# ES|QL Operators Reference

This document provides an overview of the operators available in ES|QL (Elasticsearch Query Language), including binary, unary, logical, and other special operators. Each section includes a brief description and an example ES|QL query.

---

## 1. Binary Operators

Binary operators operate on two expressions.

### Equality (`==`)
Checks if two values are equal.

```esql
FROM employees
| WHERE first_name == "Alice"
```

### Inequality (`!=`)
Checks if two values are not equal.

```esql
FROM employees
| WHERE department != "HR"
```

### Less Than (`<`)
Checks if the left value is less than the right value.

```esql
FROM employees
| WHERE salary < 50000
```

### Less Than or Equal To (`<=`)
Checks if the left value is less than or equal to the right value.

```esql
FROM employees
| WHERE hire_date <= "2020-01-01"
```

### Greater Than (`>`)
Checks if the left value is greater than the right value.

```esql
FROM employees
| WHERE height > 1.8
```

### Greater Than or Equal To (`>=`)
Checks if the left value is greater than or equal to the right value.

```esql
FROM employees
| WHERE languages >= 3
```

### Add (`+`)
Adds two values.

```esql
FROM employees
| EVAL total = salary + bonus
| WHERE total > 100000
```

### Subtract (`-`)
Subtracts the right value from the left value.

```esql
FROM employees
| WHERE vacation_days - used_days > 5
```

### Multiply (`*`)
Multiplies two values.

```esql
FROM employees
| WHERE height * 100 > 180
```

### Divide (`/`)
Divides the left value by the right value.

```esql
FROM employees
| WHERE salary / 12 > 4000
```

### Modulus (`%`)
Returns the remainder of division.

```esql
FROM employees
| WHERE emp_no % 2 == 0
```

---

## 2. Unary Operators

Unary operators operate on a single expression.

### Negation (`-`)
Negates a numeric value.

```esql
ROW a = 5
| EVAL neg_a = -a
```

---

## 3. Logical Operators

Logical operators are used to combine multiple boolean expressions.

### AND
Returns `true` if both expressions are true.

```esql
FROM employees
| WHERE still_hired AND salary > 50000
```

### OR
Returns `true` if at least one expression is true.

```esql
FROM employees
| WHERE department == "Engineering" OR department == "IT"
```

### NOT
Negates a boolean expression.

```esql
FROM employees
| WHERE NOT still_hired
```

---

## 4. Other Operators and Predicates

### IS NULL / IS NOT NULL
Checks if a value is `null` or not.

```esql
FROM employees
| WHERE birth_date IS NULL
```

```esql
FROM employees
| WHERE is_rehired IS NOT NULL
| STATS COUNT(emp_no)
```

### Cast (`::`)
Casts a value to a different type.

```esql
FROM employees
| EVAL salary_str = salary::keyword
```

### IN
Checks if a value is in a list of values.

```esql
ROW a = 1, b = 4, c = 3
| WHERE c-a IN (3, b / 2, a)
```

### LIKE
Pattern matching using wildcards (`*` for any number of characters, `?` for a single character).

```esql
FROM employees
| WHERE first_name LIKE """?b*"""
| KEEP first_name, last_name
```

```esql
ROW message = "foo * bar"
| WHERE message LIKE """foo \* bar"""
```

### RLIKE
Pattern matching using regular expressions.

```esql
FROM employees
| WHERE last_name RLIKE """^S.*n$"""
| KEEP first_name, last_name
```

---

## 5. Example: Combining Operators

You can combine multiple operators in a single query:

```esql
FROM employees
| WHERE (salary > 50000 AND still_hired) OR department IN ("Engineering", "IT")
```

---

## 6. Notes

- Wildcards in `LIKE`: `*` matches zero or more characters, `?` matches one character.
- Use triple quotes (`"""`) to avoid escaping special characters in patterns.
- For more advanced pattern matching, use `RLIKE` with regular expressions.
- The `IN` operator can be used with lists of literals, fields, or expressions.
- Use `IS NULL` and `IS NOT NULL` for null checks.
- Use `::` or type conversion functions to cast values.

---

For more details, refer to the [ES|QL Syntax Reference](#).