Update multi-value-esql-controls.md#5689
Conversation
Param order addressed, adding reference to MV_INTERSECTS for any vs all semantics.
🔍 Preview links for changed docs⏳ Building and deploying preview... View progress This comment will be updated with preview links when the build is complete. |
✅ Vale Linting ResultsNo issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
|
#5684 already addresses the param order. |
|
Hey, @mjmbischoff, thanks for the addition there. Since this section is explicitly about how to enable variable controls that can accept multiple values, are we saying that MV_INTERSECTS now also allows this? My initial understanding was that only MV_CONTAINS allowed this (unless there has been some recent development I haven't caught up on yet). CC @stratoula can you confirm? |
|
|
||
| 2. When defining the control, select the **Allow multiple selections** option. | ||
| :::{note} | ||
| [`MV_CONTAINS`](elasticsearch://reference/query-languages/esql/functions-operators/mv-functions/mv_contains.md) will check if _all_ values are present, use [`MV_INTERSECTS`](elasticsearch://reference/query-languages/esql/functions-operators/mv-functions/mv_intersects.md) if you want _any_ present semantics. |
There was a problem hiding this comment.
Hey! Can you explain to me which is the difference between MV_CONTAINS with the MV_INTERSECTS we want to add here?
There was a problem hiding this comment.
one checks if all values are present in the field, the other will return true if any values are present.
So if you have a field with for example cloud provider [AWS, AZURE, GCP] you can ask "give me all services deployed in AWS and AZURE" vs "Give me all services in AZURE or GCP"
PUT services
{
"mappings": {
"properties": {
"name": {
"type": "keyword"
},
"location": {
"properties": {
"cloud": {
"type" : "keyword"
}
}
}
}
}
}
PUT services/_doc/a
{
"name": "service A",
"location" : {
"cloud": ["AZURE", "AWS", "GCP"]
}
}
PUT services/_doc/b
{
"name": "service B",
"location" : {
"cloud": ["AZURE", "AWS"]
}
}
PUT services/_doc/c
{
"name": "service C",
"location" : {
"cloud": [ "AWS", "GCP"]
}
}
PUT services/_doc/d
{
"name": "service D",
"location" : {
"cloud": ["AZURE", "GCP"]
}
}
PUT services/_doc/e
{
"name": "service E",
"location" : {
"cloud": ["AZURE"]
}
}
POST services/_refresh
POST _query?format=txt
{
"query": """
FROM services
| WHERE MV_CONTAINS(location.cloud, ["AZURE","AWS"])
"""
}
/*
#! No limit defined, adding default limit of [1000]
location.cloud | name
-----------------+---------------
[AWS, AZURE, GCP]|service A
[AWS, AZURE] |service B
*/
POST _query?format=txt
{
"query": """
FROM services
| WHERE MV_INTERSECTS(location.cloud, ["AZURE","AWS"])
"""
}
/*
#! No limit defined, adding default limit of [1000]
location.cloud | name
-----------------+---------------
AZURE |service E
[AWS, AZURE, GCP]|service A
[AWS, AZURE] |service B
[AWS, GCP] |service C
[AZURE, GCP] |service D
*/
Improving wording Co-authored-by: Liam Thompson <leemthompo@gmail.com>
Yes, the variable will start emitting multi values, so any function that takes multi values could be used. |
|
@mjmbischoff @stratoula for the UI message update: elastic/kibana#264353 |



Summary
Param order addressed(otherwise docs with null value in field are always returned), adding reference to MV_INTERSECTS for any vs all semantics.
Generative AI disclosure