elk-stack-queries

ELK Stack Query Languages

Language Overview

Language	Use Case	Sequences	Best For
EQL	Event correlation	Yes	Process trees, lateral movement
ES|QL	Aggregations	No	Metrics, baselines, anomalies
KQL	Kibana searches	No	Quick filtering, ad-hoc
DSL	Full control	No	Nested queries, scoring

Core Principles

1. use the right query language — KQL for Kibana, EQL for sequences, DSL for API.
2. Avoid skipping time bounds — unbounded queries timeout on large indices.
3. check field existence — field:* before aggregating to avoid nulls.
4. Avoid using match_all in production — scope by index pattern and time range.
5. use keyword fields for exact match — text fields tokenize and match partially.

References

• EQL Syntax
• EQL Functions
• ES|QL Reference
• KQL Reference

Core Principles

1. use the right query language — KQL for Kibana, EQL for sequences, DSL for API.
2. Avoid skipping time bounds — unbounded queries timeout on large indices.
3. check field existence — field:* before aggregating to avoid nulls.
4. Avoid using match_all in production — scope by index pattern and time range.
5. use keyword fields for exact match — text fields tokenize and match partially.

Reference

For detailed patterns, examples, and advanced usage, see reference.md.