ES|QL `TOP` function

Collects the top values for a field, including repeated values.

Syntax

field: The field to collect the top values for.
limit: The maximum number of values to collect.
order: The order to calculate the top values. Either asc or desc, and defaults to asc if omitted.
outputField: The extra field that, if present, will be the output of the TOP call instead of field. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Collects the top values for a field. Includes repeated values.

field	limit	order	outputField	result
boolean	integer	keyword		boolean
boolean	integer			boolean
date	integer	keyword	date	date
date	integer	keyword	double	double
date	integer	keyword	integer	integer
date	integer	keyword	keyword	keyword
date	integer	keyword	long	long
date	integer	keyword	text	keyword
date	integer	keyword		date
date	integer			date
double	integer	keyword	date	date
double	integer	keyword	double	double
double	integer	keyword	integer	integer
double	integer	keyword	keyword	keyword
double	integer	keyword	long	long
double	integer	keyword	text	keyword
double	integer	keyword		double
double	integer			double
integer	integer	keyword	date	date
integer	integer	keyword	double	double
integer	integer	keyword	integer	integer
integer	integer	keyword	keyword	keyword
integer	integer	keyword	long	long
integer	integer	keyword	text	keyword
integer	integer	keyword		integer
integer	integer			integer
ip	integer	keyword		ip
ip	integer			ip
keyword	integer	keyword	date	date
keyword	integer	keyword	double	double
keyword	integer	keyword	integer	integer
keyword	integer	keyword	keyword	keyword
keyword	integer	keyword	long	long
keyword	integer	keyword	text	keyword
keyword	integer	keyword		keyword
keyword	integer			keyword
long	integer	keyword	date	date
long	integer	keyword	double	double
long	integer	keyword	integer	integer
long	integer	keyword	keyword	keyword
long	integer	keyword	long	long
long	integer	keyword	text	keyword
long	integer	keyword		long
long	integer			long
text	integer	keyword	date	date
text	integer	keyword	double	double
text	integer	keyword	integer	integer
text	integer	keyword	keyword	keyword
text	integer	keyword	long	long
text	integer	keyword	text	keyword
text	integer	keyword		keyword
text	integer			keyword

FROM employees
| STATS top_salaries = TOP(salary, 3, "desc"), top_salary = MAX(salary)

top_salaries:integer	top_salary:integer
[74999, 74970, 74572]	74999