Type to search.

ES|QL MV_IN_RANGE function

Serverless Preview

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Preview

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack Planned

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Planned

    We plan to add this functionality in a future Elastic Stack update. Subject to changes.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Checks whether a multivalue field has any value within a range.

Embedded
Embedded
field
Multivalue expression to test. If null or empty, the function returns false.
lower
Lower bound, of the same type as field. If null or multivalued, the function returns false.
upper
Upper bound, of the same type as field. If null or multivalued, the function returns false.
options

(Optional) Range boundary options.

Returns true if at least one value of field is within the range [lower, upper], using the natural order of the type. A null or empty field returns false, as does a null bound. Both bounds are inclusive by default; set include_lower or include_upper to false in the optional options map to make either bound exclusive, covering all four interval forms. Works on any ordered type: numbers, dates, IPs, versions, and strings (compared by their UTF-8 bytes).

field lower upper options result
date date date named parameters boolean
date date date boolean
date_nanos date_nanos date_nanos boolean
double double double named parameters boolean
double double double boolean
integer integer integer named parameters boolean
integer integer integer boolean
ip ip ip boolean
keyword keyword keyword named parameters boolean
keyword keyword keyword boolean
keyword keyword text boolean
keyword text keyword boolean
keyword text text boolean
long long long named parameters boolean
long long long boolean
text keyword keyword boolean
text keyword text boolean
text text keyword boolean
text text text boolean
unsigned_long unsigned_long unsigned_long boolean
version version version boolean
include_lower
(boolean) Whether the lower bound is inclusive. Defaults to true; false makes it exclusive (value > lower).
include_upper

(boolean) Whether the upper bound is inclusive. Defaults to true; false makes it exclusive (value < upper).

ES|QL
ROW values = [1, 5, 10]
| EVAL in_range = mv_in_range(values, 4, 6)
values:integer in_range:boolean
[1, 5, 10] true

Neither 0 nor 100 is within [40, 60], so the result is false.

ES|QL
ROW values = [0, 100]
| EVAL in_range = mv_in_range(values, 40, 60)
values:integer in_range:boolean
[0, 100] false

Strings are compared by their UTF-8 bytes:

ES|QL
ROW words = ["apple", "cherry"]
| EVAL in_range = mv_in_range(words, "banana", "date")
words:keyword in_range:boolean
[apple, cherry] true

A half-open range [4, 6): 6 sits on the excluded upper bound, so it does not match.

ES|QL
ROW values = [3, 6]
| EVAL in_range = mv_in_range(values, 4, 6, {"include_upper": false})
values:integer in_range:boolean
[3, 6] false

An open range (4, 6): values equal to either bound are excluded.

ES|QL
ROW values = [4, 6]
| EVAL in_range = mv_in_range(values, 4, 6, {"include_lower": false, "include_upper": false})
values:integer in_range:boolean
[4, 6] false