This version of the OpenSearch documentation is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.

Functions

You must enable fielddata in the document mapping for most string functions to work properly.

The specification shows the return type of the function with a generic type T as the argument. For example, abs(number T) -> T means that the function abs accepts a numerical argument of type T, which could be any subtype of the number type, and it returns the actual type of T as the return type.

The SQL plugin supports the following common functions shared across the SQL and PPL languages.

Mathematical

FunctionSpecificationExample
absabs(number T) -> TSELECT abs(0.5)
addadd(number T, number T) -> TSELECT add(1, 5)
cbrtcbrt(number T) -> doubleSELECT cbrt(8)
ceilceil(number T) -> TSELECT ceil(0.5)
convconv(string T, integer, integer) -> stringSELECT conv(‘2C’, 16, 10), conv(1111, 2, 10)
crc32crc32(string) -> stringSELECT crc32(‘MySQL’)
dividedivide(number T, number T) -> TSELECT divide(1, 0.5)
ee() -> doubleSELECT e()
expexp(number T) -> doubleSELECT exp(0.5)
expm1expm1(number T) -> doubleSELECT expm1(0.5)
floorfloor(number T) -> longSELECT floor(0.5)
lnln(number T) -> doubleSELECT ln(10)
loglog(number T) -> double or log(number T, number T) -> doubleSELECT log(10), SELECT log(2, 16)
log2log2(number T) -> doubleSELECT log2(10)
log10log10(number T) -> doubleSELECT log10(10)
modmod(number T, number T) -> TSELECT mod(2, 3)
modulusmodulus(number T, number T) -> TSELECT modulus(2, 3)
multiplymultiply(number T, number T) -> TSELECT multiply(2, 3)
pipi() -> doubleSELECT pi()
powpow(number T, number T) -> doubleSELECT pow(2, 3)
powerpower(number T, number T) -> doubleSELECT power(2, 3)
randrand() -> float or rand(number T) -> floatSELECT rand(), SELECT rand(0.5)
rintrint(number T) -> doubleSELECT rint(1.5)
roundround(number T) -> T or round(number T, integer) -> TSELECT round(1.5), SELECT round(1.175, 2)
signsign(number T) -> integerSELECT sign(1.5)
signumsignum(number T) -> integerSELECT signum(0.5)
sqrtsqrt(number T) -> doubleSELECT sqrt(0.5)
strcmpstrcmp(string T, string T) -> integerSELECT strcmp(‘hello’, ‘hello world’)
subtractsubtract(number T, number T) -> TSELECT subtract(3, 2)
truncatetruncate(number T, number T) -> TSELECT truncate(56.78, 1)
+number T + number T -> TSELECT 1 + 5
-number T - number T -> TSELECT 3 - 2
number T number T -> TSELECT 2 * 3
/number T / number T -> TSELECT 1 / 0.5
%number T % number T -> TSELECT 2 % 3

Trigonometric

FunctionSpecificationExample
acosacos(number T) -> doubleSELECT acos(0.5)
asinasin(number T) -> doubleSELECT asin(0.5)
atanatan(number T) -> doubleSELECT atan(0.5)
atan2atan2(number T, number T) -> doubleSELECT atan2(1, 0.5)
coscos(number T) -> doubleSELECT cos(0.5)
coshcosh(number T) -> doubleSELECT cosh(0.5)
cotcot(number T) -> doubleSELECT cot(0.5)
degreesdegrees(number T) -> doubleSELECT degrees(0.5)
radiansradians(number T) -> doubleSELECT radians(0.5)
sinsin(number T) -> doubleSELECT sin(0.5)
sinhsinh(number T) -> doubleSELECT sinh(0.5)
tantan(number T) -> doubleSELECT tan(0.5)

Date and time

Functions marked with * are only available in SQL.

FunctionSpecificationExample
adddateadddate(date, INTERVAL expr unit) -> dateSELECT adddate(date(‘2020-08-26’), INTERVAL 1 hour)
addtimeaddtime(date, date) -> dateSELECT addtime(date(‘2008-12-12’), date(‘2008-12-12’))
convert_tzconvert_tz(date, string, string) -> dateSELECT convert_tz(‘2008-12-25 05:30:00’, ‘+00:00’, ‘America/Los_Angeles’)
curtimecurtime() -> timeSELECT curtime()
curdatecurdate() -> dateSELECT curdate()
current_datecurrent_date() -> dateSELECT current_date()
current_timecurrent_time() -> timeSELECT current_time()
current_timestampcurrent_timestamp() -> dateSELECT current_timestamp()
datedate(date) -> dateSELECT date(‘2000-01-02’)
datediffdatediff(date, date) -> integerSELECT datediff(date(‘2000-01-02’), date(‘2000-01-01’))
datetimedatetime(string) -> datetimeSELECT datetime(‘2008-12-25 00:00:00’)
date_adddate_add(date, INTERVAL integer UNIT)SELECT date_add(‘2020-08-26’, INTERVAL 1 HOUR)
date_formatdate_format(date, string) -> string or date_format(date, string, string) -> stringSELECT date_format(date(‘2020-08-26’), ‘Y’)
date_subdate_sub(date, INTERVAL expr unit) -> dateSELECT date_sub(date(‘2008-01-02’), INTERVAL 31 day)
dayofmonthdayofmonth(date) -> integerSELECT dayofmonth(date(‘2001-05-07’))
dayday(date) -> integerSELECT day(date(‘2020-08-25’))
daynamedayname(date) -> stringSELECT dayname(date(‘2020-08-26’))
dayofmonthdayofmonth(date) -> integerSELECT dayofmonth(date(‘2020-08-26’))
dayofweekdayofweek(date) -> integerSELECT dayofweek(date(‘2020-08-26’))
dayofyeardayofyear(date) -> integerSELECT dayofyear(date(‘2020-08-26’))
dayofweekdayofweek(date) -> integerSELECT dayofweek(date(‘2020-08-26’))
day_of_monthday_of_month(date) -> integerSELECT day_of_month(date(‘2020-08-26’))
day_of_weekday_of_week(date) -> integerSELECT day_of_week(date(‘2020-08-26’))
day_of_yearday_of_year(date) -> integerSELECT day_of_year(date(‘2020-08-26’))
extractextract(part FROM date) -> integerSELECT extract(MONTH FROM datetime(‘2020-08-26 10:11:12’))
from_daysfrom_days(N) -> integerSELECT from_days(733687)
from_unixtimefrom_unixtime(N) -> dateSELECT from_unixtime(1220249547)
get_formatget_format(PART, string) -> stringSELECT get_format(DATE, ‘USA’)
hourhour(time) -> integerSELECT hour(time ‘01:02:03’)
hour_of_dayhour_of_day(time) -> integerSELECT hour_of_day(time ‘01:02:03’)
last_daylast_day(date) -> integerSELECT last_day(date(‘2020-08-26’))
localtimelocaltime() -> dateSELECT localtime()
localtimestamplocaltimestamp() -> dateSELECT localtimestamp()
makedatemakedate(double, double) -> dateSELECT makedate(1945, 5.9)
maketimemaketime(integer, integer, integer) -> dateSELECT maketime(1, 2, 3)
microsecondmicrosecond(expr) -> integerSELECT microsecond(time ‘01:02:03.123456’)
minuteminute(expr) -> integerSELECT minute(time ‘01:02:03’)
minute_of_dayminute_of_day(expr) -> integerSELECT minute_of_day(time ‘01:02:03’)
minute_of_hourminute_of_hour(expr) -> integerSELECT minute_of_hour(time ‘01:02:03’)
monthmonth(date) -> integerSELECT month(date(‘2020-08-26’))
month_of_yearmonth_of_year(date) -> integerSELECT month_of_year(date(‘2020-08-26’))
monthnamemonthname(date) -> stringSELECT monthname(date(‘2020-08-26’))
nownow() -> dateSELECT now()
period_addperiod_add(integer, integer)SELECT period_add(200801, 2)
period_diffperiod_diff(integer, integer)SELECT period_diff(200802, 200703)
quarterquarter(date) -> integerSELECT quarter(date(‘2020-08-26’))
secondsecond(time) -> integerSELECT second(time ‘01:02:03’)
second_of_minutesecond_of_minute(time) -> integerSELECT second_of_minute(time ‘01:02:03’)
sec_to_timesec_to_time(integer) -> dateSELECT sec_to_time(10000)
subdatesubdate(date, INTERVAL expr unit) -> date, datetimeSELECT subdate(date(‘2008-01-02’), INTERVAL 31 day)
subtimesubtime(date, date) -> dateSELECT subtime(date(‘2008-12-12’), date(‘2008-11-15’))
str_to_datestr_to_date(string, format) -> dateSELECT str_to_date(“01,5,2013”, “%d,%m,%Y”)
timetime(expr) -> timeSELECT time(‘13:49:00’)
timedifftimediff(time, time) -> timeSELECT timediff(time(‘23:59:59’), time(‘13:00:00’))
timestamptimestamp(date) -> dateSELECT timestamp(‘2001-05-07 00:00:00’)
timestampaddtimestampadd(interval, integer, date) -> date)SELECT timestampadd(DAY, 17, datetime(‘2000-01-01 00:00:00’))
timestampdifftimestampdiff(interval, date, date) -> integerSELECT timestampdiff(YEAR, ‘1997-01-01 00:00:00’, ‘2001-03-06 00:00:00’)
time_formattime_format(date, string) -> stringSELECT time_format(‘1998-01-31 13:14:15.012345’, ‘%f %H %h %I %i %p %r %S %s %T’)
time_to_sectime_to_sec(time) -> longSELECT time_to_sec(time ‘22:23:00’)
to_daysto_days(date) -> longSELECT to_days(date ‘2008-10-07’)
to_secondsto_seconds(date) -> integerSELECT to_seconds(date(‘2008-10-07’))
unix_timestampunix_timestamp(date) -> doubleSELECT unix_timestamp(timestamp(‘1996-11-15 17:05:42’))
utc_dateutc_date() -> dateSELECT utc_date()
utc_timeutc_time() -> dateSELECT utc_time()
utc_timestamputc_timestamp() -> dateSELECT utc_timestamp()
weekweek(date[mode]) -> integerSELECT week(date(‘2008-02-20’))
weekofyearweekofyear(date[mode]) -> integerSELECT weekofyear(date(‘2008-02-20’))
week_of_yearweek_of_year(date[mode]) -> integerSELECT week_of_year(date(‘2008-02-20’))
yearyear(date) -> integerSELECT year(date(‘2001-07-05’))
yearweekyearweek(date[mode]) -> integerSELECT yearweek(date(‘2008-02-20’))

String

FunctionSpecificationExample
asciiascii(string) -> integerSELECT ascii(‘h’)
concatconcat(string, string) -> stringSELECT concat(‘hello’, ‘world’)
concat_wsconcat_ws(separator, string, string…) -> stringSELECT concat_ws(“ “, “Hello”, “World!”)
leftleft(string, integer) -> stringSELECT left(‘hello’, 2)
lengthlength(string) -> integerSELECT length(‘hello’)
locatelocate(string, string, integer) -> integer or locate(string, string) -> integerSELECT locate(‘o’, ‘hello’), locate(‘l’, ‘hello world’, 5)
replacereplace(string, string, string) -> stringSELECT replace(‘hello’, ‘l’, ‘x’)
rightright(string, integer) -> stringSELECT right(‘hello’, 2)
rtrimrtrim(string) -> stringSELECT rtrim(‘hello ‘)
substringsubstring(string, integer, integer) -> stringSELECT substring(‘hello’, 2, 4)
trimtrim(string) -> stringSELECT trim(‘ hello’)
upperupper(string) -> stringSELECT upper(‘hello world’)

Aggregate

FunctionSpecificationExample
avgavg(number T) -> TSELECT avg(column) FROM my-index
countcount(number T) -> TSELECT count(date) FROM my-index
minmin(number T) -> TSELECT min(column) FROM my-index
showshow(string) -> stringSHOW TABLES LIKE my-index

Advanced

FunctionSpecificationExample
ifif(boolean, os_type, os_type) -> os_typeSELECT if(false, 0, 1),if(true, 0, 1)
ifnullifnull(os_type, os_type) -> os_typeSELECT ifnull(0, 1), ifnull(null, 1)
isnullisnull(os_type) -> integerSELECT isnull(null), isnull(1)

Relevance-based search (full-text search)

These functions are only available in the WHERE clause. For their descriptions and usage examples in SQL and PPL, see Full-text search.