KQL and syntex

Should I use KQL or Lucene in the Kibana query bar? It depends! KQL and Lucene have quite a lot in common, but there are some differences. Let's explore some key-features one by one to find out the best use-case for each language. For new users, we recommend starting with KQL(opens in a new tab) and switching to Lucene(opens in a new tab) if any particular feature is unavailable in KQL. KQL Kibana Query Language (KQL) is a simple text-based query language for filtering data. KQL only filters data, and has no role in aggregating, transforming, or sorting data. Semi-structured search free text search with field-based search. The semi-structured search will filter documents for matches, and only return matching documents. Filter for documents where a field exists To filter documents for which an indexed value exists for a given field, use the * operator. For example, to filter for documents where the http.request.method field exists, use the following syntax: http.request.method: * This checks for any indexed value, including an empty string. Filter for documents that match a value Use KQL to filter for documents that match a specific number, text, date, or boolean value. For example, to filter for documents where the http.request.method is GET, use the following query: http.request.method: GET to search all fields for “Hello”, use the following: Hello To querying keyword, numeric, date, or boolean fields, the value must be an exact match, including punctuation and case. To Search text field that has "null pointer" then querry using http.request.body.content: "null pointer" if the \" are not used then you will get all documents that has null pointer OR Pointer null. This is called term querry. to search urls use \ or you will find syntax error OR try with ". Example: http.request.referrer: "https://example.com" http.request.referrer: https\://example.com [!Note] \():"* excape These Charecters with \ Filter for documents within a range to search for all documents for which http.response.bytes is less than 10000, use the following syntax: http.response.bytes < 10000 to search In Range use this http.response.bytes > 10000 and http.response.bytes

Apr 23, 2025 - 15:39

Should I use KQL or Lucene in the Kibana query bar?

It depends! KQL and Lucene have quite a lot in common, but there are some differences. Let's explore some key-features one by one to find out the best use-case for each language.

For new users, we recommend starting with KQL(opens in a new tab) and switching to Lucene(opens in a new tab) if any particular feature is unavailable in KQL.

KQL

Kibana Query Language (KQL) is a simple text-based query language for filtering data.
KQL only filters data, and has no role in aggregating, transforming, or sorting data.

Semi-structured search

free text search with field-based search.

The semi-structured search will filter documents for matches, and only return matching documents.

Filter for documents where a field exists

To filter documents for which an indexed value exists for a given field, use the * operator.

For example, to filter for documents where the http.request.method field exists, use the following syntax:

http.request.method: *

This checks for any indexed value, including an empty string.

Filter for documents that match a value

Use KQL to filter for documents that match a specific number, text, date, or boolean value. For example, to filter for documents where the http.request.method is GET, use the following query:
http.request.method: GET

to search all fields for “Hello”, use the following:

Hello

To querying keyword, numeric, date, or boolean fields, the value must be an exact match, including punctuation and case.

To Search text field that has "null pointer" then querry using http.request.body.content: "null pointer" if the \" are not used then you will get all documents that has null pointer OR Pointer null. This is called term querry.

to search urls use \ or you will find syntax error OR try with ".
Example:

http.request.referrer: "https://example.com"  
http.request.referrer: https\://example.com

[!Note]
\():<>"* excape These Charecters with \

Filter for documents within a range

to search for all documents for which http.response.bytes is less than 10000, use the following syntax:
http.response.bytes < 10000

to search In Range use this
http.response.bytes > 10000 and http.response.bytes <= 20000

Filter for documents using wildcards

To search for documents matching a pattern, use the wildcard syntax. For example, to find documents where http.response.status_code begins with a 4, use the following syntax:

http.response.status_code: 4*
By default, leading wildcards are not allowed for performance reasons. You can modify this with the query:allowLeadingWildcards advanced setting.

[!Note]
Only * is currently supported. This matches zero or more characters.

Negating a query

use NOT in front of querry like:
NOT http.request.method: GET

Querying nested fields

Use . operater to query nested fields like:
user.names:{ first: "Alice" and last: "White" }