IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« ES|QL functions and operators ES|QL multivalued fields »

› › ›

ES|QL metadata fields

edit

A newer version is available. Check out the latest documentation.

ES|QL metadata fields

edit

ES|QL can access metadata fields.

To access these fields, use the METADATA directive with the FROM source command. For example:

FROM index METADATA _index, _id

Available metadata fields

edit

The following metadata fields are available in ES|QL:

Metadata field	Type	Description
`_id`	keyword	Unique document ID.
`_ignored`	keyword	Names every field in a document that was ignored when the document was indexed.
`_index`	keyword	Index name.
`_index_mode`	keyword	Index mode. For example: `standard`, `lookup`, or `logsdb`.
`_score`	`float`	Query relevance score (when enabled). Scores are updated when using full text search functions.
`_source`	Special `_source` type	Original JSON document body passed at index time (or a reconstructed version if synthetic `_source` is enabled).
`_version`	`long`	Document version number

Usage and limitations

edit

Metadata fields are only available when the data source is an index
The _source type is not supported by functions
Only the FROM command supports the METADATA directive
Once enabled, metadata fields work like regular index fields

Examples

edit

Basic metadata usage

edit

Once enabled, metadata fields are available to subsequent processing commands, just like other index fields:

FROM ul_logs, apps METADATA _index, _version
| WHERE id IN (13, 14) AND _version == 1
| EVAL key = CONCAT(_index, "_", TO_STR(id))
| SORT id, _index
| KEEP id, _index, _version, key

id:long	_index:keyword	_version:long	key:keyword
13	apps	1	apps_13
13	ul_logs	1	ul_logs_13
14	apps	1	apps_14
14	ul_logs	1	ul_logs_14

Metadata fields and aggregations

edit

Similar to index fields, once an aggregation is performed, a metadata field will no longer be accessible to subsequent commands, unless used as a grouping field:

FROM employees METADATA _index, _id
| STATS max = MAX(emp_no) BY _index

max:integer	_index:keyword
10100	employees

Sort results by search score

edit

FROM products METADATA _score
| WHERE MATCH(description, "wireless headphones")
| SORT _score DESC
| KEEP name, description, _score

Refer to Using ES|QL for search for more information on relevance scoring and how to use _score in your queries.

« ES|QL functions and operators ES|QL multivalued fields »