esql-query-language

ES|QL provides a concise, pipe-based query language to filter, transform, and analyze data across Elasticsearch indices, replacing verbose JSON DSL. You chain commands like FROM, WHERE, and STATS to assemble pipelines for fast data insights.

ES|QL offers WHERE, KEEP, DROP, RENAME, SORT, LIMIT, and STATS commands for robust data shaping and aggregation. These processing commands allow you to filter log events, select specific fields, and compute aggregations directly within your query pipeline.

Yes, ES|QL supports advanced transformations using EVAL, DISSECT, GROK, ENRICH, and JOIN patterns. These commands enable data enrichment and cross-index analysis by allowing you to parse unstructured fields and combine data from multiple Elasticsearch indices.

Build dashboards by streaming logs from multiple indices using FROM, filtering by timestamp with WHERE, and computing aggregations by service with STATS. You can highlight anomalies using percentile-based thresholds within your ES|QL pipeline.

ES|QL is designed for metric exploration and log analytics across multiple indices, reducing the complexity of traditional queries. It satisfies scenarios where users chain source, filter, transform, and aggregate commands to generate fast insights.

Run a simple ES|QL pipeline by selecting recent log events with FROM logs-* | WHERE @timestamp > NOW() - 1 hour | LIMIT 20. This chains source initialization, time-based filtering, and row limitation to quickly return relevant data.