An EQL query contains one or more semicolon-delimited statements with at least one RETURN clause.
Any number of statements from the query can return results, while others are defined only as generating intermediate results.
Each statement must contain at least three clauses: a DEFINE or a RETURN clause, a SELECT clause, and a FROM clause. In addition, the statement may contain other, optional clauses.
Most clauses can contain expressions. Expressions are typically combinations of one or more functions, attributes, constants, or operators. Most expressions are simple combinations of functions and attributes. EQL provides functions for working with numeric, string, dateTime, duration, Boolean, and geocode attribute types.
Input records, output records, and records used in aggregation can be filtered in EQL. EQL supports filtering on arbitrary, Boolean expressions.
Syntax conventions used in this guide
The syntax descriptions in this guide use the following conventions:
| Convention | Meaning | Example |
|---|---|---|
| Square brackets [ ] | Optional |
FROM <statementKey> [alias] |
| Asterisk * | May be repeated |
[, JOIN statement [alias] ON <Boolean expression>]*
|
| Ellipsis ... | Additional, unspecified content |
DEFINE <recordSetName> AS ... |
| Angle brackets < > | Variable name |
HAVING <Boolean expression>
|
Commenting in EQL
You can comment your EQL code using the following notation:
DEFINE Example AS SELECT /* This is a comment */
You can also comment out lines or sections as shown in the following example:
RETURN Top5 AS SELECT SUM(Sale) AS Sales FROM SaleState GROUP BY Customer ORDER BY Sales DESC PAGE(0,5); /* RETURN Others AS SELECT SUM(Sale) AS Sales FROM SaleState WHERE NOT [Customer] IN Top5 GROUP */ ...
Note that EQL comments cannot be nested.