elasticsearch reference - Robuta Search

https://www.elastic.co/docs/reference/query-languages/esql/esql-cross-clusters Use ES|QL across clusters | Elasticsearch Reference With ES|QL, you can execute a single query across multiple clusters. Cross-cluster search requires remote clusters. To set up remote clusters, see Remote... es ql elasticsearch reference use across clusters https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/conditional-functions-and-expressions/clamp_max ES|QL CLAMP_MAX function | Elasticsearch Reference es ql max function elasticsearch reference clamp https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/spatial-functions/st_npoints ES|QL ST_NPOINTS function | Elasticsearch Reference es ql st function elasticsearch reference https://www.elastic.co/docs/reference/elasticsearch/plugins/store-smb Store SMB plugin | Elasticsearch Reference The Store SMB plugin works around for a bug in Windows SMB and Java on windows. This plugin can be installed using the plugin manager: The plugin must... plugin elasticsearch store smb reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/type-conversion-functions/to_dateperiod ES|QL TO_DATEPERIOD function | Elasticsearch Reference es ql function elasticsearch reference https://www.elastic.co/docs/reference/search-connectors/es-connectors-run-from-source Running from the source code | Elasticsearch Reference The basic way to run connectors is to clone the repository and run the code locally. This is a good option if you are comfortable with Python and want... source code elasticsearch reference running https://www.elastic.co/docs/reference/elasticsearch/plugins/discovery-gce-usage-testing Testing GCE | Elasticsearch Reference Integrations tests in this plugin require working GCE configuration and therefore disabled by default. To enable tests prepare a config file... elasticsearch reference testing gce https://www.elastic.co/docs/reference/query-languages/esql/esql-time-spans ES|QL time spans | Elasticsearch Reference Time spans represent intervals between two datetime values. There are currently two supported types of time spans: DATE_PERIOD specifies intervals in... es ql time spans elasticsearch reference https://www.elastic.co/docs/reference/elasticsearch/plugins/mapper-annotated-text Mapper annotated text plugin | Elasticsearch Reference The mapper-annotated-text plugin provides the ability to index text that is a combination of free-text and special markup that is typically used to identify... plugin elasticsearch mapper annotated text reference https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-query Span or query | Elasticsearch Reference Matches the union of its span clauses. Here is an example: The clauses element is a list of one or more other span type queries. query elasticsearch reference span https://www.elastic.co/docs/reference/query-languages/esql/commands/stats-by ES|QL STATS command | Elasticsearch Reference es ql stats command elasticsearch reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/grouping-functions/categorize ES|QL CATEGORIZE function | Elasticsearch Reference es ql function elasticsearch categorize reference https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-term-query Span term query | Elasticsearch Reference Matches spans containing a term. Here is an example: A boost can also be associated with the query: Or : query elasticsearch reference span term https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/min_over_time ES|QL MIN_OVER_TIME function | Elasticsearch Reference time function elasticsearch es ql min reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/math-functions/ceil ES|QL CEIL function | Elasticsearch Reference es ql function elasticsearch ceil reference https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-doc-count-field _doc_count field | Elasticsearch Reference Bucket aggregations always return a field named doc_count showing the number of documents that were aggregated and partitioned in each bucket. Computation... field elasticsearch reference doc count https://www.elastic.co/docs/reference/text-analysis/analysis-truncate-tokenfilter Truncate token filter | Elasticsearch Reference Truncates tokens that exceed a specified character limit. This limit defaults to 10 but can be customized using the length parameter. For example, you... token filter elasticsearch truncate reference https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-sampler-aggregation Sampler aggregation | Elasticsearch Reference A filtering aggregation used to limit any sub aggregations' processing to a sample of the top-scoring documents. Tightening the focus of analytics to... aggregation elasticsearch sampler reference https://www.elastic.co/docs/reference/query-languages/sql/sql-client-apps-dbvis DbVisualizer | Elasticsearch Reference You can use the Elasticsearch JDBC driver to access Elasticsearch data from DbVisualizer. DbVisualizer 13.0 or higher, Elasticsearch SQL JDBC driver. elasticsearch reference dbvisualizer https://www.elastic.co/docs/reference/query-languages/esql/commands/grok ES|QL GROK command | Elasticsearch Reference es ql command elasticsearch grok reference https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-stored-fields Retrieve stored fields using the Get document API | Elasticsearch Reference You can use the Get API's stored_fields parameter to retrieve fields marked as stored ( document api elasticsearch reference retrieve stored fields https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/type-conversion-functions/to_integer ES|QL TO_INTEGER function | Elasticsearch Reference es ql function elasticsearch integer reference https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-bool-prefix-query Match boolean prefix query | Elasticsearch Reference A match_bool_prefix query analyzes its input and constructs a bool query from the terms. Each term except the last is used in a term query. The last term... query elasticsearch reference match boolean prefix https://www.elastic.co/docs/reference/scripting-languages/painless/painless-bucket-script-agg-context Bucket script aggregation context | Elasticsearch Reference Use a Painless script in an bucket_script pipeline aggregation to calculate a value as a result in a bucket. The standard Painless API is available. To... context elasticsearch bucket script aggregation reference https://www.elastic.co/docs/reference/enrich-processor/bytes-processor Bytes processor | Elasticsearch Reference Converts a human readable byte value (e.g. 1kb) to its value in bytes (e.g. 1024). If the field is an array of strings, all members of the array will... processor elasticsearch bytes reference https://www.elastic.co/docs/reference/elasticsearch/index-settings/serverless Index settings available in Elastic Cloud Serverless projects | Elasticsearch Reference In Elastic Cloud Serverless projects, configuration available to users is limited to certain index-level settings. These restrictions help ensure the... elastic cloud elasticsearch reference index settings available https://www.elastic.co/docs/reference/query-languages/esql/commands/uri-parts ES|QL URI_PARTS command | Elasticsearch Reference es ql command elasticsearch uri parts reference https://www.elastic.co/docs/reference/text-analysis/analysis-ngram-tokenfilter N-gram token filter | Elasticsearch Reference Forms n-grams of specified lengths from a token. For example, you can use the ngram token filter to change fox to [ f, fo, o, ox, x ]. This filter uses... token filter elasticsearch gram reference https://www.elastic.co/docs/reference/text-analysis/analysis-standard-analyzer Standard analyzer | Elasticsearch Reference The standard analyzer is the default analyzer which is used if none is specified. It provides grammar based tokenization (based on the Unicode Text... analyzer elasticsearch standard reference https://www.elastic.co/docs/reference/query-languages/query-dsl/regexp-syntax Regular expression syntax | Elasticsearch Reference A regular expression is a way to match patterns in data using placeholder characters, called operators. Elasticsearch supports regular expressions in... regular expression elasticsearch reference syntax https://www.elastic.co/docs/reference/enrich-processor/foreach-processor Foreach processor | Elasticsearch Reference Runs an ingest processor on each element of an array or object. All ingest processors can run on array or object elements. However, if the number of elements... processor elasticsearch foreach reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/string-functions/contains ES|QL CONTAINS function | Elasticsearch Reference es ql function elasticsearch contains reference https://www.elastic.co/docs/reference/query-languages/esql/commands/completion ES|QL COMPLETION command | Elasticsearch Reference es ql command elasticsearch completion reference https://www.elastic.co/docs/reference/enrich-processor/remove-processor Remove processor | Elasticsearch Reference Removes existing fields. If one field doesn’t exist, an exception will be thrown. Here is an example to remove a single field: To remove multiple fields,... processor elasticsearch remove reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/aggregation-functions/std_dev ES|QL STD_DEV function | Elasticsearch Reference es ql function elasticsearch std dev reference https://www.elastic.co/docs/reference/elasticsearch/plugins/analysis-icu-folding ICU folding token filter | Elasticsearch Reference Case folding of Unicode characters based on UTR#30, like the ASCII-folding token filter on steroids. It registers itself as the icu_folding token filter... token filter elasticsearch icu folding reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/string-functions/sha1 ES|QL SHA1 function | Elasticsearch Reference es ql function elasticsearch sha1 reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/count_over_time ES|QL COUNT_OVER_TIME function | Elasticsearch Reference time function elasticsearch es ql count reference https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-adjacency-matrix-aggregation Adjacency matrix aggregation | Elasticsearch Reference A bucket aggregation returning a form of adjacency matrix. The request provides a collection of named filter expressions, similar to the filters aggregation... aggregation elasticsearch matrix reference https://www.elastic.co/docs/reference/query-languages/query-dsl/term-level-queries Term-level queries | Elasticsearch Reference You can use term-level queries to find documents based on precise values in structured data. Examples of structured data include date ranges, IP addresses,... queries elasticsearch term level reference https://www.elastic.co/docs/reference/scripting-languages/painless/painless-walkthrough-updating-fields Updating Fields with Painless | Elasticsearch Reference elasticsearch reference updating fields painless https://www.elastic.co/docs/reference/scripting-languages/painless/painless-literals Literals | Elasticsearch Reference Literals represent fixed values in your code that are directly written into your script. Unlike variables, literals have constant values that cannot be... elasticsearch reference literals https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-minimum-should-match minimum_should_match parameter | Elasticsearch Reference The minimum_should_match parameter’s possible values: NOTE: When dealing with percentages, negative values can be used to get different behavior in edge... elasticsearch reference minimum match parameter https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-not-query Span not query | Elasticsearch Reference Removes matches which overlap with another span query or which are within x tokens before (controlled by the parameter pre) or y tokens after (controlled... query elasticsearch reference span https://www.elastic.co/docs/reference/scripting-languages/painless/painless-min-should-match-context Minimum should match context | Elasticsearch Reference Use a Painless script to specify the minimum number of terms that a specified field needs to match with for a document to be part of the query results... context elasticsearch minimum match reference https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-multi-match-query Multi-match query | Elasticsearch Reference The multi_match query builds on the match query to allow multi-field queries: Fields can be specified with wildcards, eg: Individual fields can be boosted... query elasticsearch reference multi match https://www.elastic.co/docs/reference/elasticsearch/index-settings/total-shards-per-node Total shards per node | Elasticsearch Reference The cluster-level shard allocator tries to spread the shards of a single index across as many nodes as possible. However, depending on how many shards... elasticsearch reference total shards per node https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/math-functions/round ES|QL ROUND function | Elasticsearch Reference es ql round function elasticsearch reference https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-multi-term-rewrite rewrite parameter | Elasticsearch Reference Elasticsearch uses Apache Lucene internally to power indexing and searching. In their original form, Lucene cannot execute the following queries: fuzzy,... elasticsearch reference rewrite parameter https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-correlation-aggregation Bucket correlation aggregation | Elasticsearch Reference A sibling pipeline aggregation which executes a correlation function on the configured sibling multi-bucket aggregation. (Required, string) Path to the... aggregation elasticsearch bucket correlation reference https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-source-field _source field | Elasticsearch Reference The _source field contains the original JSON document body that was passed at index time. The _source field itself is not indexed (and thus is not... field elasticsearch reference source https://www.elastic.co/docs/reference/enrich-processor/gsub-processor Gsub processor | Elasticsearch Reference Converts a string field by applying a regular expression and a replacement. If the field is an array of string, all members of the array will be converted... processor elasticsearch gsub reference https://www.elastic.co/docs/reference/query-languages/esql/commands/enrich ES|QL ENRICH command | Elasticsearch Reference es ql command elasticsearch enrich reference https://www.elastic.co/docs/reference/scripting-languages/painless/painless-operators-general Operators: General | Elasticsearch Reference Use the precedence operator '()' to guarantee the order of evaluation for an expression. An expression encapsulated by the precedence operator (enclosed... elasticsearch reference operators general https://www.elastic.co/docs/reference/elasticsearch/plugins/analysis-phonetic-token-filter phonetic token filter plugin | Elasticsearch Reference The phonetic token filter takes the following settings: It is important to note that token filter plugin elasticsearch phonetic reference https://www.elastic.co/docs/reference/query-languages/esql/commands/dissect ES|QL DISSECT command | Elasticsearch Reference es ql command elasticsearch dissect reference https://www.elastic.co/docs/reference/text-analysis/analysis-kstem-tokenfilter KStem token filter | Elasticsearch Reference Provides KStem-based stemming for the English language. The kstem filter combines algorithmic stemming with a built-in dictionary. The kstem filter tends... token filter elasticsearch reference https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/source-repository-settings Source-only repository settings | Elasticsearch Reference You can use a source repository to take source-only snapshots that delegate storage to another registered repository type. This page lists settings that... repository settings elasticsearch reference source https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/date Date field type | Elasticsearch Reference JSON doesn’t have a date data type, so dates in Elasticsearch can either be: strings containing formatted dates, e.g. field type elasticsearch date reference https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/miscellaneous-cluster-settings Miscellaneous cluster settings | Elasticsearch Reference A node can only join a cluster when it shares its cluster.name with all the other nodes in the cluster. The default name is elasticsearch, but you should... settings elasticsearch miscellaneous cluster reference https://www.elastic.co/docs/reference/elasticsearch/plugins/discovery-gce-network-host GCE Network Host | Elasticsearch Reference When the discovery-gce plugin is installed, the following are also allowed as valid network host settings: Examples: Create Google Compute Engine instance... elasticsearch reference gce network host https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/mv-functions/mv_median ES|QL MV_MEDIAN function | Elasticsearch Reference es ql mv function elasticsearch median reference https://www.elastic.co/docs/reference/aggregations Aggregations | Elasticsearch Reference Aggregations are a powerful framework that enables you to perform complex data analysis and summarization over indexed documents. They enable you to extract... elasticsearch reference aggregations https://www.elastic.co/docs/reference/query-languages/sql/sql-functions-aggs Aggregate functions | Elasticsearch Reference Functions for computing a single result from a set of input values. Elasticsearch SQL supports aggregate functions only alongside grouping (implicit or... aggregate functions elasticsearch reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/string-functions/ltrim ES|QL LTRIM function | Elasticsearch Reference es ql function elasticsearch reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/string-functions/repeat ES|QL REPEAT function | Elasticsearch Reference es ql function elasticsearch repeat reference https://www.elastic.co/docs/reference/query-languages/sql/sql-functions Functions and operators | Elasticsearch Reference Elasticsearch SQL provides a comprehensive set of built-in operators and functions: Operators, LIKE and RLIKE Operators, Aggregate Functions, Grouping... elasticsearch reference functions operators https://www.elastic.co/docs/reference/elasticsearch/plugins/analysis-kuromoji-tokenizer kuromoji_tokenizer | Elasticsearch Reference The kuromoji_tokenizer accepts the following settings: As a demonstration of how the user dictionary can be used, save the following dictionary to... tokenizer elasticsearch reference https://www.elastic.co/docs/reference/search-connectors/content-syncs Content syncs | Elasticsearch Reference Elastic connectors have two types of content syncs: Full syncs, Incremental syncs. A full sync syncs all documents in the third-party data source into... elasticsearch reference content syncs https://www.elastic.co/docs/reference/elasticsearch/rest-apis/collapse-search-results Collapse search results | Elasticsearch Reference You can use the Search API's collapse parameter to collapse search results based on field values. The collapsing is done by selecting only the top sorted... search results elasticsearch reference collapse https://www.elastic.co/docs/reference/query-languages/query-dsl/full-text-queries Full text queries | Elasticsearch Reference The full text queries enable you to search analyzed text fields such as the body of an email. The query string is processed using the same analyzer that... full text queries elasticsearch reference https://www.elastic.co/docs/reference/search-connectors/document-level-security Document level security for content connectors | Elasticsearch Reference Document level security (DLS) enables you to restrict access to documents in your Elasticsearch indices according to user and group permissions. This... document level elasticsearch reference security content connectors https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/watcher-settings Watcher settings in Elasticsearch | Elasticsearch Reference You configure Watcher settings to set up Watcher and send notifications via email, Slack, and PagerDuty. All of these settings can be added to the... elasticsearch reference watcher settings https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/math-functions/asin ES|QL ASIN function | Elasticsearch Reference es ql function elasticsearch asin reference https://www.elastic.co/docs/reference/elasticsearch/command-line-tools Command-line tools | Elasticsearch Reference Elasticsearch includes a set of command-line tools in its bin subdirectory (for example, /usr/share/elasticsearch/bin). These tools support tasks such... command line tools elasticsearch reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/math-functions/pi ES|QL PI function | Elasticsearch Reference es ql function elasticsearch pi reference https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-index index | Elasticsearch Reference The index option controls whether field values are indexed. It accepts true or false and defaults to true. Indexing a field creates data structures that... elasticsearch reference index https://www.elastic.co/docs/reference/elasticsearch/rest-apis/vector-tile-search Vector tile search API examples | Elasticsearch Reference The vector tile search API searches for geospatial data within a specific tile coordinate (zoom/x/y) and returns the results as a binary Mapbox Vector... vector tile search api examples elasticsearch reference https://www.elastic.co/docs/reference/text-analysis/analysis-thai-tokenizer Thai tokenizer | Elasticsearch Reference The thai tokenizer segments Thai text into words, using the Thai segmentation algorithm included with Java. Text in other languages in general will be... tokenizer elasticsearch thai reference https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-count-ks-test-aggregation Bucket count K-S test correlation aggregation | Elasticsearch Reference A sibling pipeline aggregation which executes a two sample Kolmogorov–Smirnov test (referred to as a aggregation elasticsearch bucket count test correlation https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/bbq Better Binary Quantization (BBQ) | Elasticsearch Reference Better Binary Quantization (BBQ) is an advanced vector quantization method, designed for large-scale similarity search. BBQ is a form of lossy compression... elasticsearch reference better binary quantization bbq https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-autodatehistogram-aggregation Auto-interval date histogram aggregation | Elasticsearch Reference A multi-bucket aggregation similar to the Date histogram except instead of providing an interval to use as the width of each bucket, a target number of... histogram aggregation elasticsearch reference auto interval date https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/grouping-functions ES|QL grouping functions | Elasticsearch Reference The STATS command supports these grouping functions: The INLINE STATS command supports these grouping functions: BUCKET, TBUCKET. es ql functions elasticsearch grouping reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/time-series-aggregation-functions/sum_over_time ES|QL SUM_OVER_TIME function | Elasticsearch Reference time function elasticsearch es ql sum reference https://www.elastic.co/docs/reference/elasticsearch/plugins/analysis-icu-normalization ICU normalization token filter | Elasticsearch Reference Normalizes characters as explained here. It registers itself as the icu_normalizer token filter, which is available to all indices without any further... token filter elasticsearch icu normalization reference https://www.elastic.co/docs/reference/scripting-languages/painless/painless-regexes Regexes | Elasticsearch Reference Regular expression constants are directly supported. To ensure fast performance, this is the only mechanism for creating patterns. Regular expressions... elasticsearch reference regexes https://www.elastic.co/docs/reference/query-languages/sql/sql-odbc-installation Driver installation | Elasticsearch Reference The Elasticsearch SQL ODBC Driver can be installed on Microsoft Windows using an MSI package. The installation process is simple and is composed of standard... driver installation elasticsearch reference https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/text Text field type | Elasticsearch Reference A field to index full-text values, such as the body of an email or the description of a product. These fields are analyzed, that is they are passed through... field type elasticsearch text reference https://www.elastic.co/docs/reference/aggregations/search-aggregations-random-sampler-aggregation Random sampler aggregation | Elasticsearch Reference The random_sampler aggregation is a single bucket aggregation that randomly includes documents in the aggregated results. Sampling provides significant... aggregation elasticsearch random sampler reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/mv-functions/mv_union ES|QL MV_UNION function | Elasticsearch Reference es ql mv function elasticsearch union reference https://www.elastic.co/docs/reference/elasticsearch/plugins/analysis-icu ICU analysis plugin | Elasticsearch Reference The ICU Analysis plugin integrates the Lucene ICU module into Elasticsearch, adding extended Unicode support using the ICU libraries, including better... analysis plugin elasticsearch reference icu https://www.elastic.co/docs/reference/elasticsearch/rest-apis/create-index-from-source Create index from source API | Elasticsearch Reference The create index from source API copies mappings and settings from a source index or data stream to a destination index or data stream, with optional... create index source api elasticsearch reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/type-conversion-functions/to_boolean ES|QL TO_BOOLEAN function | Elasticsearch Reference es ql function elasticsearch boolean reference https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/number Numeric field types | Elasticsearch Reference The following numeric types are supported: Below is an example of configuring a mapping with numeric fields: As far as integer types (byte, short, integer... field types elasticsearch reference numeric https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/spatial-functions/st_simplify ES|QL ST_SIMPLIFY function | Elasticsearch Reference es ql st function elasticsearch simplify reference https://www.elastic.co/docs/reference/text-analysis/analysis-phonetic-tokenfilter Phonetic token filter for text analysis | Elasticsearch Reference The phonetic token filter is provided as the analysis-phonetic plugin. token filter text analysis elasticsearch reference phonetic https://www.elastic.co/docs/reference/text-analysis/analysis-chargroup-tokenizer Character group tokenizer | Elasticsearch Reference The char_group tokenizer breaks text into terms whenever it encounters a character which is in a defined set. It is mostly useful for cases where a simple... character group tokenizer elasticsearch reference https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-prefix-query Prefix query | Elasticsearch Reference Returns documents that contain a specific prefix in a provided field. The following search returns documents where the user.id field contains a term that... query elasticsearch reference prefix https://www.elastic.co/docs/reference/elasticsearch/plugins/mapper-plugins Mapper plugins | Elasticsearch Reference Mapper plugins allow new field data types to be added to Elasticsearch. The core mapper plugins are: plugins elasticsearch mapper reference https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/math-functions/scalb ES|QL SCALB function | Elasticsearch Reference es ql function elasticsearch reference