ES|QL implicit casting

ES|QL implicit casting

Often users will input date, date_period, time_duration, ip or version as simple strings in their queries for use in predicates, functions, or expressions. ES|QL provides type conversion functions to explicitly convert these strings into the desired data types.

Without implicit casting users must explicitly code these to_X functions in their queries, when string literals don’t match the target data types they are assigned or compared to. Here is an example of using to_datetime to explicitly perform a data type conversion.

  1. FROM employees
  2. | EVAL dd_ns1=date_diff("day", to_datetime("2023-12-02T11:00:00.00Z"), birth_date)
  3. | SORT emp_no
  4. | KEEP dd_ns1
  5. | LIMIT 1

Implicit casting example

Implicit casting automatically converts string literals to the target data type. This allows users to specify string values for types like date, date_period, time_duration, ip and version in their queries.

The first query can be coded without calling the to_datetime function, as follows:

  1. FROM employees
  2. | EVAL dd_ns1=date_diff("day", "2023-12-02T11:00:00.00Z", birth_date)
  3. | SORT emp_no
  4. | KEEP dd_ns1
  5. | LIMIT 1

Operations that support implicit casting

The following table details which ES|QL operations support implicit casting for different data types.

ScalarFunctionsOperatorsGroupingFunctionsAggregateFunctions

DATE

Y

Y

Y

N

DATE_PERIOD/TIME_DURATION

Y

N

Y

N

IP

Y

Y

Y

N

VERSION

Y

Y

Y

N

BOOLEAN

Y

Y

Y

N

ScalarFunctions includes:

Operators includes: