[Q]: Is there a 'LIKE' function in ES|QL?

Elastic Search
3

@cjessing

Perhaps review the docs

LIKE

RLIKE

Actually it is mostly a new execution framework and specifically does not translate to DSL.:).

But the actual issue is tags is an array so it needs to be expanded first

You can use MV_EXPAND

FROM logs-* 
| MV_EXPAND tags
| where tags == "Private key" 
| LIMIT 10
1 Like