## SUBSTRING

The `SUBSTRING` function in ES|QL is used to extract a specific portion of a string. It is specified by a start position and an optional length. If the length is not provided, the function returns all positions after the start.

### Syntax:

`SUBSTRING(string, start, [length])`

#### Parameters:

- `string`: The string expression from which to extract the substring. If null, the function returns null.
- `start`: The starting position for the substring.
- `length`: The length of the substring from the start position. This is optional; if omitted, all positions after start are returned.

### Examples:

Here are a couple of examples of how to use the `SUBSTRING` function in ES|QL:

1. Extracting the first three characters of every last name:

    ```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 1, 3)
```

2. Extracting the last three characters of every last name:

    ```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, -3, 3)
```

3. Extracting all characters except for the first:

    ```esql
FROM employees
| KEEP last_name
| EVAL ln_sub = SUBSTRING(last_name, 2)
```