# CASE

The CASE function evaluates pairs of conditions and values, returning the value associated with the first condition that evaluates to `true`. If no condition matches, a default value is returned if provided; otherwise, the function returns `null`.

## Syntax

`CASE(condition, trueValue, elseValue)`

### Parameters

#### condition

A condition to evaluate.

#### trueValue

The value returned when the corresponding condition is the first to evaluate to `true`. If no condition matches, the default value is returned.

#### elseValue

(Optional) The value returned when no condition evaluates to `true`.

## Examples

Classify employees based on the number of languages they speak as monolingual, bilingual, or polyglot.

```esql
FROM employees
| EVAL type = CASE(
    languages <= 1, "monolingual",
    languages <= 2, "bilingual",
     "polyglot")
| KEEP emp_no, languages, type
```

Assign a success value based on log message content and calculate the average success rate.

```esql
FROM sample_data
| EVAL successful = CASE(
    STARTS_WITH(message, "Connected to"), 1,
    message == "Connection error", 0
  )
| STATS success_rate = AVG(successful)
```

Flag error messages and compute the average error rate per hour.

```esql
FROM sample_data
| EVAL error = CASE(message LIKE "*error*", 1, 0)
| EVAL hour = DATE_TRUNC(1 hour, @timestamp)
| STATS error_rate = AVG(error) by hour
| SORT hour
```