ES|QL `MV_CONTAINS` function

Checks if one multi-value field contains all values from another.

Syntax

Embedded

Parameters

superset: Expression that can be null, a single value, or multiple values.
subset: Expression that can be null, a single value, or multiple values.

Description

Checks if all values yielded by the second multivalue expression are present in the values yielded by the first multivalue expression. Returns a boolean. Null values are treated as an empty set.

Supported types

superset	subset	result
boolean	boolean	boolean
cartesian_point	cartesian_point	boolean
cartesian_shape	cartesian_shape	boolean
date	date	boolean
date_nanos	date_nanos	boolean
double	double	boolean
flattened The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.	flattened The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.	boolean
geo_point	geo_point	boolean
geo_shape	geo_shape	boolean
geohash	geohash	boolean
geohex	geohex	boolean
geotile	geotile	boolean
integer	integer	boolean
ip	ip	boolean
keyword	keyword	boolean
keyword	text	boolean
long	long	boolean
text	keyword	boolean
text	text	boolean
unsigned_long	unsigned_long	boolean
version	version	boolean

Examples

ROW set = ["a", "b", "c"], element = "a"
| EVAL set_contains_element = mv_contains(set, element)

set:keyword	element:keyword	set_contains_element:boolean
[a, b, c]	a	true

ROW setA = ["a","c"], setB = ["a", "b", "c"]
| EVAL a_subset_of_b = mv_contains(setB, setA)
| EVAL b_subset_of_a = mv_contains(setA, setB)

setA:keyword	setB:keyword	a_subset_of_b:boolean	b_subset_of_a:boolean
[a, c]	[a, b, c]	true	false

FROM airports
| WHERE mv_contains(type, ["major","military"]) AND scalerank == 9
| KEEP scalerank, name, country

scalerank:integer	name:text	country:keyword
9	Chandigarh Int'l	India