Functions Overview¶

LENGTH(str)              -- String length
SUBSTR(str, start, len)  -- Substring
UPPER(str)               -- Uppercase
LOWER(str)               -- Lowercase
TRIM(str)                -- Remove whitespace
REPLACE(str, old, new)   -- Replace text
CONCAT(str1, str2, ...)  -- Concatenate
SPLIT(str, delimiter)    -- Split to array

ARRAY_LENGTH(arr)        -- Array size
ARRAY_APPEND(arr, val)   -- Add element
ARRAY_CONTAINS(arr, val) -- Check membership
ARRAY_FILTER(arr, fn)    -- Filter elements
ARRAY_MAP(arr, fn)       -- Transform elements
ARRAY_JOIN(arr, sep)     -- Join to string

MAP_GET(map, key)           -- Get value by key
MAP_PUT(map, key, value)    -- Add/update entry
MAP_KEYS(map)               -- Get all keys
MAP_VALUES(map)             -- Get all values
MAP_SIZE(map)               -- Count entries
MAP_CONTAINS_KEY(map, key)  -- Check key exists
MAP_MERGE(map1, map2)       -- Combine maps

ESQL_QUERY(query)        -- Execute ES|QL
INDEX_DOCUMENT(idx, doc) -- Index document
GET_DOCUMENT(idx, id)    -- Get by ID
REFRESH_INDEX(idx)       -- Refresh index

LLM_COMPLETE(prompt)     -- Generate text
LLM_SUMMARIZE(text)      -- Summarize text
LLM_CLASSIFY(text, labels) -- Classify text
INFERENCE(endpoint, input) -- ES Inference API

SLACK_SEND(channel, msg) -- Send to Slack
PAGERDUTY_TRIGGER(...)   -- Create incident
K8S_SCALE(ns, deploy, n) -- Scale deployment
AWS_LAMBDA_INVOKE(...)   -- Invoke Lambda

DECLARE len NUMBER = LENGTH('Hello');
DECLARE upper STRING = UPPER(name);
DECLARE logs ARRAY = ESQL_QUERY('FROM logs | LIMIT 10');

DECLARE result = UPPER(TRIM(SUBSTR(text, 1, 10)));

DECLARE functions ARRAY = ESCRIPT_FUNCTIONS();

FOR func IN functions LOOP
    PRINT func.name || ': ' || func.description;
END LOOP;

DECLARE info DOCUMENT = ESCRIPT_FUNCTION('ARRAY_MAP');
PRINT info.signature;
PRINT info.description;
PRINT info.examples;