ES|QL EVAL command

The EVAL processing command enables you to append new columns with calculated values.

EVAL [column1 =] value1[, ..., [columnN =] valueN]

columnX

The column name. If a column with the same name already exists, the existing column is dropped. If a column name is used more than once, only the rightmost duplicate creates a column.

valueX

The value for the column. Can be a literal, an expression, or a function. Can use columns defined left of this one.

The EVAL processing command enables you to append new columns with calculated values. EVAL supports various functions for calculating values. Refer to Functions for more information.

The following examples show common EVAL patterns.

FROM employees
| SORT emp_no
| KEEP first_name, last_name, height
| EVAL height_feet = height * 3.281, height_cm = height * 100

If the specified column already exists, the existing column will be dropped, and the new column will be appended to the table:

FROM employees
| SORT emp_no
| KEEP first_name, last_name, height
| EVAL height = height * 3.281

Specifying the output column name is optional. If not specified, the new column name is equal to the expression. The following query adds a column named height*3.281:

FROM employees
| SORT emp_no
| KEEP first_name, last_name, height
| EVAL height * 3.281

Because this name contains special characters, it needs to be quoted with backticks (```) when using it in subsequent commands:

FROM employees
| EVAL height * 3.281
| STATS avg_height_feet = AVG(`height * 3.281`)