## WHERE

The `WHERE` command filters rows from the input table, returning only those for which the specified condition evaluates to `true`.

## Syntax

`WHERE expression`

### Parameters

#### `expression`

A boolean expression that determines which rows are included in the output.

## Examples

### Basic Usage

Filter rows where the `still_hired` field is `true`:

```esql
FROM employees
| KEEP first_name, last_name, still_hired
| WHERE still_hired == true
```

If `still_hired` is a boolean field, the query can be simplified to:

```esql
FROM employees
| KEEP first_name, last_name, still_hired
| WHERE still_hired
```

### Using Date Math

Retrieve rows from the last hour of logs:

```esql
FROM sample_data
| WHERE @timestamp > NOW() - 1 hour
```

### Using Functions

Filter rows where the length of the `first_name` field is less than 4:

```esql
FROM employees
| KEEP first_name, last_name, height
| WHERE LENGTH(first_name) < 4
```

### NULL Comparison

Filter rows where the `birth_date` field is `NULL`:

```esql
FROM employees
| WHERE birth_date IS NULL
| KEEP first_name, last_name
| SORT first_name
| LIMIT 3
```

Filter rows where the `is_rehired` field is not `NULL`:

```esql
FROM employees
| WHERE is_rehired IS NOT NULL
| STATS COUNT(emp_no)
```

### Using LIKE for String Patterns

Filter rows based on string patterns using wildcards. The following wildcard characters are supported:
- `*` matches zero or more characters.
- `?` matches one character.

Filter rows where `first_name` matches the pattern `?b*`:

```esql
FROM employees
| WHERE first_name LIKE """?b*"""
| KEEP first_name, last_name
```

To match the exact characters `*` or `.`, escape them using a backslash (`\\`). For example:

```esql
ROW message = "foo * bar"
| WHERE message LIKE "foo \\* bar"
```

To simplify escaping, use triple-quoted strings:

```esql
ROW message = "foo * bar"
| WHERE message LIKE """foo \* bar"""
```

### Using RLIKE for Regular Expressions

Filter rows based on regular expressions. For example, filter rows where `first_name` matches the pattern `.leja.*`:

```esql
FROM employees
| WHERE first_name RLIKE """.leja.*"""
| KEEP first_name, last_name
```

Escape special characters in regular expressions using a backslash (`\\`). For example:

```esql
ROW message = "foo ( bar"
| WHERE message RLIKE "foo \\( bar"
```

To simplify escaping, use triple-quoted strings:

```esql
ROW message = "foo ( bar"
| WHERE message RLIKE """foo \( bar"""
```

### Using IN Operator

Filter rows where an expression matches any value in a list of literals, fields, or expressions:

```esql
ROW a = 1, b = 4, c = 3
| WHERE c-a IN (3, b / 2, a)
```