From c8adec8c501fb237d4852d92ddbeeb02fd570825 Mon Sep 17 00:00:00 2001 From: Florent Le Borgne Date: Mon, 8 Sep 2025 18:53:22 +0200 Subject: [PATCH 1/6] Add more Kibana context to E&A Languages page --- explore-analyze/query-filter.md | 7 ++++--- explore-analyze/query-filter/languages.md | 21 +++++++++---------- explore-analyze/query-filter/tools/console.md | 3 --- 3 files changed, 14 insertions(+), 17 deletions(-) diff --git a/explore-analyze/query-filter.md b/explore-analyze/query-filter.md index d65669759c..87e5c71e00 100644 --- a/explore-analyze/query-filter.md +++ b/explore-analyze/query-filter.md @@ -6,15 +6,16 @@ applies_to: serverless: ga products: - id: elasticsearch + - id: kibana --- # Querying and filtering [search-analyze] -You can use {{es}} as a basic document store to retrieve documents and their metadata. However, the real power of {{es}} comes from its advanced search and analytics capabilities. +{{es}} is not only great at storing and retrieving documents and their metadata, it also offers powerful querying and analytics capabilities that let you search, filter, and analyze your data at scale. These same capabilities are available in {{kib}} applications to facilitate interactive data exploration and visualization. * **{{es}} makes JSON documents searchable and aggregatable.** The documents are stored in an [index](/manage-data/data-store/index-basics.md) or [data stream](/manage-data/data-store/data-streams.md), which represent one type of data. -* **Searchable** means that you can filter the documents for conditions.** For example, you can filter for data "within the last 7 days" or data that "contains the word {{kib}}". {{kib}} provides many ways for you to construct filters, which are also called queries or search terms. -* **Aggregatable** means that you can extract summaries from matching documents.** The simplest aggregation is **count**, and it is frequently used in combination with the **date histogram**, to see count over time. The **terms** aggregation shows the most frequent values. +* **Searchable means that you can filter the documents for conditions.** For example, you can filter for data "within the last 7 days" or data that "contains the word {{kib}}". {{kib}} provides many ways for you to construct filters, which are also called queries or search terms. +* **Aggregatable means that you can extract summaries from matching documents.** The simplest aggregation is **count**, and it is frequently used in combination with the **date histogram**, to see count over time. The **terms** aggregation shows the most frequent values. ## Querying diff --git a/explore-analyze/query-filter/languages.md b/explore-analyze/query-filter/languages.md index 48be839b88..e4919fd526 100644 --- a/explore-analyze/query-filter/languages.md +++ b/explore-analyze/query-filter/languages.md @@ -2,22 +2,21 @@ applies_to: stack: ga serverless: ga +products: + - id: elasticsearch + - id: kibana --- # Query languages [search-analyze-query-languages] -{{es}} provides a number of query languages for interacting with your data. +{{es}} provides a number of query languages for interacting with your data. You can use these languages in your requests to {{es}} and {{kib}} APIs, or using the {{kib}} interface. | Name | Description | Use cases | API endpoint | | --- | --- | --- | --- | -| [Query DSL](languages/querydsl.md) | The primary query language for {{es}}. A powerful and flexible JSON-style language that enables complex queries. | Full-text search, semantic search, keyword search, filtering, aggregations, and more. | [`_search`](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search) | -| [{{esql}}](elasticsearch://reference/query-languages/esql.md) | Introduced in **8.11**, the Elasticsearch Query Language ({{esql}}) is a piped query language language for filtering, transforming, and analyzing data. | Initially tailored towards working with time series data like logs and metrics. Robust integration with {{kib}} for querying, visualizing, and analyzing data. | [`_query`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-esql) | -| [EQL](languages/eql.md) | Event Query Language (EQL) is a query language for event-based time series data. Data must contain the `@timestamp` field to use EQL. | Designed for the threat hunting security use case. | [`_eql`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-eql) | -| [Elasticsearch SQL](languages/sql.md) | Allows native, real-time SQL-like querying against {{es}} data. JDBC and ODBC drivers are available for integration with business intelligence (BI) tools. | Enables users familiar with SQL to query {{es}} data using familiar syntax for BI and reporting. | [`_sql`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-sql) | -| [Kibana Query Language (KQL)](languages/kql.md) | {{kib}} Query Language (KQL) is a text-based query language for filtering data when you access it through the {{kib}} UI. | Use KQL to filter documents where a value for a field exists, matches a given value, or is within a given range. | N/A | - -:::{tip} -> {{esql}} does not yet support all the features of Query DSL. Look forward to new {{esql}} features and functionalities in each release. [Learn more about {{esql}}](elasticsearch://reference/query-languages/esql.md). -::: - +| **Query DSL** | {{es}}'s primary, most powerful and flexible JSON-style language for complex queries.

[Full language reference](elasticsearch://reference/query-languages/querydsl.md)| Full-text search, semantic search, keyword search, filtering, aggregations, and more.

[Query DSL in Kibana](languages/querydsl.md) |[`_search`](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search) | +| **{{esql}}** | Introduced in **8.11**, the Elasticsearch Query Language ({{esql}}) is a piped query language for filtering, transforming, and analyzing data.

[Full language reference](elasticsearch://reference/query-languages/esql.md) | Initially tailored towards working with time series data like logs and metrics. You can use {{esql}} in multiple {{kib}} applications for querying, visualizing, and analyzing data.

[{{esql}} in Kibana](languages/esql.md) | [`_query`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-esql) | +| **EQL** | Event Query Language (EQL) is a query language for event-based time series data. Data must contain the `@timestamp` field to use EQL.

[Full language reference](elasticsearch://reference/query-languages/eql.md) | Designed for the threat hunting security use case.

[EQL in Kibana](languages/eql.md) | [`_eql`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-eql) | +| **Elasticsearch SQL** | Allows native, real-time SQL-like querying against {{es}} data. JDBC and ODBC drivers are available for integration with business intelligence (BI) tools.

[Full language reference](elasticsearch://reference/query-languages/sql.md) | Query {{es}} data using a familiar SQL syntax for BI and reporting.

[Elasticsearch SQL in Kibana](languages/sql.md) | [`_sql`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-sql) | +| **Kibana Query Language (KQL)** | {{kib}} Query Language (KQL) is a text-based query language for filtering data when you access it through the {{kib}} UI. | Use KQL to filter documents where a value for a field exists, matches a given value, or is within a given range.

[KQL in Kibana](languages/kql.md) | N/A | +| **Lucene query syntax** | The original query syntax for {{es}}, based on Apache Lucene. Simple text-based syntax for basic searches and filtering. | Perform basic text searches, simple field queries, and wildcard searches. Useful for quick searches and simple filtering.

[Lucene syntax in Kibana](languages/lucene.md) | [`_search`](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search) | \ No newline at end of file diff --git a/explore-analyze/query-filter/tools/console.md b/explore-analyze/query-filter/tools/console.md index dfa17dcda2..8be0e48e4c 100644 --- a/explore-analyze/query-filter/tools/console.md +++ b/explore-analyze/query-filter/tools/console.md @@ -15,9 +15,6 @@ products: # Run API requests with Console [console-kibana] -$$$import-export-console-requests$$$ - - **Console** is an interactive UI for sending requests to [{{es}} APIs](elasticsearch://reference/elasticsearch/rest-apis/index.md) and [{{kib}} APIs](https://www.elastic.co/docs/api) and viewing their responses. :::{image} /explore-analyze/images/kibana-console.png From aaee771392044f20bf5e0e2835e4159d34fe935e Mon Sep 17 00:00:00 2001 From: Florent Le Borgne Date: Mon, 8 Sep 2025 19:09:22 +0200 Subject: [PATCH 2/6] links --- explore-analyze/query-filter/languages.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/explore-analyze/query-filter/languages.md b/explore-analyze/query-filter/languages.md index e4919fd526..63a5018b85 100644 --- a/explore-analyze/query-filter/languages.md +++ b/explore-analyze/query-filter/languages.md @@ -15,8 +15,8 @@ products: | Name | Description | Use cases | API endpoint | | --- | --- | --- | --- | | **Query DSL** | {{es}}'s primary, most powerful and flexible JSON-style language for complex queries.

[Full language reference](elasticsearch://reference/query-languages/querydsl.md)| Full-text search, semantic search, keyword search, filtering, aggregations, and more.

[Query DSL in Kibana](languages/querydsl.md) |[`_search`](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search) | -| **{{esql}}** | Introduced in **8.11**, the Elasticsearch Query Language ({{esql}}) is a piped query language for filtering, transforming, and analyzing data.

[Full language reference](elasticsearch://reference/query-languages/esql.md) | Initially tailored towards working with time series data like logs and metrics. You can use {{esql}} in multiple {{kib}} applications for querying, visualizing, and analyzing data.

[{{esql}} in Kibana](languages/esql.md) | [`_query`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-esql) | +| **{{esql}}** | Introduced in **8.11**, the Elasticsearch Query Language ({{esql}}) is a piped query language for filtering, transforming, and analyzing data.

[Full language reference](elasticsearch://reference/query-languages/esql.md) | Initially tailored towards working with time series data like logs and metrics. You can use {{esql}} in multiple {{kib}} applications for querying, visualizing, and analyzing data.

[{{esql}} in Kibana](languages/esql-kibana.md) | [`_query`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-esql) | | **EQL** | Event Query Language (EQL) is a query language for event-based time series data. Data must contain the `@timestamp` field to use EQL.

[Full language reference](elasticsearch://reference/query-languages/eql.md) | Designed for the threat hunting security use case.

[EQL in Kibana](languages/eql.md) | [`_eql`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-eql) | | **Elasticsearch SQL** | Allows native, real-time SQL-like querying against {{es}} data. JDBC and ODBC drivers are available for integration with business intelligence (BI) tools.

[Full language reference](elasticsearch://reference/query-languages/sql.md) | Query {{es}} data using a familiar SQL syntax for BI and reporting.

[Elasticsearch SQL in Kibana](languages/sql.md) | [`_sql`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-sql) | | **Kibana Query Language (KQL)** | {{kib}} Query Language (KQL) is a text-based query language for filtering data when you access it through the {{kib}} UI. | Use KQL to filter documents where a value for a field exists, matches a given value, or is within a given range.

[KQL in Kibana](languages/kql.md) | N/A | -| **Lucene query syntax** | The original query syntax for {{es}}, based on Apache Lucene. Simple text-based syntax for basic searches and filtering. | Perform basic text searches, simple field queries, and wildcard searches. Useful for quick searches and simple filtering.

[Lucene syntax in Kibana](languages/lucene.md) | [`_search`](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search) | \ No newline at end of file +| **Lucene query syntax** | The original query syntax for {{es}}, based on Apache Lucene. Simple text-based syntax for basic searches and filtering. | Perform basic text searches, simple field queries, and wildcard searches. Useful for quick searches and simple filtering.

[Lucene syntax in Kibana](languages/lucene-query-syntax.md) | [`_search`](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search) | \ No newline at end of file From 6d95cbbb98631ed09db4089411c2ae8260e2236b Mon Sep 17 00:00:00 2001 From: florent-leborgne Date: Tue, 9 Sep 2025 10:32:56 +0200 Subject: [PATCH 3/6] Update explore-analyze/query-filter.md Co-authored-by: Liam Thompson --- explore-analyze/query-filter.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/explore-analyze/query-filter.md b/explore-analyze/query-filter.md index 87e5c71e00..a422c904f9 100644 --- a/explore-analyze/query-filter.md +++ b/explore-analyze/query-filter.md @@ -14,7 +14,7 @@ products: {{es}} is not only great at storing and retrieving documents and their metadata, it also offers powerful querying and analytics capabilities that let you search, filter, and analyze your data at scale. These same capabilities are available in {{kib}} applications to facilitate interactive data exploration and visualization. * **{{es}} makes JSON documents searchable and aggregatable.** The documents are stored in an [index](/manage-data/data-store/index-basics.md) or [data stream](/manage-data/data-store/data-streams.md), which represent one type of data. -* **Searchable means that you can filter the documents for conditions.** For example, you can filter for data "within the last 7 days" or data that "contains the word {{kib}}". {{kib}} provides many ways for you to construct filters, which are also called queries or search terms. +* **Searchable means that you can find documents through multiple retrieval methods.** This includes filtering by yes/no conditions, keyword and full-text search with relevance scoring, and vector/semantic search to find content based on meaning rather than exact terms. {{kib}} provides many ways for you to construct these searches, from simple filters in dashboards to relevance-ranked queries in its search interfaces. * **Aggregatable means that you can extract summaries from matching documents.** The simplest aggregation is **count**, and it is frequently used in combination with the **date histogram**, to see count over time. The **terms** aggregation shows the most frequent values. ## Querying From ec9f560e04f98716e779d8208b6acabe2c5e917a Mon Sep 17 00:00:00 2001 From: florent-leborgne Date: Tue, 9 Sep 2025 10:33:09 +0200 Subject: [PATCH 4/6] Update explore-analyze/query-filter.md Co-authored-by: Liam Thompson --- explore-analyze/query-filter.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/explore-analyze/query-filter.md b/explore-analyze/query-filter.md index a422c904f9..b5d559247b 100644 --- a/explore-analyze/query-filter.md +++ b/explore-analyze/query-filter.md @@ -15,7 +15,7 @@ products: * **{{es}} makes JSON documents searchable and aggregatable.** The documents are stored in an [index](/manage-data/data-store/index-basics.md) or [data stream](/manage-data/data-store/data-streams.md), which represent one type of data. * **Searchable means that you can find documents through multiple retrieval methods.** This includes filtering by yes/no conditions, keyword and full-text search with relevance scoring, and vector/semantic search to find content based on meaning rather than exact terms. {{kib}} provides many ways for you to construct these searches, from simple filters in dashboards to relevance-ranked queries in its search interfaces. -* **Aggregatable means that you can extract summaries from matching documents.** The simplest aggregation is **count**, and it is frequently used in combination with the **date histogram**, to see count over time. The **terms** aggregation shows the most frequent values. +* **Aggregatable means that you can compute statistics and summaries from matching documents to reveal patterns and insights in your dataset.** The simplest aggregation is **count**, and it is frequently used in combination with the **date histogram**, to see count over time. The **terms** aggregation shows the most frequent values. ## Querying From 7ff93f8ffa40b908d193e039afd799377d667b22 Mon Sep 17 00:00:00 2001 From: florent-leborgne Date: Tue, 9 Sep 2025 10:33:29 +0200 Subject: [PATCH 5/6] Update explore-analyze/query-filter/languages.md Co-authored-by: Liam Thompson --- explore-analyze/query-filter/languages.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/explore-analyze/query-filter/languages.md b/explore-analyze/query-filter/languages.md index 63a5018b85..b3ddc986db 100644 --- a/explore-analyze/query-filter/languages.md +++ b/explore-analyze/query-filter/languages.md @@ -9,7 +9,7 @@ products: # Query languages [search-analyze-query-languages] -{{es}} provides a number of query languages for interacting with your data. You can use these languages in your requests to {{es}} and {{kib}} APIs, or using the {{kib}} interface. +{{es}} provides a number of query languages for interacting with your data. You can use these languages programmatically when working with {{es}} and {{kib}} APIs in your application, or interactively using the {{kib}} UI. | Name | Description | Use cases | API endpoint | From b294a8ec2d64e2511b835a5b6755efbdab4de104 Mon Sep 17 00:00:00 2001 From: florent-leborgne Date: Tue, 9 Sep 2025 10:33:43 +0200 Subject: [PATCH 6/6] Update explore-analyze/query-filter/languages.md Co-authored-by: Liam Thompson --- explore-analyze/query-filter/languages.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/explore-analyze/query-filter/languages.md b/explore-analyze/query-filter/languages.md index b3ddc986db..a1d5c8f5a5 100644 --- a/explore-analyze/query-filter/languages.md +++ b/explore-analyze/query-filter/languages.md @@ -15,7 +15,7 @@ products: | Name | Description | Use cases | API endpoint | | --- | --- | --- | --- | | **Query DSL** | {{es}}'s primary, most powerful and flexible JSON-style language for complex queries.

[Full language reference](elasticsearch://reference/query-languages/querydsl.md)| Full-text search, semantic search, keyword search, filtering, aggregations, and more.

[Query DSL in Kibana](languages/querydsl.md) |[`_search`](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search) | -| **{{esql}}** | Introduced in **8.11**, the Elasticsearch Query Language ({{esql}}) is a piped query language for filtering, transforming, and analyzing data.

[Full language reference](elasticsearch://reference/query-languages/esql.md) | Initially tailored towards working with time series data like logs and metrics. You can use {{esql}} in multiple {{kib}} applications for querying, visualizing, and analyzing data.

[{{esql}} in Kibana](languages/esql-kibana.md) | [`_query`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-esql) | +| **{{esql}}** | Introduced in **8.11**, the Elasticsearch Query Language ({{esql}}) is a piped query language for filtering, transforming, and analyzing data.

[Full language reference](elasticsearch://reference/query-languages/esql.md) | You can use {{esql}} in multiple {{kib}} applications for querying, visualizing, and analyzing data.

[{{esql}} in Kibana](languages/esql-kibana.md) | [`_query`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-esql) | | **EQL** | Event Query Language (EQL) is a query language for event-based time series data. Data must contain the `@timestamp` field to use EQL.

[Full language reference](elasticsearch://reference/query-languages/eql.md) | Designed for the threat hunting security use case.

[EQL in Kibana](languages/eql.md) | [`_eql`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-eql) | | **Elasticsearch SQL** | Allows native, real-time SQL-like querying against {{es}} data. JDBC and ODBC drivers are available for integration with business intelligence (BI) tools.

[Full language reference](elasticsearch://reference/query-languages/sql.md) | Query {{es}} data using a familiar SQL syntax for BI and reporting.

[Elasticsearch SQL in Kibana](languages/sql.md) | [`_sql`](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-sql) | | **Kibana Query Language (KQL)** | {{kib}} Query Language (KQL) is a text-based query language for filtering data when you access it through the {{kib}} UI. | Use KQL to filter documents where a value for a field exists, matches a given value, or is within a given range.

[KQL in Kibana](languages/kql.md) | N/A |