout")) // WHERE host LIKE "prod-*" AND TO_LOWER(message) LIKE "*timeout*" ``` | ES|QL | `EsqlFunctions` | C# native | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------|-----------------------------------------------------------| | [`BIT_LENGTH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/bit_length) | `EsqlFunctions.BitLength(s)` | | | [`BYTE_LENGTH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/byte_length) | `EsqlFunctions.ByteLength(s)` | | | [`CHUNK`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/chunk) | `EsqlFunctions.Chunk(s, size)` | | | [`CONCAT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/concat) | `EsqlFunctions.Concat(a, b)` | | | [`ENDS_WITH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/ends_with) | | `s.EndsWith("suffix")` (via LIKE) | | [`FROM_BASE64`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/from_base64) | `EsqlFunctions.FromBase64(s)` | | | [`HASH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/hash) | `EsqlFunctions.Hash(algo, s)` | | | [`LEFT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/left) | `EsqlFunctions.Left(s, n)` | | | [`LENGTH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/length) | `EsqlFunctions.Length(s)` | `s.Length` | | [`LOCATE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/locate) | `EsqlFunctions.Locate(s, substr)` | `s.IndexOf(substr)` | | [`LTRIM`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/ltrim) | `EsqlFunctions.Ltrim(s)` | `s.TrimStart()` | | [`MD5`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/md5) | `EsqlFunctions.Md5(s)` | | | [`REPEAT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/repeat) | `EsqlFunctions.Repeat(s, n)` | | | [`REPLACE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/replace) | `EsqlFunctions.Replace(s, old, new)` | `s.Replace(old, new)` | | [`REVERSE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/reverse) | `EsqlFunctions.Reverse(s)` | | | [`RIGHT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/right) | `EsqlFunctions.Right(s, n)` | | | [`RTRIM`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/rtrim) | `EsqlFunctions.Rtrim(s)` | `s.TrimEnd()` | | [`SHA1`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/sha1) | `EsqlFunctions.Sha1(s)` | | | [`SHA256`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/sha256) | `EsqlFunctions.Sha256(s)` | | | [`SPACE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/space) | `EsqlFunctions.Space(n)` | | | [`SPLIT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/split) | `EsqlFunctions.Split(s, delim)` | `s.Split(delim)` | | [`STARTS_WITH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/starts_with) | | `s.StartsWith("prefix")` (via LIKE) | | [`SUBSTRING`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/substring) | `EsqlFunctions.Substring(s, start, len)` | `s.Substring(start, len)` or `s[index]` | | [`TO_BASE64`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/to_base64) | `EsqlFunctions.ToBase64(s)` | | | [`TO_LOWER`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/to_lower) | `EsqlFunctions.ToLower(s)` | `s.ToLower()` or `s.ToLowerInvariant()` | | [`TO_UPPER`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/to_upper) | `EsqlFunctions.ToUpper(s)` | `s.ToUpper()` or `s.ToUpperInvariant()` | | [`TRIM`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/trim) | `EsqlFunctions.Trim(s)` | `s.Trim()` | | [`URL_DECODE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/url_decode) | `EsqlFunctions.UrlDecode(s)` | | | [`URL_ENCODE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/url_encode) | `EsqlFunctions.UrlEncode(s)` | | | [`URL_ENCODE_COMPONENT`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/string-functions/url_encode_component) | `EsqlFunctions.UrlEncodeComponent(s)` | | | LIKE pattern | | `s.Contains("text")` | | Null/empty checks | | `string.IsNullOrEmpty(s)`, `string.IsNullOrWhiteSpace(s)` | ## Operators All comparison, arithmetic, logical, and pattern-matching operators are fully supported. ### Comparison | ES|QL | C# | |-------|------| | `==` | `==` | | `!=` | `!=` | | `<` | `<` | | `<=` | `<=` | | `>` | `>` | | `>=` | `>=` | ### Arithmetic | ES|QL | C# | |-------|-----| | `+` | `+` | | `-` | `-` | | `*` | `*` | | `/` | `/` | | `%` | `%` | ### Logical | ES|QL | C# | |-------|--------| | `AND` | `&&` | | `OR` | `\|\|` | | `NOT` | `!` | ### Pattern matching and membership ```csharp using static Elastic.Esql.Functions.EsqlFunctions; .Where(l => Like(l.Path, "/api/v?/users")) // path LIKE "/api/v?/users" .Where(l => Rlike(l.Path, "/api/v[0-9]+/.*")) // path RLIKE "/api/v[0-9]+/.*" .Where(l => levels.Contains(l.Level)) // log.level IN ("a", "b") ``` | ES|QL | `EsqlFunctions` | C# native | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------|------------------------| | [`LIKE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/operators#esql-like) | `EsqlFunctions.Like(field, pattern)` | | | [`RLIKE`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/operators#esql-rlike) | `EsqlFunctions.Rlike(field, pattern)` | | | [`IN`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/operators#esql-in-operator) | | `list.Contains(field)` | | [`IS NULL`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/operators#esql-is_null) | `EsqlFunctions.IsNull(field)` | `field == null` | | [`IS NOT NULL`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/operators#esql-is_not_null) | `EsqlFunctions.IsNotNull(field)` | `field != null` | | [`MATCH`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/operators#esql-match-operator) | `EsqlFunctions.Match(field, query)` | | ### Cast operator (`::`) ```csharp .Select(l => new { IntDuration = EsqlFunctions.CastToInteger(l.Duration) }) // EVAL intDuration = duration::integer ``` | ES|QL | `EsqlFunctions` | C# native | |-------------------|---------------------------------------|-----------| | `field::integer` | `EsqlFunctions.CastToInteger(field)` | | | `field::long` | `EsqlFunctions.CastToLong(field)` | | | `field::double` | `EsqlFunctions.CastToDouble(field)` | | | `field::boolean` | `EsqlFunctions.CastToBoolean(field)` | | | `field::keyword` | `EsqlFunctions.CastToKeyword(field)` | | | `field::datetime` | `EsqlFunctions.CastToDatetime(field)` | | | `field::ip` | `EsqlFunctions.CastToIp(field)` | | ## Not yet supported categories The following ES|QL function categories have no Elastic.Esql equivalents yet: **[Spatial functions](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/spatial-functions)**: `ST_CONTAINS`, `ST_DISTANCE`, `ST_DISJOINT`, `ST_ENVELOPE`, `ST_INTERSECTS`, `ST_NPOINTS`, `ST_SIMPLIFY`, `ST_WITHIN`, `ST_X`, `ST_XMAX`, `ST_XMIN`, `ST_Y`, `ST_YMAX`, `ST_YMIN`, `ST_GEOTILE`, `ST_GEOHEX`, `ST_GEOHASH`. **[Multivalue functions](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/mv-functions)**: `MV_APPEND`, `MV_AVG`, `MV_CONCAT`, `MV_CONTAINS`, `MV_COUNT`, `MV_DEDUPE`, `MV_FIRST`, `MV_INTERSECTION`, `MV_INTERSECTS`, `MV_LAST`, `MV_MAX`, `MV_MEDIAN`, `MV_MEDIAN_ABSOLUTE_DEVIATION`, `MV_MIN`, `MV_PERCENTILE`, `MV_PSERIES_WEIGHTED_SUM`, `MV_SLICE`, `MV_SORT`, `MV_SUM`, `MV_UNION`, `MV_ZIP`. **[Type conversion functions](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/type-conversion-functions)**: `TO_BOOLEAN`, `TO_CARTESIANPOINT`, `TO_CARTESIANSHAPE`, `TO_DATEPERIOD`, `TO_DATETIME`, `TO_DATE_NANOS`, `TO_DEGREES`, `TO_DENSE_VECTOR`, `TO_DOUBLE`, `TO_GEOHASH`, `TO_GEOHEX`, `TO_GEOPOINT`, `TO_GEOSHAPE`, `TO_GEOTILE`, `TO_INTEGER`, `TO_IP`, `TO_LONG`, `TO_RADIANS`, `TO_STRING`, `TO_TIMEDURATION`, `TO_UNSIGNED_LONG`, `TO_VERSION`, `TO_AGGREGATE_METRIC_DOUBLE`. **[Dense vector functions](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/dense-vector-functions)**: `KNN`, `TEXT_EMBEDDING`, `V_COSINE`, `V_DOT_PRODUCT`, `V_HAMMING`, `V_L1_NORM`, `V_L2_NORM`. **[Time series aggregation functions](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql/functions-operators/time-series-aggregation-functions)**: `ABSENT_OVER_TIME`, `AVG_OVER_TIME`, `COUNT_OVER_TIME`, `COUNT_DISTINCT_OVER_TIME`, `DELTA`, `DERIV`, `FIRST_OVER_TIME`, `IDELTA`, `INCREASE`, `IRATE`, `LAST_OVER_TIME`, `MAX_OVER_TIME`, `MIN_OVER_TIME`, `PERCENTILE_OVER_TIME`, `PRESENT_OVER_TIME`, `RATE`, `STDDEV_OVER_TIME`, `VARIANCE_OVER_TIME`, `SUM_OVER_TIME`.