## RIGHT

The `RIGHT` function in ES|QL is used to extract a substring from a string, starting from the right. The number of characters to return is specified by the `length` parameter.

### Syntax

`RIGHT(string, length)`

#### Parameters

- `string`: The string from which to return a substring.
- `length`: The number of characters to return.

### Examples

Here are a couple of examples of how to use the `RIGHT` function in ES|QL:

```esql
FROM employees
| KEEP last_name
| EVAL right = RIGHT(last_name, 3)
| SORT last_name ASC
| LIMIT 5
```

In this example, the `RIGHT` function is used to extract the last three characters from the `last_name` field of each record in the `employees` index. The resulting substring is then stored in a new field called `right`. The query then sorts the results in ascending order by `last_name` and limits the output to the first 5 records.

```esql
FROM logs-*
| EVAL file_extension = RIGHT(file_name, 3)
```

In this second example, the `RIGHT` function is used to extract the file extension from a `file_name` field in a `logs-*` index. The resulting substring is stored in a new field called `file_extension`.