Type to search.

ES|QL MV_GREATER function

Serverless Preview

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Preview

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack Planned

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Planned

    We plan to add this functionality in a future Elastic Stack update. Subject to changes.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Checks whether a multivalue field has any value greater than a bound.

Embedded
Embedded
field
Multivalue expression to test. If null or empty, the function returns false.
bound
Comparison bound, of the same type as field. If null or multivalued, the function returns false.
options

(Optional) Bound inclusivity options.

Returns true if at least one value of field is greater than bound, using the natural order of the type. A null or empty field returns false, as does a null or multivalued bound. The comparison is strict (>) by default; set include_bound to true in the optional options map to make it inclusive (>=). Works on any ordered type: numbers, dates, IPs, versions, and strings (compared by their UTF-8 bytes).

field bound options result
date date named parameters boolean
date date boolean
date_nanos date_nanos boolean
double double named parameters boolean
double double boolean
integer integer named parameters boolean
integer integer boolean
ip ip boolean
keyword keyword named parameters boolean
keyword keyword boolean
keyword text boolean
long long named parameters boolean
long long boolean
text keyword boolean
text text boolean
unsigned_long unsigned_long boolean
version version boolean
include_bound

(boolean) Whether the bound is inclusive. Defaults to false (strict >); true makes it inclusive (>=).

ES|QL 
ROW values = [1, 5, 10]
| EVAL greater = mv_greater(values, 4)
values:integer greater:boolean
[1, 5, 10] true

With include_bound: true a value equal to the bound matches too:

ES|QL 
ROW values = [4]
| EVAL greater = mv_greater(values, 4, {"include_bound": true})
values:integer greater:boolean
[4] true

Strings are compared by their UTF-8 bytes:

ES|QL 
ROW words = ["apple", "cherry"]
| EVAL greater = mv_greater(words, "banana")
words:keyword greater:boolean
[apple, cherry] true