Discover, KQL and ES|QL

1. Discover #

Everyday search.

Getting started #

• Choose the data view and the time range (top right).
• Add columns from the field list; clicking a field shows its 5 most frequent values.
• Add filters in one click (+/-) from a document.
• Save the search to reuse it in a dashboard or share it.

2. KQL and Lucene #

Filtering documents.

KQL #

service.name : "checkout" and http.response.status_code >= 500
message : "timeout" and not host.name : web-0*
log.level : (error or critical)
user_agent.original : *bot*
http.request.method : POST and url.path : "/api/panier"

Good practice: KQL is enough in 90% of cases and offers field autocompletion. Switch to Lucene only for regular expressions or fuzzy search.

3. ES|QL #

A step-by-step language.

Principle #

ES|QL (Elasticsearch Query Language) chains commands separated by |: you start from a source, filter, compute, aggregate, sort. It is available in Discover (ES|QL mode), in Lens and in alert rules.

FROM logs-*
| WHERE @timestamp > NOW() - 1 hour AND http.response.status_code >= 500
| STATS erreurs = COUNT(*) BY service.name
| SORT erreurs DESC
| LIMIT 10

FROM logs-*
| EVAL duree_s = event.duration / 1000000000
| STATS p95 = PERCENTILE(duree_s, 95), requetes = COUNT(*) BY url.path
| WHERE requetes > 100
| SORT p95 DESC

FROM logs-*
| GROK message "%{IP:client} %{WORD:methode} %{URIPATHPARAM:chemin} %{NUMBER:statut:int}"
| STATS total = COUNT(*) BY statut, BUCKET(@timestamp, 5 minutes)

Good to know: ES|QL can parse fields on the fly (GROK, DISSECT), enrich (ENRICH, LOOKUP JOIN depending on the version) and bucket time (BUCKET): many analyses no longer require a visualization.